Mantis Bug Tracker 0.15.x/0.16/0.17.x - JPGraph Remote File Inclusion Command Execution

source: https://www.securityfocus.com/bid/5504/info Mantis depends on include files to provide some functionality, such as dynamic generation of graphs. However, since Mantis does not properly validate the path to the include file, it is possible for attackers to specify an arbitrary path, either...

GoAhead Web Server 2.1.x - URL Encoded Slash Directory Traversal

source: https://www.securityfocus.com/bid/5197/info A vulnerability has been reported for GoAhead WebServer 2.1. Reportedly, it is possible to launch directory traversal attacks against GoAhead WebServer. It is possible for remote attackers to access arbitrary files residing on a vulnerable host...

CVE-2002-0455

IncrediMail stores attachments in a directory with a fixed name, which could make it easier for attackers to exploit vulnerabilities in other software that rely on installing and reading files from directories with known pathnames...

Cisco Security Advisory: ATA-186 Password Disclosure Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Cisco Security Advisory: ATA-186 Password Disclosure Vulnerability Revision 1.0: INTERIM For Public Release 2002 May 23 16:00 GMT - ------------------------------------------------------------------------------- Contents ======== Summary Affected Products Detail...

AirConnect Default Password

This AirConnect wireless access point still has the default password set for the web interface. This could be abused by an attacker to gain full control over the wireless network settings. This script was written by H D Moore Information about the AP provided by Brian Caswell Chnages by Tenable :...

ISC DHCPD 2.03.0.1 - NSUPDATE Remote Format String

ISC DHCPD 2.03.0.1 - NSUPDATE Remote Format String // source: https://www.securityfocus.com/bid/4701/info The ISC DHCPD Dynamic Host Configuration Protocol is a collection of software implementing the DHCP protocol. It is available for a range of operating systems, including BSD and Solaris. A...

IRIX 6.5.x - Performance Co-Pilot Remote Denial of Service

IRIX 6.5.x - Performance Co-Pilot Remote Denial of Service source: https://www.securityfocus.com/bid/4642/info Performance Co-Pilot PCP is a set of services to support system-level performance monitoring developed by SGI. It has traditionally been an IRIX product, however SGI has made it open...

Citrix NFuse 1.51/1.6 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/4372/info Citrix NFuse is an application portal server meant to provide the functionality of any application on the server via a web browser. NFuse works in conjunction with a previously-installed webserver. NFuse is said to support almost any operating...

Details and exploitation of buffer overflow in mshtml.dll (and few sidenotes on Unicode overflows in general)

Dear, Advisory was originally posted in 1-3 2 weeks ago, so I think it's enough time passed to publish some details, because 4,5 have enough information to re-discover vulnerability. ERRor erroratpochtamt.ru discovered IE 5.5 and 6.0 in some cases crash on embed src="filename.AAAAAAAAAAlot of 'A'...

codeblue remote root

/ Demonstration linux-x86 remote root against codeblue v1.1 from file header Otherwise it's known as CodeBlue v4 This is a rather trivial to exploit... From getsmtpreply "We'll loop infinately, receiving 1 byte at a time until we receive a carriage return or line-feed character, signifying the en...

[NGSEC-2002-1] Ettercap, remote root compromise

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Next Generation Security Technologies http://www.ngsec.com Security Advisory Title: Ettercap, remote root compromise ID: NGSEC-2002-1 Application: ettercap 0.6.3.1 and older http://ettercap.sourceforge.net Date: 05/02/2002 Status: Vendor Contacted, ne...

Microsoft Internet Explorer 6.0 / Mozilla 0.9.6 / Opera 5.1 - Image Count Denial of Service

source: https://www.securityfocus.com/bid/3684/info An issue which affects users of multiple web browsers on Microsoft Windows platforms has been discovered. An unusually high image count may cause a denial of services to users who view the webpage containing the offending image. Malicious...

Fetchmail 5.x - IMAP Reply Signed Integer Index

// source: https://www.securityfocus.com/bid/3166/info Fetchmail is a unix utility for downloading email from mail servers via POP3 and IMAP. Fetchmail contains a vulnerability that may allow for remote attackers to gain access to client systems. The vulnerability has to do with the use of a...

CVE-2001-0106

Vulnerability in inetd server in HP-UX 11.04 and earlier allows attackers to cause a denial of service when the "swait" state is used by a server...

Advisory CA-2001-09

-----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-2001-09 Statistical Weaknesses in TCP/IP Initial Sequence Numbers Original release date: May 01, 2001 Last revised: -- Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affected Systems using TCP stacks...

SSH 1.2.x - CRC-32 Compensation Attack Detector

SSH 1.2.x - CRC-32 Compensation Attack Detector // source: https://www.securityfocus.com/bid/2347/info Secure Shell, or SSH, is an encrypted remote access protocol. SSH or code based on SSH is used by many systems all over the world and in a wide variety of commercial applications. An...

Lotus Domino Server 5.0.x - Directory Traversal (1)

source: https://www.securityfocus.com/bid/2173/info It is possible for a remote user to gain access to any known file residing on the Lotus Domino Server 5.0.6 and previous. A specially crafted HTTP request comprised of '.nsf' and '../' along with the known filename, will display the contents of...

AOL Instant Messenger 4.04.1.20104.2.1193 - BuddyIcon Buffer Overflow

AOL Instant Messenger 4.04.1.20104.2.1193 - BuddyIcon Buffer Overflow source: https://www.securityfocus.com/bid/2122/info AOL Instant Messenger AIM is a real time messaging service for users that are on line. When AOL Instant Messenger is installed, by default it configures the system so that the...

Microsoft Internet Explorer 5 - 'INPUT TYPE=FILE' Remote File Upload

Example.. IE 5 Versiontd align="right"...

RESIN ServletExec JSP Source Disclosure Vulnerability(Resin Web Server)

Resintm serves the fastest servlets and JSP. With Java and JavaScript support, Resin gives web applications the flexibility to choose the right language for the task. Resin's leading XSL XML stylesheet language support encourages separation of content from formatting. Resin provides a standalone...