SOL6924 - Insertion of special characters in URL path circumvents Accessibility Scope and Access Control Lists

It is possible to bypass the Deny list, configured in the Accessibility Scope section located on the Portal Access: Web Applications: Master Group Settings page, by inserting certain special characters into a URL path. In FirePass version 6.0, this issue also applies to the Deny list configured...

SOL6922 - Decimal-encoded IP address circumvents Accessibility Scope

It is possible to bypass the Deny list configured in the Accessibility Scope section of the Portal Access: Web Applications: Master Group Settings page using a URL with a decimal-encoded IP address. When you log in to the FirePass Webtop, you can enter a URL into the Webtop Address Bar if the...

SOL6920 - Cross-site scripting vulnerabilities

Multiple cross-site scripting XSS vulnerabilities exist in the FirePass Administrative Console pages. The affected FirePass URLs fail to fully sanitize certain URL arguments before the requested web page content is returned to the browser. It is possible for an attacker to create web pages, email...

[SA23583] ICONICS Dialog Wrapper Module ActiveX Control Buffer Overflow

TITLE: ICONICS Dialog Wrapper Module ActiveX Control Buffer Overflow SECUNIA ADVISORY ID: SA23583 VERIFY ADVISORY: http://secunia.com/advisories/23583/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: ICONICS Gauge ActiveX 8.x http://secunia.com/product/13098/ ICONICS...

MailEnable POP PASS command buffer overflow

Added: 12/28/2006 CVE: CVE-2006-6605 BID: 21645 OSVDB: 32341 Background MailEnable is a mail server supporting SMTP and POP3 for Windows platforms. Problem A buffer overflow vulnerability in MailEnable allows remote, unauthenticated attackers to execute arbitrary commands by sending a long,...

MailEnable POP PASS command buffer overflow

Added: 12/28/2006 CVE: CVE-2006-6605 BID: 21645 OSVDB: 32341 Background MailEnable is a mail server supporting SMTP and POP3 for Windows platforms. Problem A buffer overflow vulnerability in MailEnable allows remote, unauthenticated attackers to execute arbitrary commands by sending a long,...

MailEnable POP PASS command buffer overflow

Added: 12/28/2006 CVE: CVE-2006-6605 BID: 21645 OSVDB: 32341 Background MailEnable is a mail server supporting SMTP and POP3 for Windows platforms. Problem A buffer overflow vulnerability in MailEnable allows remote, unauthenticated attackers to execute arbitrary commands by sending a long,...

MailEnable POP PASS command buffer overflow

Added: 12/28/2006 CVE: CVE-2006-6605 BID: 21645 OSVDB: 32341 Background MailEnable is a mail server supporting SMTP and POP3 for Windows platforms. Problem A buffer overflow vulnerability in MailEnable allows remote, unauthenticated attackers to execute arbitrary commands by sending a long,...

[Full-disclosure] Secunia Research: MailEnable POP Service "PASS" Command Buffer Overflow

====================================================================== Secunia Research 18/12/2006 - MailEnable POP Service "PASS" Command Buffer Overflow - ====================================================================== Table of Contents Affected...

CVE-2006-6423

Stack-based buffer overflow in the IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.35, Professional Edition 1.6 through 1.84, and Enterprise Edition 1.1 through 1.41 allows remote attackers to execute arbitrary code via a pre-authentication command followed by a...

[SA23201] MailEnable IMAP Service Buffer Overflow Vulnerability

TITLE: MailEnable IMAP Service Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA23201 VERIFY ADVISORY: http://secunia.com/advisories/23201/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: MailEnable Professional 2.x http://secunia.com/product/10625/ MailEnable...

dc-arbitrary.txt

/ -061124b- \ | deV!Lz Clanportal - Arbitrary File Upload | \ / S Y N O P S I S / =================' - access: remote severity: high - deV!Lz Clanportal allows nearly arbitrary files to be uploaded and stored on the server's filesystem, which enables anyone, even without a user account, to upload...

CVE-2006-6291

Stack overflow in the IMAP module MEIMAPS.EXE in MailEnable Professional 1.6 through 1.83 and 2.0 through 2.33, and MailEnable Enterprise 1.1 through 1.40 and 2.0 through 2.33, allows remote authenticated users to cause a denial of service crash via a long argument containing asterisk and ?...

CVE-2006-6291

Stack overflow in the IMAP module MEIMAPS.EXE in MailEnable Professional 1.6 through 1.83 and 2.0 through 2.33, and MailEnable Enterprise 1.1 through 1.40 and 2.0 through 2.33, allows remote authenticated users to cause a denial of service crash via a long argument containing asterisk and ?...

CVE-2006-6291

CVE-2006-6291 describes a stack overflow in MailEnable’s IMAP module (MEIMAPS.EXE) affecting MailEnable Professional 1.6–1.83 and 2.0–2.33, and MailEnable Enterprise 1.1–1.40 and 2.0–2.33. An authenticated remote user could crash the service by sending a long argument containing * and ? character...

MailEnable NetWebAdmin Unauthorized Access (ME-10019)

The remote version of MailEnable contains a web-based administration tool that allows a user to login with a blank password. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid23755; scriptversion"1.19";...

MailEnable IMAP SELECT buffer overflow

Added: 12/01/2006 CVE: CVE-2006-6290 BID: 21362 OSVDB: 31698 Background MailEnable is a mail server supporting SMTP and POP3 for Windows platforms. MailEnable Professional and MailEnable Enterprise also include IMAP and HTTPMail services. Problem A buffer overflow vulnerability in the IMAP servic...

MailEnable IMAP SELECT buffer overflow

Added: 12/01/2006 CVE: CVE-2006-6290 BID: 21362 OSVDB: 31698 Background MailEnable is a mail server supporting SMTP and POP3 for Windows platforms. MailEnable Professional and MailEnable Enterprise also include IMAP and HTTPMail services. Problem A buffer overflow vulnerability in the IMAP servic...

Secunia Research: MailEnable IMAP Service Two Vulnerabilities

====================================================================== Secunia Research 30/11/2006 - MailEnable IMAP Service Two Vulnerabilities - ====================================================================== Table of Contents Affected...

DeluxeBB sig.php远程文件包含漏洞

DeluxeBB是一款基于PHP的论坛程序。 DeluxeBB对用户请求的处理存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上以Web进程权限执行任意指令。 DeluxeBB的templates/deluxe/cp/sig.php脚本没有对templatefolder参数做充分的检查过滤，允许攻击者通过恶意参数串包含远程服务器上的脚本代码执行。 DeluxeBB DeluxeBB 1.09 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： DeluxeBB hotfixfor109.zip...