Microsoft Windows XP/2000/NT 4.0 - Window Message Subsystem Design Error (4)

// source: https://www.securityfocus.com/bid/5408/info A serious design error in the Win32 API has been reported. The issue is related to the inter-window message passing system. This vulnerability is wide-ranging and likely affects almost every Win32 window-based application. Attackers with loca...

Microsoft Windows XP2000NT 4.0 - Window Message Subsystem Design Error (5)

Microsoft Windows XP2000NT 4.0 - Window Message Subsystem Design Error 5 // source: https://www.securityfocus.com/bid/5408/info A serious design error in the Win32 API has been reported. The issue is related to the inter-window message passing system. This vulnerability is wide-ranging and likely...

Re: IE allows universal Cross Site Scripting (TL#002)

Hello, This can also be exploited in IE5 and IE5.5 as well as IE6 by using a different resource file. Thor's demonstration is confined to IE6 because the resource he found to be exploitable first appeared in IE6 privacy policy. Proof of concept and HTML version:...

Microsoft IIS 4.05.0 - HTTP Error Page Cross-Site Scripting

Microsoft IIS 4.05.0 - HTTP Error Page Cross-Site Scripting source: https://www.securityfocus.com/bid/4486/info A Cross Site Scripting issue exists in some versions of IIS. The HTTP Error Page created by IIS may, under some circumstances, contain HTML content which includes unsanitized user...

Buffer overflow in Python code

Hi, I've found buffer overflow in Python 2.1.1 source code. Maybe there're many others The buffer overflow is in the file traceback.c in the directory Python of the Python source code. Simply there's a sprintf done in this way: sprintflinebuf,FMT,filename,lineno,name What cause the overflow is th...

Дырки в ColdFusion (file access)

Уязвимости в демонстрационных приложениях...

pkc001.txt

/ pkc001.txt / -= SECURITY ADVISORY 001 =- | \ www.pkcrew.org / \ \ | / \ | | | | | / | | | | | / | | | | / | | / / | | | / | Application : Oops proxy server 1.4.22 1.4.6 and maybe prior Type: heap buffer overflow --- The problem --- Function listparser in ftputils.c : line is the line sent by th...

Solaris 2.6 7 8 - Lock Users Out of mailx

Solaris 2.6 7 8 - Lock Users Out of mailx !/bin/sh Solaris mailx1 username.lock proof of theory makes mailx not work for all users except those that can erase the lockfile even so mailx will hang for a long time. Tested on Solaris 2.6, 7, 8 by Optyx http://www.uberhax0r.net echo "mailx-lock by...

ksh.temp-hole.txt

Author: Paul Szabo Recently I reported that, similarly to the recently discussed tcsh vulnerability, the Bourne shell /bin/sh creates temporary files in an insecure way: http://www.securityfocus.com/templates/archive.pike?list=1&msg=200011230225.N [email protected] At the time I als...

GnomeHack - Local Buffer Overflow

GnomeHack - Local Buffer Overflow / gnomehack local buffer overflow. gid=games60 Author: Cody Tubbs loophole of hhp. www.hhp-programming.net / [email protected] 12/17/2000 Tested on Debian 2.2, kernel 2.2.17 - x86. sgid "games"60 by default. bash-2.03$ id uid=1000loophole gid=501noc bash-2.03$ ....

Remote DoS Attack in Pragma TelnetServer 2000 (Remote Execute Daemon) Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Remote DoS Attack in Pragma TelnetServer 2000 Remote Execute Daemon Vulnerability USSR Advisory Code: USSR-2000051 Release Date: August 24, 2000 Systems Affected: Pragma TelnetServer 2000 for Windows NT/2000 THE PROBLEM: The Ussr Labs team has recentl...

DST2K0008.txt

================================================================================ Delphis Consulting Plc ================================================================================ Security Team Advisories 30/05/2000 [email protected] http://www.delphisplc.com/thinking/whitepapers/...

Black Watch Labs Vulnerability Alert

Dear Security Professional, The following vulnerability: "Environment and Setup Variables Can Be Viewed Through DBMan db.cgi Script" is in the text of the message below and has just been posted to the Black Watch Labs Web site at http://www.perfectotech.com/blackwatchlabs/ Thank you, Black Watch...

Microsoft Windows 95/98/NT 4.0 - 'autorun.inf' Code Execution

source: https://www.securityfocus.com/bid/993/info The Windows Autorun feature was designed to allow an executable and an icon to be specified for any piece of removable media. Upon insertion, the icon would be displayed for the drive, and the executable would automatically run. This feature also...

SunOS 4.1.1 - '/usr/release/bin/makeinstall' Local Privilege Escalation

source: https://www.securityfocus.com/bid/21/info This applies to sites that have installed Sun Source tapes only. The Sun distribution of sources sunsrc has an installation procedure which creates the directory /usr/release/bin and installs two setuid root files in it: makeinstall and winstall...

ie5.javascript.redirect.txt

IE 5.0 allows reading local and from any domain files and window spoofing using HTTP redirection to "javascript:" Disclaimer: The opinions expressed in this advisory and program are my own and not of any company. The usual standard disclaimer applies, especially the fact that Georgi Guninski is n...

SCO Open Server 5.0.5 - cancel Buffer Overflow

// source: https://www.securityfocus.com/bid/702/info There is a buffer overflow vulnerability in /opt/K/SCO/Unix/5.0.5Eb/.softmgmt/var/usr/bin/cancel. It is important to know that the overflows are not in "/usr/bin/cancel" or "/usr/lpd/remote/cancel". The consequence of this vulnerability being...

mail_bof.txt

Subject: Many kind of POP3/SMTP server softwares for Windows have buffer overflow bug To: [email protected] Many kind of POP3/SMTP server softwares for Windows have buffer overflow bug by The Shadow Penguin Securuty http://shadowpenguin.backsection.net 1. Introduction I confirmed many kin...

ms-iis4-avoid-log.txt

Date: Fri, 22 Jan 1999 10:12:52 -0000 From: mnemonix To: [email protected] Subject: IIS 4 Request Logging Security Advisory There is are a combination of problems with IIS 4 that allows an successful HTTP request to go unlogged. Microsoft's Internet Information Server 4 allows the use of any...

sendmail.8.9.1-2.txt

Date: Thu, 24 Sep 1998 10:14:06 -0400 From: Simon Smith This is not the same attack as the last one regarding the "". This one does not make your system hang but rather alters permissions is seems. If this was already posted please disregard it...