Addendum Re: Internet Explorer Pop-Up OBJECT Tag Bug

Pop-Up Bug Notes First, adding an addendum about the bug which Dave Ahmad discovered: This can be used with the window object as well, when setting the document body's innerHTML property and using method "window.open". This information has been forwarded to the vendor. Secondly, there are a numbe...

CVE-2001-0867

Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not properly filter does not properly filter packet fragments even when the "fragment" keyword is used in an ACL, which allows remote attackers to bypass the intended access controls...

MacOS 9.2, Internet Explorer, Local Vulnerability

Vulnerability: Access controls can be evaded on MacOS9.2 using Internet Explorer, allowing users to execute programs they otherwise would not be able to run. Details: While in the college media lab I attempted to run MacSSH to get onto my home desktop, I received an error message telling me I did...

CVE-1999-1206

The CVE-1999-1206 issue concerns SystemSoft SystemWizard on HP Pavilion PCs running Windows 98, where two ActiveX controls (LaunchCtrl and RegistryAccess) marked as safe-for-scripting can be used by a malicious web page to execute arbitrary commands. The vulnerabilities are tied to the Registry O...

LPRng/rhs-printfilters - remote execution of commands

posted to vendor security ppl, no reply, no patch, so posting here. --begin forwarded message-- RedHat 7.0 possibly others If the lpd is listening on 0.0.0.0 and no access controls are in place, it is possible to execute commands as the lp user, assuming tetex-dvips is installed. From man dvips...

CVE-2001-0090

The Print Templates feature in Internet Explorer 5.5 executes arbitrary custom print templates without prompting the user, which could allow an attacker to execute arbitrary ActiveX controls, aka the "Browser Print Template" vulnerability...

CVE-2000-1061

Microsoft Virtual Machine VM in Internet Explorer 4.x and 5.x allows an unsigned applet to create and use ActiveX controls, which allows a remote attacker to bypass Internet Explorer's security settings and execute arbitrary commands via a malicious web page or email, aka the "Microsoft VM Active...

CVE-2000-1061

Microsoft Virtual Machine VM in Internet Explorer 4.x and 5.x allows an unsigned applet to create and use ActiveX controls, which allows a remote attacker to bypass Internet Explorer's security settings and execute arbitrary commands via a malicious web page or email, aka the "Microsoft VM Active...

Wang/Kodak Image Admin ActiveX Control

Overview Description The Image Admin control is incorrectly marked safe for scripting. This control is sometimes identified as from "Kodak" and other times as from "Wang". The Image Admin control is one of several controls used to provide image editting services through a web site. Because the...

Microsoft Windows Media Player 7 - Embedded OCX Control

source: https://www.securityfocus.com/bid/1714/info Due to a flaw in the method Microsoft Windows Media Player 7 handles OCX controls ActiveX containers in embedded in RTF email messages, it is possible to crash RTF-enabled email clients such as Microsoft Outlook and Outlook Express. While this...

CVE-2000-1221

The line printer daemon lpd in the lpr package in multiple Linux operating systems authenticates by comparing the reverse-resolved hostname of the local machine to the hostname of the print server as returned by gethostname, which allows remote attackers to bypass intended access controls by...

CVE-2000-1221

The line printer daemon lpd in the lpr package in multiple Linux operating systems authenticates by comparing the reverse-resolved hostname of the local machine to the hostname of the print server as returned by gethostname, which allows remote attackers to bypass intended access controls by...

CVE-1999-1206

SystemSoft SystemWizard package in HP Pavilion PC with Windows 98, and possibly other platforms and operating systems, installs two ActiveX controls that are marked as safe for scripting, which allows remote attackers to execute arbitrary commands via a malicious web page that references 1 the...

unixware.pkg.txt

Greetings, OVERVIEW Any user may read any file on the system. BACKGROUND Only UnixWare 7.1 has been tested. DETAILS As previously stated, UnixWare binaries gain additional privileges via standard suid/sgid AND /etc/security/tcb/privs. The majority of the UnixWare "pkg" command, such as pkginfo,...

SCO Unixware 7.1 - 'pkg' Local Privilege Escalation

source: https://www.securityfocus.com/bid/850/info Certain versions of SCO's Unixware only version 7.1 was tested ship with a series of package install/removal utilities which due to design issues under the SCO UnixWare operating system may read any file on the system regardless of their permissi...

Web Server robots.txt Information Disclosure

The remote host contains a file named 'robots.txt' that is intended to prevent web 'robots' from visiting certain directories in a website for maintenance or indexing purposes. A malicious user may also be able to use the contents of this file to learn of sensitive documents or directories on the...

ActiveX_bof.txt

ActiveX Buffer Overruns Advisory Disclaimer: I'm not responsible for anything, unless it's good. This advisory outlines several buffer overruns in several controls, and the vulnerability of ActiveX controls to buffer overrun attacks in general. It appears that the ActiveX/OLE/COM technology in...

CVE-1999-1575

The Kodak/Wang 1 Image Edit imgedit.ocx, 2 Image Annotation imgedit.ocx, 3 Image Scan imgscan.ocx, 4 Thumbnail Image imgthumb.ocx, 5 Image Admin imgadmin.ocx, 6 HHOpen hhopen.ocx, 7 Registration Wizard regwizc.dll, and 8 IE Active Setup setupctl.dll ActiveX controls for Internet Explorer IE 4.01...

msie.5.0.hta.txt

Date: Tue, 8 Jun 1999 08:41:54 -0400 From: "Noller, Jesse" To: [email protected] Subject: IE 5.0 and HTAs Security hole Good day: I recently set up an NT box, with just the basic setup, no other modifications, other than SP5, and an installation of Internet Explorer 5.0. I was...

squid -- possible abuse of cachemgr.cgi

The squid patches page notes: This patch adds access controls to the cachemgr.cgi script, preventing it from being abused to reach other servers than allowed in a local configuration file...