CVE-2004-0482

The CVE-2004-0482 issue affects OpenBSD 3.5 and earlier in procfs components (procfs_cmdline.c, procfs_fpregs.c, procfs_linux.c, procfs_regs.c, procfs_status.c, procfs_subr.c) due to multiple integer overflows. This enables local users to read sensitive kernel memory and potentially perform other...

CVE-2003-0119

The secldapclntd daemon in AIX 4.3, 5.1 and 5.2 uses an Internet socket when communicating with the loadmodule, which allows remote attackers to directly connect to the daemon and conduct unauthorized activities...

CVE-2003-0965

Cross-site scripting XSS vulnerability in the admin CGI script for Mailman before 2.1.4 allows remote attackers to steal session cookies and conduct unauthorized activities...

CVE-2003-0965

Removed by vendor...

CVE-2003-0965

CVE-2003-0965 is a cross-site scripting (XSS) vulnerability in the Mailman admin CGI script before 2.1.4. The issue allows remote attackers to steal session cookies and perform unauthorized activities via the administrative interface. Affected: Mailman (admin CGI). Root cause: XSS in the admin UI...

CVE-2003-1215

SQL injection vulnerability in groupcp.php for phpBB 2.0.6 and earlier allows group moderators to perform unauthorized activities via the sqlin parameter...

CVE-2003-0974

Applied Watch Command Center allows remote attackers to conduct unauthorized activities without authentication, such as 1 add new users to a console, as demonstrated using appliedsnatch.c, or 2 add spurious IDS rules to sensors, as demonstrated using addrule.c...

CVE-2003-0945

The Web Database Manager in web-tools for SAP DB before 7.4.03.30 generates predictable session IDs, which allows remote attackers to conduct unauthorized activities...

CVE-2003-0983

Cisco Unity on IBM servers is shipped with default settings that should have been disabled by the manufacturer, enabling unauthorized activity via (1) a local user account named “bubba,” (2) an open TCP port 34571, or (3) a DHCP server on the manufacturer’s test network when a local DHCP server i...

CVE-2003-0983

Cisco Unity on IBM servers is shipped with default settings that should have been disabled by the manufacturer, which allows local or remote attackers to conduct unauthorized activities via 1 a "bubba" local user account, 2 an open TCP port 34571, or 3 when a local DHCP server is unavailable, a...

CVE-2003-0974

The CVE-2003-0974 entry involves Applied Watch Command Center. Affected: the Command Center application allowing remote, unauthenticated actions including adding new users to a console and injecting spurious IDS rules to sensors (via demonstrated payloads appliedsnatch.c and addrule.c). The root ...

CVE-2003-0945

The Web Database Manager in web-tools for SAP DB before 7.4.03.30 generates predictable session IDs, which allows remote attackers to conduct unauthorized activities...

CVE-2003-0945

CVE-2003-0945 affects SAP DB Web-tools Web Database Manager prior to 7.4.03.30. The vulnerability stems from generating predictable session IDs in the Web Database Manager, with IDs placed in the URL, enabling remote attackers to perform unauthorized activities. The issue is addressed by SAP with...

CVE-2003-0874

CVE-2003-0874 affects DeskPRO 1.1.0 and earlier. The vulnerability arises from multiple SQL injection vectors, including cat and article parameters in faq.php, tickedid in view.php, and the Password field on the logon screen. The underlying issue is improper input handling that allows an attacker...

CVE-2003-0845

CVE-2003-0845 is addressed by Red Hat/RHEL 5 security updates RHSA-2007:1048 for openoffice.org and hsqldb. The connected advisories state that HSQLDB could allow remote command execution via a port (tcp 9001) when used with OpenOffice.org Base, stemming from two issues: (1) HSQLDB lacking a pass...

LedNews 0.7 Post Script - Code Injection

LedNews 0.7 Post Script - Code Injection source: https://www.securityfocus.com/bid/7920/info It has been reported that LedNews does not properly filter input from news posts. Because of this, it may be possible for an attacker to steal authentication cookies or perform other nefarious activities...

Syscall implementation could lead to whether or not a file exists

include stdlib.h include unistd.h include stdio.h include sys/types.h include fcntl.h ifndef ONOFOLLOW define ONOFOLLOW 0400000 / don't follow links / endif ifndef OLARGEFILE define OLARGEFILE 0100000 endif int flags = ORDONLY|OEXCL|OSYNC|ONOCTTY|ONOFOLLOW; / taken from scuts format string...

CVE-2001-1008

The CVE-2001-1008 entry concerns Java Plugin 1.4 for JRE 1.3, where signed applets can run even if the code-signing certificate is expired. This indicates a vulnerability in how the plugin handles expired certificates, allowing remote attackers to attempt unauthorized activity via an applet signe...

CVE-2002-1517

fsrefs in IRIX 6.5 allows local users to conduct unauthorized file activities via a symlink attack, possibly via the .fsrlast file...

CVE-2000-1211

The CVE concerns Zope 2.2.0 through 2.2.4, where security registrations for legacy names of object constructors (e.g., DTML method objects) are not performed correctly. This could allow attackers to perform unauthorized activities due to improper access control on constructor names. The issue is ...