Mandrake Linux Security Advisory : gzip (MDKSA-2003:068)

A vulnerability exists in znew, a script included with gzip, that would create temporary files without taking precautions to avoid a symlink attack. Patches have been applied to make use of mktemp to generate unique filenames, and properly make use of noclobber in the script. Likewise, a fix for...

BEA WebLogic config.xml Operator/Admin Password Disclosure

The remote web server is running WebLogic. BEA WebLogic Server and WebLogic Express are reportedly may allow disclosure of Operator or Admin passwords. An attacker who has interactive access to the affected managed server may potentially exploit this issue in a timed attack to harvest credentials...

CVE-2003-0974

The CVE-2003-0974 entry involves Applied Watch Command Center. Affected: the Command Center application allowing remote, unauthenticated actions including adding new users to a console and injecting spurious IDS rules to sensors (via demonstrated payloads appliedsnatch.c and addrule.c). The root ...

_BSSADV-0000.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bugtraq Security Systems, Incorporated www.bugtraq.org Security Advisory Advisory Name: Multiple Issues in Applied Watch Command Center Release Date: 11/27/2003 Application: Applied Watch Platform: Linux IA32 Linux sparc Linux sparc64 Linux hppa Linux...

Applied Watch protection bypass

It's possible to add new users or IDS rules without authentication...

Multiple Remote Issues in Applied Watch IDS Suite (advisory attached)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bugtraq Security Systems, Incorporated www.bugtraq.org Security Advisory Advisory Name: Multiple Issues in Applied Watch Command Center Release Date: 11/27/2003 Application: Applied Watch Platform: Linux IA32 Linux sparc Linux sparc64 Linux hppa Linux...

Applied Watch Command Center 1.0 - Authentication Bypass (2)

// source: https://www.securityfocus.com/bid/9124/info A vulnerability has been identified in the system that may allow an attacker to bypass authentication to add attacker supplied IDS alerts and new user accounts in the console. Successful exploitation of these issues may allow an attacker to...

MS00-091: Incomplete TCP/IP Packet Vulnerability (199346)

The hotfix for the 'incomplete TCP/IP packet' problem has not been applied. This vulnerability allows a user to prevent this host from communicating with the network. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10563; scriptversion"1.46"; scriptcvsdate"Date:...

MS00-053: Service Control Manager Named Pipe Impersonation patch (269523)

The hotfix for the 'Service Control Manager Named Pipe Impersonation' problem has not been applied. This vulnerability allows a malicious user, who has the right to log on this host locally, to gain additional privileges. C Tenable Network Security, Inc. include"compat.inc"; if description...

Microsoft .NET Framework Service Pack 2, German Version (SDK Applied)

Microsoft .NET Framework Service Pack 2 resolves various issues found after the initial release of Microsoft .NET Framework. These include both security- and non-security-related issues...