DSA-180 nis - information leak

Bulletin has no description...

[SECURITY] [DSA 178-1] New Heimdal packages fix remote command execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 178-1 [email protected] http://www.debian.org/security/ Martin Schulze October 17th, 2002 http://www.debian.org/security/faq -...

Mike Spice's My Calendar does not adequately validate user input

Overview Mike Spice's My Calendar does not adequately validate user input, allowing directory traversal. As a result, an attacker can cause My Calendar to overwrite any file on the server to which the web server process has write privileges. Description Mike Spice's My Calendar is a CGI script...

IBM AIX FC contains buffer overflow exploitable during session setup

Overview The FC client in IBM's AIX contains a buffer overflow that may cause a core dump in the client. Description The IBM AIX FC client allows a buffer overflow of a few bytes in the client process, which could cause intermittent core dumps during session setup. Overflowing the buffer is...

PHP-Nuke Network Tools Add-On Arbitrary Command Execution

It is possible to make the remote host execute arbitrary commands through the use of the PHPNuke addon called 'Network Tools'. An attacker may use this flaw to gain a shell on this system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; ...

Viralator CGI Script Arbitrary Command Execution

The CGI 'viralator.cgi' is installed. Some versions of this CGI are don't check properly the user input and allow anyone to execute arbitrary commands with the privileges of the web server. No flaw was tested. Your script might be a safe version. %NASLMINLEVEL 70300 C Tenable Network Security, In...

Moderate: Red Hat Security Advisory: mm security update

Updated mm packages are now available for Red Hat Linux Advanced Server. This update addresses possible vulnerabilities in how the MM library opens temporary files. The MM library provides an abstraction layer which allows related processes to easily share data. On systems where shared memory or...

KF Web Server version 1.0.2 shows file and directory content

KF Web Server version 1.0.2 shows file and directory content .oO Overview Oo. KF Web Server version 1.0.2 shows file and directory content Discovered on 2002, July, 2nd Vendor: KeyFocus http://www.keyfocus.net/kfws/ KF Web Server 1.0.2 is a free personal web server available for Windows...

Apache on Windows php.exe Malformed Request Path Disclosure

The version of Apache running on the remote Windows host will reveal the physical path of the PHP cgi binary when sent a specially crafted HTTP GET request. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid11008;...

[SNS Advisory No.52] Webmin/Usermin Cross-site Scripting Vulnerability

---------------------------------------------------------------------- SNS Advisory No.52 Webmin/Usermin Cross-site Scripting Vulnerability Problem first discovered: Thu, 2 May 2002 Published: Tue, 7 May 2002 ---------------------------------------------------------------------- Overview: -------...

ISC BIND < 4.9.7 / 8.1.2 Inverse-Query Remote Overflow

The remote BIND server, according to its version number, is vulnerable to an inverse query overflow which could allow an attacker to execute arbitrary code on the remote host. C Tenable Network Security, Inc. This script replaces bindbof.nes include"compat.inc"; if description scriptid10329;...

AgoraCart agora.cgi cart_id Parameter XSS

Agora is a CGI-based, e-commerce package. Due to poor input validation, Agora allows an attacker to execute cross-site scripting attacks. %NASLMINLEVEL 70300 This script was written by Matt Moore See the Nessus Scripts License for details include'deprecatednasllevel.inc'; include'compat.inc'; if...

ht://Dig htsearch Multiple Vulnerabilities

The remote CGI htsearch allows the user to supply his own configuration file using the '-c' switch, as in : /cgi-bin/htsearch?-c/some/config/file This file is not displayed by htsearch. However, if an attacker manages to upload a configuration file to the remote server, it may make htsearch read...

Sendmail < 8.11.6 -d category Value Local Overflow

The remote Sendmail server, according to its version number, may be vulnerable to a local buffer overflow allowing local users to gain root privileges. C Tenable Network Security, Inc. References also vulnerable to a heap overflow Date: Mon, 28 May 2001 18:16:57 -0400 EDT From: "Michal Zalewski"...

Local exploit for TrollFTPD-1.26

Affects: TrollFTPD 1.26 probably earlier Severity: local users can gain root access. Fix: upgrade to TrollFTPD-1.27 Fix URL: ftp://ftp.trolltech.com/freebies/ftpd/troll-ftpd-1.27.tar.gz Description: An error in the handling of recursive directory listings can result in an exploitable buffer...

Cisco IOS vulnerable to DoS via crafted PPTP packet sent to port 1723/tcp

Overview Cisco IOS contains a vulnerability that allows an intruder to crash the router. Description By sending a specially crafted PPTP packet to port 1723, an intruder can crash a device running a vulnerable version of IOS. Quoting from the Cisco Advisory: By sending a crafted PPTP packet to a...

Linux kernel contains race condition via ptrace/procfs/execve

Overview Unprivileged local users can use the ptrace function to take advantage of a privileged program, while that program is performing a privileged operation, to gain privileged access. Description Ptrace is a function, which is often used for debugging, that allows one process to attach to...

SimpleServer:WWW Encoded Traversal Arbitrary Command Execution

By sending a specially encoded string to the remote server, it is possible to execute remote commands with the privileges of the server. This script was written by Mathieu Meadele Script audit and contributions from Carmichael Security Erik Anderson nb: domain no longer exists Added BugtraqID...

Vulnerabilities in CrushFTP Server

----- Begin Hush Signed Message from [email protected] ----- Vulnerabilities in CrushFTP Server Overview CrushFTP Server 2.1.4 is a java ftp server available from http://www.crushftp.com. Multiple vulnerabilities exist which allow users to change directories outside of the ftp root and downlo...

tinyProxy Long Connect Request Overflow

It was possible to make the remote service crash by sending it the command : connect AAA...AAAA:// It may be possible for an attacker to execute arbitrary code on this host thanks to this flaw. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10596; scriptversion "1.26"...