Improper access control

The default access control lists ACL in ISC BIND 9.4.0, 9.4.1, and 9.5.0a1 through 9.5.0a5 do not set the allow-recursion and allow-query-cache ACLs, which allows remote attackers to make recursive queries and query the cache...

CVE-2007-2925

CVE-2007-2925 affects ISC BIND 9.4.0/9.4.1 and 9.5.0a1–9.5.0a5 where default ACLs do not enable allow-recursion or allow-query-cache, allowing remote recursion against the cache. Upstream fixes exist (e.g., 9.5.0a6, and related patches for 9.4.x/9.5.x lines). Several advisories note the issue and...

CVE-2007-2925

The default access control lists ACL in ISC BIND 9.4.0, 9.4.1, and 9.5.0a1 through 9.5.0a5 do not set the allow-recursion and allow-query-cache ACLs, which allows remote attackers to make recursive queries and query the cache...

CVE-2007-2925: Undefined Security Weakness

The default access control lists ACL in ISC BIND 9.4.0, 9.4.1, and 9.5.0a1 through 9.5.0a5 do not set the allow-recursion and allow-query-cache ACLs, which allows remote attackers to make recursive queries and query the cache...

Microsoft Windows Vista/2003/XP/2000 file management security issues

Title: Microsoft Windows Vista/2003/XP/2000 file management security issues Author: 3APA3A, http://securityvulns.com/ Vendor: Microsoft and potentially another vendors Products: Microsoft Windows Vista/2003/XP/2000, Microsoft resource kit for Windows 2000 and different utilities. Access Vector:...

security flaw

slapd in OpenLDAP before 2.3.25 allows remote authenticated users with selfwrite Access Control List ACL privileges to modify arbitrary Distinguished Names DN...

Sun Solaris NFS客户端模块ACL(2)报文远程拒绝服务漏洞

Solaris是一款由Sun开发和维护的商业性质UNIX操作系统。 Solaris的NFS客户端处理畸形请求时存在漏洞，远程攻击者可能利用此漏洞导致系统忙碌。 远程攻击者可以通过向Solaris的NFS客户端模块发送acl2报文导致NFS服务器忙碌，造成拒绝服务的情况。仅在将Solaris系统配置为NFS服务器的情况下才会出现这个漏洞。 Sun Solaris 9.0x86 Sun Solaris 9.0 Sun Solaris 8.0x86 Sun Solaris 8.0 Sun Solaris 10x86 Sun Solaris 10.0 临时解决方法： 通过以下命令禁用NFS服务器...

CVE-2007-2882

CVE-2007-2882 concerns an unspecified vulnerability in the NFS client module of Sun Solaris versions 8–10 prior to the 20070524 build when the system acts as an NFS server. The issue can allow remote attackers to cause a denial of service (crash) by sending certain ACL packets. Connected advisori...

CVE-2007-2882: Undefined Security Weakness

Unspecified vulnerability in the NFS client module in Sun Solaris 8 through 10 before 20070524, when operating as an NFS server, allows remote attackers to cause a denial of service crash via certain Access Control List acl packets...

Sun Solaris NFS客户端模块ACL(2)报文拒绝服务漏洞

Sun Solaris是一款商业性质的操作系统。 Sun Solaris NFS客户端模块相关处理acl2报文存在安全问题，远程攻击者可以利用漏洞对NFS服务器进行拒绝服务攻击。 目前没有详细漏洞细节提供 Sun Solaris 9x86 Sun Solaris 9 Sun Solaris 8x86 Sun Solaris 8 Sun Solaris 10x86 Sun Solaris 10 可参考如下安全公告获得补丁信息： http://sunsolve.sun.com/search/document.do?assetkey=1-26-102911-1&searchclause=...

CVE-2007-2815

CVE-2007-2815 concerns Microsoft IIS webhits.dll Hit-Highlighting authentication bypass. The hit-highlighting feature in IIS Web Server 5.x (notably IIS 5.0/5.1) uses Windows NT ACLs, enabling remote attackers to bypass NTLM and Basic authentication and access private web directories via the CiWe...

CVE-2007-2637

MoinMoin before 20070507 does not properly enforce ACLs for calendars and includes, which allows remote attackers to read certain pages via unspecified vectors...

CVE-2007-2637: Undefined Security Weakness

MoinMoin before 20070507 does not properly enforce ACLs for calendars and includes, which allows remote attackers to read certain pages via unspecified vectors...

Cisco IOS FTP Server非授权访问及拒绝服务漏洞

Cisco IOS是Cisco网络设备所使用的操作系统。 Cisco IOS所带的FTP Server处理访问请求时存在漏洞，远程攻击者可能利用此漏洞非授权访问系统文件或导致拒绝服务。 启用了IOS FTP Server功能的Cisco IOS没有正确检查用户授权，可能允许攻击者非授权读写设备文件系统中的任意文件，包括设备保存的配置，其中可能有口令或其他敏感信息；此外这种配置的Cisco IOS还可能导致在通过FTP传输文件时IOS重载。 Cisco IOS 12.4 Cisco IOS 12.3 Cisco IOS 12.2 Cisco IOS 12.1 Cisco IOS 12.0...

Integer overflow

Integer signedness error in the acl facl system call in Solaris 10 before 20070507 allows local users to cause a denial of service kernel panic and possibly gain privileges via a certain argument, related to ACESETACL...

CVE-2007-2529: Undefined Security Weakness

Integer signedness error in the acl facl system call in Solaris 10 before 20070507 allows local users to cause a denial of service kernel panic and possibly gain privileges via a certain argument, related to ACESETACL...

CVE-2007-2529

CVE-2007-2529 affects Solaris 10 (before 20070507) with an integer signedness error in the acl (facl) system call. The underlying issue is a signedness bug in ACE_SETACL handling, enabling local users to trigger a denial of service (kernel panic) and potentially escalate privileges. Publicly docu...

USN-458-1: MoinMoin vulnerabilities

A flaw was discovered in MoinMoin's error reporting when using the AttachFile action. By tricking a user into viewing a crafted MoinMoin URL, an attacker could execute arbitrary JavaScript as the current MoinMoin user, possibly exposing the user's authentication information for the domain where...

security flaw

slapd in OpenLDAP before 2.3.25 allows remote authenticated users with selfwrite Access Control List ACL privileges to modify arbitrary Distinguished Names DN...

Design/Logic Flaw

Cisco Wireless LAN Controller WLC before 4.0.206.0 saves the WLAN ACL configuration with an invalid checksum, which prevents WLAN ACLs from being loaded at boot time, and might allow remote attackers to bypass intended access restrictions, aka Bug ID CSCse58195...