CVE-2002-2051

The processorweb plugin for ModLogAn 0.5.0 through 0.7.11, when used with the splitby option, allows local users to overwrite arbitrary files via a symlink attack on files specified as hostnames in a log file...

CVE-2002-1869

Heysoft EventSave 5.1 and 5.2 and Heysoft EventSave+ 5.1 and 5.2 does not check whether the log file can be written to, which allows attackers to prevent events from being recorded by opening the log file using an application such as Microsoft's Event Viewer...

CVE-2002-1695

Norton Internet Security 2001 opens log files with FILESHAREREAD and FILESHAREWRITE permissions, which could allow remote attackers to modify the log file contents while Norton Internet Security is running...

CVE-2002-1694

Microsoft Internet Information Server IIS 4.0 opens log files with FILESHAREREAD and FILESHAREWRITE permissions, which could allow remote attackers to modify the log file contents while IIS is running...

CVE-2002-2187

Unknown "file disclosure" vulnerability in Macromedia JRun 3.0, 3.1, and 4.0, related to a log file or jrun.ini, with unknown impact...

PT-2002-2779 · Teekai · Teekai Tracking Online

Name of the Vulnerable Software and Affected Versions: TeeKai Tracking Online version 1.0 Description: The issue concerns the weak encryption of web usage statistics stored in the data/userlog/log.txt file. This weakness allows remote attackers to identify the IP addresses of visitors to the site...

PT-2002-2591 · Heysoft +1 · Heysoft Eventsave +1

Name of the Vulnerable Software and Affected Versions: Heysoft EventSave versions 5.1 through 5.2 Heysoft EventSave+ versions 5.1 through 5.2 Description: The issue allows attackers to prevent events from being recorded by opening the log file using an application such as Microsoft's Event Viewer...

Netscape and iPlanet Enterprise Servers fail to sanitize log files before they are displayed using the administration client

Overview IPlanet Enterprise Server and Netscape Enterprise Server versions prior to 4.1. SP12 have a vulnerability involving the rendering of tags embedded in the web logs when viewed through the administration client. Description Requests made to web servers are routinely logged by the web serve...

Moderate: Red Hat Security Advisory: webalizer security update

Updated Webalizer packages are available for Red Hat Linux Advanced Server 2.1 which fix an obscure buffer overflow bug in the DNS resolver code. Updated 13 Jan 2003 Added fixed packages for the Itanium IA64 architecture. Updated 06 Feb 2003 Added fixed packages for Advanced Workstation 2.1...

TCP flood against NetGear FM114P

Hi! I've got a lot of availability trouble with my NetGear FM114P. After asking the support and no good answer I started doing some test for myself. It seems possible to crash the NetGear FM114P with many TCP connects. I did some tests on my FM114P firmware Version 1.3 Release 05 and these are th...

Inso DynaWeb HTTPd 3.1/4.0.2/4.1 - Format String

// source: https://www.securityfocus.com/bid/5384/info Inso DynaWeb webserver, dwhttpd, is used as a subcomponent in products such as Sun's AnswerBook2, which is shipped as part of the Solaris operating environment. The dwhttpd webserver is prone to a remotely exploitable format-string...

security flaw

split-logfile in Apache 1.3.20 allows remote attackers to overwrite arbitrary files that end in the .log extension via an HTTP request with a / slash in the Host: header...

SonicWALL SOHO3 6.3 - Content Blocking Script Injection

SonicWALL SOHO3 6.3 - Content Blocking Script Injection source: https://www.securityfocus.com/bid/4755/info The Sonicwall SOHO3 is an Internet security appliance that provides firewall security solutions. Reportedly, a vulnerability exists in the product that allows for a script injection attack ...

Security holes : XMB Magic Lantern forum & DevBB

Hi all : Product 1 : XMB Magic Lantern forum 1.6b final http://www.xmbforum.com http://www.aventure-media.co.uk Problems : - Reading of logs files - XSS - Path Disclosure - Access to users/admins accounts - Logs distortion Exploits : - /indexlog.log - /cplogfile.log - If indexlog not chmod 777 =...

XMB Forum 1.6 - Magic Lantern Log File

source: https://www.securityfocus.com/bid/4722/info XMB Forum 1.6 Magic Lantern allows remote users to conduct activities in the forum while bypassing normal logging functions. This is accomplished by submitting an arbitrary string as the "analized" variable to index.php. Log information is writt...

Buffer overflow in webalizer

Buffer overflow in host name resolution during log analizing...

SWS Vuln (small but important to those using it.)

-------------------------------------------------------------------- Dear Bugtraq Readers, I wasn't sure if this advisory deserved space on the bugtraq mailing list but as a friend of mine helped me to remember. "All security flaws are important no matter what their size". I guess ill go ahead, h...

AOL Instant Messenger saves code embedded in image tag to conversation log which could be viewed/executed by a browser

Overview Certain Alpha versions of AOL Instant Messenger AIM, that were leaked, would log errors to a log file. By sending a crafted image file, it may be possible to execute arbitrary script/HTML on a victims browser when they view the log files. Description AOL Instant Messenger has the ability...

CVE-2002-0114

EMC NetWorker formerly Legato NetWorker before 7.0 stores passwords in plaintext in the daemon.log file, which allows local users to gain privileges by reading the password from the file. NOTE: this was originally reported for Legato NetWorker 6.1 on the Solaris 7 platform...

CVE-2001-1170

The CVE concerns AmTote International’s homebet program. The vulnerability arises because homebet.log is stored in the homebet/ virtual directory, enabling remote attackers to access sensitive data and potentially disclose account and PIN numbers. The description does not specify affected version...