MS05-011: Vulnerability in SMB may allow remote code execution (885250)

The remote version of Windows contains a flaw in the Server Message Block SMB implementation that could allow an attacker to execute arbitrary code on the remote host. To exploit this flaw, an attacker would need to send malformed responses to the remote SMB client, and would be able to either...

PostgreSQL < 7.2.7 / 7.3.9 / 7.4.7 / 8.0.1 Multiple Vulnerabilities

The remote PostgreSQL server, according to its version number, is vulnerable to multiple flaws that could allow an attacker who has the rights to query the remote database to obtain a shell on this host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Berlios gpsd gpsd_report() Function Format String

The remote host is running GPSD, a daemon which monitors a GPS device and publishes its data over the network. The remote version of this software is vulnerable to format string attack due to the way it uses the syslog call. An attacker may exploit this flaw to execute arbitrary code on the remot...

VERITAS Backup Exec Agent Browser Registration Request Remote Overflow

The remote host is running a version of VERITAS Backup Exec Agent Browser which is vulnerable to a remote buffer overflow. An attacker may exploit this flaw to execute arbitrary code on the remote host or to disable this service remotely. To exploit this flaw, an attacker would need to send a...

MS05-001: HTML Help Code Execution (890175)

The remote host contains a version of the HTML Help ActiveX control that could allow an attacker to execute arbitrary code on the remote host by constructing a malicious web page and entice a victim to visit this web page. C Tenable Network Security, Inc. include"compat.inc"; if description...

Debian DSA-610-1 : cscope - insecure temporary file

A vulnerability has been discovered in cscope, a program to interactively examine C source code, which may allow local users to overwrite files via a symlink attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

MS04-045: WINS Code Execution (870763)

The remote Windows Internet Naming Service WINS server is prone to a heap overflow attack that could allow an attacker to execute arbitrary code on this host. To exploit this flaw, an attacker would need to send a specially crafted packet to port 42 of the remote host. C Tenable Network Security,...

OpenText FirstClass HTTP Daemon /Search Large Request Remote DoS

The remote host is running OpenText FirstClass, a web-based unified messaging system. The remote version of this software is vulnerable to an unspecified denial of service attack that could allow an attacker to disable this service remotely. C Tenable Network Security, Inc. include"compat.inc";...

WS_FTP Server Multiple Command Remote Overflow DoS

According to its version number, the remote WSFTP server is vulnerable to multiple buffer overflows which may be used by an attacker to execute arbitrary code on the remote system. C Tenable Network Security include"compat.inc"; ifdescription scriptid15857; scriptbugtraqid11772;...

Open DC Hub RedirectAll Value Remote Overflow

The remote host is running Open DC Hub, a peer-to-peer file sharing application, which is vulnerable to a remote buffer overflow. A successful exploit would allow a remote attacker to execute code on the remote host. It must be noted that the remote attacker needs administrative access to this...

Digital Mappings Systems POP3 Server (pop3svr.exe) Multiple Field Remote Overflow

The remote host is running Digital Mappings Systems POP3 server that has a remote buffer overrun vulnerability. An attacker, exploiting this flaw, may be crash the service. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid15783; scriptversion "1.12";...

Fastream NETFile FTP/Web Server HEAD Request Saturation DoS

The remote host appears to be running FastStream NETFile Server version 7.1 or older. These versions do not close the connection when an HTTP HEAD request is received with the keep-alive option set. An attacker may exploit this flaw by sending multiple HEAD requests to the remote host, thus...

Bugzilla Multiple Remote Command Execution

The remote Bugzilla bug tracking system, according to its version number, is vulnerable to arbitrary command execution flaws due to a lack of sanitization of user-supplied data in processbug.cgi. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Ipswitch WhatsUp Gold _maincfgret.cgi Remote Overflow

The 'maincfgret' CGI is installed on the remote web server. Some versions are vulnerable to a buffer overflow. Note that Nessus only checked for the presence of this CGI, and did not attempt to determine whether or not it is vulnerable. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

w-Agora Multiple Script Traversal Arbitrary File Access

The remote host is running w-agora, a web-based forum application written in PHP. The remote version of this software is prone to directory traversal attacks. A remote attacker could send specially crafted URL to read arbitrary files from the remote system with the privileges of the web server...

Debian DSA-462-1 : xitalk - missing privilege release

Steve Kemp from the Debian Security Audit Project discovered a problem in xitalk, a talk intercept utility for the X Window System. A local user can exploit this problem and execute arbitrary commands under the GID utmp. This could be used by an attacker to remove traces from the utmp file...

Debian DSA-053-1 : nedit - insecure temporary file

The nedit Nirvana editor package as shipped in the non-free section accompanying Debian GNU/Linux 2.2/potato had a bug in its printing code: when printing text it would create a temporary file with the to be printed text and pass that on to the print system. The temporary file was not created...

Debian DSA-295-1 : pptpd - buffer overflow

Timo Sirainen discovered a vulnerability in pptpd, a Point to Point Tunneling Server, which implements PPTP-over-IPSEC and is commonly used to create Virtual Private Networks VPN. By specifying a small packet length an attacker is able to overflow a buffer and execute code under the user id that...

Debian DSA-505-1 : cvs - heap overflow

Stefan Esser discovered a heap overflow in the CVS server, which serves the popular Concurrent Versions System. Malformed 'Entry' Lines in combination with Is-modified and Unchanged can be used to overflow malloced memory. This was proven to be exploitable. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-344-2 : unzip - directory traversal

A directory traversal vulnerability in UnZip 5.50 allows attackers to bypass a check for relative pathnames '../' by placing certain invalid characters between the two '.' characters. The fix which was implemented in DSA-344-1 may not have protected against all methods of exploiting this...