Ubuntu time confusion vulnerability is still not fixed don't know the password can get root permissions-bug warning-the black bar safety net

Ubuntu（Ubuntu）is the world's most popular Linux distribution, General Unix Assembly in the presence of a security vulnerability. However, from the official release of the relevant patches has been more than a year, the vulnerability still has not been repaired. ! Unix systems, the“Sudo”is“Super...

JBoss 3.0.8/3.2.1 HSQLDB Remote Command Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8773/info A remote command-injection vulnerability has been reported in JBoss. The issue is reportedly exposed via the HSQLDB component, which is a SQL database server that manages JMS connections. Because of a number of...

Apache security vulnerabilities

moddav malformed MERGE request crash, modrewrite log manipulation...

tmux '-S' Option Incorrect SetGID Privilege Escalation Vulnerability

Exploit for linux platform in category local exploits --------------------------------------- | Team ph0x90bic proudly presents | | tmux -S 1.3/1.4 local utmp exploit | --------------------------------------- Exploit Title: tmux '-S' Option Incorrect SetGID Local Privilege Escalation Vulnerabilit...

DEBIAN-CVE-2008-1926

Argument injection vulnerability in login login-utils/login.c in util-linux-ng 2.14 and earlier makes it easier for remote attackers to hide activities by modifying portions of log events, as demonstrated by appending an "addr=" statement to the login name, aka "audit log injection."...

HTTP File Serve multiple security vulnerabilities

Crossite scripting, information disclosure, unauthroized files creation, log manipulation, user name spoofing...

CVE-2002-2417

acFTP 1.4 does not properly handle when an invalid password is provided by the user during authentication, which allows remote attackers to hide or misrepresent certain activity from log files and possibly gain privileges...

CVE-2007-3102

Unspecified vulnerability in the linuxauditrecordevent function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. NOTE: some of these details are obtained from third party informatio...

bbsxp sql latest version and then burst 0day?- Vulnerability warning-the black bar safety net

bbsxp some time ago a log injection vulnerability, this vulnerability is still present in this place. sub LogMessage if Request. ServerVariables"QueryString""" then QueryString="?"& amp;Request. ServerVariables"QueryString"&"" Conn. Execute"insert into BBSXPLog...

Update Protection against Microsoft ISA Server Manipulation Vulnerability

ISA Server 2004 is an application-layer firewall, virtual private network VPN, and Web cache solution. A Log Manipulation vulnerability was reported in Microsoft ISA Server 2004. When exploited, the vulnerability will enable an attacker to manipulate the Destination Host parameter of the log file...

JVN#74012178 Movable Type session management vulnerability

Impact A remote attacker could freely manipulate a web log by posting or deleting blog entries. Solution Products Affected Movable Type 3.151-ja and earlier...

JBoss 3.2.1: Remote Command Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ================================ Illegalaccess.org Security Alert ================================ Date : 10/04/2003 Application : JBoss, java server for running J2EE enterprise applications Version : 3.2.1 Website : http://www.jboss.org Problems :...

Update JBoss 308 & 321: Remote Command Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Adam, thanks for the question, here is the answer: just downloaded the 3.0.8 from Jboss.org and changed the port of the exploit code from 1701 to 1476, which is the HSQL port in Version 3.0.8 of JBoss. I can confirm that JBOSS 3.0.8 is also...

JBoss 3.0.8/3.2.1 - HSQLDB Remote Command Injection

source: https://www.securityfocus.com/bid/8773/info A remote command-injection vulnerability has been reported in JBoss. The issue is reportedly exposed via the HSQLDB component, which is a SQL database server that manages JMS connections. Because of a number of flaws, an attacker can pass comman...

scx-sa-12.txt

============================================================================= Securax-SA-12 Security Advisory belgian.networking.security Dutch ============================================================================= Topic: Remote hiding from accesslog and errorlog Announced: 2000-12-28...

Stunnel format bug

Macaroon Advisory Hi, ppl We have recently discovered a format bug in stunnel= 3.8 in which the log function calls directly the syslog with only two parameters: sysloglevel, text. It should be sysloglevel, "s", text. If a user can pass any string that is written to the log file, he can exploit th...

PT-1999-1131 · Microsoft +1 · Iis +1

Name of the Vulnerable Software and Affected Versions: IIS version 4.0 Apache affected versions not specified Description: The issue allows a remote attacker to hide the URL they are requesting by taking advantage of how IIS 4.0 and Apache log HTTP request methods, regardless of their length...