CVE-2004-1028

Untrusted execution path vulnerability in chcod on AIX IBM 5.1.0, 5.2.0, and 5.3.0 allows local users to execute arbitrary programs by modifying the PATH environment variable to point to a malicious "grep" program, which is executed from chcod...

Debian DSA-036-1 : Midnight Commander - arbitrary program execution

It has been reported that a local user could tweak Midnight Commander of another user into executing an arbitrary program under the user id of the person running Midnight Commander. This behaviour has been fixed by Andrew V. Samoilov. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-377-1 : wu-ftpd - insecure program execution

wu-ftpd, an FTP server, implements a feature whereby multiple files can be fetched in the form of a dynamically constructed archive file, such as a tar archive. The names of the files to be included are passed as command line arguments to tar, without protection against them being interpreted as...

CVE-2004-0839

Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder...

Symantec Norton AntiVirus 2004 ActiveX control fails to properly validate input

Overview There is a vulnerability in an ActiveX control provided by Norton AntiVirus 2004 that could allow an attacker to execute arbitrary programs, launch a browser window containing an unauthorized URL, or cause a denial of service on a vulnerable system. Description Norton AntiVirus 2004 is a...

F-Secure BackWeb 6.31 - Local Privilege Escalation

source: https://www.securityfocus.com/bid/10055/info A vulnerability has been reported in F-Secure BackWeb that may permit local attackers to gain system level privileges. The source of this vulnerability is that certain areas within the BackWeb interface permit arbitrary programs to be invoked...

IE 5.x-6.0 allows executing arbitrary programs using showHelp()

IE 5.x-6.0 allows executing arbitrary programs using showHelp =============================================================== Title: IE 5.x-6.0 allows executing arbitrary programs using showHelp Date: Monday, December 29, 2003 Software: IE 5.x, 6.0 Vendor: Microsoft Corp. Patch: N/A Author: Arman...

CVE-2003-0742

SCO Internet Manager mana allows local users to execute arbitrary programs by setting the REMOTEADDR environment variable to cause menu.mana to run as if it were called from ncsahttpd, then modifying the PATH environment variable to point to a malicious "hostname" program...

CVE-2003-0742

SCO Internet Manager mana allows local users to execute arbitrary programs by setting the REMOTEADDR environment variable to cause menu.mana to run as if it were called from ncsahttpd, then modifying the PATH environment variable to point to a malicious "hostname" program...

Low: Red Hat Security Advisory: lv security update

Updated lv packages that fix the possibility of local privilege escalation are now available. Lv is a powerful file viewer similar to less. It can decode and encode multilingual streams through many coding systems, such as ISO-8859, ISO-2022, EUC, SJIS Big5, HZ, and Unicode. A bug has been found ...

CVE-2003-0337

The ckconfig command in lsadmin for Load Sharing Facility LSF 5.1 allows local users to execute arbitrary programs by modifying the LSFENVDIR environment variable to reference an alternate lsf.conf file, then modifying LSFSERVERDIR to point to a malicious lim program, which lsadmin then executes...

Microsoft Outlook2000Express 6.0 - Arbitrary Program Execution

Microsoft Outlook2000Express 6.0 - Arbitrary Program Execution source: https://www.securityfocus.com/bid/6923/info Microsoft Outlook and Outlook Express may execute arbitrary programs through objects embedded in HTML email messages. When an email message or newsgroup message is viewed using...

Microsoft Outlook2000/Express 6.0 - Arbitrary Program Execution

source: https://www.securityfocus.com/bid/6923/info Microsoft Outlook and Outlook Express may execute arbitrary programs through objects embedded in HTML email messages. When an email message or newsgroup message is viewed using Outlook, a temporary object is created in the Internet Explorer cach...

[SECURITY] [DSA 204-1] New kdlibs packages fix arbitrary program execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 204-1 [email protected] http://www.debian.org/security/ Martin Schulze December 5th, 2002 http://www.debian.org/security/faq -...

[SECURITY] [DSA 158-1] New gaim packages fix arbitrary program execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 158-1 [email protected] http://www.debian.org/security/ Martin Schulze August 27th, 2002 http://www.debian.org/security/faq -...

[SECURITY] [DSA 158-1] New gaim packages fix arbitrary program execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 158-1 [email protected] http://www.debian.org/security/ Martin Schulze August 27th, 2002 http://www.debian.org/security/faq -...

CVE-2002-0532

EMU Webmail allows local users to execute arbitrary programs via a .. dot dot in the HTTP Host header that points to a Trojan horse configuration file that contains a pageroot specifier that contains shell metacharacters...

CVE-2002-0767

simpleinit on Linux systems does not close a read/write FIFO file descriptor before creating a child process, which allows the child process to cause simpleinit to execute arbitrary programs with root privileges...

CVE-2001-0942

dbsnmp in Oracle 8.1.6 and 8.1.7 uses the ORACLEHOME environment variable to find and execute the dbsnmp program, which allows local users to execute arbitrary programs by pointing the ORACLEHOME to an alternate directory that contains a malicious version of dbsnmp...

HP Openview NNM6.1 ovactiond bin exploit

Hello, Summery: HP Openview NNM6.1 and earlier running on unix have a problem with the suid bin executable ovactiond. It allows for starting of any program by just sending a trap or event to the station running the daemon. Details: in the trapd.conf the following is defined by default NNM6.1: EVE...