CVE-2004-0996

main.c in cscope 15-4 and 15-5 creates temporary files with predictable filenames, which allows local users to overwrite arbitrary files via a symlink attack...

CVE-2004-1032

fcronsighup in Fcron 2.0.1, 2.9.4, and possibly earlier versions allows local users to delete arbitrary files or create arbitrary empty files via a target filename with a large number of leading slash / characters such that fcronsighup does not properly append the intended fcrontab.sig to the...

helvis -- arbitrary file deletion problem

The setuid root elvprsv utility, used to preserve recovery helvis files, can be abused by local users to delete with root privileges. The problem is that elvprsv deletes files when it thinks they have become corrupt. When elvprsv is pointed to a normal file then it will almost always think the fi...

SquirrelMail: Encoded text XSS vulnerability

Background SquirrelMail is a webmail package written in PHP. It supports IMAP and SMTP, and can optionally be installed with SQL support. Description SquirrelMail fails to properly sanitize certain strings when decoding specially-crafted headers. Impact By enticing a user to read a...

SQL Injection in UBB.threads 3.4.x

Product: ======== UBB.threads Vendor: ======= UBBCentral http://www.ubbcentral.com/ Versions: ========= I tested it successfull on 3.4.x At Version 3.5 you need to be logged in to perform a search. I didnt tested this version. Problem: ======== Sql-Injection in dosearch.php dosearch.php?Name=' OR...

Debian DSA-391-1 : freesweep - buffer overflow

Steve Kemp discovered a buffer overflow in freesweep, when processing several environment variables. This vulnerability could be exploited by a local user to gain gid 'games'. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracte...

Debian DSA-112-1 : hanterm - buffer overflow

A set of buffer overflow problems have been found in hanterm, a Hangul terminal for X11 derived from xterm, that will read and display Korean characters in its terminal window. The font handling code in hanterm uses hard limited string variables but didn't check for boundaries. This problem can b...

CVE-2004-0643

Double free vulnerability in the krb5rdcred function for MIT Kerberos 5 krb5 1.3.1 and earlier may allow local users to execute arbitrary code...

Serv-U up to 5.2 Denial of Service

Serv-U FTP server is a secure, advanced FTP server for Windows. However, like most programs, it is not completely bugfree. I and maybe more people with me found this bug some time ago. It can be triggered as every user that can log in, anonymous included, and exists in possibly every version. At...

CVE-2001-0837

DeltaThree Pc-To-Phone 3.0.3 is affected by a local-privilege issue where sensitive data is placed in world-readable locations within the installation directory. The vulnerable components include access to temp.html, the log folder, and the PhoneBook folder, enabling local users to read sensitive...

CVE-2004-0108

The isag utility, which processes sysstat data, allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CAN-2004-0107...

CVE-2002-1366

Common Unix Printing System CUPS 1.1.14 through 1.1.17 allows local users with lp privileges to create or overwrite arbitrary files via file race conditions, as demonstrated by ice-cream...

Qt: Image loader overflows

Background Qt is a cross-platform GUI toolkit used by KDE. Description There are several unspecified bugs in the QImage class which may cause crashes or allow execution of arbitrary code as the user running the Qt application. These bugs affect the PNG, XPM, BMP, GIF and JPEG image types. Impact ...

Microsoft Windows contains a vulnerability in the way the Windows Shell launches applications

Overview Microsoft Windows contains a remote code execution vulnerability in the way that the Windows Shell launches applications. An remote attacker could exploit this vulnerability to execute arbitrary code if they could trick a user into visiting a malicious website. Description Microsoft...

Shorewall : Insecure temp file handling

Background Shorewall is a high level tool for configuring Netfilter, the firewall facility included in the Linux Kernel. Description Shorewall uses temporary files and directories in an insecure manner. A local user could create symbolic links at specific locations, eventually overwriting other...

RHEL 2.1 / 3 : netpbm (RHSA-2004:031)

Updated NetPBM packages are available that fix a number of temporary file vulnerabilities in the netpbm libraries. The netpbm package contains a library of functions that support programs for handling various graphics file formats, including .pbm portable bitmaps, .pgm portable graymaps, .pnm...

[Full-Disclosure] Multiple vulnerabilities PowerPortal

http://www.swp-zone.org/archivos/advisory-07.txt ------------------------------------------------------------------------------------------------- :.: Multiple vulnerabilities PowerPortal :.: PROGRAM: PowerPortal HOMEPAGE: http://powerportal.sourceforge.net/ VERSION: v1.x BUG: Multiple...

[Full-Disclosure] CSA-200402-1: Previous Open Webmail vulnerability is exploitable

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cycom AB Security Advisory CSA-200402-1 www.cycom.se Advisory: Previous Open Webmail vulnerability is exploitable Date: Sat Feb 21 15:18:21 CET 2004, updated: Thu May 6 10:37:29 CEST 2004 Application: Open Webmail 2.20, 2.21 and 2.30 and -current...

CVE-2003-0618

Multiple vulnerabilities in suidperl 5.6.1 and earlier allow a local user to obtain sensitive information about files for which the user does not have appropriate permissions...

Another YabbSE SQL Injection

Summary YaBB SE is a PHP/MySQL port of the popular forum software YaBB yet another bulletin board. An SQL injection vulnerability allows a remote attacker to execute malicious SQL statements on the database remotely Details Vulnerable Systems: YaBB SE versions 1.5.4, 1.5.5, possibly others The fi...