openview_connectednodes_exec.pm.txt

This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artistic. The latest version of the...

Anti OpenVAS defenses

It seems that your web server rejects requests from OpenVAS. It is probably protected by a reverse proxy. OpenVAS Vulnerability Test $Id: antinessus.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: Anti OpenVAS defenses Authors: Michel Arboi Copyright: Copyright C 2003 Michel Arboi This progr...

ProZilla buffer overflow

Buffer overflow on oversized HREF parameters of the search results HTML page...

Prozilla 1.3.7.4 - 'ftpsearch' Results Handling Buffer Overflow

include include include define OVERFLOW 1"; buf = mallocOVERFLOW; for i = 0; buf + i "; buf = reallocbuf, SLEDSIZ + sizeofshellcode; memsetbuf, 0x90, SLEDSIZ; memcpybuf + SLEDSIZ, shellcode, sizeofshellcode; fwritebuf, SLEDSIZ + sizeofshellcode, 1, exploit; freebuf; fprintfstderr, " %s created.\n...

CVE-2005-1961

The CVE affects ObjectWeb Consortium C-JDBC prior to 1.3.1, where a local-user access control bypass allows reading the cache results of another user. The underlying issue is an improper enforcement of user isolation, enabling unintended exposure of cached data. Impact is limited to local attacke...

CVE-2005-1961

Unknown vulnerability in ObjectWeb Consortium C-JDBC before 1.3.1 allows local users to bypass intended access restrictions and obtain the cache results from another user...

DEBIAN-CVE-2005-0706

Buffer overflow in discdb.c for grip 3.1.2 allows attackers to cause a denial of service crash and possibly execute arbitrary code by causing the cddb lookup to return more matches than expected...

Microsoft Windows - WINS Vulnerability + OSSP Scanner

Microsoft Windows - WINS Vulnerability + OSSP Scanner / HAT-SQUAD WINS VULNERABILITY/OS SCANNER ------------------------------------ ------------------------------------ Note: ---------------- By default, nothing printed on screen, 200 threads, all results in the file HSWINS.txt -v..: lite verbos...

CartWIZ 1.10 - searchresults.asp SKU Argument Cross-Site Scripting

CartWIZ 1.10 - searchresults.asp SKU Argument Cross-Site Scripting source: https://www.securityfocus.com/bid/13342/info CartWIZ is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage th...

typo3sql.txt

Here is a POC for the typo3 issue to test if you are vulnerable. This doesn't pull the password, just the username : http://path/?&action=getviewcategory&categoryuid=-99%20UNION%20SELECT%20use rname%20FROM%20beusers%20WHERE%20uid=1/ Also, it's easy to pull lists of data from the database using th...

squid -- confusing results on empty acl declarations

Applying an empty ACL list results in unexpected behavior: anything will match an empty ACL list. For example, The meaning of the configuration gets very confusing when we encounter empty ACLs such as acl something src "/path/to/emptyfile.txt" httpaccess allow something somewhere gets parsed with...

Flash FTP Server - Directory Traversal

TestCode: C:\ftp localhost Connected to server. 220 Flash FTP Server v2.1 ready... User server:none: CoolICE 331 Password required for CoolICE. Password: 230 User CoolICE logged in. ftp get /winnt/system.ini 200 Port command successful. 150 Opening data connection for /winnt/system.ini. 226 File...

"Content-Type" XSS vulnerability affecting other webmail systems

Roman Medina-Heigl Hernandez did a survey which other webmail systems where vulnerable to a bug he discovered in SquirrelMail. This advisory summarizes the results...

[Hat-Squad] phpBB search_id injection exploit

Hello list, Here is the exploit code for phpbb 2.06 sql injection described in http://www.securityfocus.com/archive/1/345872 . It will return MD5 password hash of specified user as highlight variable for viewtopic.php in search results page...

CVE-2002-2012

Unknown vulnerability in Apache 1.3.19 running on HP Secure OS for Linux 1.0 allows remote attackers to cause "unexpected results" via an HTTP request...

CVE-1999-1052

Microsoft FrontPage stores form results in a default location in /private/formresults.txt, which is world-readable and accessible in the document root, which allows remote attackers to read possibly sensitive information submitted by other users...

Weak TCP Sequence Numbers in Sonicwall SOHO Firewall

This may not seem bad, but to me it seems that this defeats the point of NAT if somebody can steal your sessions. Note the section on TCP sequence prediction. This was a Sonicwall SOHO firewall. ======= Host 192.168.1.254 appears to be up ... good. Initiating SYN half-open stealth scan against...

Securax-SA-09.serv-u

===================================================================== Securax-SA-09 Security Advisory belgian.networking.security Dutch ===================================================================== Topic: Catsoft serv-U FTP Directory Transversal Vulnerability Announced: 2000-12-03 Updated...

isc-dhcpd.exploit.txt

Somebody at OpenBSD discovered a possible root exploit in the ISC DHCP client. I can confirm that as of 6:23am on June 23rd after several hours of hacking around the sources I had the following dhcpd config running on my own machine's private network for testing: shared-network LOCAL-NET option...

CVE-1999-1052

Microsoft FrontPage stores form results in a default location in /private/formresults.txt, which is world-readable and accessible in the document root, which allows remote attackers to read possibly sensitive information submitted by other users...