Oracle 9iAS globals.jsa Database Credential Remote Disclosure

In the default configuration of Oracle 9iAS, it is possible to make requests for the globals.jsa file for a given web application. These files should not be returned by the server as they often contain sensitive information such as database credentials. %NASLMINLEVEL 70300 This script was written...

Oracle 9iAS mod_plsql DAD Admin Interface Access

In a default installation of Oracle 9iAS, it is possible to access the modplsql DAD Admin interface. Access to these pages should be restricted. %NASLMINLEVEL 70300 This script was written by Matt Moore Script audit and contributions from Carmichael Security Erik Anderson Added link to the Bugtra...

CVE-2001-1044

Basilix Webmail 0.9.7beta, and possibly other versions, stores .class and .inc files under the document root and does not restrict access, which could allows remote attackers to obtain sensitive information such as MySQL passwords and usernames from the mysql.class file...

CVE-2001-0910

CVE-2001-0910 affects Legato NetWorker prior to 6.1, where remote attackers could bypass access restrictions and gain privileges on the Networker interface by spoofing the admin server name and IP, then connecting from an IP address whose hostname cannot be determined via reverse DNS. The provide...

CVE-2001-0910: Undefined Security Weakness

Legato Networker before 6.1 allows remote attackers to bypass access restrictions and gain privileges on the Networker interface by spoofing the admin server name and IP address and connecting to Networker from an IP address whose hostname can not be determined by a DNS reverse lookup...

PCCS-Mysql User/Password Exposure

It is possible to read the include file of PCCS-Mysql, dbconnect.inc on the remote server. This include file contains information such as the username and password used to connect to the database. %NASLMINLEVEL 70300 This script was written by Georges Dagousset See the Nessus Scripts License for...

CVE-2001-0535

The CVE-2001-0535 issue affects ColdFusion Server 4.x Exampleapps, where access checks do not correctly limit requests from outside the local host domain. This enables remote attackers to spoof the HTTP Host (CGI.Host) to the Web Publish and Email example scripts, allowing upload, read, or execut...

CVE-2001-0766: Improper Handling of Case Sensitivity

Apache on MacOS X Client 10.0.3 with the HFS+ file system allows remote attackers to bypass access restrictions via a URL that contains some characters whose case is not matched by Apache's filters...

SiteScope Web Service Unpassworded Access

The remote SiteScope web service has no password set. An attacker who can connect to this server can view usernames and passwords stored in the preferences section or reconfigure the service. %NASLMINLEVEL 70300 This script was written by H D Moore Changes by Tenable: - Revised plugin title...

CVE-2001-0402

CVE-2001-0402 affects IPFilter 3.4.16 and earlier. The issue is that the module does not include sufficient session information in its cache, enabling a remote attacker to bypass access restrictions by sending fragmented packets to a restricted port after sending unfragmented packets to an unrest...

CVE-2001-0402: Undefined Security Weakness

IPFilter 3.4.16 and earlier does not include sufficient session information in its cache, which allows remote attackers to bypass access restrictions by sending fragmented packets to a restricted port after sending unfragmented packets to an unrestricted port...

CVE-2001-0405: Undefined Security Weakness

ipconntrackftp in the IPTables firewall for Linux 2.4 allows remote attackers to bypass access restrictions for an FTP server via a PORT command that lists an arbitrary IP address and port number, which is added to the RELATED table and allowed by the firewall...

CVE-1999-1547

Oracle Web Listener 2.1 allows remote attackers to bypass access restrictions by replacing a character in the URL with its HTTP-encoded hex equivalent...

CVE-1999-1124: Undefined Security Weakness

HTTP Client application in ColdFusion allows remote attackers to bypass access restrictions for web pages on other ports by providing the target page to the mainframeset.cfm application, which requests the page from the server, making it look like the request is coming from the local host...

CVE-2001-1401

Bugzilla before 2.14 does not properly restrict access to confidential bugs, which could allow Bugzilla users to bypass viewing permissions via modified bug id parameters in 1 processbug.cgi, 2 showactivity.cgi, 3 showvotes.cgi, 4 showdependencytree.cgi, 5 showdependencygraph.cgi, 6...

CVE-2001-1405

Bugzilla before 2.14 does not restrict access to sanitycheck.cgi, which allows local users to cause a denial of service CPU consumption via a flood of requests to sanitycheck.cgi...

HP System Management Homepage Detection

HP System Management Homepage SMH, formerly Compaq Web Management, is running on the remote web server. SMH is a web-based application for managing HP ProLiant and Integrity servers, or HP 9000 and HP Integrity servers. C Tenable Network Security, Inc. include"compat.inc"; if description...

[SNS Advisory No.36] TrendMicro InterScan WebManager Version 1.2 HttpSave.dll Buffer Overflow Vulnerability

----------------------------------------------------------------------- SNS Advisory No.36 TrendMicro InterScan WebManager Version 1.2 HttpSave.dll Buffer Overflow Vulnerability Problem first discovered: Mon, 11 Jun 2001 Published: Mon, 2 Jul 2001...

Access Restriction Bypass

Overview Affected versions of this package are vulnerable to Access Restriction Bypass. OpenSSH 2.9 and earlier does not initiate a Pluggable Authentication Module PAM session if commands are executed with no pty, which allows local users to bypass resource limits rlimits set in pam.d. Remediatio...

CVE-2001-0402

IPFilter 3.4.16 and earlier does not include sufficient session information in its cache, which allows remote attackers to bypass access restrictions by sending fragmented packets to a restricted port after sending unfragmented packets to an unrestricted port...