osCommerce update.php readme_file Parameter Arbitrary File Disclosure

The osCommerce installation on the remote host has a supplementary script, 'extras/update.php', that fails to validate user-supplied input to the 'readmefile' parameter before using that to display a file. An attacker can exploit this flaw to read arbitrary files on the remote host, such as the...

PT-2005-3138 · Capturix · Capturix Scanshare

Name of the Vulnerable Software and Affected Versions: Capturix ScanShare version 1.06 build 50 Description: The issue concerns the storage of sensitive information, such as passwords, in cleartext within the capturixss cfg.ini file. This file is readable by local users, potentially exposing the...

DSA-735-2 sudo - pathname validation race

Bulletin has no description...

Debian DSA-735-1 : sudo - pathname validation race

A local user who has been granted permission to run commands via sudo could run arbitrary commands as a privileged user due to a flaw in sudo's pathname validation. This bug only affects configurations which have restricted user configurations prior to an ALL directive in the configuration file. ...

DSA-735-1 sudo - pathname validation race

Bulletin has no description...

CVE-2002-1810

CVE-2002-1810 - Affected product: D-Link DWL-900AP+ Access Point, versions 2.1 through 2.2. Vulnerability: Remote attackers can access the TFTP server without authentication and read the config.img file. Impact: config.img contains sensitive information such as the administrative password, WEP en...

JBoss 3.x/4.0.2 - HTTP Request Remote Information Disclosure

source: https://www.securityfocus.com/bid/13985/info JBoss is prone to a remote information-disclosure vulnerability. The issue occurs in the 'org.jboss.web.WebServer' class and is due to a lack of sufficient sanitization of user-supplied request data. Information that attackers can harvest throu...

CVE-2005-1828

D-Link DSL-504T stores usernames and passwords in cleartext in the router configuration file, which allows remote attackers to obtain sensitive information...

CVE-2005-1705

gdb before 6.3 searches the current working directory to load the .gdbinit configuration file, which allows local users to execute arbitrary commands as the user running gdb...

CVE-2005-1705

gdb before 6.3 searches the current working directory to load the .gdbinit configuration file, which allows local users to execute arbitrary commands as the user running gdb...

CVE-2005-1705

gdb before 6.3 searches the current working directory to load the .gdbinit configuration file, which allows local users to execute arbitrary commands as the user running gdb...

CVE-2005-1705

gdb before 6.3 searches the current working directory to load the .gdbinit configuration file, which allows local users to execute arbitrary commands as the user running gdb...

cdrdao privilege escalation

root privileges are not dropped before writing configuration file...

CVE-2003-1140

CVE-2003-1140 describes a buffer overflow in Musicqueue 1.2.0 that allows local users to execute arbitrary code via a long language variable in the configuration file. The provided documents specify the affected product/version and the activation vector as local/ configuration-based overflow, but...

CVE-2003-1140

Buffer overflow in Musicqueue 1.2.0 allows local users to execute arbitrary code via a long language variable in the configuration file...

CVE-2005-0440

ELOG before 2.5.7 allows remote attackers to bypass authentication and download a configuration file that contains a sensitive write password via a modified URL...

CVE-2005-0194

Squid 2.5, when processing the configuration file, parses empty Access Control Lists ACLs, including proxyauth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warning...

CVE-2000-1220

The line printer daemon lpd in the lpr package in multiple Linux operating systems allows local users to gain root privileges by causing sendmail to execute with arbitrary command line arguments, as demonstrated using the -C option to specify a configuration file...

BakBone NetVault 6.x/7.x - Local Stack Buffer Overflow

/ for more informations class101.org/netv-locsbof.pdf / include include ifdef WIN32 include "winsock2.h" pragma commentlib, "ws232" else include include include include include include include include include include endif char scode1= /add u:class101 p:class101 Administrators users/...

CVE-2002-1635

The Apache configuration file httpd.conf in Oracle 9i Application Server 9iAS uses a Location alias for /perl directory instead of a ScriptAlias, which allows remote attackers to read the source code of arbitrary CGI files via a URL containing the /perl directory instead of /cgi-bin...