DEBIAN-CVE-2002-1154

anlgform.pl in Analog before 5.23 does not restrict access to the PROGRESSFREQ progress update command, which allows remote attackers to cause a denial of service disk consumption by using the command to report updates more frequently and fill the web server error log...

DEBIAN-CVE-2002-0914

Double Precision Courier e-mail MTA allows remote attackers to cause a denial of service CPU consumption via a message with an extremely large or negative value for the year, which causes a tight loop...

Lynx 2.8.x - Command Line URL CRLF Injection

Lynx 2.8.x - Command Line URL CRLF Injection source: https://www.securityfocus.com/bid/5499/info A CRLF injection vulnerability has been reported for Lynx that may allow an attacker to include extra HTTP headers when viewing web pages. If Lynx is called from the command line, carriage return and...

Lynx 2.8.x - Command Line URL CRLF Injection

source: https://www.securityfocus.com/bid/5499/info A CRLF injection vulnerability has been reported for Lynx that may allow an attacker to include extra HTTP headers when viewing web pages. If Lynx is called from the command line, carriage return and line feed CRLF characters may be included in...

Microsoft Windows XP2000NT 4.0 - Window Message Subsystem Design Error (6)

Microsoft Windows XP2000NT 4.0 - Window Message Subsystem Design Error 6 // source: https://www.securityfocus.com/bid/5408/info A serious design error in the Win32 API has been reported. The issue is related to the inter-window message passing system. This vulnerability is wide-ranging and likely...

IBM Net.Commerce orderdspc.d2w order_rn Option SQL Injection

The macro orderdspc.d2w in the remote IBM Net.Commerce 3x is vulnerable to a SQL injection attack via the 'orderrn' option. An attacker may use it to abuse your database in many ways. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

CVE-2002-0299

CNet CatchUp before 1.3.1 allows attackers to execute arbitrary code via a .RVP file that creates a file with an arbitrary extension such as .BAT, which is executed during a scan...

Compaq Web-enabled Management Software HTTP Server Arbitrary Traffic Proxy

The remote Compaq Web Management Agent install can be used as an HTTP proxy. An attacker can use this to bypass firewall rules or hide the source of web-based attacks. Written by H D Moore Changes by Tenable: - Revised plugin title, changed family 1/21/2009 include"compat.inc"; ifdescription...

Microsoft Internet Information Server (IIS) contains cross-site scripting vulnerability in HTTP error page results

Overview Visitors to web sites that use Microsoft IIS and also use the default error pages are vulnerable to cross-site scripting attacks. Description Cross-site scripting is a form of attack in which an intruder leverages the trust between a victim and a web-site the victim trusts. Quoting from...

Microsoft Internet Information Server (IIS) contains cross-site scripting vulnerability in IIS Help Files search facility

Overview Visitors to web sites that use Microsoft IIS 5.0 and 5.1 are vulnerable to cross-site scripting attacks through the IIS help facility. Description Cross-site scripting is a form of attack in which an intruder leverages the trust between a victim and a web-site the victim trusts. Quoting...

Xoops Private Message System Script injection

-- Xoops Private Message System Script injection -- Discovered on 29/01/2002 Vendor: http://xoops.sourceforge.net -- Overview -- XOOPS is an open source portal script written extensively in object-oriented PHP, backend with MySQL Database. Xoops offers for members a Private Message System mail li...

PT-2001-2309 · Omnisecure · Omnisecure Httprotect

Name of the Vulnerable Software and Affected Versions: OmniSecure HTTProtect version 1.1.1 Description: The issue allows a superuser without omnish privileges to modify a protected file. This can be achieved by creating a symbolic link to the protected file, thereby bypassing the intended...

CVE-2000-0960

The vulnerability CVE-2000-0960 affects Netscape Messaging Server 4.15p1: the POP3 server exposes user enumeration by returning different error messages for incorrect usernames versus incorrect passwords, enabling an attacker to determine valid accounts and harvest email addresses. The connected ...

CVE-1999-0512

CVE-1999-0512 describes a mail server that is explicitly configured to allow SMTP relaying, enabling abuse by spammers. The connected documents corroborate an open mail-relay condition detected by various scanners (Nessus/OpenVAS) and consistently reference reconfiguring the SMTP server to preven...

CVE-1999-0512

A mail server is explicitly configured to allow SMTP mail relay, which allows abuse by spammers...

Alibaba tst.bat Arbitrary Command Execution

The 'tst.bat' CGI script is installed on this machine. This CGI has a well known security flaw that would allow an attacker to read arbitrary files on the remote system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; ifdescription...

smtp.acct.probing.txt

http://www.l8r.com/nwa/nwa1.htm Network Abuse Information SMTP Server abuse Software: GeoList Pro Author: www.earthonline.com SPECIAL UPDATE: 03/08/99 GeoList Pro is being pulled from distribution. Details can be found at EarthOnline's Site. Use the URL above. Jump to Updates Original Posting:...

netscape-4.x-DoS.txt

Date: Sun, 6 Sep 1998 00:53:24 +0200 From: Michal Zalewski To: [email protected] Subject: Sendmail, lynx, Netscape, sshd, Linux kernel twice Now, some DoSes on Netscape 4.0x browsers: ------------------------------------------ Meta refresh or href to URL "mocha:document.open'300k times A';"...

msie.5.0.setup.wizard.txt

Tue, 23 Mar 1999 11:41:24 +0200 Thor Kottelin Windows NT BugTraq Mailing List Thor Kottelin MSIE 5 installer disables screen saver After running the MSIE 5 installation wizard ie5setup.exe on two separate NT 4.0 SP4 machines - one Workstation, one Server - my screen saver Logon Screen Saver,...

[SECURITY] new version isdnutils fixes exploitable xmonisdn

We have received reports that the version of xmonisdn as distributed in the isndutils package from Debian GNU/Linux 2.1 has a security problem. Xmonisdn is an X applet that shows the status of the ISDN links. You can configure it to run two scripts when the left or right mouse button are clicked ...