6 results (0.004 seconds)

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 3

CVE-2007-6378 – BadBlue 2.72b - Multiple Vulnerabilities

https://notcve.org/view.php?id=CVE-2007-6378

Directory traversal vulnerability in upload.dll in BadBlue 2.72b and earlier allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the filename parameter. Vulnerabilidad de cruce de directorios en upload.dll de BadBlue 2.72b y anteriores. Permite que atacantes remotos creen o sobreescriban ficheros a su elección, utilizando .. (punto punto) en el parámetro filename. • https://www.exploit-db.com/exploits/4715 http://aluigi.altervista.org/adv/badblue-adv.txt http://aluigi.org/testz/myhttpup.zip http://osvdb.org/42417 http://secunia.com/advisories/28031 http://securityreason.com/securityalert/3448 http://www.securityfocus.com/archive/1/484834/100/0/threaded http://www.securityfocus.com/bid/26803 http://www.vupen.com/english/advisories/2007/4160 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 2

CVE-2007-6379 – BadBlue 2.72b - Multiple Vulnerabilities

https://notcve.org/view.php?id=CVE-2007-6379

BadBlue 2.72b and earlier allows remote attackers to obtain sensitive information via an invalid browse parameter, which reveals the installation path in an error message. BadBlue 2.72b y anteriores permiten que atacantes remotos obtengan información sensible a través de un parámetro browse inválido, que revela el directorio de instalación en un mensaje de error. • https://www.exploit-db.com/exploits/4715 http://aluigi.altervista.org/adv/badblue-adv.txt http://osvdb.org/42418 http://secunia.com/advisories/28031 http://securityreason.com/securityalert/3448 http://www.securityfocus.com/archive/1/484834/100/0/threaded http://www.securityfocus.com/bid/26803 http://www.vupen.com/english/advisories/2007/4160 • CWE-16: Configuration •

CVSS: 7.5EPSS: 93%CPEs: 1EXPL: 6

CVE-2007-6377 – BadBlue 2.72 - PassThru Remote Buffer Overflow

https://notcve.org/view.php?id=CVE-2007-6377

Stack-based buffer overflow in the PassThru functionality in ext.dll in BadBlue 2.72b and earlier allows remote attackers to execute arbitrary code via a long query string. Desbordamiento de buffer relacionado con la pila en la funcionalidad PassThru en ext.dll de BadBlue 2.72b y anteriores. Permite que atacantes remotos ejecuten código a su elección utilizando una cadena de petición larga. • https://www.exploit-db.com/exploits/4784 https://www.exploit-db.com/exploits/4715 https://www.exploit-db.com/exploits/16806 https://github.com/Nicoslo/Windows-exploitation-BadBlue-2.7-CVE-2007-6377 http://aluigi.altervista.org/adv/badblue-adv.txt http://aluigi.altervista.org/poc/badbluebof.txt http://osvdb.org/42416 http://secunia.com/advisories/28031 http://securityreason.com/securityalert/3448 http://www.securityfocus.com/archive/1/484834/100/0/threaded http://www. • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 2

CVE-2003-0332 – Working Resources BadBlue 1.7.x/2.x - Unauthorized HTS Access

https://notcve.org/view.php?id=CVE-2003-0332

The ISAPI extension in BadBlue 1.7 through 2.2, and possibly earlier versions, modifies the first two letters of a filename extension after performing a security check, which allows remote attackers to bypass authentication via a filename with a .ats extension instead of a .hts extension. La extendisón ISAPI en BadBlue 1.7 hasta 2.2, y posiblemente versiones anteriores, modifica las dos primeras letras de la extensión de un archivo después de realizar comprobaciones de seguridad, lo que permite que atacantes remotos pasen la autentificación mediante un fichero .ats en lugar de uno .hts. • https://www.exploit-db.com/exploits/22620 http://archives.neohapsis.com/archives/vulnwatch/2003-q2/0075.html http://marc.info/?l=bugtraq&m=105346382524169&w=2 •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2002-1541

https://notcve.org/view.php?id=CVE-2002-1541

BadBlue 1.7 allows remote attackers to bypass password protections for directories and files via an HTTP request containing an extra / (slash). BadBlue 1.7 permiten a atacantes remotos eludir las protecciones de contraseñas en directorios y ficheros mediante una petición HTTP que contiene un caracter / (slash). • http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0041.html http://www.iss.net/security_center/static/10466.php http://www.securityfocus.com/bid/6044 •