CVE-1999-1549

Lynx 2.x is affected by CVE-1999-1549 due to not distinguishing internal vs external HTML. This can permit a local attacker to read a hidden, secure form value from a temporary file and craft a LYNXOPTIONS URL that causes Lynx to modify the user’s configuration file and execute commands. The PT S...

CVE-1999-1125: Undefined Security Weakness

Oracle Webserver 2.1 and earlier runs setuid root, but the configuration file is owned by the oracle account, which allows any local or remote attacker who obtains access to the oracle account to gain privileges or modify arbitrary files by modifying the configuration file...

CVE-1999-1220: Undefined Security Weakness

Majordomo 1.94.3 and earlier allows remote attackers to execute arbitrary commands when the advertise or noadvertise directive is used in a configuration file, via shell metacharacters in the Reply-To header...

CVE-1999-1296: Undefined Security Weakness

Buffer overflow in Kerberos IV compatibility libraries as used in Kerberos V allows local users to gain root privileges via a long line in a kerberos configuration file, which can be specified via the KRBCONF environmental variable...

Wvdial insecure conf?

I've compiled and installed wvdial a dialer for dial up connection and the program wvdialconf generate a file called wvdial.conf. In this file : AT strings, username, pass and another setting like /etc/ppp/options. But now the problem, with ls -l -rw-r--r-- 1 root root 335 Aug 1 18:21 wvdial.conf...

CVE-2001-1258

Horde Internet Messaging Program IMP before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password by placing the prefs.lang file containing PHP code on the server...

Exploit for xinetd-2.1.8.9pre11-1

Hi bugtraq. I read the zen-parse's advisory about the 'potential' overflow, as he said, in xinetd-2.1.8.9pre11-1 and I tried to work around it. First of all we have to remember that the bof occurs only if, in the configuration file of the daemon, there is an entry like this: logonsuccess = HOST P...

LPRng 3.6.x - Failure To Drop Supplementary Groups

/ source: https://www.securityfocus.com/bid/2865/info The LPRng software is an enhanced, extended, and portable implementation of the Berkeley LPR print spooler functionality. When the LPRng daemon is initialized, it fails to drop its supplementary groups. As a result, the daemon and any child...

Due to insecure creation of configuration files via KApplication-class, local users can create arbitrary files when running setuid root KDE programs

Overview KApplication-class, a class used to create KDE applications, creates configuration files without checking for proper ownership or prior existence. Description KApplication-class, a class used to create KDE applications, creates configuration files. These files are created in a local...

CVE-2001-0358

Buffer overflows in Sierra Half-Life build 1573 and earlier allow remote attackers to execute arbitrary code via 1 a long map command, 2 a long exec command, or 3 long input in a configuration file...

CVE-2001-0358: Undefined Security Weakness

Buffer overflows in Sierra Half-Life build 1573 and earlier allow remote attackers to execute arbitrary code via 1 a long map command, 2 a long exec command, or 3 long input in a configuration file...

CVE-2001-0289

Joe text editor 2.8 searches the current working directory CWD for the .joerc configuration file, which could allow local users to gain privileges of other users by placing a Trojan Horse .joerc file into a directory, then waiting for users to execute joe from that directory...

iScouter PHP Web Portal System, MySQL Password in clear text

Hi all, I have found that i can easily retrieve MySQL password of the last iScouter PHP Web Portal System. Exploit : www.your-iScouter-web-portal.com/config.inc You can find those lines in clear text: $CFGDBSERVERTYPE = "mySQL"; $CFGDBHOST = "www.your-iScouter-web-portal.com"; $CFGDBUSERNAME =...

ProFTPD STAT Command Remote DoS

The remote FTP server is affected by a denial of service vulnerability that is triggered when it receives a specially crafted STAT command. A remote attacker can exploit this to cause the consumption of all available memory. C Tenable Network Security, Inc. Script audit and contributions from...

CVE-2000-0348

A vulnerability in the Sendmail configuration file sendmail.cf as installed in SCO UnixWare 7.1.0 and earlier allows an attacker to gain root privileges...

[SECURITY] [DSA-041-1] joe local attack via joerc

Package : joe Problem type : local exploit Debian-specific: no Christer Öberg of Wkit Security AB found a problem in joe Joes Own Editor. joe will look for a configuration file in three locations: the current directory, the users homedirectory $HOME and in /etc/joe. Since the configuration file c...

Joe's Own Editor File Handling Error

WKIT SECURITY AB www.wkit.com TITLE: Joe's Own Editor File Handling Error ADVISORY ID: WSIR-01/02-02 REFERENCE: http://www.wkit.com/advisories CVE: GENERIC-MAP-NOMATCH CREDIT: Christer Цberg, Wkit Security AB CONTACT: [email protected] CLASS: File Handling Error OBJECT: joe1 exec VENDOR: Josef ...

CVE-2000-0565

SmartFTP Daemon 0.2 allows a local user to access arbitrary files by uploading and specifying an alternate user configuration file via a .. dot dot attack...

CVE-2000-1148

The installation of VolanoChatPro chat server sets world-readable permissions for its configuration file and stores the server administrator passwords in plaintext, which allows local users to gain privileges on the server...

CVE-2000-0565: Undefined Security Weakness

SmartFTP Daemon 0.2 allows a local user to access arbitrary files by uploading and specifying an alternate user configuration file via a .. dot dot attack...