Microsoft Internet Explorer 5 - FTP Password Storage

Microsoft Internet Explorer 5 - FTP Password Storage Microsoft Internet Explorer 5.0 for Windows 2000/Windows NT 4 FTP Password Storage Vulnerability source: https://www.securityfocus.com/bid/610/info FTP usernames and passwords for sites accessed via Internet Explorer 5.X are stored cleartext in...

Microsoft FrontPage Extensions authors.pwd Information Disclosure

The remote web server appears to be running with Microsoft FrontPage extensions. The file 'authors.pwd', which contains the encrypted passwords of FrontPage authors, can by accessed by anyone. A remote attacker could decrypt these passwords, or possibly overwrite this file. C Tenable Network...

oracle.8.passwd.txt

Date: Thu, 4 Mar 1999 15:44:37 -0600 From: James Kivisild To: [email protected] Subject: Oracle Plaintext Password I now know this has been mentioned before, however I've gotten a large number of responses from people about Oracle problems similar to this. As a first time Oracle installer, I...

asmcodes.txt

http://www.rootshell.com/ ----------------- begin asmcodes.txt --------------------- -- Assembly drop in replacements -- Probably useless, but can be a little fun ;- Here are some assembly instructions that you can drop into your favorite buffer overflow exploit. Generally, replacing existing...

CVE-1999-0408

Files created from interactive shell sessions in Cobalt RaQ microservers e.g. .bashhistory are world readable, and thus are accessible from the web server...

CVE-1999-1168

install.iss installation script for Internet Security Scanner ISS for Linux, version 5.3, allows local users to change the permissions of arbitrary files via a symlink attack on a temporary file...

Hancom Office 2007 - 'Reboot.ini' Clear-Text Passwords

source: https://www.securityfocus.com/bid/228/info During installation of BackOffice 4.0, a file called reboot.ini is created and stored in the \Program Files\Microsoft BackOffice directory. This file contains clear-text usernames and passwords for several services that may be created during...

CVE-1999-0402

wget 1.5.3 follows symlinks to change permissions of the target file instead of the symlink itself...

CVE-1999-0560

A system-critical Windows NT file or directory has inappropriate permissions...

CVE-1999-1433

HP JetAdmin D.01.09 on Solaris allows local users to change the permissions of arbitrary files via a symlink attack on the /tmp/jetadmin.log file...

HP JetAdmin 1.0.9 Rev. D - symlink

HP JetAdmin 1.0.9 Rev. D - symlink source: https://www.securityfocus.com/bid/157/info A vulnerability exists in HP's JetAdmin Rev. D.01.09 software. Due to its failure to check if it is following a symbolic link, it is possible for an attacker to create a link from /tmp/jetadmin.log to anywhere o...

HP JetAdmin 1.0.9 Rev. D - symlink

source: https://www.securityfocus.com/bid/157/info A vulnerability exists in HP's JetAdmin Rev. D.01.09 software. Due to its failure to check if it is following a symbolic link, it is possible for an attacker to create a link from /tmp/jetadmin.log to anywhere on the filesystem, with permissions...

Digital UNIX 4.04.0 B4.0 D - SUIDSGID Core File

Digital UNIX 4.04.0 B4.0 D - SUIDSGID Core File source: https://www.securityfocus.com/bid/74/info Digital UNIX 4.0 will follow symlinks while writting core files if two setuid programs dump core in sucession. The core file is owned by root but with the user's groud id. The core file permissions a...

Slackware Linux 3.4 - netconfig Temporary File

Slackware Linux 3.4 - netconfig Temporary File source: https://www.securityfocus.com/bid/81/info netconfig creates the file /tmp/tmpmsg insecurely and follows symbolic links. An attacker can create a symbolic link from /tmp/tmpmsg to any file and wait for root to run the program. This will clober...

Digital UNIX 4.0/4.0 B/4.0 D - SUID/SGID Core File

source: https://www.securityfocus.com/bid/74/info Digital UNIX 4.0 will follow symlinks while writting core files if two setuid programs dump core in sucession. The core file is owned by root but with the user's groud id. The core file permissions are 0600. This can be used to create root owned...

Slackware Linux 3.4 - 'netconfig' Temporary File

source: https://www.securityfocus.com/bid/81/info netconfig creates the file /tmp/tmpmsg insecurely and follows symbolic links. An attacker can create a symbolic link from /tmp/tmpmsg to any file and wait for root to run the program. This will clober the target file. The file created has...

FreeBSD-SA-97:05.open

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-97:05 Security Advisory FreeBSD, Inc. Topic: security compromise via open Category: core Module: kern Announced: 1997-10-29 Affects: FreeBSD 2.1., FreeBSD 2.2.,...

Solaris 2.5.1 lp lpsched - Symlink

Solaris 2.5.1 lp lpsched - Symlink !/bin/sh lpNet & temp file exploit: break lp, then use lp priv to break root or bin, etc.... Written by: Chris Sheldon [email protected] Tested on Solaris-2.5.1: SunOS testhost 5.5.1 Generic sun4m sparc SUNW,SPARCstation-20 Caveat: This system is running...

Solaris 2.5.1 lp / lpsched - Symlink

!/bin/sh lpNet & temp file exploit: break lp, then use lp priv to break root or bin, etc.... Written by: Chris Sheldon [email protected] Tested on Solaris-2.5.1: SunOS testhost 5.5.1 Generic sun4m sparc SUNW,SPARCstation-20 Caveat: This system is running without patches. Sun released patch...

CVE-1999-1243

SGI Desktop Permissions Tool in IRIX 6.0.1 and earlier allows local users to modify permissions for arbitrary files and gain privileges...