AWOL helperfunction.php includedir Parameter Remote File Inclusion

The remote host is running AWOL, an open source PHP application. It is possible to make the remote host include php files hosted on a third party server using the '$include' variable in AWOL. An attacker may use this flaw to inject arbitrary code in the remote host and gain a shell with the...

TYPSoft FTP Server Malformed STOR / RETR Command DoS

The remote FTP server crashes when it is sent the command RETR ../../ or STOR ../../ An attacker may use this flaw to cause the server to crash. C Tenable Network Security, Inc. Script audit and contributions from Carmichael Security Erik Anderson nb: domain no longer exists Added BugtraqID and C...

iBill ibillpm.pl Password Generation Weakness

The remote host is running iBill, an internet billing application. Some versions of the 'ibillpm.pl' CGI use a weak password management system that can be brute-forced. No flaw was tested. Your script might be a safe version. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Script audit and...

IBM Tivoli SecureWay WebSEAL Proxy Policy Director Encoded URL DoS

The remote web server crashes when an URL ending with %2E is requested. An attacker may use this flaw to cause the server crash continually. C Tenable Network Security, Inc. Script audit and contributions from Carmichael Security Erik Anderson nb: domain no longer exists Added BugtraqID and CAN...

Basilix Webmail basilix.php3 request_id[DUMMY] Variable Traversal Arbitrary File Access

The script 'basilix.php3' is installed on the remote web server. Some versions of this webmail software allow the users to read any file on the system with the permission of the webmail software, and execute any PHP. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. References: From: "karol "...

CVE-2001-1384

CVE-2001-1384 affects the Linux kernel in 2.2.x up to 2.2.19 and 2.4.x up to 2.4.9. The vulnerability is a local privilege escalation: a local user can gain root by ptracing a setuid/setgid process that itself executes an unprivileged program (e.g., newgrp). The provided documents do not specify ...

CVE-2001-1384

ptrace in Linux 2.2.x through 2.2.19, and 2.4.x through 2.4.9, allows local users to gain root privileges by running ptrace on a setuid or setgid program that itself calls an unprivileged program, such as newgrp...

CVE-2001-1379

CVE-2001-1379 affects the PostgreSQL authentication modules used with Apache: mod_auth_pgsql 0.9.5 and mod_auth_pgsql_sys 0.9.4 . The vulnerability is a SQL injection via the user name parameter that allows remote attackers to bypass authentication and execute arbitrary SQL. OpenVAS/Nessus entrie...

CVE-2001-0890

The CVE-2001-0890 entry describes a vulnerability in backend drivers of the SANE library (1.0.3 and earlier), used by frontend tools such as XSane, where a local user can modify files via a symlink attack on temporary files. The root cause is a symlink-related flaw in temporary file handling with...

Solaris dtspcd Heap Overflow

This is a port of noir's dtspcd exploit. This module should work against any vulnerable version of Solaris 8 sparc. The original exploit code was published in the book Shellcoder's Handbook. Module Options msf use exploit/solaris/dtspcd/heap/noir msf undefinednoir show actions ...actions... msf...

CVE-2001-0508

CVE-2001-0508 relates to Microsoft IIS 5.0 WebDAV processing. A very long, invalid WebDAV request can trigger a memory access error, causing the IIS 5.0 process to terminate and restart (DoS). The issue is addressed by the MS01-044 patch from Microsoft. Affected platform noted in sources is IIS 5...

CVE-2001-0726

CVE-2001-0726 concerns Outlook Web Access (OWA) in Microsoft Exchange 5.5 Server. The issue arises when OWA is used with Internet Explorer and fails to properly detect certain inline script in HTML emails, which can allow remote attackers to perform arbitrary actions on a user’s Exchange mailbox....

CVE-2001-0731

CVE-2001-0731 affects Apache 1.3.20 when Multiviews is enabled. A remote attacker can cause a directory listing to be displayed (information disclosure) by crafting a request containing an M=D query string, bypassing normal index page behavior. Public advisories and scans consistently reference t...

CVE-2001-0797

A buffer overflow vulnerability exists in the System V derived /bin/login program across various operating systems, including Solaris/SunOS, HP-UX, AIX, IRIX, and Unixware . The root cause is the improper handling of a large number of extraneous arguments or environment variables . This allows re...

CVE-2001-0869

CVE-2001-0869 is a format-string vulnerability in the Cyrus SASL library (cyrus-sasl) affecting the default logging callback _sasl_syslog in common.c. The Mandrake MDKSA-2002:018 advisory notes a format bug in cyrus-sasl that could allow a remote attacker to obtain access or elevate privileges, w...

CVE-2001-0886

Mode C: The CVE-2001-0886 issue is a buffer overflow in the glibc glob(3) implementation. The vulnerability affects glibc’s globbing code and can lead to a crash (DoS) and potentially arbitrary code execution when processing a glob pattern that ends with the brace character “{”. The OpenVAS/DEBIA...

CVE-2001-0889

Exim vulnerable to remote command execution when redirecting to a pipe: Exim 3.22 and earlier fail to properly verify the local part of the address, allowing shell metacharacters to run arbitrary commands. Public details from CVE-2001-0889 describe impact as remote command execution with the Exim...

CVE-2001-0894

Postfix SMTP server (pre-20010228-pl07) is affected by a remote DoS: when configured to email the postmaster on SMTP errors, a storm of errors can cause the SMTP session log to grow, leading to memory exhaustion. Debian advisory DSA-093-1 and OpenVAS/NESL entries corroborate a remote DoS due to e...

CVE-2001-0905

The provided sources confirm CVE-2001-0905: a race condition in the signal handling of procmail versions 3.20 and earlier when running setuid. This vulnerability allows local users to cause a denial of service or gain root privileges by sending a signal while a signal handling routine is already ...

CVE-2001-0920

The CVE-2001-0920 entry concerns a format string vulnerability in the auto nice daemon (AND) version 1.0.4 and earlier that lets a local user potentially execute arbitrary code by supplying a process name containing a format string. Affected component: the daemon’s handling of process names. Unde...