4478 matches found
Несанкционированный доступ в DCForum (unauthorized access)
Предсказуемый механизм генерации новго пароля...
CVE-2001-0972: Undefined Security Weakness
Surf-Net ASP Forum before 2.30 uses easily guessable cookies based on the UserID, which allows remote attackers to gain administrative privileges by calculating the value of the admin cookie UserID 1, i.e. "0888888."...
CVE-2001-1534
modusertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication...
DEBIAN-CVE-2001-1534
modusertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication...
[RHSA-2001:110-05] Insecure setserial initscript
--------------------------------------------------------------------- Red Hat, Inc. Red Hat Security Advisory Synopsis: Insecure setserial initscript Advisory ID: RHSA-2001:110-05 Issue date: 2001-09-12 Updated on: 2001-09-19 Product: Red Hat Linux Keywords: setserial initscript temporary file...
CVE-2000-1198
CVE-2000-1198 affects the qpopper POP server. The vulnerability arises from lock files being created with predictable names, enabling a local attacker to cause a denial of service for other users by creating lock files for other mail boxes. The available connected documents describe the issue and...
CVE-2000-1197
POP2 or POP3 server pop3d in imap-uw IMAP package on FreeBSD and other operating systems creates lock files with predictable names, which allows local users to cause a denial of service lack of mail access for other users by creating lock files for other mail boxes...
CVE-2000-1197: Undefined Security Weakness
POP2 or POP3 server pop3d in imap-uw IMAP package on FreeBSD and other operating systems creates lock files with predictable names, which allows local users to cause a denial of service lack of mail access for other users by creating lock files for other mail boxes...
CVE-2000-1198
qpopper POP server creates lock files with predictable names, which allows local users to cause a denial of service for other users lack of mail access by creating lock files for other mail boxes...
PT-2001-1232 · Qpopper · Qpopper
Name of the Vulnerable Software and Affected Versions: qpopper affected versions not specified Description: The qpopper POP server creates lock files with predictable names. This allows local users to cause a denial of service for other users, resulting in a lack of mail access, by creating lock...
Keys generated with PGP5i batch mode do not contain sufficient randomness on systems that use /dev/random
Overview Under certain circumstances, PGP v5.0 generates keys that are not sufficiently random, which may allow an attacker to predict keys and, hence, recover information encrypted with that key. Description Generating Randomness in PGP Keys In order to generate cryptographically secure keys, PG...
CVE-2001-1104
SonicWALL SOHO uses easily predictable TCP sequence numbers, which allows remote attackers to spoof or hijack sessions...
CVE-2001-1146
AllCommerce with debugging enabled in EnGarde Secure Linux 1.0.1 creates temporary files with predictable names, which allows local users to modify files via a symlink attack...
ml85p - driver for Samsung ML-85G and /tmp
ml85p - driver for Samsung ML-85G GDI printers seems to use /tmp unsecurely. it seems to use the time function to determine the /tmp files name. root@linux exp strings /usr/bin/ml85p | grep tmp /tmp/ml85gd 401070dd iopl0x3 = 0 400cf2bd timeNULL = 994462668 40100cbf brk0 = 0x8064544 40100cbf...
Дырка в man (symbolic link)
При работе утилиты makewhatis создаются временные файлы с предсказуемыми именами, что позволяет атаку с помощью символьных линков...
CVE-2001-0310: Undefined Security Weakness
sort in FreeBSD 4.1.1 and earlier, and possibly other operating systems, uses predictable temporary file names and does not properly handle when the temporary file already exists, which causes sort to crash and possibly impacts security-sensitive scripts...
Дырка в Microfocus Cobol
При установке создаются файлы открытые на запись и временные файлы с предсказуемыми именами...
CVE-2000-1096
The CVE-2000-1096 entry concerns the crontab utility by Paul Vixie, where temporary files are created with predictable names and there is insufficient verification that the file is owned by the user running crontab -e. This enables local users who have write access to the crontab spool directory ...