Apache Remote Command Execution via .bat files

The Apache 2.0.x Win32 installation is shipped with a default script, /cgi-bin/test-cgi.bat, that allows an attacker to execute commands on the Apache server although it is reported that any .bat file could open this vulnerability. An attacker can send a pipe character with commands appended as...

Apache HTTP Server Remote Command Execution via .bat files

The Apache HTTP Server 2.0.x Win32 installation is shipped with a default script, /cgi-bin/test-cgi.bat, that allows an attacker to execute commands on the Apache server although it is reported that any .bat file could open this vulnerability. SPDX-FileCopyrightText: 2002 Matt Moore Some text...

CVE-2005-3372

The CVE-2005-3372 entry concerns eTrust CA 7.0.1.4 (11.9.1 engine). The vulnerability arises from a magic byte bug: files with an unsuspecting extension (e.g., BAT, HTML, EML) containing an MZ EXE-like signature are treated as safe types but can still execute as dangerous content. This bypasses v...

CVE-2005-3382

The CVE-2005-3382 entry describes a flaw in Sophos 3.91 with the 2.28.4 engine where an interpretation error allows a file (e.g., BAT, HTML, EML) containing an MZ magic byte sequence to be treated as a safe type, enabling bypass of virus scanning. This is a “magic byte bug” vulnerability that cou...

CVE-2003-1133

CVE-2003-1133 affects Rit Research Labs The Bat! versions 1.0.11–2.0. The root cause is insecure ACLs used when creating new accounts, allowing local attackers to read other users’ email messages. The vulnerability is local and limited by the product’s access controls. KB/related advisories from ...

CVE-2003-1133

Rit Research Labs The Bat! 1.0.11 through 2.0 creates new accounts with insecure ACLs, which allows local users to read other users' email messages...

CVE-2003-1133: Undefined Security Weakness

Rit Research Labs The Bat! 1.0.11 through 2.0 creates new accounts with insecure ACLs, which allows local users to read other users' email messages...

AN HTTPD 1.42 - Arbitrary Log Content Injection

AN HTTPD 1.42 - Arbitrary Log Content Injection source: https://www.securityfocus.com/bid/13069/info AN HTTPD is affected by a vulnerability that may allow remote attacker to inject arbitrary content in to the log file. This issue arises due to a failure of input validation. Corruption of logs ma...

AN HTTPD 1.42 - Arbitrary Log Content Injection

source: https://www.securityfocus.com/bid/13069/info AN HTTPD is affected by a vulnerability that may allow remote attacker to inject arbitrary content in to the log file. This issue arises due to a failure of input validation. Corruption of logs may result in concealing attacks and/or misleading...

The Bat! memory corruption

Memory corruption on parsing multipart PGP messages...

The Bat! 2.01 memory corruption

Dear bugtraq, AGK agk at sandy.ru discovered The Bat! 2.01 to throw exception on few messages. It looks like The Bat! 2.01 in standard configuration with build-in PGP support has a bug with processing PGP signed messages protocol="application/pgp-signature" with multiple recursively included part...

CVE-2003-1133

Rit Research Labs The Bat! 1.0.11 through 2.0 creates new accounts with insecure ACLs, which allows local users to read other users' email messages...

KLA10362 OSI vulnerability in The Bat

An insecure ACL was found in The Bat! By exploiting this vulnerability malicious users can read e-mail messages. This vulnerability can be exploited locally. Original advisories - Exploitation Public exploits exist for this vulnerability. Related products The-Bat! CVE list CVE-2003-1133 warning...

CVE-2002-0338

The Bat! 1.53d and 1.54beta, and possibly other versions, allows remote attackers to cause a denial of service crash via an attachment whose name includes an MS-DOS device name...

CVE-2002-0338

The Bat! 1.53d and 1.54beta, and possibly other versions, allows remote attackers to cause a denial of service crash via an attachment whose name includes an MS-DOS device name...

CVE-2002-0338

The CVE-2002-0338 issue affects The Bat! mail client, specifically version 1.53d and 1.54beta (and possibly others). A remote attacker can trigger a denial of service (crash) by sending an attachment whose filename includes an MS-DOS device name. The available references confirm the consequence a...

CVE-2002-0338: Undefined Security Weakness

The Bat! 1.53d and 1.54beta, and possibly other versions, allows remote attackers to cause a denial of service crash via an attachment whose name includes an MS-DOS device name...

Code execution in Win32 Apache via .bat files

If server uses .bat files as CGI it's possible to execute any shell commands by using pipes...

CVE-2001-0675

The Bat! (RIT Research Labs) for Windows (The Bat! v1.51) is affected by a vulnerability where a remote attacker can trigger a denial of service by delivering an email containing a carriage return CR not followed by a LF. This incorrect RFC822 parsing can cause premature end-of-message handling, ...

CVE-2001-0675

Rit Research Labs The Bat! 1.51 for Windows allows a remote attacker to cause a denial of service by sending an email to a user's account containing a carriage return that is not followed by a line feed...