Books & Papers Security Vulnerabilities

CVE-2005-1121

Format string vulnerability in the my_xlog function in lib.c for Oops! Proxy Server 1.5.23 and earlier, as called by the auth functions in the passwd_mysql and passwd_pgsql modules, may allow attackers to execute arbitrary code via a...

CVE-2005-1187

Heap-based buffer overflow in WinHex 12.05 SR-14, and possibly other versions, may allow attackers to execute arbitrary code via a long file name argument. NOTE: since this overflow is in the command line of an unprivileged program, it is highly likely that this is not a...

CVE-2005-1187

Heap-based buffer overflow in WinHex 12.05 SR-14, and possibly other versions, may allow attackers to execute arbitrary code via a long file name argument. NOTE: since this overflow is in the command line of an unprivileged program, it is highly likely that this is not a...

CVE-2005-1187

Heap-based buffer overflow in WinHex 12.05 SR-14, and possibly other versions, may allow attackers to execute arbitrary code via a long file name argument. NOTE: since this overflow is in the command line of an unprivileged program, it is highly likely that this is not a...

CVE-2005-1121

Format string vulnerability in the my_xlog function in lib.c for Oops! Proxy Server 1.5.23 and earlier, as called by the auth functions in the passwd_mysql and passwd_pgsql modules, may allow attackers to execute arbitrary code via a...

oops -- format string vulnerability

A RST/GHC Advisory reports that there is an format string vulnerability in oops. The vulnerability can be found in the MySQL/PgSQL authentication module. Succesful exploitation may allow execution of arbitrary...

CVE-2005-0958

Format string vulnerability in the log_do function in log.c for YepYep mtftpd 0.0.3, when the statistics option is enabled, allows remote attackers to execute arbitrary code via the CWD...

CVE-2002-1635

The Apache configuration file (httpd.conf) in Oracle 9i Application Server (9iAS) uses a Location alias for /perl directory instead of a ScriptAlias, which allows remote attackers to read the source code of arbitrary CGI files via a URL containing the /perl directory instead of...

CVE-2002-1637

Multiple components in Oracle 9i Application Server (9iAS) are installed with over 160 default usernames and passwords, including (1) SYS, (2) SYSTEM, (3) AQJAVA, (4) OWA, (5) IMAGEUSER, (6) USER1, (7) USER2, (8) PLSQL, (9) DEMO, (10) FINANCE, and many others, which allows attackers to gain...

CVE-2002-1635

The Apache configuration file (httpd.conf) in Oracle 9i Application Server (9iAS) uses a Location alias for /perl directory instead of a ScriptAlias, which allows remote attackers to read the source code of arbitrary CGI files via a URL containing the /perl directory instead of...

CVE-2002-1636

Cross-site scripting (XSS) vulnerability in the htp PL/SQL package for Oracle 9i Application Server (9iAS) allows remote attackers to inject arbitrary web script or HTML via the cbuf parameter to...

CVE-2002-1636

Cross-site scripting (XSS) vulnerability in the htp PL/SQL package for Oracle 9i Application Server (9iAS) allows remote attackers to inject arbitrary web script or HTML via the cbuf parameter to...

CVE-2002-1637

Multiple components in Oracle 9i Application Server (9iAS) are installed with over 160 default usernames and passwords, including (1) SYS, (2) SYSTEM, (3) AQJAVA, (4) OWA, (5) IMAGEUSER, (6) USER1, (7) USER2, (8) PLSQL, (9) DEMO, (10) FINANCE, and many others, which allows attackers to gain...

CVE-2002-1630

The sendmail.jsp sample page in Oracle 9i Application Server (9iAS) allows remote attackers to send arbitrary...

CVE-2002-1632

Oracle 9i Application Server (9iAS) installs multiple sample pages that allow remote attackers to obtain environment variables and other sensitive information via (1) info.jsp, (2) printenv, (3) echo, or (4)...

CVE-2002-1632

Oracle 9i Application Server (9iAS) installs multiple sample pages that allow remote attackers to obtain environment variables and other sensitive information via (1) info.jsp, (2) printenv, (3) echo, or (4)...

CVE-2002-1631

SQL injection vulnerability in the query.xsql sample page in Oracle 9i Application Server (9iAS) allows remote attackers to execute arbitrary code via the sql...

CVE-2002-1630

The sendmail.jsp sample page in Oracle 9i Application Server (9iAS) allows remote attackers to send arbitrary...

CVE-2002-1631

SQL injection vulnerability in the query.xsql sample page in Oracle 9i Application Server (9iAS) allows remote attackers to execute arbitrary code via the sql...

Multiple web browsers vulnerable to spoofing via Internationalized Domain Name support

Overview Multiple web browsers are vulnerable to spoofing attacks through the use of Internationalized Domain Names. Other applications such as email programs may also be vulnerable. Description The Domain Name System The Domain Name System (DNS) provides name, address, and other information about....

exp2.php.txt

...

MySQL 4.x - CREATE FUNCTION mysql.func Table Arbitrary Library Injection

MySQL 4.x - CREATE FUNCTION mysql.func Table Arbitrary Library...

MySQL 4.x - CREATE FUNCTION mysql.func Table Arbitrary Library Injection

...

CVE-2005-0109

Hyper-Threading technology, as used in FreeBSD and other operating systems that are run on Intel Pentium and other processors, allows local users to use a malicious thread to create covert channels, monitor the execution of other threads, and obtain sensitive information such as cryptographic...

CVE-2005-0109

Hyper-Threading technology, as used in FreeBSD and other operating systems that are run on Intel Pentium and other processors, allows local users to use a malicious thread to create covert channels, monitor the execution of other threads, and obtain sensitive information such as cryptographic...

CVE-2005-0109

Hyper-Threading technology, as used in FreeBSD and other operating systems that are run on Intel Pentium and other processors, allows local users to use a malicious thread to create covert channels, monitor the execution of other threads, and obtain sensitive information such as cryptographic...

BibORB.txt

...

WinAmp playlist handling may allow a remote buffer overflow and arbitrary code execution

Overview WinAmp contains a flaw which may allow a remote system compromise if a maliciously crafted playlist is loaded. Description Nullsoft's WinAmp is a multimedia system for Microsoft Windows. WinAmp allows users to create and use "playlists" to play their multimedia files in a customized...

[Full-Disclosure] Advisory: Multiple Vulnerabilities in BibORB

= Advisory: Multiple Vulnerabilities in BibORB = Multiple vulnerabilities were found in BibORB which result in SQL injection, XSS, directory traversal and arbitrary file upload. == Details == Product: BibORB Affected Version: 1.3.2, probably all lower versions Immune Version: 1.3.2 Security...

[Full-Disclosure] Advisory: Cross Site Scripting Vulnerability in Openconf Conference Management Software

Advisory: Cross Site Scripting Vulnerability in Openconf Conference Management Software A group of students at our lab called RedTeam found a cross site scripting vulnerability in openconf which results in possible session takeover. Details Product: openconf Affected Version: 1.04, probably also...

#11 by unl0ck team

-= Unl0ck Team Security Advisory =- ____ ___ __ _______ __ ___________ | | \____ | | \ _ \ ____ | | __ \__ / _____ _____ | | / \| | / /\ \ / \| |/ / | | / __ \\ \ / ...

Painkiller 1.35 - in-game cd-key alpha-numeric Buffer Overflow (PoC)

...

Painkiller <= 1.35 in-game cd-key alpha-numeric Buffer Overflow Exploit

No description provided by...

Painkiller 1.35 - in-game cd-key alpha-numeric Buffer Overflow (PoC)

Painkiller 1.35 - in-game cd-key alpha-numeric Buffer Overflow...

Painkiller <= 1.35 in-game cd-key alpha-numeric Buffer Overflow Exploit

Exploit for unknown platform in category dos /...

CVE-2004-1119

Stack-based buffer overflow in IN_CDDA.dll in Winamp 5.05, and possibly other versions including 5.06, allows remote attackers to execute arbitrary code via a certain .m3u playlist...

CVE-2004-1119

Stack-based buffer overflow in IN_CDDA.dll in Winamp 5.05, and possibly other versions including 5.06, allows remote attackers to execute arbitrary code via a certain .m3u playlist...

MySQL 4.0.17 (Linux) - User-Defined Function (UDF) Dynamic Library (1)

MySQL 4.0.17 (Linux) - User-Defined Function (UDF) Dynamic Library...

MySQL 4.0.17 (Linux) - User-Defined Function (UDF) Dynamic Library (1)

...

MySQL 4.0.17 UDF Dynamic Library Exploit

Exploit for linux platform in category local...

-= Unl0ck Team Security Advisory =-

-= Unl0ck Team Security Advisory =- ____ ___ __ _______ __ ___________ | | &#92;____ | | &#92; _ &#92; ____ | | __ &#92;__ / _____ _____ | | / &#92;| | / /&#92; &#92; / &#92;| |/ / | | / __ &#92;&#92; &#92; / ...

In-game buffer-overflow in the Gamespy cd-key validation SDK

Luigi Auriemma Application: Gamespy cd-key validation SDK http://www.gamespy.net Versions: before 20 November 2004 Games: due to the implementation of this SDK is hard to test and list all the vulnerable games, however the following is the...

Bypass personal firewall application protection . Again.

Bypass personal firewall application protection . Again. (c)oded by offtopic ([email protected]) 2004 Special thank to 3APA3A for links to the debuggers for Windows. &lt;quote src= http://www.security.nnov.ru/advisories/bypassing.asp?l=EN &gt; Personal firewall usually restricts access to network...

CVE-2004-1119

Stack-based buffer overflow in IN_CDDA.dll in Winamp 5.05, and possibly other versions including 5.06, allows remote attackers to execute arbitrary code via a certain .m3u playlist...

CVE-2004-0269

SQL injection vulnerability in PHP-Nuke 6.9 and earlier, and possibly 7.x, allows remote attackers to inject arbitrary SQL code and gain sensitive information via (1) the category variable in the Search module or (2) the admin variable in the Web_Links...

CVE-2004-0269

SQL injection vulnerability in PHP-Nuke 6.9 and earlier, and possibly 7.x, allows remote attackers to inject arbitrary SQL code and gain sensitive information via (1) the category variable in the Search module or (2) the admin variable in the Web_Links...

security hole &#40;http response splitting&#41; in phpwebsite

ADVISORY Author: Maestro (me!) Date: 11-NOV-04 Vendor: Appalachian State University (http://phpwebsite.appstate.edu/) Product: phpWebSite 0.9.3-4 Product description (from vendor website): phpWebSite provides a complete web site content management system. Web-based administration allows for easy...

phpwebsite.txt

...

yak212.txt

...

HTTP Response Splitting in Serendipity 0.7-beta4

SECURITY ADVISORY: HTTP Response Splitting in Serendipity 0.7-beta4 AUTHOR: Chaotic Evil (chaoticevil $$$at$$$ spyring $$$dot$$$ com) DATE: October 21st, 2004 PRODUCT: Serendipity 0.7-beta4 [October 14th, 2004 (Recommended release, most stable)] - www.s9y.org FROM THE VENDOR WEBSITE: Serendipity...