CVE-2005-0285

Webseries Payment Application does not properly restrict privileged operations, which allows remote authenticated users to gain privileges by directly accessing certain URLs...

DelphiTurk FTP 1.0 - Passwords to Local Users

/ DelphiTurk FTP v1.0 Local Exploit by Kozan Application: DelphiTurk FTP v1.0 Procuder: Delphiturk.com and Delphikitabi.com Vulnerable Description: DelphiTurk FTP v1.0 passwords to local users. Coded by: Kozan Web : www.netmagister.com Web2: www.spyinstructors.com Mail: kozanatnetmagisterdotcom /...

[VulnWatch] iDEFENSE Security Advisory 02.08.05: IBM AIX auditselect Local Format String Vulnerability

IBM AIX auditselect Local Format String Vulnerability iDEFENSE Security Advisory 02.08.05 www.idefense.com/application/poi/display?id=193&type=vulnerabilities February 08, 2005 I. BACKGROUND The auditselect program is a setuid root application, installed by default under multiple versions of IBM...

CVE-2003-1082

Buffer overflow in utmpupdate for Solaris 2.6 through 9 allows local users to gain root privileges, as identified by Sun BugID 4705891, a different vulnerability than CVE-2003-1068...

CVE-2003-1071

rpc.walld wall daemon for Solaris 2.6 through 9 allows local users to send messages to logged on users that appear to come from arbitrary user IDs by closing stderr before executing wall, then supplying a spoofed from header...

CVE-2005-0250

Format string vulnerability in auditselect on IBM AIX 5.1, 5.2, and 5.3 allows local users to execute arbitrary code via format string specifiers in a command line argument...

CVE-2002-1590

The Web-Based Enterprise Management WBEM packages 1 SUNWwbdoc, 2 SUNWwbcou, 3 SUNWwbdev and 4 SUNWmgapp packages, when installed using Solaris 8 Update 1/01 or later, install files with world or group write permissions, which allows local users to gain root privileges or cause a denial of service...

Microsoft Windows SharePoint Services Cross-Site Scripting and Spoofing Vulnerability

Description A cross-site scripting and spoofing vulnerability affects Microsoft Windows SharePoint Services and SharePoint Team Services. A remote attacker may carry out a cross-site scripting attack to execute arbitrary HTML and script code in a user's browser. It is also possible to poison Web...

Microsoft Windows Media Player Remote PNG Image Format Buffer Overflow Vulnerability

Description A remote buffer overflow vulnerability affects the Portable Network Graphics PNG image format processing functionality of Microsoft Windows Media Player. This issue is due to a failure of the application to properly validate the size of image data prior to copying it into static proce...

CVE-2005-0018

The f2 shell script in the f2c package 3.1 allows local users to read arbitrary files via a symlink attack on temporary files...

CVE-2005-0125

The "at" commands on Mac OS X 10.3.7 and earlier do not properly drop privileges, which allows local users to 1 delete arbitrary files via atrm, 2 execute arbitrary programs via the -f argument to batch, or 3 read arbitrary files via the -f argument to batch, which generates a job file that is...

CVE-2005-0142

Vulnerability CVE-2005-0142 affects Firefox 0.9, Thunderbird 0.6 and older Mozilla line up to Mozilla 1.7.x prior to 1.7.5. The root cause described across connected advisories is that temporary files are saved with world-readable permissions, enabling a local user to read web content or attachme...

Apple Mac OS X "at" utilities fail to drop privileges properly

Overview Apple's Mac OS X operating system may allow local privilege escalation in family of "at" commands. Description Mac OS X includes the "at" family of commands in order to schedule tasks. However, a flaw in these commands results in the commands not dropping privileges correctly. This may...

Ingate Firewall: Removed PPTP tunnels not deactivated

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Product: Ingate Firewall Versions: 4.1.3 and earlier Tracking ID: 1826 Summary ======= Active PPTP tunnels in Ingate Firewall are not deactivated when a PPTP user is disabled. If a user has an active PPTP connection to an Ingate Firewall, and that use...

CVE-2004-1340

Debian GNU/Linux 3.0 installs the libpam-radius-auth package with the pamradiusauth.conf set to be world-readable, which allows local users to obtain sensitive information...

CVE-2004-1345

Unknown vulnerability in Sun StorEdge Enterprise Storage Manager ESM 2.1 for Solaris 8 and Solaris 9 allows local users with the "ESMUser" role to gain root access...

CVE-2004-1374

Multiple buffer overflows in NetBSD kernel may allow local users to execute arbitrary code and gain privileges...

CVE-2005-0118

helvis 1.8h21 and earlier stores recovery files in world readable directories with world readable permissions, which allows local users to read the recovered files of other users...

CVE-2004-1367

Oracle 10g Database Server, when installed with a password that contains an exclamation point "!" for the 1 DBSNMP or 2 SYSMAN user, generates an error that logs the password in the world-readable postDBCreation.log file, which could allow local users to obtain that password and use it against SY...

CVE-2004-1349

gzip before 1.3 in Solaris 8, when called with the -f or -force flags, will change the permissions of files that are hard linked to the target files, which allows local users to view or modify these files...