CVE-2002-1756

CVE-2002-1756 affects ACDSee 4.0. The vulnerability arises in handling of .ais file properties when viewing a file’s description field, allowing remote attackers to trigger a crash (denial of service). The available documents describe the condition and impact but do not specify exploit code, affe...

CVE-2005-1970

Symantec pcAnywhere 10.5x and 11.x before 11.5, with "Launch with Windows" enabled, allows local users with physical access to execute arbitrary commands via the Caller Properties feature...

Symantec PcAnywhere privilege escalation

By using "Caller Properties" it's possible to execute application with Local System privileges...

[SECURITY] [DSA 694-1] New xloadimage packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 694-1 [email protected] http://www.debian.org/security/ Martin Schulze March 21st, 2005 http://www.debian.org/security/faq -...

Java Web Start argument injection vulnerability

OVERVIEW ======== Java Web Start is a technology for easy client-side deployment of Java applications. "Using Java Web Start technology, standalone Java software applications can be deployed with a single click over the network" from Sun Microsystems's website. Java Web Start is installed with Ja...

CVE-2004-1366

Oracle 10g Database Server stores the password for the SYSMAN account in cleartext in the world-readable emoms.properties file, which could allow local users to gain DBA privileges...

Manage authentication for NTLM proxies

We want to access RRS content internally, but we are using a secured proxy requiring authentication via NTLM or user/password. We setted up the standard Java proxies properties: http.proxyHost, http.proxyPort and http.auth.ntlm.domain. But it seams that the http.auth.ntlm.domain properties does n...

Manage authentication for NTLM proxies

We want to access RRS content internally, but we are using a secured proxy requiring authentication via NTLM or user/password. We setted up the standard Java proxies properties: http.proxyHost, http.proxyPort and http.auth.ntlm.domain. But it seams that the http.auth.ntlm.domain properties does n...

shadow privilege escalation

It's possible to change account properties...

CVE-2004-0831

McAfee VirusScan 4.5.1 does not drop SYSTEM privileges before allowing users to browse for files via the "System Scan" properties of the System Tray applet, which could allow local users to gain privileges...

Firefox < 1.0 Multiple Spoofing Vulnerabilities

The remote host is using Mozilla and/or Firefox, an alternative web browser. This web browser supports the XUL XML User Interface Language, a language designed to manipulate the user interface of the browser itself. Since XUL gives the full control of the browser GUI to the visited websites, an...

CVE-2003-1226

BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.properties, and weblogic-rar.xml, which allows local users to learn those secrets and decrypt passwords...

Microsoft Visual Basic for Applications (VBA) does not adequately validate document properties

Overview Microsoft Visual Basic for Applications VBA contains a buffer overflow when validating document properties. This vulnerability could allow an attacker to execute arbitrary code with the privileges of the user running VBA. Description From Microsoft Security Bulletin MS03-037:Microsoft VB...

Microsoft Internet Explorer 5 - window.open Search Pane Cross-Zone Scripting

Microsoft Internet Explorer 5 - window.open Search Pane Cross-Zone Scripting source: https://www.securityfocus.com/bid/9798/info A vulnerability has been reported in Microsoft Internet Explorer that could enable unauthorized access by malicious scripts and Active Content to document properties...

CVE-2003-0664

Microsoft Word 2000/97/98(J)/2002 contains a vulnerability where Word’s macro-security checks fail for certain document properties, allowing a malicious document to bypass macro security and automatically execute arbitrary macros. Impact: remote code execution likely under the user’s privileges w...

Opera 7.0 - History Object Information Disclosure

source: https://www.securityfocus.com/bid/6757/info An information disclosure weakness has been reported for Opera 7 browsers on the Microsoft Windows platform. The weakness is due to the way the history object exposes some properties. Specifically, the properties history.next and history.previou...

CVE-2002-1756

ACDSee 4.0 allows remote attackers to cause a denial of service crash via an .ais file with a long file description field, which is not properly handled when the file properties of the file are viewed...

CVE-2002-2327

Unspecified vulnerability in the environmental monitoring subsystem in Solaris 8 running on Sun Fire 280R, V480 and V880 allows local users to cause a denial of service by setting volatile properties...

Microsoft Internet Explorer 56 - Unauthorized Document Object Model Access

Microsoft Internet Explorer 56 - Unauthorized Document Object Model Access source: https://www.securityfocus.com/bid/5963/info Microsoft Internet Explorer MSIE is prone to a vulnerability that may enable a frame or iframe to gain unauthorized access to the Document Object Model DOM of other...

OpenBB 1.0 - Unauthorized Moderator Access

source: https://www.securityfocus.com/bid/4823/info OpenBB is web forum software written in PHP. It will run on most Linux and Unix variants, in addition to Microsoft Windows operating systems. OpenBB is reported to be vulnerable to a condition that will allow an unauthorized user to gain moderat...