Fedora Core 4 : firefox-1.0.6-1.1.fc4 (2005-605)

Mozilla Firefox is an open source Web browser. A bug was found in the way Firefox handled synthetic events. It is possible that Web content could generate events such as keystrokes or mouse clicks that could be used to steal data or execute malicious JavaScript code. The Common Vulnerabilities an...

Javascript prompt origin spoofing — Mozilla

Alerts and prompts created by scripts in web pages are presented with the generic title JavaScript Application which sometimes makes it difficult to know which site created them. A malicious page could attempt to cause a prompt to appear in front of a trusted site in an attempt to extract...

CVE-2005-2187

McAfee IntruShield Security Management System allows remote authenticated users to access the "Generate Reports" feature and modify alerts by setting the Access option to true, as demonstrated using the 1 fullAccess or 2 fullAccessRight parameter in reports-column-center.jsp, or 3 fullAccess...

CVE-2005-2187

McAfee IntruShield Security Management System allows remote authenticated users to access the "Generate Reports" feature and modify alerts by setting the Access option to true, as demonstrated using the 1 fullAccess or 2 fullAccessRight parameter in reports-column-center.jsp, or 3 fullAccess...

McAfee IntruShield Security Management System - Multiple Vulnerabilities

McAfee IntruShield Security Management System - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/14167/info McAfee IntruShield Security Management System is susceptible to multiple vulnerabilities. The first two issues are cross-site scripting vulnerabilities in the...

McAfee IntruShield Security Management System - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/14167/info McAfee IntruShield Security Management System is susceptible to multiple vulnerabilities. The first two issues are cross-site scripting vulnerabilities in the 'intruvert/jsp/systemHealth/SystemEvent.jsp' script. These issues are due to a failur...

CVE-2002-1932

CVE-2002-1932 affects Microsoft Windows XP and Windows 2000. When configured to send administrative alerts and with the "+Do not overwrite events (clear log manually)" option enabled, the system fails to notify administrators when the event log reaches its maximum size, allowing local users and r...

PeteFinnigan.com - Oracle security advisory

Hi I have just created a security advisory for the issue I found that is fixed in Oracle latest security patch. The issue is with abuse of DIRECTORY objects and can be found here http://www.petefinnigan.com/directorytraversal.pdf - I have also updated my Oracle security alerts page to link to thi...

CVE-2004-2306

Sun Solaris 7 through 9, when Basic Security Module BSM is enabled and the SUNWscpu package has been removed as a result of security hardening, disables mail alerts from the auditwarn script, which might allow attackers to escape detection...

sudo -- privilege escalation with bash scripts

A Sudo Security Alerts reports: A flaw in exists in sudo's environment sanitizing prior to sudo version 1.6.8p2 that could allow a malicious user with permission to run a shell script that utilized the bash shell to run arbitrary commands...

Re: HP Web JetAdmin vulnerabilities.

Just a few more for HP Web JetAdmin 6.5 - I'm tired of waiting for HP and since the current version is way past 6.5, there is no point in hiding it any more : ---SNIP--- Phenoelit Advisory wir-haben-auch-mal-was-gefunden 0815 ++-+ Title Multiple vulnerabilities in HP Web JetAdmin Authors FX...

Applied Watch Command Center 1.0 - Authentication Bypass (1)

Applied Watch Command Center 1.0 - Authentication Bypass 1 // source: https://www.securityfocus.com/bid/9124/info A vulnerability has been identified in the system that may allow an attacker to bypass authentication to add attacker supplied IDS alerts and new user accounts in the console...

Applied Watch Command Center 1.0 - Authentication Bypass (1)

// source: https://www.securityfocus.com/bid/9124/info A vulnerability has been identified in the system that may allow an attacker to bypass authentication to add attacker supplied IDS alerts and new user accounts in the console. Successful exploitation of these issues may allow an attacker to...

CVE-2002-0302

The Notify daemon for Symantec Enterprise Firewall SEF 6.5.x drops large alerts when SNMP is used as the transport, which could prevent some alerts from being sent in the event of an attack...

CVE-2000-0502

Mcafee VirusScan 4.03 is affected by a local-access restriction flaw in the alert text file before it is sent to the Central Alert Server, allowing local users to modify alerts and impact the integrity of alert data. The root cause is improper access restriction of the alert file, enabling unauth...

CVE-2002-1932

Microsoft Windows XP and Windows 2000, when configured to send administrative alerts and the "Do not overwrite events clear log manually" option is set, does not notify the administrator when the log reaches its maximum size, which allows local users and remote attackers to avoid detection...

netgear.txt

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ =+ NetGear RO318 HTTP Filter Advisory =+ =+ Null Byte Security =+ =+ http://home.tampabay.rr.com/nbs/ =+ =+ don't call it a come back =+ =+ [email protected] =+...

Redhat Linux diskcheck.pl creates predictable temporary file and fails to check for existing symbolic link of same name

Overview Diskcheck.pl is a PERL script, part of Red Hat's powertools suite, that alerts a system administrator if any file system approaches capacity. In creating email alerts, diskcheck.pl creates insecure temporary files in a world-writable directory, which may permit an attacker to corrupt any...

Vulnerability in AIX diagrpt

This file contains security alerts published by the IBM Emergency Response Service. These alerts are published at the following URL on the world-wide web: http://www.ers.ibm.com/ In order to keep the size of this file reasonable, it contains only advisories for the current year. You can obtain a...

Fwd: Microsoft Word macro vulnerability advisory MS01-034

Hi, Within minutes of Microsoft posting the bulletin on their site, my mailbox was swamped with emails from people asking the same two questions. I am therefore forwarding the below email minus the sample document! to the BugTraq mailing list to reach a wide audience and answer the two questions ...