CVE-2002-1592

The aplogrerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information...

CVE-2002-1592

The aplogrerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information...

CVE-2002-0260

CVE-2002-0260 concerns a buffer overflow in InstantServers MiniPortal 1.1.5 and earlier. The overflow occurs when a long login name is processed by the logging utility, allowing remote attackers to potentially execute arbitrary code. Affected software/version: MiniPortal

Format string and buffer overflow bugs in Posadis DNS Server

Format string bug on logging without syslog facility...

Format String Bug in Posadis DNS Server

Date: Mar 27 02 Me: kkr [email protected] Software: Posadis DNS Server http://sourceforge.net/projects/posadis/ Ver: m5pre1 Bug: bad fmt string usage in log function, may lead to remote access Word Life: the warez dude Overview: Posadis dns server is a small dns server without cache or resolving...

CVE-2002-0113

EMC NetWorker formerly Legato NetWorker before 7.0 stores log files in the /nsr/logs/ directory with world-readable permissions, which allows local users to read sensitive information and possibly gain privileges. NOTE: this was originally reported for Legato NetWorker 6.1 on the Solaris 7 platfo...

CVE-1999-1047

When BSDI patches for Gauntlet 5.0 BSDI are installed in a particular order, Gauntlet allows remote attackers to bypass firewall access restrictions, and does not log the activities...

CVE-2000-0615

CVE-2000-0615 : LPRng 3.6.x improperly installs lpd as setuid root, allowing local users to append lpd trace and logging messages to files. The connected documents confirm the vulnerability is a local privilege issue tied to the lpd binary running with root privileges. No explicit exploit details...

CVE-1999-1047

Gauntlet 5.0 BSDI: When patches are installed in a particular order, the system allows remote attackers to bypass firewall access restrictions and prevents logging of those activities. Affected component: Gauntlet firewall on BSDI with specific patch ordering. Root cause described as the patch se...

CVE-2001-0908

CITRIX Metaframe 1.8 logs the Client Address IP address that is provided by the client instead of obtaining it from the packet headers, which allows clients to spoof their public IP address, e.g. through Network Address Translation NAT...

Brecht Claerhout Sniffit 0.3.6 HIP0.3.7 Beta - Mail Logging Buffer Overflow (3)

Brecht Claerhout Sniffit 0.3.6 HIP0.3.7 Beta - Mail Logging Buffer Overflow 3 // source: https://www.securityfocus.com/bid/1158/info Sniffit is a freely available, open source network monitoring tool. It is designed for use on the Unix and Linux Operating Systems. Sniffit contains a remotely...

Brecht Claerhout Sniffit 0.3.6 HIP/0.3.7 Beta - Mail Logging Buffer Overflow (3)

// source: https://www.securityfocus.com/bid/1158/info Sniffit is a freely available, open source network monitoring tool. It is designed for use on the Unix and Linux Operating Systems. Sniffit contains a remotely exploitable buffer overflow vulnerability. If Sniffit is configured to log emails,...

Lynx format string vulnerability in URL logging.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The vendor has been notified, but since this is a low risk I am releasing early. Vapid Labs Larry W. Cashdollar Bug Report Summary: lynx has a format string vulnerability in LYUtils.c line 7995 due to a bad call to syslog, where the format argument is...

CVE-2001-0908

CITRIX Metaframe 1.8 logs the Client Address IP address that is provided by the client instead of obtaining it from the packet headers, which allows clients to spoof their public IP address, e.g. through Network Address Translation NAT...

Formatting string bug on cyrus-sasl library

This issue may be already have been on list. I assume that the moderator this case rejects this mail. On last non-beta version of cyrus-sasl library have formatting string bug on default logging callback. Default cyrys sasl logging callback is static int saslsyslogvoid context attributeunused, in...

CVE-2001-0738

LogLine function in klogd in sysklogd 1.3 in various Linux distributions allows an attacker to cause a denial of service hang by causing null bytes to be placed in log messages...

samba.sh

/bin/sh Samba =2.0.7 xploit for RH 5.1-7.0 by MostaraCaka Snyggast @2001, mail: [email protected] Tested on RH 7.0 with no updates Use it wisely and make the Net more secure Author is not responsible for any illegal usage of this script Knowledge is power, and power is knowledge.../by...

CVE-2001-1414

The Basic Security Module BSM for Solaris 2.5.1, 2.6, 7, and 8 does not log anonymous FTP access, which allows remote attackers to hide their activities, possibly when certain BSM audit files are not present under the FTP root...

CVE-1999-1280

Hummingbird Exceed 6.0.1.0 inadvertently includes a DLL that was meant for development and testing, which logs user names and passwords in cleartext in the test.log file...

CVE-1999-1029

SSH server sshd2 before 2.0.12 does not properly record login attempts if the connection is closed before the maximum number of tries, allowing a remote attacker to guess the password without showing up in the audit logs...