CVE-2001-0897

Cross-site scripting vulnerability in Infopop Ultimate Bulletin Board UBB before 5.47e allows remote attackers to steal user cookies via an IMG tag that references an about: URL with an onerror field...

Extracting a 3DES key from an IBM 4758

Extracting a 3DES key from an IBM 4758 The IBM 4758 is an extremely secure crytographic co-processor. It is used by banking systems and in other security conscious applications to hold keying material. It is designed to make it impossible to extract this keying material unless you have the correc...

CVE-2001-0214

Way-board CGI program allows remote attackers to read arbitrary files by specifying the filename in the db parameter and terminating the filename with a null byte...

Дырка в Ultimate Bulletin Board

Можно посмотреть сообщения в закрытой паролем конференции используя функцию ответа с квотированием...

More on Ultimate Bullering Board

In response to Scott Ashman's post about UBB. After i discovered this bug last week i tried to contact infopop on 3 email adresses from their contact page i finally managed to find one that didn't bounce, but i haven't recieved any response yet. Anyway, Scott describes a way to retrieve other...

Way-board way-board.cgi db Parameter Arbitrary File Access

The 'way-board' CGI is installed. This CGI has a well known security flaw that lets an attacker read arbitrary files with the privileges of the http daemon usually root or nobody. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include 'compat.inc' ; ifdescription scriptid10610;...

CVE-2000-0853

YaBB Bulletin Board 9.1.2000 allows remote attackers to read arbitrary files via a .. dot dot attack...

CVE-2000-0853

YaBB Bulletin Board vulnerability (CVE-2000-0853) affects YaBB.pl: an input validation flaw in the file parameter (num) allows remote attackers to read arbitrary server files via path traversal (e.g., ../../../../../../../../etc/passwd%00) and the .txt suffix handling. This enables reading files ...

Technote 20002001 - board File Disclosure

Technote 20002001 - board File Disclosure source: https://www.securityfocus.com/bid/2155/info Technote Inc. offers a Multicommunication Package which includes a web board type of service. A script that ships with Technote, print.cgi, accepts a parameter called "board". This remotely-supplied...

En: ubb hole

----- Original Message ----- From: tdf To: [email protected] Sent: Monday, November 20, 2000 2:46 PM Subject: ubb hole ----------------------------------------------------------------------------------- Ultimate Bulletin Board - Private forums security hole, by tdf [email protected]...

CVE-2000-0853

YaBB Bulletin Board 9.1.2000 allows remote attackers to read arbitrary files via a .. dot dot attack...

CVE-2000-0141

Infopop Ultimate Bulletin Board UBB allows remote attackers to execute commands via shell metacharacters in the topic hidden field...

yabb.txt

YaBB 9.1.2000 Multiple Vulnerabilities + Advisory by pestilence www.synnergy.net |===============================================| Affected program: YABB 9.1.2000 previous ? System : Linux, UNIX, Windows Problem : Problem located in all scripts that handle files. Discovery :...

YaBB 1.9.2000 Vulnerabilitie

YaBB 9.1.2000 Multiple Vulnerabilities + Advisory by pestilence www.synnergy.net |===============================================| Affected program: YABB 9.1.2000 previous ? System : Linux, UNIX, Windows Problem : Problem located in all scripts that handle files. Discovery :...

YaBB 9.1.2000 - Arbitrary File Read

YaBB 9.1.2000 - Arbitrary File Read source: https://www.securityfocus.com/bid/1668/info YaBB.pl, a web-based bulletin board script, stores board postings in numbered text files. The numbered file name is specified in the call to YaBB.pl in the variable num=. Before retrieving the file, YaBB will...

Дырка в Java Web Server

Одно из приложений на сервере позволяет скомпилировать и запустить любой файл, как JSP-приложение. Таким образом, если атакующий имеет возможность записать файл он может выполнить код. Как минимум одно из демонстрационных приложений - доска объявлений - позволяет запись файлов...

CVE-1999-0854

CVE-1999-0854 affects Ultimate Bulletin Board. The issue arises because data files are stored in the cgi-bin directory, enabling remote viewing by an attacker when the HTTP server erroneously tries to execute such files. Documentation in PT-1999-1407 confirms affected software but does not specif...

ultimatebb.txt

Hello. Writing cgi scripts in perl is simple. It's also rather safe, providing authors follow very simple instructions. But they don't. Browsing some site, I found that their forums were based not on home- made scripts, but rather commercial software product. Hey, said I to myself, remember those...

CVE-2000-0141

Infopop Ultimate Bulletin Board UBB allows remote attackers to execute commands via shell metacharacters in the topic hidden field...

PT-2000-1126 · Infopop · Infopop Ultimate Bulletin Board

Name of the Vulnerable Software and Affected Versions: Infopop Ultimate Bulletin Board UBB affected versions not specified Description: The issue allows remote attackers to execute commands by injecting shell metacharacters into the topic hidden field. Recommendations: At the moment, there is no...