Blazix Trailing Character JSP Source Disclosure

The remote host is running the Blazix web server, a web server written in Java. The installed version of Blazix discloses the source code of its JSP pages by requesting the pages while appending a plus sign or a backslash to its name. An attacker may use this flaw to get the source code of your...

fingerd Remote Overflow

Nessus was able to crash the remote finger daemon by sending a very long request. This is likely due to a buffer overflow. A remote attacker could potentially exploit this to execute arbitrary code. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid17141; scriptversion...

Debian DSA-684-1 : typespeed - format string

Ulf Harnhammar from the Debian Security Audit Project discovered a problem in typespeed, a touch-typist trainer disguised as game. This could lead to a local attacker executing arbitrary code as group games. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Emacs, XEmacs: Format string vulnerabilities in movemail

Background GNU Emacs and XEmacs are highly extensible and customizable text editors. movemail is an Emacs utility that can fetch mail on remote mail servers. Description Max Vozeler discovered that the movemail utility contains several format string errors. Impact An attacker could set up a...

vBulletin forumdisplay.php comma Parameter Arbitrary Command Execution

The remote version of vBulletin is vulnerable to a remote command execution flaw through the script 'forumdisplay.php'. A malicious user could exploit this flaw to execute arbitrary commands on the remote host with the privileges of the web server. %NASLMINLEVEL 70300 C Tenable Network Security,...

PowerDNS: Denial of Service vulnerability

Background The PowerDNS Nameserver is an authoritative-only nameserver which uses a flexible backend architecture. Description A vulnerability has been reported in the DNSPacket::expand method of dnspacket.cc. Impact An attacker could cause a temporary Denial of Service by sending a random stream...

Mailman: Directory traversal vulnerability

Background Mailman is a Python-based mailing list server with an extensive web interface. Description Mailman contains an error in private.py which fails to properly sanitize input paths. Impact An attacker could exploit this flaw to obtain arbitrary files on the web server. Workaround There is n...

pdftohtml: Vulnerabilities in included Xpdf

Background pdftohtml is a utility to convert PDF files to HTML or XML formats. It makes use of Xpdf code to decode PDF files. Description Xpdf is vulnerable to a buffer overflow, as described in GLSA 200501-28. Impact An attacker could entice a user to convert a specially-crafted PDF file,...

RaidenHTTPD Crafted Request Arbitrary File Access

The remote host is running a version of RaidenHTTPD which is vulnerable to a remote directory traversal bug. An attacker exploiting this bug would be able to gain access to potentially confidential material outside of the web root. C Tenable Network Security, Inc. include"compat.inc"; if...

LessTif: Multiple vulnerabilities in libXpm

Background LessTif is a clone of OSF/Motif, which is a standard user interface toolkit available on Unix and Linux. Description Multiple vulnerabilities, including buffer overflows, out of bounds memory access and directory traversals, have been discovered in libXpm, which is shipped as a part of...

PostgreSQL < 7.2.7 / 7.3.9 / 7.4.7 / 8.0.1 Multiple Vulnerabilities

The remote PostgreSQL server, according to its version number, is vulnerable to multiple flaws that could allow an attacker who has the rights to query the remote database to obtain a shell on this host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Newspost: Buffer overflow vulnerability

Background Newspost is a Usenet News binary autoposter. Description Niels Heinen has discovered a buffer overflow in the socketgetline function of Newspost, which can be triggered by providing long strings that do not end with a newline character. Impact A remote attacker could setup a malicious...

ngIRCd < 0.8.3 Log_Resolver() Format String

According to its banner, the version of the ngIRCd chat service running on the remote host contains a format string vulnerability. If it was compiled with IDENT, DEBUG is enabled, and it's logging to SYSLOG, a remote attacker can leverage this issue to execute arbitrary code on the remote host...

UW IMAP: CRAM-MD5 authentication bypass

Background UW IMAP is the University of Washington IMAP toolkit which includes POP3 and IMAP daemons. Description A logic bug in the code handling CRAM-MD5 authentication incorrectly specifies the condition for successful authentication. Impact An attacker could exploit this vulnerability to...

FireHOL: Insecure temporary file creation

Background FireHOL is an iptables rules generator. Description FireHOL insecurely creates temporary files with predictable names. Impact A local attacker could create malicious symbolic links to arbitrary system files. When FireHOL is executed, this could lead to these files being overwritten wit...

SmarterTools SmarterMail Attachment Upload XSS

There are flaws in the remote SmarterMail, a web mail interface. This version of SmarterMail is affected by a cross-site scripting issue. An attacker, exploiting this flaw, would be able to steal user credentials. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include 'compat.inc' ;...

ClamAV: Multiple issues

Background ClamAV is an antivirus toolkit. It includes a multi-threaded daemon and a command line scanner. Description ClamAV fails to properly scan ZIP files with special headers CAN-2005-0133 and base64 encoded images in URLs. Impact By sending a base64 encoded image file in a URL an attacker...

VDR: Arbitrary file overwriting issue

Background Video Disk Recorder VDR is a Linux-based digital video recorder. The VDR program handles the On Screen Menu system that offers complete control over channel settings, timers and recordings. Description Javier Fernandez-Sanguino Pena from the Debian Security Audit Team discovered that V...

[ GLSA 200501-40 ] ngIRCd: Buffer overflow

Gentoo Linux Security Advisory GLSA 200501-40 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

TikiWiki: Arbitrary command execution

Background TikiWiki is a web-based groupware and content management system CMS, using PHP, ADOdb and Smarty. Description TikiWiki does not validate files uploaded to the "temp" directory. Impact A malicious user could run arbitrary commands on the server by uploading and calling a PHP script...