324 matches found
CVE-2006-6171
ProFTPD 1.3.0a and earlier does not properly set the buffer size limit when CommandBufferSize is specified in the configuration file, which leads to an off-by-two buffer underflow. NOTE: in November 2006, the role of CommandBufferSize was originally associated with CVE-2006-5815, but this was an...
Hacking quest dove gray is not on-line analysis summary-vulnerability warning-the black bar safety net
Not automatically on-line of reason: 1. You do not have public IP or you are within the network did not do the appropriate port mapping; 2. You opened the firewall closes the Dove gray to use to the port; 3. You do not have to update the IP to your domain name; 4. Your service-side configuration...
[Full-disclosure] iDefense Security Advisory 11.11.05: Multiple Vendor Lynx Command Injection Vulnerability
Multiple Vendor Lynx Command Injection Vulnerability iDefense Security Advisory 11.11.05 www.idefense.com/application/poi/display?id=338&type=vulnerabilities November 11, 2005 I. BACKGROUND Lynx is a fully-featured WWW client for users running cursor- addressable, character-cell display devices...
DSA-845-1 mason - programming error
Bulletin has no description...
PTL_advisory_050825.txt
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ================================================================= P . T . L . P I N I O N S T E K N I S K A L A B O R A T O R I U M The Pinion Technical Laboratory http://www.pinion.se Advisory...
CVE-2005-1345
Squid 2.5.STABLE9 and earlier does not trigger a fatal error when it identifies missing or invalid ACLs in the httpaccess configuration, which could lead to less restrictive ACLs than intended by the administrator...
Debian DSA-032-1 : proftpd - proftpd running with incorrect userid, erroneous file removal
The following problems have been reported for the version of proftpd in Debian 2.2 potato : - There is a configuration error in the postinst script, when the user enters 'yes', when asked if anonymous access should be enabled. The postinst script wrongly leaves the 'run as uid/gid root'...
Debian proftpd root Privilege Escalation
Binary data 1817.prm...
Mandrake Linux Security Advisory : mod_ssl (MDKSA-2002:048)
Frank Denis discovered an off-by-one error in modssl dealing with the handling of older configuration directorives the rewritecommand hook. A malicious user could use a specially crafted .htaccess file to execute arbitrary commands as the apache user or execute a DoS against the apache child...
RedHat Apache 2.0.40 - Directory Index Default Configuration Error
RedHat Apache 2.0.40 - Directory Index Default Configuration Error source: https://www.securityfocus.com/bid/8898/info The Red Hat Apache configuration may allow an attacker to view directory listings. The problem is reported to present itself when an attacker issues an HTTP GET request to a...
RedHat Apache 2.0.40 - Directory Index Default Configuration Error
source: https://www.securityfocus.com/bid/8898/info The Red Hat Apache configuration may allow an attacker to view directory listings. The problem is reported to present itself when an attacker issues an HTTP GET request to a vulnerable server containing '//' characters, evading the rule desgined...
ProFTPD on Debian Linux postinst Installation Privilege Escalation
The following problems have been reported for the version of proftpd in Debian 2.2 potato: 1. There is a configuration error in the postinst script, when the user enters 'yes', when asked if anonymous access should be enabled. The postinst script wrongly leaves the 'run as uid/gid root'...
CVE-2001-1387
The CVE-2001-1387 entry concerns the iptables package, specifically iptables-save in versions before 1.2.4. The issue is that iptables-save records the --reject-with icmp-host-prohibited rule as --reject-with tcp-reset, causing generated responses to diverge from the administrator’s configuration...
GNUJSP 1.0 - File Disclosure
GNUJSP 1.0 - File Disclosure source: https://www.securityfocus.com/bid/4125/info GNUJSP is a freely available, open-source implementation of Sun's Java Server Pages. It will run on most Unix and Linux variants, as well as Microsoft Windows NT/2000 operating systems. It has been reported that a...
GNUJSP 1.0 - File Disclosure
source: https://www.securityfocus.com/bid/4125/info GNUJSP is a freely available, open-source implementation of Sun's Java Server Pages. It will run on most Unix and Linux variants, as well as Microsoft Windows NT/2000 operating systems. It has been reported that a remote attacker may disclose th...
CVE-2001-0482
The CVE-2001-0482 entry concerns Argus PitBull LX. It describes a configuration error that lets root bypass access controls and potentially cause a denial of service or run arbitrary commands by altering kernel tunables (MaxFiles, MaxInodes, ModProbePath) in /proc/sys via sysctl. The connected re...
RedHat 6.2/7.0/7.1 Lpd - Remote Command Execution via DVI Printfilter Configuration Error
source: https://www.securityfocus.com/bid/3241/info 'dvips' is a utility that converts DVI documents to PostScript. It is an optional component of the TeTeX text formatting package. When installed on a system where LPRnG and TeTeX are in use, 'dvips' will be invoked by 'lpd' when a DVI document i...
Slackware 7.0/7.1/8.0 - Manual Page Cache File Creation
// source: https://www.securityfocus.com/bid/3054/info Slackware Linux contains a configuration error that enables local users to create files in the directory used by the system manual pager 'man' for cache files. Due to the behaviour of the 'man' program, it may be possible for an attacker to...
