A vulnerability in the Amaya Web development server allows remote read access to files on the server's file system. By passing a malicious `templ` argument to the sendtemp.pl script, an attacker can traverse the file system and read files, such as the passwd file. This vulnerability occurs due to lack of input sanitization on the `templ` parameter.
Remote attackers can execute arbitrary machine code in the context of the vulnerable application, leading to the remote compromise of affected computers.
The DataWizard FtpXQ Server is prone to multiple remote vulnerabilities. The first vulnerability is a remote denial-of-service issue that occurs when the application fails to perform adequate bounds checks on user-supplied data before copying it to an insufficiently sized buffer. This can be exploited by an attacker to crash the application, denying access to legitimate users. The second vulnerability is due to the application creating two testing accounts by default. An attacker can access these accounts to gain read/write privileges on the server, potentially compromising the affected computer.
The application fails to validate input passed to the 'doc' parameter of the '/scripts/cruise/cms.exe' application, leading to a buffer overflow vulnerability.
Casinosoft Casino Script is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
Remote command execution on 'becommunity' (modules that support by BBS e-market professional) makes insecure calls to the include() function of PHP (works on 'pageurl=' functions) which can allow the inclusion of remote files, and thereby the execution of arbitrary commands by remote user with the web server user permissions, usually 'nobody'.
This module exploits a stack buffer overflow in HP LoadRunner before 11.52. The vulnerability exists on the LoadRunner Agent Process magentproc.exe. By sending a specially crafted packet, an attacker may be able to execute arbitrary code.
This exploit allows an attacker to gain root access on Progress Database Server v8.3b on Linux and SCO-Unix systems. The exploit was discovered by krfinisterre@checkfree.com and can be used by running the prodbx binary with the appropriate parameters. The exploit contains shellcode for Linux and SCO-Unix systems. The Linux shellcode is a regular shellcode for Linux on the x86 architecture, while the SCO shellcode is specific to SCO-Unix systems.
Multiple Computer Associates products are prone to multiple buffer-overflow vulnerabilities because the applications using an affected library fail to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer. Exploiting these issues allows attackers to execute arbitrary machine code within the context of the affected application.
Local attackers can exploit this issue to corrupt memory and execute arbitrary code with kernel-level privileges. Successful exploits may facilitate a complete system compromise.
Services By CQR