CVE-2008-0101

Format string vulnerability in the swDebugf function in DuneApp.cpp in WhiteDune 0.29 beta791 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a .WRL file...

CVE-2007-0101

CVE-2007-0101 describes a cross-site request forgery (CSRF) vulnerability in SPINE that allows remote attackers to perform unauthorized administrative actions in SPINE via unspecified vectors. The affected product is SPINE; the underlying cause is a CSRF flaw enabling privileged actions. The avai...

Linux Kernel auto-reap ptraced子进程本地拒绝服务漏洞

BUGTRAQ ID: 15625 CVECAN ID: CVE-2005-3784 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel对系统进程的处理上存在问题，本地攻击者可能利用此漏洞进行拒绝服务攻击。 漏洞存在于signal.c文件中，内核对子进程执行auto-reap操作时，操作对象包含了已经被ptrace附着的进程，这可能导致ptrace引用混乱，允许本地攻击者触发拒绝服务问题。 Linux kernel = 2.6.15-rc2 S.u.S.E. Linux Enterprise Server 9 S.u.S.E. Linux...

Linux Kernel set_mempolicy本地拒绝服务漏洞

BUGTRAQ ID: 16135 CVECAN ID: CVE-2005-3358 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的setmempolicy系统调用实现上存在漏洞，本地攻击者可能利用此漏洞对系统进行拒绝服务攻击。 漏洞存在于“mm/mempolicy.c”文件中，本地攻击者以掩码0调用setmempolicy会导致某些64位的系统崩溃。 Linux kernel 2.6.15 RedHat Linux WS 4 RedHat Linux ES 4 RedHat Linux Desktop 4 RedHat Linux AS ...

Linux Kernel Sysctl接口注销本地拒绝服务漏洞

BUGTRAQ ID: 15365 CVECAN ID: CVE-2005-2709 Linux kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的"sysctl.c"在"/proc/sys/net/ipv4/conf/"中处理接口注销时存在拒绝服务漏洞。恶意用户可以利用这个漏洞导致系统忙碌，造成服务不可用。 Linux kernel 2.6.14.1 Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： Linux Upgrade linux-2.6.14.1.tar.bz2...

Linux Kernel mq_open系统调用拒绝服务漏洞

BUGTRAQ ID: 16283 CVECAN ID: CVE-2005-335 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel对目录操作的实现上存在漏洞，本地攻击者可能利用此漏洞对系统进行拒绝服务攻击。 如果dentryopen函数调用失败的话，就会多次调用mntput函数。Linux Kernel的mqopen系统调用在这种情况下就可能两次递减计数器，这就允许本地攻击者导致系统忙碌，造成拒绝服务。 Linux kernel 2.6.9 RedHat Linux WS 4 RedHat Linux ES 4 RedHat Linux...

CVE-2006-0101

CVE-2006-0101 affects sBLOG 0.7.1 Beta 20051202 and earlier. The vulnerability is a cross-site scripting (XSS) flaw in the application’s handling of the (1) p and (2) keyword parameters in index.php and search.php, allowing remote attackers to inject arbitrary web script or HTML. The impact is li...

Debian DSA-319-1 : webmin - session ID spoofing

miniserv.pl in the webmin package does not properly handle metacharacters, such as line feeds and carriage returns, in Base64-encoded strings used in Basic authentication. This vulnerability allows remote attackers to spoof a session ID, and thereby gain root privileges. %NASLMINLEVEL 70300 C...

Mandrake Linux Security Advisory : webmin (MDKSA-2003:025)

A vulnerability was discovered in webmin by Cintia M. Imanishi, in the miniserv.pl program, which is the core server of webmin. This vulnerability allows an attacker to spoof a session ID by including special metacharacters in the BASE64 encoding string used during the authentication process. Thi...

Usermin 'miniserv.pl' Base-64 String Metacharacter Handling Session Spoofing

The remote server is running a version of Usermin which is vulnerable to Session ID spoofing. An attacker may use this flaw to log in as the 'root' user, and gain full control of the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

CVE-2003-0101

CVE-2003-0101 describes a vulnerability in miniserv.pl used by Webmin before 1.070 (and Usermin before 1.000) where metacharacters in Base-64 strings during Basic authentication can cause session ID spoofing, potentially granting root privileges. The issue arises from improper handling of line fe...

CVE-2003-0101

miniserv.pl in 1 Webmin before 1.070 and 2 Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns CRLF in Base-64 encoded strings during Basic authentication, which allows remote attackers to spoof a session ID and gain root privileges...

CVE-2002-0101

Microsoft Internet Explorer 6.0 and earlier allows local users to cause a denial of service via an infinite loop for modeless dialogs showModelessDialog, which causes CPU usage while the focus for the dialog is not released...

CVE-2002-0101

CVE-2002-0101 affects Microsoft Internet Explorer 6.0 and earlier. The issue is a local denial of service caused by an infinite loop triggered by modeless dialogs (showModelessDialog), leading to high CPU usage when the dialog’s focus is not released. The available documents do not specify a root...

CVE-2001-0101

Vulnerability in fetchmail 5.5.0-2 and earlier in the AUTHENTICATE GSSAPI command...

CVE-2001-0101

CVE-2001-0101 affects fetchmail 5.5.0-2 and earlier, with vulnerability in the AUTHENTICATE GSSAPI command. The available connected records confirm the affected software and the vulnerable component, but do not provide further technical details on root cause, impact specifics beyond what NVD list...

CVE-2001-0101

Vulnerability in fetchmail 5.5.0-2 and earlier in the AUTHENTICATE GSSAPI command...

CVE-2000-0101

The CVE-2000-0101 entry concerns the Make-a-Store OrderPage shopping cart, where remote users can modify sensitive purchase information via hidden form fields in the application. Connected PT-2000-1089 confirms the vulnerable software as Make-a-Store OrderPage (affected versions not specified) an...

CVE-1999-0101

CVE-1999-0101 describes a buffer overflow in the AIX/Solaris gethostbyname() library call that allows root access through corrupt DNS host names. Affected: AIX 3.x/4.x, SunOS/Solaris; impact: potential full host compromise. Root cause: insufficient bounds checking in gethostbyname() implementatio...