Lotus Domino multiple security vulnerabilities

LDAP Server heap overflow, Web access crossite scripting. Buffer overflow in IMAP CRAM-MD5 authentication...

Hidden ASP the back door of the three methods-vulnerability warning-the black bar safety net

1, The establishment of a non-standard directory: mkdir images..\ A copy of the ASP Trojan to the directory: copy c:\inetpub\wwwroot\news.asp c:\inetpub\wwwroot\images..\news.asp Through the web Access ASP Trojan: http://ip/images../news.asp?action=login How to delete a non-standard directory:...

T-Com Speedport ADSL router unauthorized access

Constant Cookie value is set for Web access verification...

Chetcpasswd本地权限提升漏洞

Chetcpasswd是一个允许用户通过Web更改自己Squid及Web访问口令的工具。 Chetcpasswd在处理参数时存在漏洞，本地攻击者可能利用此漏洞提升自己权限。 如果配置为使用postchange和alertemail的话，或在更改口令后将新的passwd文件拷贝到旧的passwd文件，chetcpasswd就可能不安全地执行外部程序，允许本地攻击者获得root用户权限。但要利用这个漏洞要求攻击者在服务器上拥有有效的shell帐号且知道允许使用chetcpasswd的IP地址。 CHETCPASSWD CHETCPASSWD 2.4.1...

Microsoft Outlook Web Access 'owalogon.asp' URL重定向漏洞

Microsoft Exchange Server是一款企业级的邮件服务程序。 Microsoft Outlook Web Access在处理URL时存在问题，远程攻击者可以利用这个漏洞重定向任意URL。 通过构建特殊URL，攻击者可以使用户重定向到任意URL，攻击者利用这个漏洞可以诱使用户访问某个页面，并可能记录密码并发送，或者下载任意文件等。 Microsoft Outlook 2003 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.microsoft.com/technet/security/ Donnie...

Microsoft Exchange Server OWA脚本注入漏洞（MS06-029）

Microsoft Exchange Server是一款流行的邮件服务器。 Exchange Server在处理邮件中的脚本存在漏洞，导致脚本代码在用户机器上非授权执行。 运行Outlook Web Access OWA的Exchange Server在某些情况下没有正确的过滤邮件中的 脚本，导致脚本注入漏洞。攻击者可以通过创建有特制脚本的邮件消息来利用这个漏洞。如果运行了特制脚本的话，就会在客户端以用户的安全环境执行。利用这个漏洞需要用户交互。 Microsoft Exchange Server 2003 SP2 Microsoft Exchange Server 2003 SP1...

[SA21988] CMtextS admin.txt Password Disclosure

TITLE: CMtextS admin.txt Password Disclosure SECUNIA ADVISORY ID: SA21988 VERIFY ADVISORY: http://secunia.com/advisories/21988/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: CMtextS 1.x http://secunia.com/product/11994/ DESCRIPTION: Kacper ha...

[SA21997] Amazing Little Poll "lp_settings.inc" Password Disclosure

TITLE: Amazing Little Poll "lpsettings.inc" Password Disclosure SECUNIA ADVISORY ID: SA21997 VERIFY ADVISORY: http://secunia.com/advisories/21997/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: Amazing Little Poll 1.x...

CVE-2006-4763

IBM Lotus Domino Web Access DWA 7.0.1 does not expire a client's Lightweight Third-Party Authentication token LtpaToken upon logout, which allows remote attackers to obtain a user's privileges by intercepting the LtpaToken cookie...

CVE-2006-4763

IBM Lotus Domino Web Access DWA 7.0.1 does not expire a client's Lightweight Third-Party Authentication token LtpaToken upon logout, which allows remote attackers to obtain a user's privileges by intercepting the LtpaToken cookie...

Invalid Lotus Domino Web access sesssion cookie handling

Server accepts session cookie after user logout...

[Full-disclosure] SEC Consult SA-20060613-0 :: Outlook Web Access Cross Site Scripting Vulnerability

SEC-CONSULT Security Advisory 20060613-0 ======================================================================= title: HTML Code Injection in Outlook Web Access program: Outlook Web Access vulnerable version: Exchange 2000 SP3, 2003 SP1, 2003 SP2 impact: severe homepage:...

Microsoft Exchange Outlook Web Access crossite scripting

Crossite scripting on message reading...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access OWA, allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing."...

CVE-2006-1193

CVE-2006-1193 describes a script-injection (XSS) vulnerability in Microsoft Exchange Server running Outlook Web Access (OWA) across Exchange 2000 SP1–SP3. The issue arises from improper sanitization of e-mail content read via OWA, allowing a remote attacker to inject and execute HTML/script in th...

Microsoft Exchange Server Outlook Web Access Script Injection Vulnerability

Description Microsoft Exchange Server Outlook Web Access is prone to a script-injection vulnerability. A remote attacker can exploit this issue by sending a malicious email message to a vulnerable user. Technologies Affected Microsoft Exchange Server 2000 SP3 Microsoft Exchange Server 2003 SP1...

Microsoft Exchange Server 20002003 - Outlook Web Access Script Injection

Microsoft Exchange Server 20002003 - Outlook Web Access Script Injection source: https://www.securityfocus.com/bid/18381/info Microsoft Exchange Server Outlook Web Access is prone to a script-injection vulnerability. A remote attacker can exploit this issue by sending a malicious email message to...

MS06-029: Vulnerability in Microsoft Exchange Server Running Outlook Web Access Could Allow Script Injection (912442)

The remote host is running a version of the Outlook Web Access that contains cross-site scripting flaws. This vulnerability could allow an attacker to convince a user to run a malicious script. If this malicious script is run, it would execute in the security context of the user. Attempts to...

Microsoft Exchange Server 2000/2003 - Outlook Web Access Script Injection

source: https://www.securityfocus.com/bid/18381/info Microsoft Exchange Server Outlook Web Access is prone to a script-injection vulnerability. A remote attacker can exploit this issue by sending a malicious email message to a vulnerable user. !/usr/bin/perl use Net::SMTP; my $to =...

Microsoft Security Bulletin MS06-029 Vulnerability in Microsoft Exchange Server Running Outlook Web Access Could Allow Script Injection (912442)

Microsoft Security Bulletin MS06-029 Vulnerability in Microsoft Exchange Server Running Outlook Web Access Could Allow Script Injection 912442 Published: June 13, 2006 Version: 1.0 Summary Who should read this document: Customers who use Microsoft Exchange Server running Microsoft Outlook Web...