8872 matches found
IBM HomePagePrint 1.0 7 - Remote Buffer Overflow
IBM HomePagePrint 1.0 7 - Remote Buffer Overflow // source: https://www.securityfocus.com/bid/763/info Certain versions of the IBM Web page printout software "IBM HomePagePrint " can in some instances be remotely exploited by malicious webservers. The problem lies in a buffer overflow in the code...
bsd_bugs.txt
Subject: serious problem in netbsd/openbsd procfs/fdesc To: [email protected] Greetings. I have found a nasty bug in the fdesc and procfs filesystems included with NetBSD and OpenBSD. Any user with access to a mounted procfs/fdesc filesystem has the ability to cause a kernel panic. The...
Microsoft Internet Explorer 5 / Netscape Communicator 4.0/4.5/4.6 - JavaScript STYLE
Microsoft Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4,Netscape Communicator 4.0/4.5/4.6 Javascript STYLE Vulnerability source: https://www.securityfocus.com/bid/630/info The HTML STYLE command can be used to embed Javascript into Hotmail email messages. The STYLE tag...
Netscape Communicator 4.064.54.64.514.61 - EMBED Buffer Overflow
Netscape Communicator 4.064.54.64.514.61 - EMBED Buffer Overflow / source: https://www.securityfocus.com/bid/618/info In several versions of Netscape Communicator, there is an unchecked buffer in the code that handles EMBED tags. The buffer is in the 'plugins page' option. This vulnerability can ...
msie4-object.txt
Date: Tue, 28 Jul 1998 10:10:36 PDT From: Georgi Guninski Subject: Object tag crashes Internet Explorer 4.0 The tag seems to crash Internet Explorer 4.0 under Win95 don't know about other versions/OS. The following: opens a dialog box "IEXPLORE: ...illegal operation" and closes IE 4.0, or a blue...
pop-spoof.pl
This is a simple tcp server that listens on port 110 unless another is specified. The possible uses of this are; Netscape/explorer mail password caching/grabbing In netscape edit your prefs.js file so that your pop server is your own ip 127.0.0.1 then open netscape and click on get mail then this...
solaris.2.5.su.expect.txt
Date: Thu, 10 Jun 1999 14:13:06 -0500 From: Dr. Mudge To: [email protected] Subject: Solaris 2.5 /bin/su was: vulnerability in su/PAM in redhat The same sort of problem existed in solaris /bin/su on 2.5 and below. The comments in the quick proof of concept sploit below should explain further h...
netscape.title.tag.about.txt
Date: Mon, 24 May 1999 14:24:13 +0300 From: Georgi Guninski To: [email protected] Subject: Netscape Communicator JavaScript in security vulnerability There is a security bug in Netscape Communicator 4.6 Win95, 4.07 Linux guess all 4.x versions are affected in the way they treat JavaScript code...
ps_expl.sh
--- psexpl.sh: cut here --- !/bin/sh Exploit for Solaris 2.5.1 /usr/bin/ps J. Zbiciak, 5/18/97 change as appropriate CC=gcc Build the "replacement message" :- cat psexpl.po psexpl.c include include include define BUFLENGTH 632 define EXTRA 256 int mainint argc, char argv char bufBUFLENGTH + EXTRA...
opera.txt
Date: Fri, 14 Aug 1998 09:54:09 +0800 From: "Zac Leow C.H" Subject: URL exploit to crash Opera Browser By putting an extra slash at the end of http:// tag will crash your opera browser. Tested on version 3.21 e.g. http:///opera.nta.no Seems to be save on Netscape and MSIE, they just generate an...
RedHat Linux 5.1 - xosview
// source: https://www.securityfocus.com/bid/362/info xosview is an X11 system monitoring application that ships with RedHat 5.1 installed setuid root. A buffer overflow vulnerability was found in Xrm.cc, the offending code listed below: char userrfilename1024; strcpyuserrfilename, getenv"HOME";...
PT-1999-1333 · Netscape · Netscape Communicator
Name of the Vulnerable Software and Affected Versions: Netscape Communicator affected versions not specified Description: The issue allows a remote attacker to gain access to browser information when Javascript is embedded within the TITLE tag, utilizing the "about" protocol. Recommendations: At...
CVE-1999-0465
Remote attackers can crash Lynx and Internet Explorer using an IMG tag with a large width parameter...
PT-1999-1146 · Lynx +1 · Lynx +1
Name of the Vulnerable Software and Affected Versions: Lynx affected versions not specified Internet Explorer affected versions not specified Description: The issue allows remote attackers to crash the browser using an IMG tag with a large width parameter. Recommendations: For Lynx, at the moment...
CVE-1999-1447
Internet Explorer 4.0 allows remote attackers to cause a denial of service crash via HTML code that contains a long CLASSID parameter in an OBJECT tag...
SCO Open Server 5.0.4 - POP Server Buffer Overflow
// source: https://www.securityfocus.com/bid/156/info A buffer overflow exists in the pop server shipped with Santa Cruz Operation, Inc's SCO Open Server. By presenting a buffer of sufficient length to the pop server, an attacker can overwrite the return address on the stack, and execute arbitrar...
SGI IRIX 6.2 - 'eject' Local Privilege Escalation (2)
// source: https://www.securityfocus.com/bid/351/info A vulnerability exists in the eject program shipped with Irix 6.2 from Silicon Graphics. By supplying a long argument to the eject program, it is possible to overwrite the return address on the stack, and execute arbitrary code as root. Eject ...
Solaris 2.5.1 - 'chkey' Local Privilege Escalation
/ source: https://www.securityfocus.com/bid/207/info The chkey program is used to change a users secure RPC Diffie-Hellman public key and secret key pair. A buffer overflow condition has been found in the chkey program. Since chkey has setuid root permissions, an unauthorized user may be able to...
BSD/OS 2.1 / DG/UX 4.0 / Debian 0.93 / Digital UNIX 4.0 B / FreeBSD 2.1.5 / HP-UX 10.34 / IBM AIX 4.1.5 / NetBSD 1.0/1.1 / NeXTstep 4.0 / SGI IRIX 6.3 / SunOS 4.1.4 - 'rlogin' Local Privilege Escalation
/ source: https://www.securityfocus.com/bid/242/info The SUID rlogin program is used to establish remote sessions. A buffer overflow condition has been found in the rlogin program that may allow an unauthorized user to gain root access. The overflow in particular is in the rlogin code that handle...
