There is a remotely exploitable stack buffer overflow in HTTP digest authentication handling in Asterisk. This vulnerability includes the possibility of code execution with plenty of stack space for inserting custom code to run. The offending code is in main/utils.c, ast_parse_digest(). Note that the only user of ast_parse_digest appears to be HTTP AMI. chan_sip has its own method to parse digests that does not appear to have this vulnerability.
Guitar Pro 6.1.1 r10791 is vulnerable to a Denial of Service (DoS) attack when a malformated file is loaded into the program. The program will crash, but the place of crash and registers values differ every time.
This exploit allows an attacker to add an admin user to the X7 Chat 2.0.5.1 application by exploiting a Cross-Site Request Forgery (CSRF) vulnerability. The attacker must first register a user and then send the main page URL to an administrator. The main page URL contains an iframe which contains a form that posts to the application's admin panel page. The form contains the attacker's username and sets the usergroup to 'Administrator'. When the administrator visits the main page URL, the form is automatically submitted and the attacker's user is added as an administrator.
This module exploits an out-of-bounds access flaw in Firefox 7 and 8 (<= 8.0.1). The notification of nsSVGValue observers via nsSVGValue::NotifyObservers(x,y) uses a loop which can result in an out-of-bounds access to attacker-controlled memory. The mObserver ElementAt() function (which picks up pointers), does not validate if a given index is out of bound. If a custom observer of nsSVGValue is created, which removes elements from the original observer, and memory layout is manipulated properly, the ElementAt() function might pick up an attacker provided pointer, which can be leveraged to gain remote arbitrary code execution.
Due to improper input sanitization, the 'priority' field when creating and adding an item in the 'todo list' is subject to SQL injection.
The Vulnerability Laboratory Researcher Team discovered multiple web vulnerabilities in myCare v2x CMS. Multiple remote SQL Injection vulnerabilities are detected in myCare2x Content Management System. The vulnerability allows an attacker (remote) or local low privileged user account to inject/execute own sql commands on the affected application dbms. Successful exploitation of the vulnerability results in dbms & application compromise. The vulnerability is located on the username post method. Multiple persistent input validation vulnerabilites are detected in myCare2x Content Management System. The vulnerability allows remote attackers to inject/execute malicious script code on the application-side (persistent). Successful exploitation of the vulnerability results in account steal, session hijacking, persistent phishing attacks, persistent external redirects and more.
Multiple remote SQL Injection and Cross Site Scripting vulnerabilities are deteected in the MYRE Real Estate Mobile Application (2012 Q2). The vulnerability allows an remote attacker to inject/execute own sql commands on the affected application dbms and inject own malicious script codes on the application-side of the vulnerable module.
The persistent input validation vulnerability is located in the `article listing & pool` fields of the genium cms 2012|Q2. Remote attackers are able to inject own malicious script codes to the vulnerable application fields. The execution of the code occurs in the main application page context. The request method to inject is POST and the attack vector is located on the application-side. The security risk of the persistent input validation vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 4.3. Exploitation of the vulnerability requires a low privileged genium cms application user account and low user interaction. Successful exploitation of the vulnerability results in session hijacking, persistent phishing, persistent external redirects and persistent manipulation of affected or connected module context.
By submitting malicious input to certain fields, it is possible to add administrative users to the system without credentials using SQL injection, and inject code in the security context of the server. With access to session network traffic, It is also possible to hijack sessions and sniff user ID's and passwords.
When is appended to a POST request any padding data that surpasses 2399 bytes, the WAF do not inspect the data sent and the request hits directly the application. This should occur when the product is not configured to block malformed requests, but this feature also check the POST size limit, blocking the request if it surpass a fixed limit, therefore is likely that is being disabled due to application requirements in medium size forms. The same issue with POST Request but it could be done through the sending arbitrary data at the end of the URL.
Services By CQR