MySQL allows default user to be changed to root via custom "my.cnf" file

Overview MySQL reads configuration options from world-writeable files. This can lead to a remote user gaining elevated privileges. Description A message posted to the bugtraq mailing list details a vulnerability affecting versions of MySQL prior to 3.23.56. MySQL would permit users with 'FILE'...

HP JetDirect Printer - SNMP JetAdmin Device Password Disclosure

HP JetDirect Printer - SNMP JetAdmin Device Password Disclosure HP JetDirect J2552A/J2552B/J2591A/J3110A/J3111A/J3113A/J3263A/300.0 X Printer SNMP JetAdmin Device Password Disclosure Vulnerability source: https://www.securityfocus.com/bid/7001/info A problem with JetDirect printers could make it...

Stronghold swish Search Script Information Disclosure

An information disclosure vulnerability was reported in a sample script provided with Red Hat's Stronghold web server. A remote user can determine the web root directory path. A remote user can send a request to the Stronghold sample script swish to cause the script to reveal the full path to the...

Rediff Bol 2.0.2 - URL Handling Denial of Service

Rediff Bol 2.0.2 - URL Handling Denial of Service source: https://www.securityfocus.com/bid/6670/info It has been reported that a problem in Rediff Bol may allow remote users to log other users out of the Bol chat client. Due to improper handling of some types of requests, a remote user could sen...

PHPPass 2 - AccessControl.php SQL Injection

PHPPass 2 - AccessControl.php SQL Injection source: https://www.securityfocus.com/bid/6594/info A problem with phpPass may allow an attacker to launch a SQL injection attack. The vulnerability exists in the accesscontrol.php script included with phpPass. Due to insufficient sanitization of...

Xynph FTP Server 1.0 - Directory Traversal

source: https://www.securityfocus.com/bid/6587/info A problem with the handling of input has been reported in Xynph FTP Server. Under some circumstances, it may be possible for a remote user to escape the FTP root directory using relative path notation. This could allow unauthorized access to...

BRS Webweaver 1.0 1 - MKDir Directory Traversal

source: https://www.securityfocus.com/bid/6585/info WebWeaver's FTP component has a flaw which can permit a remote user to create directories outside the FTP root. By executing the mkdir command on an ftp server with dot-dot-slash ..\ directory traversal notation, an attacker can create a directo...

Solaris wall message spoofing

It's possible to spoof message from any remote user...

Sun Solaris 2.5.12.67.089 Wall - Spoofed Message Origin

Sun Solaris 2.5.12.67.089 Wall - Spoofed Message Origin // source: https://www.securityfocus.com/bid/6509/info Solaris is the freely available UNIX Operating System variant distributed by Sun Microsystems. The wall client packaged with Solaris makes assumptions about a user's environment when the...

CVE-2002-1952

phpRank 1.8 does not properly check the return codes for MySQL operations when authenticating users, which could allow remote attackers to authenticate using a NULL password when database errors occur or if the database is unavailable...

Mambo Site Server 4.0.11 - 'PHPInfo.php' Information Disclosure

source: https://www.securityfocus.com/bid/6376/info Mambo Site Server is a freely available, open source web content management tool. It is written in PHP, and available for Unix, Linux, and Microsoft Windows operating systems. It has been reported that Mambo enables a script by default that may...

SolarWinds TFTP Server Standard Edition 5.0.55 - Directory Traversal

source: https://www.securityfocus.com/bid/6045/info SolarWinds TFTP Server is distributed for the Microsoft Windows platform. The SolarWinds TFTP Server does not properly handle user-supplied input. Due to insufficient handling of user input, it is possible for a remote user to request arbitrary...

My Web Server 1.0.11.0.2 - GET Denial of Service

My Web Server 1.0.11.0.2 - GET Denial of Service source: https://www.securityfocus.com/bid/5954/info My Web Server is a web server software package distributed and maintained by MyWebServer LLC. It is designed for the Microsoft Windows operating system. It has been reported that My Web Server doe...

My Web Server 1.0.1/1.0.2 - GET Denial of Service

source: https://www.securityfocus.com/bid/5954/info My Web Server is a web server software package distributed and maintained by MyWebServer LLC. It is designed for the Microsoft Windows operating system. It has been reported that My Web Server does not properly handle long requests. Because of...

Midicart ASP - Remote Customer Information Retrieval

Midicart ASP - Remote Customer Information Retrieval source: https://www.securityfocus.com/bid/5438/info Midicart ASP is a commercially available e-commerce solution distributed by Coxco Support. It is available for the Microsoft Windows operating system. The default installation of Midicart ASP...

phpBB2 Gender Mod 1.1.3 - SQL Injection

phpBB2 Gender Mod 1.1.3 - SQL Injection source: https://www.securityfocus.com/bid/5342/info phpBB2 is an open-source web forum application that is written in PHP and backended by a number of database products. It will run on most Unix and Linux variants, as well as Microsoft Windows operating...

phpBB2 Gender Mod 1.1.3 - SQL Injection

source: https://www.securityfocus.com/bid/5342/info phpBB2 is an open-source web forum application that is written in PHP and backended by a number of database products. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems. Gender Mod is a modification for...

CVE-2002-0558

Directory traversal vulnerability in TYPSoft FTP server 0.97.1 and earlier allows a remote authenticated user possibly anonymous to list arbitrary directories via a .. in a LIST ls command ending in wildcard . characters...

Half-Life Server 1.1/3.1 - New Player Flood Denial of Service

source: https://www.securityfocus.com/bid/5076/info Half-Life is a popular game distributed and maintained by Valve Software. It includes features that allow users to game locally, or in distributed network environments. Valve Software also distributes a dedicated server product. A denial of...

[CERT-intexxia] mmmail POP3-SMTP Daemon Format String Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SECURITY ADVISORY INTEXXIAc 04 06 2002 ID 1054-040602 TITLE : mmmail POP3-SMTP Daemon Format String Vulnerability CREDITS : Guillaume Pelat / INTEXXIA SYSTEM AFFECTED =============== mmmail = 0.0.13 mmpop3d & mmsmtpd DESCRIPTION =========== "mmmail...