simpleinit root exploit - file descriptor left open

Background ---------- Simpleinit is an init program for Linux systems. It is included in the util-linux distribution. More information about simpleinit is available at http://www.atnf.csiro.au/people/rgooch/linux/boot-scripts/. Problem ------- Simpleinit leaves a file descriptor open in some chil...

CVE-2002-0584

WorkforceROI Xpede 4.1 allows remote attackers to read user timesheets by modifying the TSN ID parameter to the tsappprocess.asp script, which is easily guessable because it is incremented by 1 for each new timesheet...

CVE-2002-0528

Watchguard SOHO firewall 5.0.35 unpredictably disables certain IP restrictions for customized services that were set before the administrator upgrades to 5.0.35, which could allow remote attackers to bypass the intended access control rules...

Shiva LanRover Blank Password

The Shiva LanRover has no password set for the root user account. An attacker is able to telnet to this system and gain access to any phone lines attached to this device. Additionally, the LanRover can be used as a relay point for further attacks via the telnet and rlogin functionality available...

Cisco ATA-186 Password Circumvention / Recovery

The remote host appears to be a Cisco ATA-186 - an analog telephone adapter used to interface analog telephones to VoIP networks. The adapter is configured via a web interface that has a security bypass vulnerability. It is possible to bypass authentication by sending an HTTP POST request with a...

CVE-2002-0345

Symantec Ghost 7.0 stores usernames and passwords in plaintext in the NGServer\params registry key, enabling privilege escalation if an attacker accesses the registry. The CVE-2002-0345 entry documents this plaintext credential storage as the underlying issue with a base impact of partial confide...

Protected files access in LilHTTP

By using ./ and ../ it's possible to access any files...

Snitz Forums 2000 remote SQL query manipulation vulnerability

vulnerable ---------- Product : Snitz Forums 2000 Version : 3.3 3.3.01 3.3.02 3.3.03 last stable version Object : members.asp Class : Input validation error remote SQL query manipulation vulnerability Vendor-URL : http://forum.snitz.com/ Vendor-Status : informed, not patched Remote-Exploit : yes...

Citrix Server Detection

Citrix servers allow a Windows user to remotely obtain a graphical login and therefore act as a local user on the remote host. NOTE: by default the Citrix Server application utilizes a weak 40 bit obfuscation algorithm not even a true encryption. If the default settings have not been changed, the...

Unauthorized remote control access to systems running Funk Softwa re's Proxy v3.x

BindView Security Advisory -------- Unauthorized remote control access to systems running Funk Software's Proxy v3.x Issue Date: April 8, 2002 Contact: Chris Coffin [email protected] CVE: CAN-2002-0064, CAN-2002-0065, CAN-2002-0066 Overview: Funk Software's Proxy v3.x Remote Control...

LogWatch 2.1.1/2.5 - Insecure Temporary Directory Creation

source: https://www.securityfocus.com/bid/4374/info LogWatch is a freely available, open source script for monitoring log files. It may be used with the Linux and Unix Operating systems. Upon execution, LogWatch creates a directory in /tmp. This directory uses the name logwatch.$pid, where $pid i...

CVE-2001-1222

Plesk Server Administrator PSA 1.0 allows remote attackers to obtain PHP source code via an HTTP request containing the target's IP address and a valid account name for the domain...

CVE-2001-1222

Plesk Server Administrator PSA 1.0 allows remote attackers to obtain PHP source code via an HTTP request containing the target's IP address and a valid account name for the domain...

CVE-2001-0593

The CVE-2001-0593 entry affects Anaconda Partners Clipper 3.3 and earlier, where a directory traversal via the template parameter allows a remote attacker to read arbitrary files. The vulnerability is rooted in a dot-dot (.. ) path traversal in the template handling, enabling file disclosure with...

CVE-1999-0801

BMC Patrol allows remote attackers to gain access to an agent by spoofing frames...

Oracle 9iAS default configuration uses well-known default passwords

Overview Oracle Database Server version 9iAS installs with up to 160 distinct default login accounts. The usernames and passwords for these have been made publicly available and could be used by an attacker to gain access to an Oracle server. Description Depending on the components chosen at...

ScriptEase:WebServer Edition vulnerability

Program: ScriptEase:WebServer Edition Url: www.nombas.com Problem: Any user can read files on server using one of examle scripts: comment2.jse Systems affected: Linux, Novell Netware, Windows 9x/NT/2k Example: WindowsNovell Netware:...

Shoutcast server 1.8.3 win32

I found a problem with the latest version of shoutcast for windows. By entering http://some-shoutcast- server:8888/admin.cgi? &...

CVE-2001-1538

SpeedXess HA-120 DSL router has a default administrative password of "speedxess", which allows remote attackers to gain access...

Buffer Overflow in Oracle 9iAS (#NISR20122001)

NGSSoftware Insight Security Research Advisory Name: Oracle PL/SQL Apache Module Systems Affected: Oracle 9iAS Platforms: Sun SPARC Solaris 2.6 MS Windows NT/2000 Server HP-UX 11.0/32-bit Severity: High Risk Vendor URL: http://www.oracle.com/ Author: David Litchfield [email protected] Date: 20t...