CVE-1999-1309: Undefined Security Weakness

Sendmail before 8.6.7 allows local users to gain root access via a large value in the debug -d command line option...

CVE-2001-0834: Undefined Security Weakness

htsearch CGI program in htdig ht://Dig 3.1.5 and earlier allows remote attackers to use the -c option to specify an alternate configuration file, which could be used to 1 cause a denial of service CPU consumption by specifying a large file such as /dev/zero, or 2 read arbitrary files by uploading...

CVE-2001-0667: Improper Neutralization of Argument Delimiters in a Command

Internet Explorer 6 and earlier, when used with the Telnet client in Services for Unix SFU 2.0, allows remote attackers to execute commands by spawning Telnet with a log file option on the command line and writing arbitrary code into an executable file which is later executed, aka a new variant o...

CVE-2000-1195: Undefined Security Weakness

telnet daemon telnetd from the Linux netkit package before netkit-telnet-0.16 allows remote attackers to bypass authentication when telnetd is running with the -L command line option...

user-mode-linux problems

Program: User-mode-linux Version tested: patch-2.4.17-8 I assume all previous versions would be Not vulnerable: patch-2.4.17-9 Haven't tested any different techniques. Now for something completely different. Anything in 's is my comments to my article... deal with it. Description: ------------...

Buffer overflow in artsd

Buffer overflow in -m command line option...

Ошибка форматной строки в lynx при работе с логами (format string)

Ошибка форматной строки при работе с syslog если lynx собран с опцией --enable-syslog...

QPopper 4.0.x - PopAuth Trace File Shell Command Execution

source: https://www.securityfocus.com/bid/3710/info Qpopper is a freely available, open source Post Office Protocol server. It is maintained and distributed by Qualcomm. When popauth is executed with the trace option, it does not correctly handle user-supplied input. A user can supply data to the...

ActivePerl 5.6.1 - 'perlIIS.dll' Remote Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/3526/info ActivePerl is an implementation of the Perl scripting language for Microsoft Windows systems developed by Activestate. ActivePerl allows for high-performance integration with IIS using a DLL called 'perlIIS.dll' to handle a '.plx' ISAPI...

CVE-2001-0892

Acme Thttpd Secure Webserver before 2.22, with the chroot option enabled, allows remote attackers to view sensitive files under the document root such as .htpasswd via a GET request with a trailing /...

OpenSSH UseLogin option allows remote execution of commands as root

Overview Versions of OpenSSH prior to 2.1.1 current circa June, 2000 allow a remote attacker to execute arbitrary commands with the privileges of sshd, typically root. Description OpenSSH is a free implementation of versions 1 and 2 of the SSH protocol. If sshd is configured with the UseLogin...

CVE-2001-0713: Undefined Security Weakness

Sendmail before 8.12.1 does not properly drop privileges when the -C option is used to load custom configuration files, which allows local users to gain privileges via malformed arguments in the configuration file whose names contain characters with the high bit set, such as 1 macro names that ar...

MDKSA-2001:079 - problems with devfs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandrake Linux Security Update Advisory Package name: kernel Date: October 8th, 2001 Advisory ID: MDKSA-2001:079 Affected versions: 8.1 Problem Description: Alexander Viro discovered a vulnerability in the devfs implementation that is shipped with...

CVE-2001-0428: Undefined Security Weakness

Cisco VPN 3000 series concentrators before 2.5.2F allow remote attackers to cause a denial of service via an IP packet with an invalid IP option...

Apache UserDir Directive Username Enumeration

When configured with the 'UserDir' option, requests to URLs containing a tilde followed by a username will redirect the user to a given subdirectory in the user home. For instance, by default, requesting /root/ displays the HTML contents from /root/publichtml/. If the username requested does not...

CVE-1999-1186

CVE-1999-1186 concerns rxvt (terminal emulator) when compiled with the PRINT_PIPE option on certain Linux distros (e.g., Slackware 3.0, RedHat 2.1). The vulnerability arises from the -print-pipe parameter, which allows a local user to specify a malicious program, potentially gaining root privileg...

CVE-1999-1446

Internet Explorer 3 records a history of all URL's that are visited by a user in DAT files located in the Temporary Internet Files and History folders, which are not cleared when the user selects the "Clear History" option, and are not visible when the user browses the folders because of tailored...

CVE-1999-1186

rxvt, when compiled with the PRINTPIPE option in various Linux operating systems including Linux Slackware 3.0 and RedHat 2.1, allows local users to gain root privileges by specifying a malicious program using the -print-pipe command line parameter...

CVE-1999-1368: Undefined Security Weakness

AV Option for MS Exchange Server option for InoculateIT 4.53, and possibly other versions, only scans the Inbox folder tree of a Microsoft Exchange server, which could allow viruses to escape detection if a user's rules cause the message to be moved to a different mailbox...

LPRng/rhs-printfilters - remote execution of commands

posted to vendor security ppl, no reply, no patch, so posting here. --begin forwarded message-- RedHat 7.0 possibly others If the lpd is listening on 0.0.0.0 and no access controls are in place, it is possible to execute commands as the lp user, assuming tetex-dvips is installed. From man dvips...