Sun Java Runtime Environment applet privilege escalation vulnerability

Overview The Sun Java Runtime Environment JRE may allow an untrusted Java applet to bypass Java security settings and execute arbitrary code. Description The Sun Java Runtime Environment provides the libraries and components necessary to run Java-based applications. There is an unspecified...

Singapore MD5 Administrative Password Disclosure

Singapore is a PHP based photo gallery web application. Due to inaddequate security settings, the file used to stored the administrative password is easily accessible, and the MD5 with which the product protects the password is feasibably crackable. SPDX-FileCopyrightText: 2004 Noam Rathaus Some...

CVE-2005-3171

CVE-2005-3171 affects Microsoft Windows 2000 before Update Rollup 1 for SP4. The issue occurs when Event ID 1704 is recorded to indicate that Group Policy security settings were updated, even if the processing fails (for example, Ntuser.pol cannot be accessed). This may cause administrators to be...

CVE-2005-3171

Microsoft Windows 2000 before Update Rollup 1 for SP4 records Event ID 1704 to indicate that Group Policy security settings were successfully updated, even when the processing fails such as when Ntuser.pol cannot be accessed, which could cause system administrators to believe that the system is...

Microsoft Internet Explorer Unspecified DigWebX ActiveX Control Vulnerability

Description Microsoft Internet Explorer is prone to an unspecified vulnerability in the DigWebX ActiveX control. The vendor has not released any further information about this vulnerability other than to state the "kill bit" has been set on unsupported versions of the control. Technologies Affect...

SSL - General Settings (CVE-2003-0719; CVE-2004-0826)

SSL Protections use a SSL protocol parser which uses a default port of TCP/443, but this port can be reconfigured...

ieBad.txt

Wednesday, March 31, 2004 This is somewhat disconcerting. Reference the recently disclosed Internet Explorer 'bug' presently in the wild original discussion: http://www.securityfocus.com/archive/1/358813 with additional input buried thereunder in subsequent threads allowing for complete remote...

apache local protection bypass

It's possible to bypass few security settings with ErrorDocument...

CSSoft-EZTRansI-Eng.txt

STG Security Advisory: SSA-20030701-03 ChangshinSoft ezTrans Server File Download Vulnerability Revision 1.1 Date Published: 2003-07-08 KST Last Update: 2003-07-08 Disclosed by SSR Team [email protected] Synopsis ======== ezTrans Server, used by famous portal sites in Korea, is a real-time...

CVE-2002-0493

CVE-2002-0493 affects Apache Tomcat where the web.xml parsing could proceed with errors and allow Tomcat to start with improper security settings, bypassing intended access restrictions. Affected component: Tomcat startup/security settings during web.xml read. Root cause described across sources ...

Vulnerabilities in Microsoft's Java implementation

OVERVIEW ======== Microsoft Internet Explorer comes with Java virtual machine and accompanying class packages. Multiple security vulnerabilities have been found in the Java environment. Some of these allow an attacker to deliver and run arbitrary code on the Internet Explorer or Outlook user's...

CVE-2002-0493

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions...

Mandrake Security may make unexpected system modifications

Overview The Mandrake Security utility included with Mandrake Linux may make unexpected modifications that affect system security. Description Mandrake Linux includes a tool named Mandrake Security msec that allows system administrators to manage and audit various system parameters associated wit...

AOL Instant Messenger installer adds "http://free.aol.com" to Trusted Sites Zone in Microsoft Internet Explorer

Overview The installer for AOL Instant Messenger contains a vulnerability that weakens the security settings of Microsoft Internet Explorer. Description There is a vulnerability in the installer for AOL Instant Messenger AIM that silently adds "http://free.aol.com" to the list of Trusted Sites in...

How Outlook 2002 can still execute JavaScript in an HTML email message

Hello, Windows Media Player WMP reintroduces the ability to automatically execute JavaScript code from an HTML email message in Outlook 2002. JavaScript is disabled by default in Outlook 2002, because it can facilitate the creation of worms and other malicious code which is carried by HTML email...

CVE-2001-0984

Password Safe 1.71 leaves cleartext passwords in memory when a user copies the password to the clipboard and minimizes Password Safe with the "Clear the password when minimized" and "Lock password database on minimize and prompt on restore" options enabled, which could allow an attacker with acce...

ZoneAlarm Pro Local Internet not only Locally!

ZoneAlarm Pro is firewall for Windows home-users. The following was tested with ZoneAlarm Pro latest version: 2.6.357 Im not sure if it also works with the free version but I can't imagine why it wouldn't. Similair to Internet Explorer ZoneAlarm Pro ZAP has security settings for Local and Interne...

Serious security Flaw in Microsoft Internet Explorer - Zone Spoofing

Serious security Flaw in Microsoft Internet Explorer - Zone Spoofing ------ Risk: POTENTIALLY HIGH. Potentially allowing any possible action on the client machine, including reading any file, placing Trojan code or altering data. The risk depends on the security settings in the 'Intranet zone'...

Security Bulletin MS01-051

---------------------------------------------------------------------- Title: Malformed Dotless IP Address Can Cause Web Page to be Handled in Intranet Zone Date: 10 October 2001 Software: Internet Explorer Impact: Three vulnerabilities: - Cause web page to render a web page using inappropriate...

Symantec Security Response SecBul-10042001, Revision1, Malformed Microsoft Excel or PowerPoint documents bypass Microsoft macro security features

Symantec Security Bulletin Symantec Security Response SecBul-10042001 Date Issued: 04 October 2001 Revision 1: 05 October,2001 HEADLINE: Malformed Microsoft Excel or PowerPoint documents bypass Microsoft macro security features. SOURCE: Symantec Corporation. RISK Impact: High Unauthorized macro...