3625 matches found
ProFTPd 1.2 pre6 - 'snprintf' Remote Root
source: https://www.securityfocus.com/bid/650/info Lack of user input validation in ProFTPD can lead to a remote root vulnerability. On systems that support it ProFTPD will attempt to modify the name of the program being executed argv0 to display the command being executed by the logged on user. ...
Microsoft FrontPage Extensions Check
The remote web server appears to be running with the FrontPage extensions. FrontPage allows remote web developers and administrators to modify web content from a remote location. While this is a fairly typical scenario on an internal local area network, the FrontPage extensions should not be...
Multiple MTA HELO Command Remote Overflow
The remote SMTP server seems to allow remote users to send mail anonymously by providing arguments that are too long to the HELO command more than 1024 chars. This problem may allow malicious users to send unsolicited mail i.e., SPAM or threatening mail using the server, and keep their anonymity....
pop2d.imap.txt
Date: Wed, 26 May 1999 20:37:13 +0100 From: Chris Evans To: [email protected] Subject: Remote vulnerability in pop2d Hi Firstly, sorry if any details are hazy - this is from memory it's two months since I last looked at this. This bug concerns the pop-2 daemon, which is a part of the Washingto...
ipop2d.txt
Vulnerable Program: POP2 shipped with imap-4.4 package Platforms: Linux Impact: Remote users can spawn a shell with uid of user "nobody" Reported Initally: Chris Evans Exploit Code: bind Details: -------- POP-2 supports anonymous proxy service where remote users can connect to remote imap servers...
nt4+sp4.wts.4.0.txt
Date: Wed, 9 Jun 1999 01:07:04 +0200 From: mRm3n4c3 To: [email protected] Subject: Bug in WTS 4.0 on WinNT 4.0 sp4 I have recently encountered what i believe to be a bug in NT security when using Windows Terminal Server 4.0 on NT 4.00.1381 Service Pack 4. The problem occured in an environment...
Anonymous FTP Enabled
Brute force setting must be enabled to use this plugin. Nessus has detected that the FTP server running on the remote host allows anonymous logins. Therefore, any remote user may connect and authenticate to the server without providing a password or unique credentials. This allows the user to...
Anonymous FTP Writable root Directory
It is possible to write on the root directory of the remote anonymous FTP server. This allows an attacker to upload arbitrary files which can be used in other attacks, or to turn the FTP server into a software distribution point. TRUSTED...
University of Washington pop2d 4.4 - Remote Buffer Overflow
// source: https://www.securityfocus.com/bid/283/info A buffer overflow vulnerability in pop2d version 4.4 or earlier allow malicious remote users to obtain access to the "nobody" user account. The pop2 and pop3 servers support the concept of an "anonymous proxy", whereby a remote user connecting...
Microsoft Site Server 2.0 with IIS 4.0 - Arbitrary File Upload
source: https://www.securityfocus.com/bid/1811/info Microsoft Site Server is an intranet server designed for an NT Server with IIS. Site Server enables users to locate and view information stored in various locations through personalized web pages and emails. The 'Users' directory, if not already...
CVE-1999-0497
Anonymous FTP is enabled...
CVE-1999-0497
Anonymous FTP is enabled...
CVE-1999-0527
The permissions for system-critical data in an anonymous FTP account are inappropriate. For example, the root directory is writeable by world, a real password file is obtainable, or executable commands such as "ls" can be overwritten...
PT-1999-1174
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned. Description The issue is related to Anonymous FTP being enabled. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...
PT-1999-1179 · Undefined · Undefined
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue concerns inappropriate permissions for system-critical data in an anonymous FTP account. This includes the root directory being writeable by anyone, the ability to obtain ...
CVE-1999-1411
The installation of the fsp package 2.71-10 in Debian GNU/Linux 2.0 adds the anonymous FTP user without notifying the administrator, which could automatically enable anonymous FTP on some servers such as wu-ftp...
[SECURITY] new version of fsp fixes security flaw
We have found that the fsp package introduces a possible security flaw. When the fsp package is installed it adds the ftp user without prompting the admin. This can enable anonymous FTP if you use the standard ftp or wu-ftpd as your FTP daemon. If you have have installed fsp and a FTP daemon and ...
[SECURITY] new version of fsp fixes security flaw
We have found that the fsp package introduces a possible security flaw. When the fsp package is installed it adds the ftp user without prompting the admin. This can enable anonymous FTP if you use the standard ftp or wu-ftpd as your FTP daemon. If you have have installed fsp and a FTP daemon and ...
CVE-1999-1298
Sysinstall in FreeBSD 2.2.1 and earlier, when configuring anonymous FTP, creates the ftp user without a password and with /bin/date as the shell, which could allow attackers to gain access to certain system resources...