HP-UX PHSS_23096 : HPSBUX0102-142 Sec. Vulnerability in OV OmniBack (rev.1)

s700800 11.00 OV OB3.10 patch - CORE packet : Security vulnerability with HP OpenView OmniBack Clients, where unauthorized remote users can start a shell as System Administrator. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and patch checks in this plugin were extract...

[Full-Disclosure] [ GLSA 200502-18 ] VMware Workstation: Untrusted library search path

Gentoo Linux Security Advisory GLSA 200502-18 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

VMware Workstation: Untrusted library search path

Background VMware Workstation is a powerful virtual machine for developers and system administrators. Description Tavis Ormandy of the Gentoo Linux Security Audit Team has discovered that VMware Workstation searches for gdk-pixbuf loadable modules in an untrusted, world-writable directory. Impact...

Debian DSA-023-1 : inn2 - local tempfile vulnerabilities

People at WireX have found several potential insecure uses of temporary files in programs provided by INN2. Some of them only lead to a vulnerability to symlink attacks if the temporary directory was set to /tmp or /var/tmp, which is the case in many installations, at least in Debian packages. An...

CVE-2003-1412

PHP remote file inclusion vulnerability in index.php for GONiCUS System Administrator GOsa 1.0 allows remote attackers to execute arbitrary PHP code via the plugin parameter to 1 3fax/1blocklists/index.php; 2 6departamentadmin/index.php, 3 5terminals/index.php, 4 4mailinglists/index.php, 5...

GOnicus System Administrator php injection

I. BACKGROUND The GOnicus System Administrator is a PHP based administration tool for managing accounts/systems in LDAP databases. Project homepage : http://www.gonicus.de II. DESCRIPTION A remote attacker can inject into GOsa arbitrary PHP code that executes under the privileges of the underlyin...

GOsa Multiple Script plugin Parameter Remote File Inclusion

The remote web server is hosting GOnicus System Administrator GOsa, a PHP-based administration tool for managing accounts and systems in LDAP databases. The version of GOsa installed on the remote host fails to sanitize user input to the 'plugin' parameter of several scripts before using it to...

GONiCUS System Administrator 1.0 - Remote File Inclusion

source: https://www.securityfocus.com/bid/6922/info GONiCUS System Administrator is prone to an issue that may allow remote attackers to include files located on remote servers. This issue is present in several PHP pages existing in the /plugins and /includes folders. By crafting specific URI...

Security Update: [CSSA-2001-SCO.35] OpenServer: setcontext and sysi86 vulnerabilities

To: [email protected] [email protected] [email protected] Caldera International, Inc. Security Advisory Subject: OpenServer: setcontext and sysi86 vulnerabilities Advisory number: CSSA-2001-SCO.35 Issue date: 2001 November 29 Cross reference: 1. Problem Description This pat...

CVE-1999-1195

CVE-1999-1195 affects NAI VirusScan NT 4.0.2, where updating the virus-definition file (scan.dat) via FTP does not properly modify the file, yet the update is reported as successful. The consequence is that a system administrator could believe the definitions have been updated correctly when they...

CVE-2001-0396

The CVE-2001-0396 entry concerns Lightwave ConsoleServer 3200, where the pre-login mode of the System Administrator interface exposes sensitive information (system status, configuration, users) to remote attackers. The vulnerability arises before authentication, enabling information disclosure wi...

CVE-2000-0402

The Mixed Mode authentication capability in Microsoft SQL Server 7.0 stores the System Administrator sa account in plaintext in a log file which is readable by any user, aka the "SQL Server 7.0 Service Pack Password" vulnerability...

freebsd_DoS.txt

Subject: Local DoS in FreeBSD To: [email protected] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This was first posted to the FreeBSD security list on the 9th of August, subsequently discussed on freebsd-stable and freebsd-hackers... no one seems to care, even though it is able to lock u...

cobalt.raq.txt

Date: Thu, 25 Feb 1999 07:59:30 -0700 MST From: mea culpa To: InfoSec News Subject: ISN Teenager Finds Web-server hole. Forwarded From: William Knowles http://www.wired.com/news/printversion/technology/story/18109.html?wnpg=all Wired.com 2.25.99 A 17-year-old Pennsylvania high school student has...