BindView advisory: sshd remote root (bug in deattack.c)

Remote vulnerability in SSH daemon crc32 compensation attack detector ----------------------------------------------------------------------- Issue date: 8 February 2001 Author: Michal Zalewski [email protected] Contact: Scott Blake [email protected] CVE: CAN-2001-0144 Topic:...

IBM NetCommerce Security

hola friends, while i was participating on the openhack contest i found a couple of serious security-holes within ibm s so called "netcommerce" thing which seems to be a mixture of websphere, net.data, servlets, jsp s and db2? however..summary: class: input validation error remote: yes local: yes...

pkc003.txt

/ pkc003.txt / -= SECURITY ADVISORY 003 =- | \ www.pkcrew.org / \ \ | / \ | | | | | / | | | | | / | | | | / | | / / | | | / | - Group: Packet Knights http://www.pkcrew.org/ - Date of release: 01/18/2000 - Problems: Remote buffer overflow Local buffer overflow not dangerous if not suid - Impact:...

Basilix Webmail .class / .inc Direct Request Remote Information Disclosure

It is possible to download the include files on the remote BasiliX webmail service. An attacker may use these to obtain the MySQL authentication credentials. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; ifdescription scriptid10601;...

[PkC] Advisory #003: micq-0.4.6 remote buffer overflow

/ pkc003.txt / -= SECURITY ADVISORY 003 =- | www.pkcrew.org / | / | | | | | / | | | | | / | | | | / | | / / | | | / | | | | | PkC | | | / | | | | | | || || || / Packet Knights Crew -= SECURITY ADVISORY 003 =- - Vulnerable program: micq-0.4.6 Matt's ICQ clone. Maybe others. - Tested on: Linux/ix86...

Удаленная дыра в BSD ftpd

Однобайтное переполнение стека позволяет получить привелегии root...

Oops! 1.4.6 - one russi4n proxy-server Heap Buffer Overflow

/--oopz.c---//-------------r-3-m-0-t-3---------------\------------- TARGET : oops-1.4.6 one russi4n proxy-server CLASS : remote 0S : FreeBSD 4.0 - 2 AUTH0R : diman VEND0R : wanna payment for support. I'm not doing his job, yeh? DATE : 7-11-2k N0TE : xploit was coded for fun only. GREETS : &y, fm,...

Stack too ;) Re: [pkc] remote heap buffer overflow in oops

Uups..!.!.!.. another hole in oops-1.4.6. just a code fragment: / check if this is full name / if !strchrname, '.' if domainname0 / join / strcpychartmpname, name; strncatchartmpname, domainname, sizeoftmpname-strlenchartmpname -1 ; name=chartmpname; if result = lookupdnscachechartmpname, NULL, 0...

Cisco Catalyst Web Interface Remote Command Execution

The remote device appears to be a Cisco Catalyst. It is possible to execute arbitrary commands on the router by requesting them via HTTP, as in : /exec/show/config/cr This command shows the configuration file, which contains passwords. A remote attacker could use this flaw to take control of the...

iPlanet Web Server shtml File Handling Remote Overflow

It is possible to make the remote iPlanet web server execute arbitrary code when requesting a too long .shtml file with a name longer than 800 chars and containing computer code. An attacker may use this flaw to gain a shell on this host C Tenable Network Security, Inc. include"compat.inc"; if...

FreeBSD-SA-00:57.muh

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:57 Security Advisory FreeBSD, Inc. Topic: muh IRC bouncer remote vulnerability Category: ports Module: muh Announced: 2000-10-13 Credits: Maxime Henrion Affects: Ports...

klogd format bug

OVERVIEW Kernel logging daemon klogd in the sysklogd package for Linux contains a "format bug" making it vulnerable to local root compromise successfully tested on Linux/x86. There's also a possibility for remote vulnerability under certain rather unprobable circumstances and a more probable...

@stake Advisory: DocumentDirect for the Internet (A090800-1)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The vulnerability documented in this advisory is remotely exploitable yet we are releasing it on a Friday. We don't see this as adding any additional risk to DocumentDirect customers. The vendor, Mobius, has assured us that they have contacted all the...

[SECURITY] New version of xchat released

Package : xchat Problem type : remote exploit Debian-specific: no The version of X-Chat that was distributed with Debian GNU/Linux 2.2 has a vulnerability in the URL handling code: when a user clicks on a URL X-Chat will start netscape to view its target. However it did not check the URL for shel...

Simple Web Counter swc ctr Parameter Remote Overflow

The CGI 'swc' Simple Web Counter is present and vulnerable to a buffer overflow when issued a too long value to the 'ctr=' argument. An attacker may use this flaw to gain a shell on this host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Script audit and contributions from Carmichael...

HPUX FTPd vulnerability

Hello, I have discovered HPUX ftpd remote vulnerability. The problem persists in using vsprintf without format string. Example: 220 xxx FTP server Version 1.7.212.2 Tue Apr 21 12:14:46 GMT 1998 ready. user ftp 331 Guest login ok, send ident as password. pass .1030d 230 Guest login ok, access...

FreeBSD-SA-00:26.popper

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:26 Security Advisory FreeBSD, Inc. Topic: popper port contains remote vulnerability REVISED Category: ports Module: popper Announced: 2000-07-05 Revised: 2000-07-11...

Fun with UltraBoard V1.6X

hola friends, found some interesting things in the "old" UltraBoard-Forum scripts UltraBoard V 1.6 class:Input Validation Error remote:Yes vulnerable:UltraBoard V1. vendor: www.ultrascripts.com || www.ub2k.com Description: By using the good old NullByte000 its possible to open "any" file on the...

3R Soft MailStudio 2000 2.0 - userreg.cgi Arbitrary Command Execution

3R Soft MailStudio 2000 2.0 - userreg.cgi Arbitrary Command Execution // source: https://www.securityfocus.com/bid/1335/info MailStudio 2000 is vulnerable to multiple attacks. It is possible for a remote user to gain read access to all files located on the server via the usage of the "/.." string...

WebSpeed Messenger Administration Utility Unauthenticated Access

The remote web server appears to be using Webspeed, a website creation language used with database-driven websites. The version of Webspeed installed on the remote host allows anonymous access to the 'WSMadmin' utility, which is used configure Webspeed. An attacker can exploit this issue to gain...