Eyedog ActiveX control incorrectly marked "safe for scripting"

Overview Versions of the Eyedog ActiveX control current circa August, 1999, are incorrectly marked safe for scripting. Description Eyedog is an ActiveX control that was used to perform diagnostic function in Windows. It was marked as safe for scripting, which means that it could be called from...

leak of information in counterpane/Bruce Schneier's Password Safe program

Background : Password Safe http://www.counterpane.com/passsafe.html is a free win9x/2000 utility used to keep all your passwords encrypted on hdd using Bruce Schneier's symmetric algorithm blowfish. Version tested : 1.71 Vulnerability : Password Safe has an option I think is default to "lock...

CVE-2001-0984

Password Safe 1.71 leaves cleartext passwords in memory when a user copies the password to the clipboard and minimizes Password Safe with the "Clear the password when minimized" and "Lock password database on minimize and prompt on restore" options enabled, which could allow an attacker with acce...

CVE-1999-1206

The CVE-1999-1206 issue concerns SystemSoft SystemWizard on HP Pavilion PCs running Windows 98, where two ActiveX controls (LaunchCtrl and RegistryAccess) marked as safe-for-scripting can be used by a malicious web page to execute arbitrary commands. The vulnerabilities are tied to the Registry O...

PHP Safe Mode mail Function 5th Parameter Arbitrary Command Execution

The remote host is running PHP 4.0.5. There is a flaw in this version of PHP that allows local users to circumvent the safe mode and to gain the UID of the HTTP process. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. References: Date: Fri, 23 Aug 2002 09:30:40 +0200 CEST From: "Wojciech...

CVE-2001-1246

PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters...

PT-2001-2378 · Php · Php

Name of the Vulnerable Software and Affected Versions: PHP versions 4.0.5 through 4.1.0 Description: The issue is related to the mail function in PHP, where the 5th parameter is not properly cleansed in safe mode, allowing local users and possibly remote attackers to execute arbitrary commands vi...

bugtraq submission

All versions of the C version of ePerl 2.2 up to current version 2.2.14 http://www.engelschall.com/sw/eperl/ Severity: Low Systems Affected: Unix systems Description: ePerl allows the user to embed perl code specified inside ePerl delimiters in HTML. ePerl has the ability to "safely" include...

RhinoSoft FTP Voyager FtpTree incorrectly marked "safe for scripting"

Overview FTP Voyager is an FTP client implemented as an ActiveX control. It is incorrectly marked as "safe for scripting" allowing malicious web pages or email messages to upload and download files. Description FTP Voyager is an FTP client implemented as an ActiveX control. An ActiveX control may...

A Stateful Inspection of FireWall-1

A Stateful Inspection of FireWall-1 Thomas Lopatic, John McDonald TUV data protect GmbH tl,[email protected] Dug Song Center for Information Technology Integration University of Michigan [email protected] 1 Introduction -------------- At the Black Hat Briefings 2000, we presented an analysis of...

CVE-2000-0419

The Office 2000 UA ActiveX control is described as wrongly marked “safe for scripting.” This vulnerability allows an intruder to script interactions through the control’s Show Me feature, potentially disabling macro warnings and enabling arbitrary actions within Office applications (e.g., launchi...

CVE-2000-0059

PHP3 with safemode enabled does not properly filter shell metacharacters from commands that are executed by popen, which could allow remote attackers to execute commands...

PHP 3.0.13 - Safe_mode Failure

PHP 3.0.13 - Safemode Failure source: https://www.securityfocus.com/bid/911/info PHP Version 3.0 is an HTML-embedded scripting language. Much of its syntax is borrowed from C, Java and Perl with a couple of unique PHP-specific features thrown in. The goal of the language is to allow web developer...

PHP 3.0.13 - 'Safe_mode' Failure

source: https://www.securityfocus.com/bid/911/info PHP Version 3.0 is an HTML-embedded scripting language. Much of its syntax is borrowed from C, Java and Perl with a couple of unique PHP-specific features thrown in. The goal of the language is to allow web developers to write dynamically generat...

CVE-1999-0379

Microsoft Taskpads allows remote web sites to execute commands on the visiting user's machine via certain methods that are marked as Safe for Scripting...

CVE-1999-0379

The CVE-1999-0379 entry concerns the Taskpads ActiveX control included with Windows/Resource Kit components. The vulnerability arises because the Taskpads ActiveX control was incorrectly marked as Safe-for-Scripting, enabling remote web content to trigger execution of commands on a visiting user’...

msie.fixes.4.99.txt

Date: Wed, 21 Apr 1999 18:13:39 -0700 From: [email protected] To: [email protected] Subject: Microsoft Security Bulletin MS99-011 The following is a Security Bulletin from the Microsoft Product Security Notification Service. Please do not reply to this message, as it was sent from an...

foolproof.txt

Fooling Foolproof Security By Nightmare Foolproof security is a program that runs on a windows 9x box. The purpose of foolproof I guess is to keep people that don't know really know what they are doing from messing with stuff. It can be quite a annoying program if you are trying to do anything wi...

foolproof-bypass.txt

FoolProof found to be full of security glitches FoolProof a product by SmartStuff was intentionally programed to stop users from increasing computer maintaince by installing new software, changing the current computer configuration and so on by limiting the functions a user can do. The mentioned...

foolproof-PC.txt

Date: Wed, 4 Nov 1998 15:55:09 -0500 From: Krish Jagannathan To: [email protected] Subject: FoolProof for PC Exploit I figured this much out -- if you are running on FoolProof for the PC Win9x and you boot up in safe mode with or without network support it will bypass the FoolProof TSR and...