2902 matches found
Web Server Generic XSS
The remote host is running a web server that fails to adequately sanitize request strings of malicious JavaScript. A remote attacker can exploit this issue, via a specially crafted request, to execute arbitrary HTML and script code in a user's browser within the security context of the affected...
MandrakeSoft Mandrake Linux Apache default configuration enables Perl ProxyPass server on 8200/tcp
Overview The default installation of Apache on MandrakeSoft Mandrake Linux configures an instance of the server to run apache-modperl listening on port 8200/tcp. Description MandrakeSoft produces a Linux distribution called Mandrake Linux that includes the Apache web server. The default...
Multiple Vulnerabilities in Access Control List Implementation for Cisco 12000 Series Internet Router
...
MS SQL 7.0 DTS saved packages contain plain text passwords
When creating a Data Transformation Service DTS Package be carefull. The saved file does not encrypt the passwords that the package will use when executed. If a client could convice an admin to create an example DTS package for troubleshooting then the client would have the admin's SQL password. ...
Пароли в открытом тексте в ARCServe for NT (readable cleartext passwords)
На разделяемом диске находится файл с паролем в открытом виде...
CVE-1999-1429
DIT TransferPro installs devices with world-readable and world-writable permissions, which could allow local users to damage disks through the ff device driver...
Дырка в Horde IMP (code execution)
Неинициализированные PHP-переменные позволяют выполнение скрипта заданного атакующим. Кроме того есть другие уязвимости...
CGIWrap 2.x3.x - Cross-Site Scripting
CGIWrap 2.x3.x - Cross-Site Scripting source: https://www.securityfocus.com/bid/3081/info CGIWrap is a free, open-source program for running CGI securely. CGIWrap does not filter embedded scripting commands from user-supplied input. A web user may submit a malicious link into any form which...
Проблемы с vipw (weak permissons)
После редактирования /etc/shadow файл становится открытым на чтение...
Переполнение буфера в sudo (buffer overflow)
Переполнение буфера...
webcgi98.txt
The following e-mail was sent to Acadsoft support about a week ago and I have yet recieved a response so I thought it was time to make it public. As I mentioned in the email I felt it was important because various universities use this as a registration utility. Hi, I was playing around with your...
Internet Explorer incorrectly validates certificates when CRL checking is enabled
Overview Microsoft Internet Explorer IE fails to properly validate certificates when CRL checking is enabled. As a result, sensitive information may be exposed. Description Digital certificates are small documents used to authenticate and encrypt information transmitted over the Internet. One ver...
Fixed in Apache Tomcat 3.2.2
Moderate: Cross site scripting CVE-2001-0829 The default 404 error page does not escape URLs. This allows XSS attacks using specially crafted URLs. Affects: 3.0, 3.1-3.1.1, 3.2-3.2.1 Moderate: Information disclosure CVE-2001-0590 A specially crafted URL can be used to obtain the source for JSPs...
Дырки при установке Interchange (default password)
При установке создаются пользователи с пустыми паролями...
Проблемы в Redi (cleartext password)
Пароль в текстовом виде попадает в открытый log-файл...
IBM Lotus Domino Administration Databases Anonymous Access
The remote Lotus Domino server allows an anonymous user to access sensitive information such as users, databases, configuration of servers including operating system and hard disk partitioning, and logs of access to users which could expose sensitive data if GET html forms are used. %NASLMINLEVEL...
Re: Security hole in kicq
I tried with version 1.0.0, it is vulnerable for sure. Other versions such as 2.0.0b1 seem to be vulerable as well, though i did not compile them to try. one little try shows that licq http://licq.org is vulerable too however the complete url will be visible to the user. greets, Wolter...
Borland/Inprise Interbase SQL database server contains backdoor superuser account with known password
Overview Description Interbase is an open source database package that is distributed by Borland/Inprise. The server contains a compiled-in backdoor account with a known password.In the following interbase code, references are made about a LOCKSMITH user: ./jrd/dyn.e ./jrd/isc.c ./jrd/jrd.c...