Physical access to a computer system can be used to bypass software-based access control mechanisms

Overview An intruder who gains physical access to a computer system can bypass software-based control mechanisms. Description If an intruder can gain physical access to a computer resource, he can bypass software-based access control mechanisms, install Trojans horses, install hardware to...

[blaqhatz] - Pastel Accounting application security issues

-----BEGIN PPP SIGNED MESSAGE----- Hash: SH1T ======================================================================== --blaqhatz-ph33r-blaqhatz-ph33r-blaqhatz-ph33r-blaqhatz-ph33r-blaqhatz-- ------------------------------------------------------------------------ blaqhatz!@!@!@! ADVISORY...

Oracle9i Application Server 9.0.2 - MOD_ORADAV Access Control

Oracle9i Application Server 9.0.2 - MODORADAV Access Control source: https://www.securityfocus.com/bid/14274/info The modoradav module for Oracle HTTP Server included in Oracle9i Application Server is prone to a vulnerability. This is related to access controls on the '/davpublic' and '/davportal...

CVE-2002-2313

Eudora email client 5.1.1, with "use Microsoft viewer" enabled, allows remote attackers to execute arbitrary programs via an HTML email message containing a META refresh tag that references an embedded .mhtml file with ActiveX controls that execute a second embedded program, which is processed by...

Working Resources BadBlue 1.7.x2.x - Unauthorized Proxy Relay

Working Resources BadBlue 1.7.x2.x - Unauthorized Proxy Relay source: https://www.securityfocus.com/bid/11030/info BadBlue is prone to a vulnerability that may let the application be abused as a proxy. This vulnerability presents itself due to the 'Pass Thru' function allowing the server to be us...

CVE-2002-0943

MetaCart2.sql stores the user database under the web document root without access controls, which allows remote attackers to obtain sensitive information such as passwords and credit card numbers via a direct request for metacart.mdb...

CVE-2002-0943

MetaCart2.sql stores the user database under the web document root without access controls, which allows remote attackers to obtain sensitive information such as passwords and credit card numbers via a direct request for metacart.mdb...

CVE-2002-0943

CVE-2002-0943 describes a vulnerability where MetaCart2.sql stores the user database (metacart.mdb) under the web document root without access controls, enabling remote attackers to obtain sensitive information (passwords, credit card numbers) via direct request. The root cause is lack of access ...

Security Bulletin MS02-044 : Unsafe Functions in Office Web Components (Q328130)

---------------------------------------------------------------------- Title: Unsafe Functions in Office Web Components Q328130 Date: 21 August 2002 Software: Office Web Components, Office, BackOffice Server, BizTalk Server, Commerce Server, ISA Server, Money, Microsoft Project, Microsoft Project...

CVE-2002-0045

The CVE affects OpenLDAP slapd prior to 2.0.20 (OpenLDAP 2.0.0–2.0.19; anonymous before 2.0.8) where a faulty ACL check allows a local/anonymous user to perform a replace operation with an empty value list. This bypasses access controls and can delete non-mandatory attributes that ACLs would norm...

CVE-2001-1227

CVE-2001-1227 affects Zope up to version prior to 2.2.4. The vulnerability arises when partially trusted users can bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags. Publicly available details in connected advisories confirm the root ...

CVE-2002-0022

CVE-2002-0022 describes a buffer overflow in the mshtml.dll HTML rendering engine (Internet Explorer 5.5/6.0) triggered by crafted HTML with embedded ActiveX controls, allowing remote code execution. The exploitation targets the SRC/EMBED handling and concatenation of two Unicode strings, enablin...

CVE-2002-0022

Buffer overflow in the implementation of an HTML directive in mshtml.dll in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code via a web page that specifies embedded ActiveX controls in a way that causes 2 Unicode strings to be concatenated...

CVE-2002-0045

slapd in OpenLDAP 2.0 through 2.0.19 allows local users, and anonymous users before 2.0.8, to conduct a "replace" action on access controls without any values, which causes OpenLDAP to delete non-mandatory attributes that would otherwise be protected by ACLs...

Wireless Access Point Detection

Nessus has determined that the remote host is a wireless access point AP. Ensure that proper physical and logical controls are in place for its use. A misconfigured access point may allow an attacker to gain access to an internal network without being physically present on the premises. If the...

CVE-2001-1278

Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags...

Microsoft scriptlet.typlib ActiveX object unsafe for scripting from Internet Explorer

Overview The ActiveX control "scriptlet.typlib" is incorrectly marked "safe for scripting" in Internet Explorer IE versions 4.0 and 5.0, when it is actually unsafe for scripting. Description There exists a vulnerability in the default installation of an ActiveX control named "scriptlet.typlib,"...

CVE-1999-1481

Squid 2.2.STABLE5 and below, when using external authentication, allows attackers to bypass access controls via a newline in the user/password pair...

CVE-1999-1481

Squid 2.2.STABLE5 and earlier versions are affected when using external authentication. A newline in the user/password pair can bypass access controls, enabling unauthorized access. The available documents confirm the affected software and the bypass condition but do not provide remediation detai...

CVE-2002-0022

Buffer overflow in the implementation of an HTML directive in mshtml.dll in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code via a web page that specifies embedded ActiveX controls in a way that causes 2 Unicode strings to be concatenated...