Очередные ошибки во многих PHP-скриптах.

Ошибки неинициализированных глобальных переменных...

Microsoft Exchange Outlook Web Access fails to authenticate users when searching the Global Address List

Overview Microsoft Exchange servers that offer the Outlook Web Access service are vulnerable to an information disclosure vulnerability that can reveal any email address stored in the Global Address List. Description The Outlook Web Access OWA component of Microsoft Exchange allows users to acces...

Доступ к глобальному списку адресов в Exchange 5.5 (unauthorized access)

Пожно получить доступ к глобальной адресной книге без авторизации через OWA...

Security Bulletin MS01-047

---------------------------------------------------------------------- Title: OWA Function Allows Unauthenticated User to Enumerate Global Address List Date: 06 September 2001 Software: Exchange 5.5 Impact: Information Disclosure Bulletin: MS01-047 Microsoft encourages customers to review the...

RH7.0: man local gid 15 (man) exploit

======================================================== Vulnerable systems: redhat 7.0 with man-1.5h1-10 default package and earlier. ========================================================= Heap Based Overflow of man via -S option gives GID man. Due to a slight error in a length check, the -S...

NewsDaemon remote administrator access

SUMMARY ------- In all versions of NewsDaemon prior to 0.21b released 25 Jan 2001, it is possible to spoof a global variable in an HTTP request and obtain administrator access remotely. NewsDaemon is the PHP-based Web Log software that runs http://daily.daemonnews.org/ a popular news and discussi...

CVE-2000-0952

global.cgi CGI program in Global 3.55 and earlier on NetBSD allows remote attackers to execute arbitrary commands via shell metacharacters...

CVE-2000-0952

CVE-2000-0952 affects the Global CGI program, specifically global.cgi, in Global 3.55 and earlier on NetBSD. The vulnerability allows remote attackers to execute arbitrary commands via shell metacharacters in input handled by the CGI. Root cause: improper handling of shell input leading to comman...

CVE-2000-0952

global.cgi CGI program in Global 3.55 and earlier on NetBSD allows remote attackers to execute arbitrary commands via shell metacharacters...

FreeBSD-SA-00:64.global

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:64 Security Advisory FreeBSD, Inc. Topic: global port allows remote compromise through CGI script Category: ports Module: global Announced: 2000-11-06 Credits: Shigio...

Security Advisory YYYY-NNN

-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 2000-014 ================================= Topic: Global-3.55 allows world-wide executable cgi. Version: any before 4.01 Severity: permits remote execution of arbitrary shell commands Abstract ======== When using the CGI interface of the...

Дырка в Global

Недостаточный разбор shell-метасимволов в CGI-Скрипте позволяет выполнение команд на сервере...

CVE-1999-1359

When the Ntconfig.pol file is used on a server whose name is longer than 13 characters, Windows NT does not properly enforce policies for global groups, which could allow users to bypass restrictions that were intended by those policies...

netscape.4.x.java.txt

Netscape 4.x javascript security flaw Versions tested: Windows98/Netscape4.7,Windows95/Netscape4.05 Description: Credits to Henri Torgemane Netscape has a "persistent" navigator object, which means that any data put in the window.navigator object will be accessible to every other window as long a...

aass_patch.txt

--- aass-old.c Mon Jul 26 20:45:46 1999 +++ aass.c Mon Jul 26 21:54:47 1999 @@ -1,5 +1,5 @@ / - The AntiAntiSniffer Sniffer by Mike Perry + The AntiAntiSniffer Sniffer v0.2 by Mike Perry To all my friends, coworkers, and associates who thought I knew better than to do something like this, please...

Hughes Technologies Mini SQL (mSQL) 2.02.0.10 - Information Disclosure

Hughes Technologies Mini SQL mSQL 2.02.0.10 - Information Disclosure source: https://www.securityfocus.com/bid/591/info Under certain versions of Mini SQL, the w3-msql CGI script allows users to view directories which are set for private access via .htaccess files. W3-mSQL converts any form data...

GetadmforSops.txt

Date: Mon, 11 Jan 1999 20:29:40 -0000 From: mnemonix To: [email protected] Subject: Default permissions on Registry key creates a getadmin hole Summary: There is an interesting hole opened up in the winlogon registry key on NT 4 that allows elevation of privileges to both local and...

MS:1F660A5E-940C-48DA-87E4-AA6DACEAA005

...

MS:BEA362DC-7BCC-4184-AC66-A456D93BA694

...

MS:C34FDA17-5A96-4A41-B126-CC5F8C44A22D

...