Шел-команды в Network Query Tool (code execution)

Нефильтруемые шел-символы при вызове внешней программы...

RSA Security ACE/Agent for Windows, ACE/Agent for Windows NT, and ACE/Agent for Windows 2000 do not properly handle null characters in URL

Overview RSA Security ACE/Agent for Windows, ACE/Agent for Windows NT, and ACE/Agent for Windows 2000 contain a vulnerability in which the ACE/Agent does not properly handle null characters contained in a URL. A specially crafted request may cause ACE/Agent to enter a debugging mode, possibly...

Шел-символы в W3Mail (shell characters)

При вызове внешнего приложения не проверяются шел-символы в воде пользователя...

CVE-2001-1070

Sage Software MAS 200 allows remote attackers to cause a denial of service by connecting to port 10000 and entering a series of control characters...

CVE-2001-0965

glFTPD 1.23 allows remote attackers to cause a denial of service CPU consumption via a LIST command with an argument that contains a large number of asterisk characters...

glFTPd 1.x - 'LIST' Denial of Service

source: https://www.securityfocus.com/bid/3201/info glFtpD contains an input validation error that may allow a malicious user to cause a denial of service against a host running the daemon. The problem occurs when a specially crafted 'LIST' command is received by the server. If the argument to th...

CVE-2001-0601

Lotus Domino R5 prior to 5.0.7 allows a remote attacker to create a denial of service via HTTP requests containing certain combinations of UNICODE characters...

Выполнение JAVA-приожений в Entrust GetAccess(code execution)

Из-за недостаточной проверки шел-символов можно выполнить любой java-код...

CVE-2001-0601

Lotus Domino R5 prior to 5.0.7 allows a remote attacker to create a denial of service via HTTP requests containing certain combinations of UNICODE characters...

Lotus Domino vulnerable to DoS via crafted unicode GET request

Overview The Lotus Domino Web Server contains a flaw that could be exploited to cause a denial of service situation. Description Sending a crafted GET request containing numerous unicode characters can trigger a server exception that will crash the Domino server. If qnc.exe is removed from the...

CVE-2001-0258

The Easycom/Safecom Print Server firmware 404.590 PrintGuide server allows remote attackers to cause a denial of service via a large number of connections that send null characters...

CVE-2000-1109

CVE-2000-1109 affects Midnight Commander (mc) versions up to 4.x, specifically 4.5.51 and earlier. The issue arises when mc processes malformed directory names during directory opening, allowing a local user to gain privileges by creating directories that contain special characters followed by co...

Microsoft Windows Server 2000 SP1SP2 - isapi .printer Extension Overflow (1)

Microsoft Windows Server 2000 SP1SP2 - isapi .printer Extension Overflow 1 / iishack 2000 - eEye Digital Security - 2001 This affects all unpatched windows 2000 machines with the .printer isapi filter loaded. This is purely proof of concept. Quick rundown of the exploit: Eip overruns at position...

CVE-2001-0258

The Easycom/Safecom Print Server firmware 404.590 PrintGuide server allows remote attackers to cause a denial of service via a large number of connections that send null characters...

Дырка в BEA Weblogic (directory browsing)

Используя escape-символы 00, 2e, 2f, 5c можно получить содержимое каталога...

Дырка в fcheck (input validation)

При вызове внешней программы с именем файла не проверяется наличией shell-символов в имени файла...

Michael Lamont Savant HTTP Server 2.1 - Directory Traversal

Michael Lamont Savant HTTP Server 2.1 - Directory Traversal source: https://www.securityfocus.com/bid/2697/info It is possible for an attacker to traverse the web folders of a Savant HTTP Server. Submitting a URL referring to a known directory or file, and appended with specific unicode character...

CVE-2000-0884

IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability...

CVE-2000-1048

Directory traversal vulnerability in the logfile service of Wingate 4.1 Beta A and earlier allows remote attackers to read arbitrary files via a .. dot dot attack via an HTTP GET request that uses encoded characters in the URL...

Malformed vsprintf in bftpd

There is a malformed vsprintf in bftpd 1.0.12 in function sendstrf: int sendstrfint s, char format, ... .... vsprintfbuffer, format, val; when the function is called from NLIST command: else foo = 1; sendstrfs, entry-dname; This can be used to overflow the buffer of the vsprintf and execute...