Photopost PHP Pro photo Parameter SQL Injection

The version of Photopost PHP Pro installed on the remote host fails to sanitize user-supplied input to the 'photo' parameter of the 'showphoto.php' script before using it in a database query. An unauthenticated attacker may be able to exploit this issue to uncover sensitive information, modify...

Local root exploit in SuSE Linux 7.3Pro

Affected: SuSE Linux 7.3Pro Not affected: SuSE Linux 8.2Pro, non-SuSE distributions Possibly affected: other SuSE distributions Vulnerable package: javarunt Impact: Local user can gain root privileges Exploit type: Symlink attack Release...

(RHSA-2003:293) openssl security update

OpenSSL is a commercial-grade, full-featured, and open source toolkit that implements Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols as well as a full-strength general purpose cryptography library. NISCC testing of implementations of the SSL protocol uncovered two bu...

[SECURITY] [DSA-389-1] New ipmasq packages fix insecure packet filtering rules

-------------------------------------------------------------------------- Debian Security Advisory DSA 389-1 [email protected] http://www.debian.org/security/ Matt Zimmerman September 20th, 2003 http://www.debian.org/security/faq -...

Critical: Red Hat Security Advisory: sendmail security update

Updated Sendmail packages that fix a potentially-exploitable vulnerability are now available. Sendmail is a widely used Mail Transport Agent MTA and is included in all Red Hat Enterprise Linux distributions. There is a bug in the prescan function of Sendmail versions prior to and including 8.12.9...

Moderate: Red Hat Security Advisory: kdebase security update

Updated KDE packages that resolve a local security issue with KDM PAM support and weak session cookie generation are now available. KDE is a graphical desktop environment for the X Window System. KDE between versions 2.2.0 and 3.1.3 inclusive contain a bug in the KDE Display Manager KDM when...

Polycom ViaVideo Web Server Incomplete HTTP Connection Saturation Remote DoS

The remote web server locks up when several incomplete web requests are sent and the connections are kept open. Some servers e.g. Polycom ViaVideo even run an endless loop, using much CPU on the machine. Nessus has no way to test this, but you'd better check your machine. C Tenable Network...

IRIX nsd server and modules mishandle AUTH_UNIX gid list

-----BEGIN PGP SIGNED MESSAGE----- SGI Security Advisory Title : IRIX nsd server and modules mishandle AUTHUNIX gid list Number : 20030704-01-P Date : July 29, 2003 Reference : CVE CAN-2003-0575 Reference : SGI BUG 873591 Fixed in : IRIX 6.5.22 or patches 5189-5197 SGI provides this information...

Moderate: Red Hat Security Advisory: unzip security update

Updated unzip packages resolving a vulnerability allowing arbitrary files to be overwritten are now available. Updated 15 August 2003 Ben Laurie found that the original patch to fix this issue missed a case where the path component included a quoted slash. These updated packages contain a new pat...

Moderate: Red Hat Security Advisory: tcpdump security update

Updated tcpdump packages that fix an infinite loop vulnerability and drop privileges on startup are now available. Tcpdump is a command-line tool for monitoring network traffic. A vulnerability exists in tcpdump before 3.7.2 and is related to an inability to handle unknown RADIUS attributes...

HP-UX FTPD REST Command Remote Arbitrary Memory Disclosure

The remote FTP server seems to be vulnerable to an integer conversion bug when it receives a malformed argument to the 'REST' command. An attacker may exploit this flaw to force the remote FTP daemon to disclose portions of the memory of the remote host. %NASLMINLEVEL 70300 C Tenable Network...

ST FTP Service Arbitrary File/Directory Access

The remote FTP server is vulnerable to a flaw that allows users to access files that are outside the FTP server root. An attacker may break out of his FTP jail by issuing the command : CWD C: TRUSTED...

Low: Red Hat Security Advisory: sharutils security update

Updated packages for sharutils which fix potential privilege escalation using the uudecode utility are available. The sharutils package contains a set of tools for encoding and decoding packages of files in binary or text format. The uudecode utility creates an output file without checking to see...

TCP/IP SYN+FIN Packet Filtering Weakness

The remote host does not discard TCP SYN packets that have the FIN flag set. Depending on the kind of firewall you are using, an attacker may use this flaw to bypass its rules. C Tenable Network Security, Inc. Ref: To: [email protected] From: [email protected] Date: Mon, 5 May 2003 11:01:0...

CiscoSecure ACS for Windows CSAdmin Login Overflow DoS

The remote web server crashed when the 'login.exe' CGI received a too login query string. This leads to a denial of service or even execution of arbitrary code. Some versions of Cisco Secure ACS web server are known to be vulnerable to this flaw. This script was written by Xue Yong Zhi Rewritten ...

MS03-012: Microsoft ISA Server Winsock Proxy DoS (331066)

A vulnerability in Microsoft Proxy Server 2.0 and ISA Server 2000 allows an attacker to cause a denial of service of the remote Winsock proxy service by sending a specially crafted packet that would cause 100% CPU utilization on the remote host and make it unresponsive. C Tenable Network Security...

IBM Tivoli Firewall Toolbox (TFST) Unspecified Remote Overflow

The remote service probably the Tivoli Relay daemon is vulnerable to a buffer overflow when it receives a long string. An attacker may use this flaw to execute arbitrary code on this host with the privilege of the user 'nobody'. C Tenable Network Security, Inc. Ref: Date: Thu, 20 Mar 2003 18:46:5...

Critical: Red Hat Security Advisory: sendmail security update

Updated Sendmail packages are available to fix a vulnerability that may allow remote attackers to gain root privileges by sending a carefully crafted message. Updated March 18 2003 Added packages for Red Hat Enterprise Linux ES and Red Hat Enterprise Linux WS. Sendmail is a widely used Mail...

Microsoft Content Management Server (MCMS) 2001 Multiple Remote Vulnerabilities

The remote host is running Microsoft Content Management Server. There is a buffer overflow in the Profile Service that could allow an attacker to execute arbitrary code on this host. C Tenable Network Security, Inc. Supercedes MS02-010 Thanks to Dave Aitel for the details. include"compat.inc"; if...

MS02-045: Unchecked buffer in Network Share Provider (326830)

Due to a flaw in Microsoft's SMB implementation, the remote host is vulnerable to a denial of service attack. By sending a specially crafted packet request, an attacker could launch a denial of service, causing the affected host to crash. Note that this vulnerability is not exploitable without...