965 matches found
CVE-2006-0485
The TCL shell in Cisco IOS 12.214S before 12.214S16, 12.218S before 12.218S11, and certain other releases before 25 January 2006 does not perform Authentication, Authorization, and Accounting AAA command authorization checks, which may allow local users to execute IOS EXEC commands that were...
Cisco routers IOS TCL privilege escalation
User can execute any command by switching to TCL Tool Command Language mode...
[SA18613] Cisco IOS AAA Command Authentication Bypass Vulnerability
TITLE: Cisco IOS AAA Command Authentication Bypass Vulnerability SECUNIA ADVISORY ID: SA18613 VERIFY ADVISORY: http://secunia.com/advisories/18613/ CRITICAL: Less critical IMPACT: Security Bypass WHERE: Local system OPERATING SYSTEM: Cisco IOS R12.x http://secunia.com/product/50/ Cisco IOS 12.x...
Cisco IOS TCLSH AAA Command Authorization Bypass (CSCeh73049)
The remote host is a CISCO router containing a version of IOS that is vulnerable to a remote AAA command authorization bypass attack. The remote version of IOS does not enforce AAA command authorization checks for commands etnered in the TCL shell. An attacker with a shell access on the remote...
CVE-2004-2471
The CVE-2004-2471 entry describes an SQL injection in the sloth TCL script of QuoteEngine prior to 1.2.0, enabling remote attackers to execute arbitrary SQL via unknown vectors. The vulnerability affects the QuoteEngine component and is documented with a high impact score (base 7.5; Confidentiali...
CVE-2004-2471
SQL injection vulnerability in the sloth TCL script in QuoteEngine before 1.2.0 allow remote attackers to execute arbitrary SQL commands via unknown vectors...
xpvm symbolic links problem
Symbolic links problem in xpvm.tcl during temporary files creation...
CVE-2004-0015
The CVE concerns vbox3:0.1.8 and earlier where root privileges were not properly relinquished before executing a user-supplied TCL script, enabling a local user to gain privileges. Affected: vbox3 (ISDN4Linux vocal system); root privilege leak via privilege drop failure. Debian DSAs confirm fixes...
Mandrake Linux Security Advisory : tcltk (MDKSA-2002:060)
Some problems were discovered with the Tcl/Tk development environment. The expect application would search for its libraries in /var/tmp prior to searching in other directories, which could allow a local user to gain root privilege by writing a trojan library and waiting for the root user to run...
CVE-2002-0385
Vignette Story Server 4.1 and 6.0 allows remote attackers to obtain sensitive information via a request that contains a large number of '"' double quote and and '' characters, which causes the TCL interpreter to crash and include stack data in the output...
CVE-2002-0385
Vignette Story Server 4.1 and 6.0 allows remote attackers to obtain sensitive information via a request that contains a large number of '"' double quote and and '' characters, which causes the TCL interpreter to crash and include stack data in the output...
CVE-2004-0015
vbox3 0.1.8 and earlier does not properly drop privileges before executing a user-provided TCL script, which allows local users to gain privileges...
DSA-418 vbox3 - privilege leak
Bulletin has no description...
CVE-2003-0405
Vignette StoryServer 5 and Vignette V/6 allows remote attackers to execute arbitrary TCL code via 1 an HTTP query or cookie which is processed in the NEEDS command, or 2 an HTTP Referrer that is processed in the VALIDPATHS command...
CVE-2003-0405
Vignette StoryServer 5 and Vignette V/6 allows remote attackers to execute arbitrary TCL code via 1 an HTTP query or cookie which is processed in the NEEDS command, or 2 an HTTP Referrer that is processed in the VALIDPATHS command...
S21SEC-024 - Vignette TCL Injection
ID: S21SEC-024-en Title: Vignette TCL Injection Date: 03/04/2003 Status: Vendor contacted and solution available Scope: TCL code Execution, Remote command execution Platforms: All Author: rpinuaga Location: http://www.s21sec.com/es/avisos/s21sec-024-en.txt Release: External S 2 1 S E C...
Vignette Story Server sensitive information disclosure (a040703-1)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Advisory Name: Vignette Story Server sensitive information disclosure Release Date: 04/07/2003 Application: Vignette Story Server v4.1, 6 Platform: Windows / Unix Severity: A remote user can extract sessi...
CVE-2001-1375
CVE-2001-1375 affects tcl/tk (tcltk) 8.3.1, where libraries may be searched in the current working directory before others. This could allow a local user to execute arbitrary code by placing a Trojan library in a user-controlled directory. The Mandrake advisory notes a related issue and indicates...
Juergen Schoenwaelder scotty 2.1.x - ntping Buffer Overflow
// source: https://www.securityfocus.com/bid/2911/info ntping is a component of scotty, a Tcl interpreter used to retrieve status and configuration information for TCP/IP networks. The utility, which runs with root privileges, contains a locally exploitable buffer overflow vulnerability. A local...