NetAccess IP3 - (Authenticated) Ping Option Command Injection

NetAccess IP3 - Authenticated Ping Option Command Injection NetAccess IP3 - Force into shell By: r00t Shouts: G., Tee, ES, s1ngl3, and D1g1t5 Requirements: Remote access to an IP3 Any level control panel username/password Vendor Information: Thanks to Sebastian Wolfgarten sebastian at wolfgarten...

Code injection

The Aclient GUI in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 installs a client executable with insecure permissions Everyone:Full Control, which allows local users to gain privileges by replacing the executable with a Trojan horse program...

CVE-2009-3108

The Aclient GUI in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 installs a client executable with insecure permissions Everyone:Full Control, which allows local users to gain privileges by replacing the executable with a Trojan horse program...

CVE-2009-3108

The Aclient GUI in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 installs a client executable with insecure permissions Everyone:Full Control, which allows local users to gain privileges by replacing the executable with a Trojan horse program...

CVE-2009-3108

CVE-2009-3108 affects Symantec Altiris Deployment Solution 6.9.x prior to 6.9 SP3 Build 430. The Aclient GUI is installed with insecure permissions (Everyone: Full Control), enabling local users to escalate privileges by replacing the client executable with a Trojan horse. Impact is local privile...

ecryptfs-utils security, bug fix, and enhancement update

75-4 - fix EOF handling 499367 - add icon to gui desktop file 75-3 - ask for password confirmation when creating openssl key 500850 - removed executable permission from ecryptfs-dot-private 500817 - ecryptfs-rewrite-file: improve of progress output 500813 - dont error out when unwrapping and addi...

Fedora Core 11 FEDORA-2009-8819 (ocsinventory)

The remote host is missing an update to ocsinventory announced via advisory FEDORA-2009-8819. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C ...

Fedora Core 10 FEDORA-2009-8799 (ocsinventory)

The remote host is missing an update to ocsinventory announced via advisory FEDORA-2009-8799. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C ...

TFTPUtil GUI 1.3.0 - Remote Denial of Service

!/usr/bin/python import socket import sys from time import Download:http://www.brothersoft.com/tftputil-131537.html Note; Good Ramadan For all MuSLimS if lensys.argv!=2: print "xTFTPUtil GUI 1.3.0 GUI Remote Denial Of Service Exploit" print "xAuthor : ThE g0bL!N" print "xBig Thanx : His0k4\n" pri...

CVE-2009-2766

httpd.c in httpd in the management GUI in DD-WRT 24 sp1 does not require administrative authentication for programs under cgi-bin/, which allows remote attackers to change settings via HTTP requests...

Design/Logic Flaw

httpd.c in httpd in the management GUI in DD-WRT 24 sp1 does not require administrative authentication for programs under cgi-bin/, which allows remote attackers to change settings via HTTP requests...

CVE-2009-2765

httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI...

CVE-2009-2766

CVE-2009-2766 affects httpd.c in the httpd management GUI of DD-WRT 24 sp1; CGI programs under /cgi-bin/ can be accessed without administrative authentication, enabling remote changes via HTTP requests. CBSS: Network vector, low complexity, no authentication, with partial impact on confidentialit...

CVE-2009-2765

The CVE-2009-2765 issue affects the DD-WRT HTTPd management GUI, where httpd.c in the HTTP daemon is vulnerable to shell metacharacter injection via requests to a CGI-bin URI. The vulnerability allows an unauthenticated remote attacker to execute arbitrary commands with root privileges on affecte...

CVE-2009-2766

httpd.c in httpd in the management GUI in DD-WRT 24 sp1 does not require administrative authentication for programs under cgi-bin/, which allows remote attackers to change settings via HTTP requests...

SAP SAPgui MDrmSap ActiveX (mdrmsap.dll) Buffer Overflow

The remote host contains the 'MDrmSap' ActiveX control included with SAP GUI version 6.40 for Windows. This control is reportedly affected by a buffer overflow involving instantiation by Internet Explorer. If an attacker can trick a user on the affected host into visiting a specially crafted web...

[SECURITY] Fedora 10 Update: wxGTK-2.8.10-2.fc10

wxWidgets/GTK2 is the GTK2 port of the C++ cross-platform wxWidgets GUI library, offering classes for all common GUI controls as well as a comprehensive set of helper classes for most common application tasks, ranging from networking to HTML display and image manipulation...

[SECURITY] Fedora 11 Update: wxGTK-2.8.10-2.fc11

wxWidgets/GTK2 is the GTK2 port of the C++ cross-platform wxWidgets GUI library, offering classes for all common GUI controls as well as a comprehensive set of helper classes for most common application tasks, ranging from networking to HTML display and image manipulation...

TekRADIUS SQL注入及不安全权限漏洞

CVECAN ID: CVE-2009-2357,CVE-2009-2358,CVE-2009-2359 TekRadius是一个免费的RADIUS服务器，可以支持RFC 2865和RFC 2866规范。 1 TekRADIUS的默认配置使用sa账号与Microsoft SQL Server通讯，远程攻击者可以相对较容易的获得对数据库的特权访问。 2 TekRADIUS将数据库凭据存储在了C:\Program Files\TekRADIUS\TekRADIUS.ini文件中。任何Windows本地用户都可以访问这个文件，读取加密了的凭据。 3...

Sql injection

Multiple SQL injection vulnerabilities in TekRADIUS 3.0 allow context-dependent attackers to execute arbitrary SQL commands via 1 the GUI client, as demonstrated by input to the Browse Users text box in the Users tab; or 2 the command-line client, as demonstrated by a certain trcli -r command...