Apache 2.0.4x mod_php - File Descriptor Leakage (1)

// source: https://www.securityfocus.com/bid/9302/info Reportedly, the Apache modphp module may be prone to a vulnerability that may allow a local attacker to gain access to privileged file descriptors. As a result, the attacker may pose as a legitimate server and possibly steal or manipulate...

Ashley Brown iWeb Server - Encoded Backslash Directory Traversal

Ashley Brown iWeb Server - Encoded Backslash Directory Traversal source: https://www.securityfocus.com/bid/8943/info It has been reported that iWeb Server is prone a directory traversal issue allowing a remote attacker to traverse outside the server root directory by using '..%5C' character...

Mac OS X Arbitrary File Overwrite via Core Files

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Advisory Name: Arbitrary File Overwrite via Core Files Release Date: 10/24/2003 Application: Kernel Platform: Mac OS X Severity: High Author: Dave G. [email protected] Vendor Status: Vendor has new releas...

Easy File Sharing Web Server 1.2 - Information Disclosure

source: https://www.securityfocus.com/bid/8777/info Easy File Sharing Web Server has been reported prone to an information disclosure vulnerability. The issue presents itself due to insecure default permissions set on folders that contain Easy File Sharing Web Server log and configuration files. ...

[Full-Disclosure] exploiting fortigate firewall through webinterface

Issue: Several vulnerabilities in web interface of Fortigate firewall of which the most serious one will allow a remote attacker to obtain a username and password of the Fortigate. Release: pre 2.50 maintenance release 4 Fixed in: Fortinet OS 2.50 MR4, available from FTP as of 29 Sept. 2003 Date:...

WebCalendar 0.9.x (Multiple Modules) - SQL Injection

WebCalendar 0.9.x Multiple Modules - SQL Injection source: https://www.securityfocus.com/bid/8540/info It has been reported that WebCalendar may be prone to multiple SQL injection issues in the viewt.php, vieww.php, viewv.php, and login.php modules of the software. The problems arise from a lack ...

WebCalendar 0.9.x (Multiple Modules) - SQL Injection

source: https://www.securityfocus.com/bid/8540/info It has been reported that WebCalendar may be prone to multiple SQL injection issues in the viewt.php, vieww.php, viewv.php, and login.php modules of the software. The problems arise from a lack of sufficient sanitization of user-supplied input...

IBM DB2 db2job - File Overwrite

IBM DB2 db2job - File Overwrite source: https://www.securityfocus.com/bid/8344/info IBM's DB2 database ships with a utility called db2job, installed with permissions 4550 and owned by root.db2asgrp. It has been reported that db2job writes to a number of files with root privileges. The files writt...

Drupal XSS Vulnerability (main page and sub pages)

------------------------------------------------------ Drupal XSS Vulnerability main page and sub pages ------------------------------------------------------ Any kind of XSS attacks possibility. An attacker could access other users/admin drupal accounts...

CVE-2003-0522

Multiple SQL injection vulnerabilities in ProductCart 1.5 through 2 allow remote attackers to 1 gain access to the admin control panel via the idadmin parameter to login.asp or 2 gain other privileges via the Email parameter to Custva.asp...

Virtual Programming VP-ASP 5.00 - shopexd.asp SQL Injection (2)

Virtual Programming VP-ASP 5.00 - shopexd.asp SQL Injection 2 source: https://www.securityfocus.com/bid/8159/info It has been reported that VP-ASP does not sufficiently sanitize user input passed to the shopexd.asp script contained in the software. As a result, it may be possible for remote...

[Full-Disclosure] iDEFENSE Security Advisory 07.01.03: Caché Insecure Installation File and Directory Permissions

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDEFENSE Security Advisory 07.01.03: http://www.idefense.com/advisory/07.01.03.txt Cach Insecure Installation File and Directory Permissions July 1, 2003 I. BACKGROUND InterSystems Corp.’s Cach is a post-relational database for e-applications that is...

Sun Management Center (SunMC) allows user to create or overwrite arbitrary files

Overview The Sun Management Center SunMC contains a vulnerability that could allow an attacker to create or overwrite any file on the system. Description An unknown vulnerability exists in the Sun Management Center SunMC, according to a Sun Alert Notification. According to that document,...

Mozilla 1.x opera 67 - Timed document.write Method Cross Domain Policy

Mozilla 1.x opera 67 - Timed document.write Method Cross Domain Policy source: https://www.securityfocus.com/bid/7847/info It has been reported that under some circumstances, it is possible violate the cross-domain restriction of browser security. Because of this, an attacker may be able to execu...

pam_xauth may insecurely forward "X MIT-Magic-Cookies" to new sessions

Overview A vulnerability exists in pamxauth that may allow a local attacker to gain access to an administrator's X session. Description pamxauth is used to forward xauth keys or cookies between users. From the pamxauth man page:Without pamxauth, when xauth is enabled and a user uses the su comman...

Coppermine Photo Gallery displayimage.php SQL Injection

The remote host is running Coppermine Gallery - a set of PHP scripts designed to handle galleries of pictures. This product has a vulnerability which allows a remote attacker to execute arbitrary SQL queries. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

CVE-2002-0300

gnujsp 1.0.0 and 1.0.1 allows remote attackers to list directories, read source code of certain scripts, and bypass access restrictions by directly requesting the target file from the gnujsp servlet, which does not work around a limitation of JServ and does not process the requested file...

PHP-Nuke 5.66.x - banners.php Banner Manager Password Disclosure

PHP-Nuke 5.66.x - banners.php Banner Manager Password Disclosure source: https://www.securityfocus.com/bid/7170/info It has been reported that an input validation error exists in the banners.php file included with PHPNuke. Because of this, an attacker could send a malicious string through PHPNuke...

Computer Associates - Unicenter Asset Manager Stored Secret Data Decryption

Computer Associates - Unicenter Asset Manager Stored Secret Data Decryption source: https://www.securityfocus.com/bid/7808/info It has been reported that Unicenter Asset Manager stores password information in a way that may be easily recovered. Because of this, an attacker may be able to gain...

Protegrity Secure.Data for Microsoft SQL Server 2000 contains buffer overflows in extended stored procedures

Overview Protegrity Secure.Data for Microsoft SQL Server 2000 includes several extended stored procedures that contain buffer overflow vulnerabilities. These vulnerabilities could allow a remote attacker to execute arbitrary code, gain access to databases, or cause a denial of service. Descriptio...