FloosieTek FTGatePro 1.2 - WebAdmin Interface Information Disclosure

FloosieTek FTGatePro 1.2 - WebAdmin Interface Information Disclosure source: https://www.securityfocus.com/bid/8578/info A weakness has been reported in the FTGatePro WebAdmin Interface that could allow an unauthorized user to gain sensitive information. The problem is believed to occur due to...

FloosieTek FTGatePro 1.2 - WebAdmin Interface Information Disclosure

source: https://www.securityfocus.com/bid/8578/info A weakness has been reported in the FTGatePro WebAdmin Interface that could allow an unauthorized user to gain sensitive information. The problem is believed to occur due to insufficient access controls put in place by FTGatePro. As a result, an...

Oracle9i Application Server 9.0.2 - MOD_ORADAV Access Control

Oracle9i Application Server 9.0.2 - MODORADAV Access Control source: https://www.securityfocus.com/bid/14274/info The modoradav module for Oracle HTTP Server included in Oracle9i Application Server is prone to a vulnerability. This is related to access controls on the '/davpublic' and '/davportal...

CVE-2002-0943

MetaCart2.sql stores the user database under the web document root without access controls, which allows remote attackers to obtain sensitive information such as passwords and credit card numbers via a direct request for metacart.mdb...

CVE-2002-0943

CVE-2002-0943 describes a vulnerability where MetaCart2.sql stores the user database (metacart.mdb) under the web document root without access controls, enabling remote attackers to obtain sensitive information (passwords, credit card numbers) via direct request. The root cause is lack of access ...

CVE-2002-0943

MetaCart2.sql stores the user database under the web document root without access controls, which allows remote attackers to obtain sensitive information such as passwords and credit card numbers via a direct request for metacart.mdb...

CVE-2002-0045

slapd in OpenLDAP 2.0 through 2.0.19 allows local users, and anonymous users before 2.0.8, to conduct a "replace" action on access controls without any values, which causes OpenLDAP to delete non-mandatory attributes that would otherwise be protected by ACLs...

CVE-2002-0045

The CVE affects OpenLDAP slapd prior to 2.0.20 (OpenLDAP 2.0.0–2.0.19; anonymous before 2.0.8) where a faulty ACL check allows a local/anonymous user to perform a replace operation with an empty value list. This bypasses access controls and can delete non-mandatory attributes that ACLs would norm...

CVE-1999-1481

Squid 2.2.STABLE5 and below, when using external authentication, allows attackers to bypass access controls via a newline in the user/password pair...

CVE-1999-1481

Squid 2.2.STABLE5 and earlier versions are affected when using external authentication. A newline in the user/password pair can bypass access controls, enabling unauthorized access. The available documents confirm the affected software and the bypass condition but do not provide remediation detai...

CVE-2001-0867

Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not properly filter does not properly filter packet fragments even when the "fragment" keyword is used in an ACL, which allows remote attackers to bypass the intended access controls...

MacOS 9.2, Internet Explorer, Local Vulnerability

Vulnerability: Access controls can be evaded on MacOS9.2 using Internet Explorer, allowing users to execute programs they otherwise would not be able to run. Details: While in the college media lab I attempted to run MacSSH to get onto my home desktop, I received an error message telling me I did...

LPRng/rhs-printfilters - remote execution of commands

posted to vendor security ppl, no reply, no patch, so posting here. --begin forwarded message-- RedHat 7.0 possibly others If the lpd is listening on 0.0.0.0 and no access controls are in place, it is possible to execute commands as the lp user, assuming tetex-dvips is installed. From man dvips...

CVE-2000-1221

The line printer daemon lpd in the lpr package in multiple Linux operating systems authenticates by comparing the reverse-resolved hostname of the local machine to the hostname of the print server as returned by gethostname, which allows remote attackers to bypass intended access controls by...

CVE-2000-1221

The line printer daemon lpd in the lpr package in multiple Linux operating systems authenticates by comparing the reverse-resolved hostname of the local machine to the hostname of the print server as returned by gethostname, which allows remote attackers to bypass intended access controls by...

unixware.pkg.txt

Greetings, OVERVIEW Any user may read any file on the system. BACKGROUND Only UnixWare 7.1 has been tested. DETAILS As previously stated, UnixWare binaries gain additional privileges via standard suid/sgid AND /etc/security/tcb/privs. The majority of the UnixWare "pkg" command, such as pkginfo,...

SCO Unixware 7.1 - 'pkg' Local Privilege Escalation

source: https://www.securityfocus.com/bid/850/info Certain versions of SCO's Unixware only version 7.1 was tested ship with a series of package install/removal utilities which due to design issues under the SCO UnixWare operating system may read any file on the system regardless of their permissi...

Web Server robots.txt Information Disclosure

The remote host contains a file named 'robots.txt' that is intended to prevent web 'robots' from visiting certain directories in a website for maintenance or indexing purposes. A malicious user may also be able to use the contents of this file to learn of sensitive documents or directories on the...

squid -- possible abuse of cachemgr.cgi

The squid patches page notes: This patch adds access controls to the cachemgr.cgi script, preventing it from being abused to reach other servers than allowed in a local configuration file...

NTMail3 Arbitrary Mail Relay

Nessus has detected that the remote SMTP server allows anyone to use it as a mail relay provided that the source address is set to ''. This issue allows any spammer to use your mail server to send their mail to the world, thus flooding your network bandwidth and possibly getting your mail server...