Phorum Discussion Board Security Bug (Email Disclosure)

Concerning latest Phorum version 3.3.2 A bug in the PHP based forum script Phorum makes it possible to obtain the email addresses of the 10 most active users. In the 'admin/' directory of the forum there is a script called 'stats.php' that allows administrators and anyone else, since there is no...

(Repost) CwpApi : GetRelativePath() returns invalid paths (security advisory)

ACD Incorporated Security Advisory Project: Comprehensive Web Programming API Synopsis: GetRelativePath in CwpApi.php returns paths outside of the HTTP ServerRoot. Advisory date: January 18, 2002 New version: 1.1.1 1. In Brief: An updated CwpApi release is available which fixes a minor security b...

CVE-1999-1373

FORE PowerHub (pre-5.0.1) is affected by a denial-of-service vulnerability: remote TCP SYN scans with TCP/IP OS fingerprinting (e.g., via nmap) can cause a hang. The available sources (NVD/NVD entry) confirm the attack vector is network-based and the impact is a partial availability loss. No reme...

security bug Internet Explorer 5

There is a security bug in the Internet Explorer 5 I haven't tested it on other browsers. It is possible to read some textfiles others than cookies from the client's hard disk. If there is for example in the directory 'C:WINNT' a textfile 'test.txt' with content: us="stefaan" passwd="mypasswd" th...

Fw: [net-com] Bug in Mirc v5.82

----- Original Message ----- From: Trax [email protected] To: opers-xnet [email protected] Cc: net-com-xnet [email protected] Sent: Sunday, April 22, 2001 1:40 PM Subject: net-com Bug in Mirc v5.82 There is a bug in mirc v5.82 that allows remote control of clients via /quote and /ctcp not the ctcp...

Security bug in Internet Explorer - MSScriptControl.ScriptControl

Georgi Guninski security advisory 41, 2001 Security bug in Internet Explorer - MSScriptControl.ScriptControl Systems affected: IE 5.5 Win2K probably others versions/platforms, have not tested Risk: High Date: 31 March 2001 Legal Notice: This Advisory is Copyright c 2001 Georgi Guninski. You may...

PHP Security Advisory - Apache Module bugs

Problems ========= 1 PHP supports a configuration mechanism that allows users to configure PHP directives on a per-directory basis. Under Apache, this is usually done using .htaccess files. Due to a bug in the Apache module version of PHP, remote 'malicious users' might be able to create a specia...

BFTPd - vsprintf() Format Strings

BFTPd - vsprintf Format Strings / Copyright c 2000 - Security.is The following material may be freely redistributed, provided that the code or the disclaimer have not been partly removed, altered or modified in any way. The material is the property of security.is. You are allowed to adopt the...

Explanation Authentix Input Validation Error

Hi there, Yesterday I posted an advisory concerning a bug in Authentix that would allow users to bypass authentification. When I contacted the vendor about this they were very responsive and after some emails going here and there we agreed to postpone the bugtraq-posting for two weeks and give th...

Security issue with Compaq Easy Access Keyboard software

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Compaq's Easy Access Keyboard software version 1.3 contains a bug which could allow a privilege escalation on the local machine or domain. I have confirmed the bug running the Easy Access Keyboard software on Windows 2000 Professional SP1, but I suspe...

boa.server.txt

ID: S21SEC-005-en Title: Vulnerability in BOA web server v0.94.8.2 Date: 03/10/2000 Status: Vendor contacted, patch available Scope: Arbitrary file access Platforms: Unix Author: llmora Location: http://www.s21sec.com/en/avisos/s21sec-005-en.txt Release: Public S 2 1 S E C http://www.s21sec.com...

Vulnerability in BOA web server v0.94.8.2

ID: S21SEC-005-en Title: Vulnerability in BOA web server v0.94.8.2 Date: 03/10/2000 Status: Vendor contacted, patch available Scope: Arbitrary file access Platforms: Unix Author: llmora Location: http://www.s21sec.com/en/avisos/s21sec-005-en.txt Release: Public S 2 1 S E C http://www.s21sec.com...

Format strings: bug #1: BSD-lpr

Hi, INTRO ----- Welcome to a short series of security bugs, all involving mistakes with "user supplied format strings". This class of bug is very popular on Bugtraq at the moment, so what an ideal time for a few examples. BSD-lpr ------- If we look into lpr/lpd/printjob.c, we can find the followi...

Microsoft refuses to fix a security bug in Windows 2000

Microsoft refuses to fix a security bug in Windows 2000 Eugene Kalinin Medical Informatics Laboratory Moscow, Russia Aug 16, 2000 Yesterday Microsoft refused to fix a security problem in Windows 2000 RPC service. The bug in RPC service allows an attacker to put a Windows 2000 server out of servic...

Kerberos security vulnerability in SSH-1.2.27

I am writing to report a security bug in SSH 1.2.27. SOFTWARE AFFECTED: SSH 1.2.27 with Kerberos authentication support compiled in i.e. "configure --with-kerberos5". I have contacted SSH Communicators Security http://www.ssh.com about this, and they have just released ssh-1.2.28, which fixes thi...

Linux news 3.07.00

WU-FTPD 2.6.1 Вышла новая версия популярного FTP сервера WU-FTPD - WU-FTPD 2.6.1. В данной версии появилась поддержка virtual passwd/virtual shadow как в BeroFTPD. Кроме того пофиксен серьезный security баг, благодаря которому пользователь мог получить права root-а. Также пофиксен баг с возможной...

glftpd.privpath.txt

Glftpd 1.18 till 1.21b8 current beta have a serious problem with the privpath directives.... It will probably be fixed in the comming 1.21b9 but i have included a quick fix in this one to prevent exploits of this bug. Thanx for Hoopy for the quick fix glftpd dev team. Problem: When you know the...

SmartFTP Daemon v0.2 Beta Build 9 - Remote Exploit

I found a bug in the SmartFTP-D Server which will give an attacker full access to the server, if he has the right to write files on the server. For every user, the program is checking if a special Userfile exists Sample: Username=hacker & Userfile=hacker.FTPUser. If it exists, the configuration,...

smartftp.txt

I found a bug in the SmartFTP-D Server which will give an attacker full access to the server, if he has the right to write files on the server. For every user, the program is checking if a special Userfile exists Sample: Username=hacker & Userfile=hacker.FTPUser. If it exists, the configuration,...

Security Bug in Jana HTTP Server

Hello Bugtraqers, I found a directory travelling bug again, this time in JANA HTTP Server software available as freeware from http://www.jana-server.ocm.de . Here is a copy of the mail I sended to the author. eAX -------------------------------------------- Hello Thomas, I got your proxy/perver...