CVE-2002-0052

Internet Explorer 6.0 and earlier does not properly handle VBScript in certain domain security checks, which allows remote attackers to read arbitrary files...

Linux kernel netfilter IRC DCC helper module creates overly permissive firewall rules

Overview The "netfilter" firewall subsystem included with Linux kernel versions 2.4.x contains a vulnerability that may allow remote attackers to reach hosts that should be protected. Description The "netfilter" subsystem included with Linux kernel versions 2.4.x provides a framework for services...

CVE-2001-0821

The default configuration of DCShop 1.002 beta places sensitive files in the cgi-bin directory, which could allow remote attackers to read sensitive data via an HTTP GET request for 1 orders.txt or 2 authuserfile.txt...

CVE-1999-1508

Web server in Tektronix PhaserLink Printer 840.0 and earlier allows a remote attacker to gain administrator access by directly calling undocumented URLs such as nclitems.html and nclsubjects.html...

CVE-1999-1051

Default configuration in Matt Wright FormHandler.cgi script allows arbitrary directories to be used for attachments, and only restricts access to the /etc/ directory, which allows remote attackers to read arbitrary files via the replymessageattach attachment parameter...

CVE-2000-1191

htsearch program in htDig 3.2 beta, 3.1.6, 3.1.5, and earlier allows remote attackers to determine the physical path of the server by requesting a non-existent configuration file using the config parameter, which generates an error message that includes the full path...

UltraEdit 8.2 - FTP Client Weak Password Encryption

source: https://www.securityfocus.com/bid/3234/info UltraEdit is a multi-featured commercial text editor with support for HTML, C/C++, VB, Java, Perl, XML, and C. It also includes a hex editor and a small FTP client. UltraEdit's FTP client has a feature which will remember FTP passwords for later...

Solaris 8 - x86 xlock Heap Overflow

Solaris 8 - x86 xlock Heap Overflow // source: https://www.securityfocus.com/bid/3160/info Xlock is a utility for locking X-windows displays. It is installed setuid root because it uses the user's password to authorize access to the display when it is locked. The version of xlock that ships with...

CVE-2001-0620

iPlanet Calendar Server 5.0p2 and earlier allows a local attacker to gain access to the Netscape Admin Server NAS LDAP database and read arbitrary files by obtaining the cleartext administrator username and password from the configuration file, which has insecure permissions...

Security Update: [CSSA-2001-026.0] Linux - docview local httpd exploit

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Caldera International, Inc. Security Advisory Subject: Linux - docview local httpd exploit Advisory number: CSSA-2001-026.0 Issue date: 2001, July 17 Cross reference: 1. Problem Description Docview is a set of CGI scripts providing documentation over...

Symantec LiveUpdate stores proxy server passwords in plaintext in registry

Overview A vulnerability exists in the way Symantec LiveUpdate stores proxy server passwords which could allow local users to have read access to the key. Description LiveUpdate version 1.5 stores proxy server passwords in clear text in the registry, under...

CVE-2001-0379

Vulnerability in the newgrp program included with HP9000 servers running HP-UX 11.11 allows a local attacker to obtain higher access rights...

CVE-2000-1118

24Link 1.06 web server allows remote attackers to bypass access restrictions by prepending strings such as "/+/" or "/." to the HTTP GET request...

Microsoft SQL Server 7.0/2000 / Data Engine 1.0/2000 - xp_displayparamstmt Buffer Overflow

// source: https://www.securityfocus.com/bid/2030/info The API Srvparaminfo, which is implemented by Extended Stored Procedures XPs in Microsoft SQL Server and Data Engine, is susceptible to a buffer overflow vulnerability which may cause the application to fail or arbitrary code to be executed o...

[CORE SDI ADVISORY] RealServer memory contents disclosure

CORE SDI http://www.core-sdi.com Report for RealServer memory contents disclosure vulnerability Date Published: November 16th, 2000 Advisory ID: CORE-20001116 Bugtraq ID: 1957 CVE CAN: None currently assigned. Title: RealServer memory contents disclosure vulnerability Class: Failure to handle...

CVE-2000-0831

Buffer overflow in Fastream FTP++ 2.0 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long username...

CVE-2000-0642

The default configuration of WebActive HTTP Server 1.00 stores the web access log active.log in the document root, which allows remote attackers to view the logs by directly requesting the page...

Visible Systems Razor 4.1 - Password File (2)

Visible Systems Razor 4.1 - Password File 2 source: https://www.securityfocus.com/bid/1424/info The Razor Configuration Management program stores passwords in an insecure manner. A local attacker can obtain the Razor passwords, and either seize control of the software and relevant databases or us...

CVE-1999-0495

A remote attacker can gain access to a file system using .. dot dot when accessing SMB shares...

CVE-1999-0710

The Squid package in Red Hat Linux 5.2 and 6.0, and other distributions, installs cachemgr.cgi in a public web directory, which allows remote attackers to use it as an intermediary to connect to other systems...