Symantec Sygate Management Server: SMS Authentication Servlet SQL Injection

SUMMARY A SQL injection vulnerability in Symantec's Sygate Management Server SMS version 4.1, build 1417 and earlier could potentially allow a remote or local attacker to gain administrative privileges to the SMS server. Risk Impact High Remote Access | Yes ---|--- Local Access | Yes Authenticati...

Re: [VulnWatch] Cisco Security Advisory: Cisco VPN 3000 Concentrator Vulnerable to Crafted HTTP Attack

With respect to: http://archives.neohapsis.com/archives/vulnwatch/2006-q1/0036.html I'm the person who discovered this particular Cisco VPN vulnerability and divulged some details at the end of my talk at Shmoocon - not "Schmoocon" as the original advisory spells it. The exploit involves sending ...

Cisco PIX firewalls unauthorized access

Pseudo user account in a form of ACSACL-IP-uacl-xxxxxxxx is created for ACL download. It's possible to use this account for authentication...

CVE-2005-4499

CVE-2005-4499 affects Cisco PIX and VPN 3000 concentrators via the Downloadable RADIUS ACLs feature. When an ACL is created on CS ACS, the system generates a random internal name that doubles as a hidden username and password, enabling a remote attacker to sniff the cleartext username from a RADI...

CVE-2004-2559

CVE-2004-2559 affects DokuWiki prior to 2004-10-19. The issue allows remote attackers to access administrative functions (Mediaselectiondialog, Recent changes, feed, search) due to missing ACL checks. This can impact confidentiality, integrity, and availability as reflected by CVSS metrics (AV:N/...

CVE-2004-2559

DokuWiki before 2004-10-19 allows remote attackers to access administrative functionality including 1 Mediaselectiondialog, 2 Recent changes, 3 feed, and 4 search, possibly due to the lack of ACL checks...

CVE-2004-2559

DokuWiki before 2004-10-19 allows remote attackers to access administrative functionality including 1 Mediaselectiondialog, 2 Recent changes, 3 feed, and 4 search, possibly due to the lack of ACL checks...

CVE-2004-2559: Undefined Security Weakness

DokuWiki before 2004-10-19 allows remote attackers to access administrative functionality including 1 Mediaselectiondialog, 2 Recent changes, 3 feed, and 4 search, possibly due to the lack of ACL checks...

CUPS < 1.1.23 Multiple Vulnerabilities

CUPS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2005 George A. Theall Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apple:cups"; ifdescription...

Singapore MD5 Administrative Password Disclosure

Singapore is a PHP based photo gallery web application. Due to inaddequate security settings, the file used to stored the administrative password is easily accessible, and the MD5 with which the product protects the password is feasibably crackable. SPDX-FileCopyrightText: 2004 Noam Rathaus Some...

CVE-2005-3168: Undefined Security Weakness

The SECEDIT command on Microsoft Windows 2000 before Update Rollup 1 for SP4, when using a security template to set Access Control Lists ACLs on folders, does not apply ACLs on folders that are listed after a long folder entry, which could result in less secure permissions than specified by the...

CVE-2005-3177: Undefined Security Weakness

CHKDSK in Microsoft Windows 2000 before Update Rollup 1 for SP4, Windows XP, and Windows Server 2003, when running in fix mode, does not properly handle security descriptors if the master file table contains a large number of files or if the descriptors do not satisfy certain NTFS conventions,...

Mandrake Linux Security Advisory : cups (MDKSA-2005:165)

A vulnerability in CUPS would treat a Location directive in cupsd.conf as case-sensitive, allowing attackers to bypass intended ACLs via a printer name containing uppercase or lowecase letters that are different from that which was specified in the Location directive. This issue only affects...

[SECURITY] [DSA 807-1] New mod_ssl packages fix acl restriction bypass

-------------------------------------------------------------------------- Debian Security Advisory DSA 807-1 [email protected] http://www.debian.org/security/ Martin Schulze September 12th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 807-1] New mod_ssl packages fix acl restriction bypass

-------------------------------------------------------------------------- Debian Security Advisory DSA 807-1 [email protected] http://www.debian.org/security/ Martin Schulze September 12th, 2005 http://www.debian.org/security/faq -...

CVE-2005-2808

frox 0.7.16 and 0.7.17 does not properly parse certain Deny ACLs, which might allow attackers to bypass intended restrictions and access blocked hosts...

CVE-2005-2808

CVE-2005-2808 affects frox 0.7.16 and 0.7.17. A flaw in parsing Deny ACLs may let an attacker bypass restrictions and reach blocked hosts. Root cause: improper handling of Deny ACLs. CVSS details indicate network access, no authentication, low complexity, and partial impacts to confidentiality, i...

CVE-2005-2808

frox 0.7.16 and 0.7.17 does not properly parse certain Deny ACLs, which might allow attackers to bypass intended restrictions and access blocked hosts...

CVE-2005-2808: Undefined Security Weakness

frox 0.7.16 and 0.7.17 does not properly parse certain Deny ACLs, which might allow attackers to bypass intended restrictions and access blocked hosts...

CVE-2005-2801: Incorrect Comparison

xattr.c in the ext2 and ext3 file system code for Linux kernel 2.6 does not properly compare the nameindex fields when sharing xattr blocks, which could prevent default ACLs from being applied...