Microsoft Windows XP - Local Denial of Service

source: https://www.securityfocus.com/bid/12870/info It is reported that Microsoft Windows XP Service Pack 1 is prone to a local denial of service vulnerability. The issue is reported to manifest when a raw IP over IP socket is created and data is transferred over the newly created socket. It is...

BetaParticle blog 2.03.0 - upload.asp Arbitrary File Upload

BetaParticle blog 2.03.0 - upload.asp Arbitrary File Upload source: https://www.securityfocus.com/bid/12861/info betaparticle blog is reported prone to multiple vulnerabilities. The following individual issues are reported: It is reported that betaparticle blog fails to sufficiently secure the...

MailEnable Standard SMTP mailto: Request Format String

The remote host is running a version of MailEnable Standard Edition that suffers from a format string vulnerability in its handling of SMTP commands. Specifically, a remote attacker can crash the SMTP daemon by sending a command with a format specifier as an argument. Due to the nature of the fla...

McNews 1.x - 'install.php' Arbitrary File Inclusion

source: https://www.securityfocus.com/bid/12835/info mcNews is reportedly affected by a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'install.php' script. This issue is reported to affect mcNews versions 1.3 a...

paBox pabox.php posticon Parameter XSS

The remote host is running paBox, a web application written in PHP. The remote version of paBox installed on the remote host does not properly sanitize input supplied through the 'posticon' parameter used to select a 'smilie' for a post. By exploiting this flaw, an attacker can inject HTML and...

VoteBox 2.0 - 'Votebox.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/12806/info It is reported that VoteBox is affected by a remote PHP file include vulnerability. This issue is due in part to the application failing to properly sanitize user-supplied input to the 'votebox.php' script. Remote attackers could potentially...

CVE-2005-0584

Firefox before 1.0.1 and Mozilla before 1.7.6, when displaying the HTTP Authentication dialog, do not change the focus to the tab that generated the prompt, which could facilitate spoofing and phishing attacks...

CVE-2005-0584

CVE-2005-0584 affects Firefox before 1.0.1 and Mozilla before 1.7.6: when the HTTP Authentication dialog is shown, focus is not moved to the prompting tab, enabling possible spoofing or phishing. The provided documents confirm the vulnerability and the affected products/versions. Remediation guid...

ieBypass.txt

Hi LIST. Windows XP SP2 forces the titlebar to be present in script-initiated Internet Explorer windows. In the titlebar, domain name is listed before the page title. Using magic DNS,this domain name can be exploited by malicious people to trick users into visiting a malicious popup window. The...

CVE-2004-1381

Firefox before 1.0 and Mozilla before 1.7.5 allow inactive background tabs to focus on input being entered in the active tab, as originally reported using form fields, which allows remote attackers to steal sensitive data that is intended for other sites, which could facilitate phishing attacks...

OutlookMuteX.txt

' Recent versions of Outlook, as well as a released patch, ' make Outlook prompt the user whenever a remote appliction ' tries to access specific contact information in the Outlook ' Contact database. The user can then decide to allow or not ' allow the application to get that access. ' ' Microso...

CVE-2004-2655

rdesktop 1.3.1 with xscreensaver 4.14, and possibly other versions, when running on Fedora and possibly other platforms, does not release the keyboard focus when xscreensaver starts, which causes the password to be entered into the active window when the user unlocks the screen...

CVE-2004-2655

rdesktop 1.3.1 with xscreensaver 4.14, and possibly other versions, when running on Fedora and possibly other platforms, does not release the keyboard focus when xscreensaver starts, which causes the password to be entered into the active window when the user unlocks the screen...

CVE-2004-2655

rdesktop 1.3.1 with xscreensaver 4.14, and possibly other versions, when running on Fedora and possibly other platforms, does not release the keyboard focus when xscreensaver starts, which causes the password to be entered into the active window when the user unlocks the screen...

CVE-2004-1381

Firefox before 1.0 and Mozilla before 1.7.5 allow inactive background tabs to focus on input being entered in the active tab, as originally reported using form fields, which allows remote attackers to steal sensitive data that is intended for other sites, which could facilitate phishing attacks...

[slackware-security] Mozilla

New Mozilla 1.7.3 packages are available for Slackware 10.0 and -current to fix security issues. Here are the details from the Slackware 10.0 ChangeLog: patches/packages/mozilla-1.7.3-i486-1.tgz: Upgraded to mozilla-1.7.3. The Mozilla page says this fixes some "minor security holes". It also brea...

PISG 0.54 - IRC Nick HTML Injection

source: https://www.securityfocus.com/bid/10195/info pisg has been reported prone to an input validation vulnerability. The issue will only present itself when pisg is used to monitor an IRC server that does not place limitations on IRC Nick values that can be used. If an attacker specifies HTML...

MNOGoSearch 3.1.20 - 'search.cgi?UL' Remote Buffer Overflow (2)

source: https://www.securityfocus.com/bid/7865/info mnoGoSearch 'search.cgi' has been reported prone to a buffer overflow vulnerability. The issue is a result of a lack of sufficient bounds checking performed on user-supplied URI parameters that are passed to the 'search.cgi' application. It may ...

HTML.cobble

Sunday, April 1, 2001 Default installation of Internet Explorer 5.5 with all of its so-called patches, service "packs" etc, still allows us to execute files on default installations of the target computer: Once Again: We cobble together new and old Components as follows : - 1. Courtesy of Georgi...

Micro Focus Cobol 4.1 - Arbitrary Command Execution

Micro Focus Cobol 4.1 - Arbitrary Command Execution source: https://www.securityfocus.com/bid/2359/info Micro Focus Cobol is a development suite for unix platforms offered by Merant. It is typically licensed on a per-user basis. If Micro Focus Cobol is installed with the 'Apptrack' feature enable...