CVE-2004-2154

CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive...

CVE-2004-1149

The CVE-2004-1149 issue concerns Computer Associates eTrust EZ Antivirus versions 7.0.0–7.0.4 (including 7.0.1.4). The root cause is insecure default file permissions (ACLs) applied during installation, allowing a local user to modify installed files and replace a program (notably VetMsg.exe) to ...

squid -- confusing results on empty acl declarations

Applying an empty ACL list results in unexpected behavior: anything will match an empty ACL list. For example, The meaning of the configuration gets very confusing when we encounter empty ACLs such as acl something src "/path/to/emptyfile.txt" httpaccess allow something somewhere gets parsed with...

BSD bmon 1.2.1_2 - Local acls Bypass

BSD bmon 1.2.12 - Local acls Bypass !/usr/local/bin/bash Written by Idan Nahoum. [email protected] local exploit for FreeBSD/OpenBSD with bmon default: $BMONEXEC" "$" -gt "0" && BMONEXEC="$1" -x "$BMONEXEC" || echo "$BMONEXEC not found" exit cd /tmp apparently bmon closes stdout, so we run a shell wit...

SUSE-SA:2004:031: cups

The remote host is missing the patch for the advisory SUSE-SA:2004:031 cups. The Common Unix Printing System CUPS enables local and remote users to obtain printing functionallity via the Internet Printing Protocol IPP. Alvaro Martinez Echevarria has found a remote Denial of Service condition with...

CVE-2004-0189: Undefined Security Weakness

The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass urlregex ACLs via a URL with a NULL "%00" character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists...

Cisco IPsec VPNSM vulnerable to DoS via malformed IKE packet

Overview A vulnerability in a Cisco VPN module can allow a remote attacker to cause a denial-of-service to the device in which the module is installed. Description The Cisco IP Security IPsec VPN Services Module VPNSM is a high-speed module for the Cisco Catalyst 6500 Series Switch and the Cisco...

CVE-2004-0189

The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass urlregex ACLs via a URL with a NULL "%00" character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists...

CVE-2002-0664

The CVE-2002-0664 entry describes a vulnerability in IBM Lotus Domino ZMerge administration databases where default ACLs allow arbitrary/anonymous users to obtain Manager-level access. This misconfiguration can let an unauthenticated attacker read or modify import/export scripts and disclose serv...

CVE-2000-0700

Cisco Gigabit Switch Routers (GSR) running IOS with Gigabit/Fast Ethernet cards are affected by a line-card failure defect (CVE-2000-0700, CSCdp35794) that can cause packets to bypass ACLs or be forwarded incorrectly, potentially disrupting enforcement and traffic flow. Affected versions include ...

CVE-1999-0993: Improper Initialization

Modifications to ACLs Access Control Lists in Microsoft Exchange 5.5 do not take effect until the directory store cache is refreshed...

Hancom Office 2007 - Reboot.ini Clear-Text Passwords

Hancom Office 2007 - Reboot.ini Clear-Text Passwords source: https://www.securityfocus.com/bid/228/info During installation of BackOffice 4.0, a file called reboot.ini is created and stored in the \Program Files\Microsoft BackOffice directory. This file contains clear-text usernames and passwords...