Trend Micro OfficeScan Web-Deployment SetupINICtrl ActiveX control buffer overflows

Overview The Trend Micro OfficeScan Web-Deployment SetupINICtrl ActiveX control contains multiple buffer overflows, which could allow a remote attacker to execute arbitrary code on a vulnerable system. Description Trend Micro OfficeScan comes with a web-based administration console that makes use...

IP3 NetAccess directory traversal

Directory traversal in Web administration interface...

syscp1215-exec.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The System Control Panel www.SysCP.org -= Security Advisory =- Advisory: Ability to inject and execute any code as root in SysCP Release Date: 2007/02/02 Last Modified: 2007/02/07 Author: Florian Lippert Application: SysCP and only affects SysCP 1.2.1...

Ability to inject and execute any code as root in SysCP

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The System Control Panel www.SysCP.org -= Security Advisory =- Advisory: Ability to inject and execute any code as root in SysCP Release Date: 2007/02/02 Last Modified: 2007/02/07 Author: Florian Lippert [email protected] Application: SysCP =...

CVE-2006-6973

CVE-2006-6973 affects Headstart Solutions DeskPRO. The vulnerability allows remote attackers to bypass authentication for administrative paths, enabling (1) reinstall via install/index.php, (2) database deletion via a crafted do=delete_database query on a renamed install/index.php, and (3)/(4) un...

EQdkp <= 1.3.1 Referer Spoof to access to SQL Database

Title: EQdkp = 1.3.1 Referer Spoof to access to SQL Database URL: http://www.eqdkp.com Hook: "Powered by EQdkp" Author: Eight10 Contact: [email protected] -------------------------------------------------------------------------------------------------------- Background: EQdkp is the largest DKP...

CVE-2007-0529

Cross-site scripting XSS vulnerability in index.html aka the administration page in PHP Link Directory phpLD 3.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted link, which is triggered when the administrator uses the "Validate Links" functionality...

ARCserve Backup for Laptops & Desktops Server Admin Service Detection

BrightStor ARCserve Backup for Laptops & Desktops Server formerly BrightStor Mobile Backup Server, an enterprise class backup solution for remote and mobile Windows-based PCs, is installed on the remote host. And the service listening on this port is used by the application's Server Explorer to...

Multiple IP Phones unauthorized access

After administrative login it's possible to access administration interface from any IP without password validation...

PHP Link Directory XSS Vulnerability version <= 3.0.6

Smilehouse Oy -= Security Advisory =- Advisory: PHP Link Directory XSS Vulnerability Release Date: 2007/01/21 Last Modified: 2007/01/21 Authors: Jussi Vuokko, CISSP [email protected] Henri Lindberg, Associate of ISCІ [email protected] Application: PHP Link Directory = 3.0.6...

MIT Kerberos 5: Arbitrary Remote Code Execution

Background MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol. Description The Kerberos administration daemon, and possibly other applications using the GSS-API or RPC libraries, could potentially call a function pointer in a freed heap buffer, or attempt to fr...

CVE-2007-0313

Unspecified vulnerability in GONICUS System Administration GOsa before 2.5.8 allows remote authenticated users to modify certain settings, including the admin password, via crafted POST requests...

CVE-2007-0313

Unspecified vulnerability in GONICUS System Administration GOsa before 2.5.8 allows remote authenticated users to modify certain settings, including the admin password, via crafted POST requests...

Design/Logic Flaw

Unspecified vulnerability in GONICUS System Administration GOsa before 2.5.8 allows remote authenticated users to modify certain settings, including the admin password, via crafted POST requests...

CVE-2007-0313

Unspecified vulnerability in GONICUS System Administration GOsa before 2.5.8 allows remote authenticated users to modify certain settings, including the admin password, via crafted POST requests...

CVE-2007-0313

CVE-2007-0313 affects GONICUS System Administration (GOsa) up to, but not including, version 2.5.8. The issue allows remote authenticated users to modify certain settings, including the admin password, via crafted POST requests. Impact is described as complete confidentiality, integrity, and avai...

CVE-2007-0313

Unspecified vulnerability in GONICUS System Administration GOsa before 2.5.8 allows remote authenticated users to modify certain settings, including the admin password, via crafted POST requests...

CVE-2007-0313: Undefined Security Weakness

Unspecified vulnerability in GONICUS System Administration GOsa before 2.5.8 allows remote authenticated users to modify certain settings, including the admin password, via crafted POST requests...

snews1530.txt

126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else...

CVE-2006-6144

The "mechglue" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon kadmind and other products that use this library, allows remote attackers to cause a denial of service crash via unspecified vectors that cause mechglue to free...