WuFTPD: Providing *remote* root since at least1994

/ - wuftpd2600.c VERY PRIVATE VERSION. DO NOT DISTRIBUTE. 15-10-1999 WUFTPD 2.6.0 REMOTE ROOT EXPLOIT by tf8 NOTE: For ethical reasons, only an exploit for 2.6.0 will be released 2.6.0 is the most popular version nowadays, and it should suffice to proof this vulnerability concept. Site exec was...

CVE-2000-0528

Net Tools PKI Server does not properly restrict access to remote attackers when the XUDA template files do not contain absolute pathnames for other files...

CVE-2000-0330

The networking software in Windows 95 and Windows 98 allows remote attackers to execute commands via a long file name string, aka the "File Access URL" vulnerability...

ssibug

ssi server sides include is a cgi proggie that comes by default with thttpd web server, I am not sure about others. ssi has a nasty bug with regards to the PATHTRANSLATED env var. As you can see the contents of PATHTRANSLATED get copied into pathtranslated which get's fopen'ed later. It does no...

Internet Security Systems ICECap Manager 2.0.23 - Default Username and Password

source: https://www.securityfocus.com/bid/1216/info ICECap Manager is a management console for BlackICE IDS Agents and Sentries. By default, ICECap Manager listens on port 8081, transmits alert messages to another server on port 8082, and has an administrative username of 'iceman' possessing a...

CVE-2000-0434

The administrative password for the Allmanage web site administration software is stored in plaintext in a file which could be accessed by remote attackers...

CVE-2000-0311

The Windows 2000 domain controller allows a malicious user to modify Active Directory information by modifying an unprotected attribute, aka the "Mixed Object Access" vulnerability...

(без имени)

Hi Bugtraq people, This is a a copy of the mail I send to AVM about the Securtity Bugs in Ken! ISDN Proxy Software. eAX --------------------------------------------------------------- Dear AVM Team, I found two serious security bugs in your internet/isdn proxy software AVM Ken!, and I think I...

Cygnus Network Security 4.0/KerbNet 5.0 / MIT Kerberos 4/5 / RedHat 6.2 - Compatibility 'krb_rd_req()' Remote Buffer Overflow (3)

// source: https://www.securityfocus.com/bid/1220/info Several buffer overflow vulnerabilities exist in Kerberos 5 implmenetations due to buffer overflows in the Kerberos 4 compatability code. These include MIT Kerberos 5 releases 1.0.x, 1.1 and 1.1.1, MIT Kerberos 4 patch level 10 and, most...

CVE-2000-0234

The default configuration of Cobalt RaQ2 and RaQ3 as specified in access.conf allows remote attackers to view sensitive contents of a .htaccess file...

Security bug in Apache project: Jakarta Tomcat

The Apache project: Jakarta Tomcat contains a serius security bug. Tomcat is used together with the Apache web server to serve Java Server Pages and Java servlets. Summary from the Tomcat development team advisory is posted below: Advisory: Delivered with Tomcat is an example jsp/source.jsp that...

gpm-root

Hi! I've sent report about the following security hole to the authors of gpm, but they seemed to ignore the problem. The problem applies to every gpm version known by me, for example 1.18.1 and 1.19.0. To exploit this problem, gpm-root must be running on a machine and the user needs both login to...

Mandrake 6.x / RedHat 6.x / Turbolinux 3.5 b2/4.x/6.0.2 userhelper/PAM - Path (2)

// source: https://www.securityfocus.com/bid/913/info Because of double path vulnerabilities in the binary userhelper and PAM, it is possible to get root locally on RedHat 6.0 and 6.1 systems. Both userhelper and PAM follow ".." paths and userhelper allows you to specifiy a program to execute as ...

Generation Terrorists Designs & Concepts Sojourn 2.0 - File Access

source: https://www.securityfocus.com/bid/1052/info Any file that the webserver has read access to can be read on a server running the Sojourn search engine. The Sojourn software includes the ability to organize a website into categories. These categories can then be accessed via the sojourn.cgi...

CVE-1999-0593

The default setting for the Winlogon key entry ShutdownWithoutLogon in Windows NT allows users with physical access to shut down a Windows NT system without logging in...

FreeBSD-SA-00:02.procfs

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:01 Security Advisory FreeBSD, Inc. Topic: Old procfs hole incompletely filled Category: core Module: make Announced: 2000-01-24 Affects: All versions before the correctio...

altavista.txt

hola, more bugs in the AV-Search thing .. using uri-encoded strings it is possible to view "any" file on the system .. examples: unixxxsss ... http://server:port/cgi-bin/query?mss=%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd or on an micro$oft IIS...

CVE-1999-0871

Internet Explorer 4.0 and 4.01 allow a remote attacker to read files via IE's cross frame security, aka the "Cross Frame Navigate" vulnerability...

Solaris 2.32.42.52.5.12.67.0 snoop - print_domain_name Remote Buffer Overflow

Solaris 2.32.42.52.5.12.67.0 snoop - printdomainname Remote Buffer Overflow // source: https://www.securityfocus.com/bid/858/info If a solaris machine is running snoop in verbose mode, it may be possible to compromise its security remotely by exploiting a buffer overflow in snoop. The problem is ...

Sun NetBeans Java IDE HTTP Server IP Restriction Bypass Arbitrary File/Directory Access (deprecated)

The remote host is running NetBeans recently renamed to 'Forte' Java IDE. There is a bug in this version that allows anyone to browse the files on this system. This plugin has been deprecated. Webmirror3 plugin ID 10662 will identify a browsable directory. %NASLMINLEVEL 999999 C Tenable Network...