2300 matches found
CVE-2003-0018
Linux kernel 2.4.10 through 2.4.21-pre4 does not properly handle the ODIRECT feature, which allows local attackers with write privileges to read portions of previously deleted files, or cause file system corruption...
Sygate Security Bulletin ID SS20030129-0002
Sygate Security Bulletin Sygate was made aware of an exposure in Sygate Personal Firewall 5.0 and Sygate Security Agent 3.0 on 1/23/2003 by David Fernandez Madrid [email protected]. Sygate Security Bulletin ID ---------------------------- SS20030129-0002 Description ------------ The reporter ...
Trend Micro Virus Control System 1.8 - Information Disclosure
Trend Micro Virus Control System 1.8 - Information Disclosure source: https://www.securityfocus.com/bid/6618/info An information disclosure vulnerability has been reported for TVCS. Reportedly, it is possible for an attacker to access the log files generated by TVCS. The log files contain very...
CVE-2002-2027
Database of Our Owlish Wisdom DOOW 0.1 through 0.2.1 does not properly verify user permissions, which allows remote attackers to perform unauthorized activities...
CVE-2002-2417
acFTP 1.4 does not properly handle when an invalid password is provided by the user during authentication, which allows remote attackers to hide or misrepresent certain activity from log files and possibly gain privileges...
DSA-214 kdenetwork - buffer overflows
Bulletin has no description...
Zeroo HTTP Server 1.5 - Directory Traversal (2)
source: https://www.securityfocus.com/bid/6308/info It has been reported that Zeroo fails to properly sanitize web requests. By sending a malicious web request to the vulnerable server, using directory traversal sequences, it is possible for a remote attacker to access sensitive resources located...
LPRNG html2ps 1.0 - Remote Command Execution
LPRNG html2ps 1.0 - Remote Command Execution source: https://www.securityfocus.com/bid/6079/info A vulnerability has been discovered in the html2ps filter which is included in the lprng print system. It has been reported that it is possible for a remote attacker to execute arbitrary commands. The...
CVE-2002-1148
The default servlet org.apache.catalina.servlets.DefaultServlet in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet...
Shambala FTP Server does not adequately validate user input thereby allowing directory traversal
Overview Shambala FTP server has a directory traversal vulnerability in its handling of the CWD command. Description Shambala FTP server contains a directory traversal vulnerability in its handling of the CWD command. Attackers may exploit this vulnerability to read directories and files outside ...
Cherokee Web Server does not adequately validate user input thereby allowing directory traversal
Overview Cherokee contains a directory traversal vulnerability caused by failure to filter '../' character sequences. Description Cherokee is a compact, open-source web server. Cherokee does not filter '../' sequences from HTTP requests. As a result, it is possible for a remote attacker to reques...
PHP-Nuke does not adequately authenticate users thereby allowing attackers to change user information
Overview PHP-Nuke's saveuser function does not adequately authenticate users. Attackers may exploit this vulnerability to change user data and gain access to accounts. Description PHP-Nuke is a set of PHP scripts designed to simplify web site creation and maintenance. PHP-Nuke's saveuser function...
PHPNuke 'admin.php' script does not adequately authenticate users, thereby allowing malicious user to copy, move, or upload files
Overview PHPNuke's "admin.php" script does not properly authenticate users of its filemanager capabilities. Attackers may exploit this vulnerability to copy, move, or upload files. Description PHPNuke is a set of PHP scripts designed to simplify website creation and maintenance. The "admin.php"...
Jakarta Tomcat serves JSP source code when supplied malformed HTTP request
Overview Tomcat does not adequately validate HTTP requests and may reveal JSP source code if supplied a malformed HTTP request. Description JavaServer Pages JSP is a technology that allows for the creation of dynamic web content. The Apache Jakarta Project implementation of JSP is known as Tomcat...
Directory-traversal vulnerability in Mike Spice's My Classifieds CGI script
Overview Some versions of My Classifieds contain a directory-traversal vulnerability that allows attackers to overwrite files. Description My Classifieds is a Perl CGI script, maintained by Mike Spice, that produces dynamic ad listings on a web server and allows users to edit their ads remotely...
iPlanet Web Server 4.1 - Search Component File Disclosure
iPlanet Web Server 4.1 - Search Component File Disclosure source: https://www.securityfocus.com/bid/5191/info The iPlanet Web Server search engine is prone to a file disclosure vulnerability. It is possible for remote attackers to make requests to the search engine which will cause arbitrary...
CVE-2002-0322
Yahoo! Messenger 4.0 sends user passwords in cleartext, which could allow remote attackers to gain privileges of other users via sniffing...
wu-imap buffer overflow condition
10.05.2002 SECURITY BUG REPORT Affected version: WU-IMAP 2000.283 default install WU-IMAP 2000.284 default install WU-IMAP 2000.287 default install WU-IMAP 2001.315 compiled with RFC 1730 support Overview: Wu-imapd is an easy to set-up IMAP daemon created and distributed by Washington University...
FileSeek CGI Script - Remote Command Execution
source: https://www.securityfocus.com/bid/6783/info FileSeek is an example cgi-script from "The CGI/Perl Cookbook from John Wiley & Sons". The script is written and maintained by Craig Patchett. It is mainly used to find and download files on a web server. It has been reported that FileSeek.cgi a...