CVE-2005-2614

Discuz! 4.0 rc4 does not properly restrict types of files that are uploaded to the server, which allows remote attackers to execute arbitrary commands via a filename containing ".php.rar" or other multiple extensions that include .php...

CVE-2004-2375

Vulnerability CVE-2004-2375 affects the POP3 server in 1st Class Mail Server 4.0. A buffer overflow can be triggered by an APOP USER command with an excessively long second parameter (digest), potentially causing a denial of service and possibly allowing arbitrary code execution. Documented in CV...

postmaster.txt

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + Postmaster 4.2.2 build 3.2.5 multiple vulnerabilities + ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ http://www.woppoware.com.au/ date: 9 May 2005 Severity: High Systems Affected: Microsoft Windows NT 4.0 all...

CVE-2002-2071

Compaq Tru64 4.0 d allows remote attackers to cause a denial of service in 1 telnet, 2 FTP, 3 ypbind, 4 rpc.lockd, 5 snmp, 6 ttdbserverd, and possibly other services via a TCP SYN scan, as demonstrated using nmap...

CVE-2002-2073

Cross-site scripting XSS vulnerability in the default ASP pages on Microsoft Site Server 3.0 on Windows NT 4.0 allows remote attackers to inject arbitrary web script or HTML via the 1 ctr parameter in Default.asp and 2 the query string to formslogin.asp...

CVE-2002-2028

The screensaver on Windows NT 4.0, 2000, XP, and 2002 does not verify if a domain account has already been locked when a valid password is provided, which makes it easier for users with physical access to conduct brute force password guessing...

CVE-2001-1510

The CVE-2001-1510 entry concerns Allaire JRun versions 2.3.3, 3.0 and 3.1 running on IIS 4.0/5.0, iPlanet, Apache, JRun Web Server (JWS) and possibly other web servers. Affected component: the web server handling of certain crafted URLs, where appending one of three fragments ("%3f.jsp", "?.jsp",...

CVE-2005-2150

CVE-2005-2150 affects Windows NT 4.0 and Windows 2000 prior to URP1 for Windows 2000 SP4. It stems from insufficient handling of NULL sessions over alternate named pipes, enabling anonymous access to certain interfaces (svcctl and eventlog). Exploitation could allow an unauthenticated remote atta...

CVE-2005-2150

Windows NT 4.0 and Windows 2000 before URP1 for Windows 2000 SP4 does not properly prevent NULL sessions from accessing certain alternate named pipes, which allows remote attackers to 1 list Windows services via svcctl or 2 read eventlogs via eventlog...

CVE-2005-2150

Windows NT 4.0 and Windows 2000 before URP1 for Windows 2000 SP4 does not properly prevent NULL sessions from accessing certain alternate named pipes, which allows remote attackers to 1 list Windows services via svcctl or 2 read eventlogs via eventlog...

CVE-2004-2182

Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server...

CVE-2004-2199

CVE-2004-2199 is a cross-site scripting (XSS) vulnerability in DUware DUclassified 4.0. The issue arises from how the application handles messages, allowing an attacker to inject arbitrary web script or HTML via the message text. The vulnerability is remote and could enable script execution in th...

CVE-2004-2182

CVE-2004-2182 (Macromedia JRun 4.0) describes a session fixation vulnerability where remote attackers can hijack user sessions by pre-setting the session ID information used by the session server. Public sources in the provided documents consistently identify JRun 4.0 as affected and cite the vul...

CVE-2005-2180

Removed by vendor...

[Full-disclosure] NULL sessions vulnerabilities using alternate named pipes

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 NULL sessions vulnerabilities using alternate named pipes Hervй Schauer Consultants Security Advisory http://www.hsc.fr/ - - Summary - Advisory: NULL sessions vulnerabilities using alternate named pipes CVE identifier: CAN-2005-2150 Release date:...

CVE-2002-1919

SQL injection vulnerability in shopadmin.asp in VP-ASP 4.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the 1 username or 2 password fields...

CVE-2002-1849

ParaChat Server 4.0 is affected: it does not log users off if the browser back button is used, allowing remote attackers to cause a denial of service by repeatedly logging into a chat room, pressing back, and re-logging as a different user, which can fill the room with invalid users. Root cause: ...

CVE-2002-1849

ParaChat Server 4.0 does not log users off if the browser's back button is used, which allows remote attackers to cause a denial of service by repeatedly logging into a chat room, hitting the back button, then logging into the same chat room as a different user, which fills the chat room with...

CVE-2002-1919

CVE-2002-1919 affects VP-ASP 4.0, exposing VP-ASP's shopadmin.asp to SQL injection via the username or password fields that can allow remote SQL execution and bypass authentication. Documents indicate a remote impact and administrator-level access possibility, but do not provide a confirmed patch...

CVE-2000-1227

CVE-2000-1227 affects Windows NT 4.0 and Windows 2000 hosts. The vulnerability allows remote attackers to cause a denial of service (unavailable connections) by sending multiple SMB SMBnegprots requests without reading the response. The available documents describe the affected products and the S...