Use a low-privileged Oracle database accounts give the OS access permissions-bug warning-the black bar safety net

Author:Mickey These days look at the article called"Penetration: from application down to OS Oracle"of the document,feel quite interesting,the document probably means that is,if the ORACLE service is using the administrator account to start,as long as you have a have resource and connect privileg...

CVE-2009-2426

The connectionedgeprocessrelaycellnotopen function in src/or/relay.c in Tor 0.2.x before 0.2.0.35 and 0.1.x before 0.1.2.8-beta allows exit relays to have an unspecified impact by causing controllers to accept DNS responses that redirect to an internal IP address via unknown vectors. NOTE: some o...

tor-devel -- DNS resolution vulnerability

The Tor Project reports: A malicious exit relay could convince a controller that the client's DNS question resolves to an internal IP address...

QMTP Open Relay

The QMTP/QMQP server that is running on this port allows relaying. Make sure it rejects connections from Internet so that it cannot be used use as an open relay. Otherwise, it may be blacklisted by RBLs or overloaded by spam. C Tenable Network Security, Inc. include"compat.inc"; ifdescription...

Oracle SMB Relay Code Execution

This module will help you to get Administrator access to OS using an unprivileged Oracle database user you need only CONNECT and RESOURCE privileges. To do this you must firstly run smbsniffer or smbrelay module on your server. Then you must connect to Oracle database and run this module...

Mail relaying

The remote SMTP server is insufficiently protected against relaying This means that spammers might be able to use your mail server to send their mails to the world. OpenVAS Vulnerability Test $Id: smtprelay.nasl 8023 2017-12-07 08:36:26Z teissa $ SMTP Open Relay Test Authors: Michael Meyer...

SA-CONTRIB-2009-009 Forward module can be used as a spam relay

This vulnerability allows spammers or spambots to use sites with the Forward module installed to send nearly unlimited e-mail. Due to improper use of Drupal's flood control API, it is possible for one user to send an unlimited numbers of mails using the forward module. Important note : the securi...

Shoutcast server buffer overflow

Buffer overflow in DNAS Relay service on master server reply parsing...

Secunia Research: SHOUTcast DNAS Relay Server Buffer Overflow

====================================================================== Secunia Research 25/02/2009 - SHOUTcast DNAS Relay Server Buffer Overflow - ====================================================================== Table of Contents Affected...

Intercepting proxy servers may incorrectly rely on HTTP headers to make connections

Overview Proxy servers running in interception mode "transparent" proxies that make connection decisions based on HTTP header values may be used by an attacker to relay connections. Description HTTP Host Headers are defined in RFC 2616 and are often used to by web servers to allow multiple websit...

New vulnerabilities in Relay

Здравствуйте 3APA3A! Сообщаю вам о найденных мною новых уязвимостях в движке Relay. Это Directory Traversal и HTTP Response Spliting уязвимости. Обе уязвимости связаны с одной SQL Injection в Relay http://websecurity.com.ua/1485/. Данные две атаки проводятся через SQL инъекцию. Эти уязвимости...

E-mail attachment execution

Added: 01/28/2009 Background This tool sends an e-mail attachment which, when executed, establishes a command connection. Limitations This tool requires a user to execute the e-mail attachment in order to succeed. This tool requires the IP address of a working mail server which allows relaying of...

E-mail attachment execution

Added: 01/28/2009 Background This tool sends an e-mail attachment which, when executed, establishes a command connection. Limitations This tool requires a user to execute the e-mail attachment in order to succeed. This tool requires the IP address of a working mail server which allows relaying of...

Input validation

The tqslverifyDataBlock function in opensslcert.cpp in American Radio Relay League ARRL tqsllib 2.0 does not properly check the return value from the OpenSSL EVPVerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a...

[SECURITY] Fedora 10 Update: rsyslog-3.21.9-1.fc10

Rsyslog is an enhanced multi-threaded syslogd supporting, among others, MyS QL, syslog/tcp, RFC 3195, permitted sender lists, filtering on any message part, and fine grain output format control. It is quite compatible to stock syskl ogd and can be used as a drop-in replacement. Its advanced...

[SECURITY] Fedora 9 Update: rsyslog-3.20.2-2.fc9

Rsyslog is an enhanced multi-threaded syslogd supporting, among others, MyS QL, syslog/tcp, RFC 3195, permitted sender lists, filtering on any message part, and fine grain output format control. It is quite compatible to stock syskl ogd and can be used as a drop-in replacement. Its advanced...

Code injection

Tor before 0.2.0.32 does not properly process the ClientDNSRejectInternalAddresses configuration option in situations where an exit relay issues a policy-based refusal of a stream, which allows remote exit relays to have an unknown impact by mapping an internal IP address to the destination...

CVE-2008-5398

CVE-2008-5398 affects Tor up to version before 0.2.0.32, where the ClientDNSRejectInternalAddresses option is not consistently enforced when an exit relay issues a policy-based stream refusal. This can allow remote exit relays to map an internal IP address to the destination hostname of the refus...

CVE-2008-5398: Undefined Security Weakness

Tor before 0.2.0.32 does not properly process the ClientDNSRejectInternalAddresses configuration option in situations where an exit relay issues a policy-based refusal of a stream, which allows remote exit relays to have an unknown impact by mapping an internal IP address to the destination...

smtp-open-relay NSE Script

Attempts to relay mail by issuing a predefined combination of SMTP commands. The goal of this script is to tell if a SMTP server is vulnerable to mail relaying. An SMTP server that works as an open relay, is a email server that does not verify if the user is authorised to send email from the...