JBoss 3.x4.0.2 - HTTP Request Remote Information Disclosure

JBoss 3.x4.0.2 - HTTP Request Remote Information Disclosure source: https://www.securityfocus.com/bid/13985/info JBoss is prone to a remote information-disclosure vulnerability. The issue occurs in the 'org.jboss.web.WebServer' class and is due to a lack of sufficient sanitization of user-supplie...

CVE-2005-1705

gdb before 6.3 searches the current working directory to load the .gdbinit configuration file, which allows local users to execute arbitrary commands as the user running gdb...

CVE-2005-0194

Squid 2.5, when processing the configuration file, parses empty Access Control Lists ACLs, including proxyauth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warning...

CVE-2002-1595

Cisco SN 5420 Storage Router 1.15 and earlier allows attackers to read configuration files without authorization...

DEBIAN-CVE-2004-1076

Multiple buffer overflows in the RtConfigLoad function in rt-config.c for Atari800 before 1.3.4 allow local users to execute arbitrary code via large values in the configuration file...

SCSA028.txt

================================================= Security Corporation Security Advisory SCSA-028 Nuked-Klan Multiple Vulnerabilities ================================================= PROGRAM: Nuked-KlaN HOMEPAGE: http://www.nuked-klan.org VULNERABLE VERSIONS: b1.4, b1.5, SP2 RISK: MEDIUM/HIGH...

Kietu 2/3 - 'index.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/9499/info A flaw exists in the Kietu 'index.php' script that may permit remote attackers to include malicious remote files. Remote users may influence the include path for the 'config.php' configuration file, which may result in execution of arbitrary...

Получение доступа к панели администрирования в Willwin's Web Voting v.1.0

Получение доступа к панели администрирования в Willwin's Web Voting v.1.0 Название скрипта: Willwin's Web Voting Уязвимая версия: v.1.0 Сайт производителя: http://willwin.plex.ru Автор: [email protected] Дата: 13th December 2003 Пароль для получения доступа к панели управления голосованием в...

Planet WGSD-1020

Добрый день! Не знаю, может кто уже присылал... В свитчах Planet WGSD-1020 есть закладка. Пользователь superuser с паролем planet. В пользовательском интерфейсе он нигде не упоминается, но его видно в файле конфигурации кстати, несмотря на то, что файл конфигурации бинарный, имена и пароли там...

SynAtari800.pl

!perl PoC By OpTiKoOl, for Atari 800 Emulator, Version 1.3.0 based on http://www.securityfocus.com/archive/1/331518/2003-08-01/2003-08-07/0 - This PoC exploits a bof in parsing a very long config file 250 bytes As in the advisory there's other bofs. but i just researched this one to make a...

PHP-Include-Hack-Possibility in phpforum 2 RC-1

================================================ ------------------------------------------------ ------------www.bright-shadows.net------------ ------------------------------------------------ --------------theblacksheep&erik-------------- ------------------------------------------------...

DEBIAN-CVE-2002-1479

Cacti before 0.6.8 stores a MySQL username and password in plaintext in config.php, which has world-readable permissions, which allows local users to modify databases as the Cacti user and possibly gain privileges...

PT-2003-1215 · Cacti · Cacti

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 0.6.8 Description: The issue allows local users to access a MySQL username and password stored in plaintext in the config.php file, which has world-readable permissions. This could enable users to modify databases as t...

CVE-2002-1886

TightAuction 3.0 stores config.inc under the web document root with insufficient access control, which allows remote attackers to obtain the database username and password...

PHPGB 1.11.2 - PHP Code Injection

PHPGB 1.11.2 - PHP Code Injection source: https://www.securityfocus.com/bid/5679/info phpGB is subject to a PHP code injection vulnerability. After bypassing authentication it is possible to inject code into the guestbook configuration file config.php by supplying malicious parameters for the...

Символьные линки в cdrdao (symbolic links)

При записи конфигурационного файла в suid root приложении не проверяются символьные линки...

Advisory: Half-life server buffer overflows and formatting vulnerabilities

Author: Stan Bubrouski [email protected] Date: March 9, 2001 Package: Half-Life dedicated server for Windows and Linux and the Windows client as well. Versions affected: All are believed vulnerable including latest builds for Windows Build 1572 and Linux Build 1573 Severity: Remote users with acce...

Fwd: APlio PRO web shell

This URL allows for the execution of commands via /bin/sh...

Security Advisory: FreeBSD-SA-00:24.libedit

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:24 Security Advisory FreeBSD, Inc. Topic: libedit reads config file from current directory Category: core Module: libedit Announced: 2000-07-05 Affects: All versions of...

allmanage.pl-admin.txt

Allmanage.pl Admin Password vulnerability 15 may 2000 Another allmanage.pl vulnerability see also allmanage.pl.txt Everybody can easily get the admin password from the allmanage directory. You are able to set/change lots of variables, add accounts, mail users, backup, restore, edit header/footer...