4718 matches found
Viralator CGI Script Arbitrary Command Execution
The CGI 'viralator.cgi' is installed. Some versions of this CGI are don't check properly the user input and allow anyone to execute arbitrary commands with the privileges of the web server. No flaw was tested. Your script might be a safe version. %NASLMINLEVEL 70300 C Tenable Network Security, In...
Web Server HTTP Header Memory Exhaustion DoS
It was possible to kill the web server by sending an invalid 'infinite' HTTP request that never ends, like: GET / HTTP/1.0 Referer: XXXXXXXXXXXXXXXXXXXXXXXX ... An attacker may exploit this vulnerability to make your web server crash continually if the attack saturates virtual memory on the targe...
Web Server HTTP Header Handling Remote Overflow
It was possible to kill the web server by sending an invalid request with a long header name or value. A remote attacker may exploit this vulnerability to make the web server crash continually or even execute arbitrary code. C Tenable Network Security, Inc. include"compat.inc"; if description...
Formatstring Vulnerability in decfingerd 0.7
Hello all, I have no idea if this is the most current version of this application, I found it while browsing packetstormsecurity earlier. For all I know it may not even be kept current anymore. Anyhow... bad call to syslog is the culprit. I'm to lazy to code an exploit for this at the moment but ...
Potential security issues in Ethereal
Looks like Ethereal has some potential security issues: http://www.ethereal.com/appnotes/enpa-sa-00004.html -- Name: Potential issues with Ethereal 0.9.3 Docid: enpa-sa-00004 Date: May 19, 2002 Severity: High Description: Four potential security issues have been discovered in Ethereal 0.9.3: The...
Microsoft Internet Explorer 5.0.1/6.0 - Content-Disposition Handling File Execution
source: https://www.securityfocus.com/bid/4752/info An issue exists in the way Microsoft Internet Explorer handles conflicting information in some HTTP headers used to describe non-HTML content. A malicious web server may provide content with misleading values in the content-type and...
RemotelyAnywhere SSH Detection
The RemotelyAnywhere SSH server is running on this system. According to NAVCIRT, attackers target this management tool. C Tenable Network Security, Inc. Script audit and contributions from Carmichael Security Erik Anderson nb: domain no longer exists Broken link deleted include"compat.inc";...
PureTLS Security Announcement: Upgrade to 0.9b2
PureTLS http://www.rtfm.com/puretls is a pure Java implementation of SSLv3/TLS. PureTLS 0.9b2 was released Mar 1, 2002. Internal audits prior to the release of PureTLS 0.9b2 discovered a potential attack under certain conditions. This vulnerability was present in all prior versions. Details of th...
Oracle 9iAS creates temporary files when processing JSP requests that are world-readable
Overview Oracle Database Server version 9iAS makes JSP source code publicly available. The source code may be used by attackers to analyze proprietary business logic or uncover Oracle's network configuration, usernames, and/or passwords. Description When Oracle receives a request for JSP file, it...
Problems with the scripts by Solution Scripts
!/possible/exploits/by/b0iler scripts from: http://solutionscripts.com don't take anything I say too seriously in this, as it is mostly guess work. Problems with the scripts by Solution Scripts solution script's powerlist script: It seems the author doesn't check for anything when removing user's...
PHP-Nuke 4.x5.x - Arbitrary File Inclusion
PHP-Nuke 4.x5.x - Arbitrary File Inclusion source: https://www.securityfocus.com/bid/3889/info PHPNuke is a website creation/maintenance tool. The 'index.php' script has a feature which allows users to include files. Due to insufficent input validation, it is possible to include files located on ...
Linksys 'routers', SNMP issues
Howdy. LinkSys DSL 'routers' have some serious information leakage, and potention DDoS usage. The following models have been confirmed as having this problem: BEFN2PS4 EtherFast Cable/DSL Router & Voice with 4-Port Switch BEFSR81 EtherFast Cable/DSL Router with 8-Port Switch Querying these device...
CVE-2001-0911
PHP-Nuke 5.1 stores user and administrator passwords in a base-64 encoded cookie, which could allow remote attackers to gain privileges by stealing or sniffing the cookie and decoding it...
Air Messenger LAN Server (AMLServer) stores usernames and passwords in plaintext
Overview Air Messenger LAN Server AMLServer stores usernames and passwords in plaintext. Description AMLServer for windows is a paging gateway that allows users on a TCP/IP LAN to communicate with mobile devices such as phones and pagers. Access to AMLServer's services is protected by a user...
CVE-2001-0440
The connected document (MDKSA-2001:032-1) confirms a vulnerability in Licq pre-1.0.3 where received URLs are parsed without sufficient checks and passed to the system() call. This allows remote attackers to cause arbitrary commands to be executed on the client, via crafted URLs, and can lead to d...
CVE-1999-1510
BisonFTP Server (Bisonware) is vulnerable: versions prior to 4.1 are affected by a buffer overflow in FTP command handlers (USER, LIST, CWD). Exploitation can cause remote denial of service and may allow arbitrary command execution. Public PoCs/exploits exist (e.g., Metasploit/MIS, OpenVAS refere...
Checkpoint Firewall-1 errors
Hi. Checkpoint Firewall-1 makes use of a piece of software called SecureRemote to create encrypted sessions between users and FW-1 modules. Before remote users are able to communicate with internal hosts, a network topology of the protected network is downloaded to the client. While newer version...
cobalt.webmail.txt
I just got a new Cobalt Cube today and I have been poking around at it for security issues... I noticed this minor issue in the webmail system. Your users are not aloud to have shell access by default however if they malform their mailbox requests they can read local files with the perms of the...
lil' exim format bug
Hi BugTrackers Just a little bug to tell: THE BUG ------- accept.c, line 2506: else if smtpreply != NULL moansmtpbatchNULL, smtpreply; while moansmtpbatch is like this: moansmtpbatchchar cmdbuffer, char format, ... So when smtpreply contains format strings, it get transformed by moansmtpbatch. Wh...