Avaya Argent Office uses weak authentication for TFTP-based administrative control

Overview The Avaya Argent Office contains a weak authentication mechanism for administrative access. Description The Avaya Argent Office uses a TFTP-based mechanism to accept requests for administrative functions. By requesting "files" from the device via its internal interface, administrators ca...

Cfengine2 cfservd remote stack overflow

============================================================================== Background ========== Cfengine www.cfengine.org automates the configuration and maintenance of large computer networks. A common setup involves running the cfservd daemon on TCP port 5308 on a central master server, wi...

Oracle XDB FTP Service UNLOCK Buffer Overflow Exploit

Exploit for unknown platform in category remote exploits ===================================================== Oracle XDB FTP Service UNLOCK Buffer Overflow Exploit ===================================================== + vulnerabilities network level/stack based buffer overflow + special network...

The PACKET 0' DEATH FastTrack network vulnerability

The PACKET 0' DEATH FastTrack network vulnerability =================================================== Vulnerability Overview ---------------------- There exists a vulnerability in the FastTrack network core that can be used by an attacker to take control of all FastTrack network supernodes. The...

Kerio Personal Firewall 2.1.4 - Remote Code Execution

Kerio Personal Firewall 2.1.4 - Remote Code Execution / Kerio Personal Firewall v2.1.4 remote code execution exploit Tested on Windows XP with SP1 In order to exploit, for ease of mind, set the firewall to permit all traffic, or allow a connection to port 44334 from your testing unix shell ip. It...

Apache 2.x - Memory Leak

/ apache-massacre.c Test code for Apache 2.x Memory Leak By Matthew Murphy DISCLAIMER: This exploit tool is provided only to test networks for a known vulnerability. Do not use this tool on systems you do not control, and do not use this tool on networks you do not own without appropriate consent...

Apache HTTP Server 2.x Memory Leak Exploit

Exploit for unknown platform in category dos / poc ========================================== Apache HTTP Server 2.x Memory Leak Exploit ========================================== / apache-massacre.c Test code for Apache 2.x Memory Leak By Matthew Murphy DISCLAIMER: This exploit tool is provided...

buffalo AirStation G54 - (WBR-G54 ) DoS

Hellow! I found bad bug/owerflow for buffalo g54 airstions: here my simple tests: schem of tests: I used 2 broadband routers Airstation WBR-g54 first named: g54-01, second - g54-02 both broadband routers set to pear-to-pear connection mode not point- multipoint atacker...

CVE-2002-0276

CVE-2002-0276 describes a buffer overflow in various decoders of Ettercap ≤ 0.6.3.1 when running on networks with MTU > 2000, allowing remote attackers to execute arbitrary code via large packets. The entry specifies the affected software (Ettercap) and version range, the root cause (buffer ov...

CVE-2003-0001

Multiple ethernet Network Interface Card NIC device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak...

CVE-2002-0452

Foundry Networks ServerIron switches do not decode URIs when applying "url-map" rules, which could make it easier for attackers to cause the switch to forward traffic to a different server than intended and exploit vulnerabilities that would otherwise be inaccessible...

Weak encryption in SunPCi II VNC

Password is DES encoded with random key generated by server and moved over the wire...

ZyXEL ZyWALL10 DoS

vendor status About half a year ago I found a 'funny' DoS condition in the ZyWALL10. ZyXEL was informed, and they at least confirmed the bug, but i believe that's all i heard. According to www.zyxel.com a new firmware for the ZyWALL10 was released 2002/01/10 - i wrote an email to a ZyXEL employee...

CVE-2001-0461

CVE-2001-0461 affects the Free On-Line Dictionary of Computing (FOLDOC) template.cgi. Remote attackers can read files and execute commands by injecting shell metacharacters in the template.cgi argument. This is documented in NVD/CVE records; no remediation/patch details are provided in the connec...

XTux Server 2001.0 6.01 - Garbage Denial of Service

XTux Server 2001.0 6.01 - Garbage Denial of Service source: https://www.securityfocus.com/bid/4260/info XTux is a multiplayer network game for Linux. The server component June 01, 2001 version is vulnerable to a denial of service initiated by connecting to the server and sending unexpected...

IPRoute Fragmentation Denial of Service Vulnerability

IPRoute Fragmentation Denial of Service Vulnerability by Chris Gragsone and The TechnoDragon Foot Clan Date: December 2, 2001 Advisory ID: Foot-20011202 Impact of vulnerability: Denial of Service Exploitable: Remotely Maximum Risk: Moderate Affected Software: IPRoute v1.18 IPRoute v0.974 IPRoute...

OSX remote root

I have seen mention of nidump being used local to an OSX box to take root... I have found that with the use of "tags" it is also a remote root. I have not notified apple due to the fact that they did nothing about the original local exploit. Any machine with a "network" nidomain is vulnerable. It...

Microsoft Windows 98 - ARP Denial of Service

Microsoft Windows 98 - ARP Denial of Service source: https://www.securityfocus.com/bid/3113/info A potential denial of service vulnerability exists in some versions of the Microsoft Windows network stack. The problem occurs when a large number of extraneous ARP packets sent to a host running...

ISSalert: ISS Advisory: Wired-side SNMP key exposure in 802.11b Access Points

Internet Security Systems Security Advisory June 20, 2001 Wired-side SNMP WEP key exposure in 802.11b Access Points Synopsis: Internet Security Systems ISS X-Force has discovered a vulnerability in several 802.11b Access Point devices. This problem may reveal the Wired Equivalent Privacy WEP key...

Cisco IOS HTTP Server ?/ String Local DoS

It was possible to make the remote switch reboot by requesting : GET /cgi-bin/view-source?/ A remote attacker may use this flaw to prevent your network from working properly. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...