iDEFENSE Security Advisory 09.13.05: Linksys WRT54G 'restore.cgi' Configuration Modification Design Error Vulnerability

Linksys WRT54G 'restore.cgi' Configuration Modification Design Error Vulnerability iDEFENSE Security Advisory 09.13.05 www.idefense.com/application/poi/display?id=306&type=vulnerabilities September 13, 2005 I. BACKGROUND The Linksys WRT54G is a combination wireless access point, switch and router...

FreeBSD : junkbuster -- heap corruption vulnerability and configuration modification vulnerability (97edf5ab-b319-11d9-837d-000e0c2e438a)

A Debian advisory reports : James Ranson discovered that an attacker can modify the referrer setting with a carefully crafted URL by accidentally overwriting a global variable. Tavis Ormandy from the Gentoo Security Team discovered several heap corruptions due to inconsistent use of an internal...

CVE-2002-1981

Microsoft SQL Server 2000 through SQL Server 2000 SP2 allows the "public" role to execute the 1 spMSSetServerProperties or 2 spMSsetalertinfo stored procedures, which allows attackers to modify configuration including SQL server startup and alert settings...

CVE-2002-1968

The CVE-2002-1968 entry describes a vulnerability in Com21 DOXport 1100 series cable modems (firmware 2.1.1.106 and possibly earlier than 2.1.1.108.003). The issue: a device may download a DOCSIS configuration file from a malicious TFTP server on the internal network, enabling local users to modi...

CVE-2005-0232

Firefox 1.0 allows remote attackers to modify Boolean configuration parameters for the about:config site by using a plugin such as Flash, and the -moz-opacity filter, to display the about:config site then cause the user to double-click at a certain screen position, aka "Fireflashing."...

CVE-2003-1121

Services in ScriptLogic 4.01, and possibly other versions before 4.14, process client requests at raised privileges, which allows remote attackers to 1 modify arbitrary registry entries via the ScriptLogic RPC service SLRPC or 2 modify arbitrary configuration via the RunAdmin services...

CVE-2004-0913

Unknown vulnerability in ecartis 0.x before 0.129a+1.0.0-snap20020514-1.3 and 1.x before 1.0.0+cvs.20030911-8 allows attackers in the same domain to gain administrator privileges and modify configuration...

Mozilla Firefox < 1.7.6 Multiple Vulnerabilities

Binary data 2671.prm...

CVE-2004-1714

CVE-2004-1714 affects BlackICE PC Protection and Server Protection. The issue arises from installation of firewall.ini, blackice.ini, sigs.ini, and protect.ini with Everyone Full Control permissions, enabling a local attacker to crash the service or modify configuration by editing firewall.ini (e...

CVE-2004-1714

BlackICE PC Protection and Server Protection installs 1 firewall.ini, 2 blackice.ini, 3 sigs.ini and 4 protect.ini with Everyone Full Control permissions, which allows local users to cause a denial of service crash or modify configuration, as demonstrated by modifying firewall.ini to contain a...

Mozilla Firefox < 1.0.1 Multiple Vulnerabilities

Binary data 2652.prm...

CVE-2004-1557

MyWebServer 1.0.3 allows remote attackers to bypass authentication, modify configuration, and read arbitrary files via a direct HTTP request to 1 /admin or 2 ServerProperties.html...

CVE-2005-0232

Firefox 1.0 allows remote attackers to modify Boolean configuration parameters for the about:config site by using a plugin such as Flash, and the -moz-opacity filter, to display the about:config site then cause the user to double-click at a certain screen position, aka "Fireflashing."...

CVE-2004-2556

NetGear WG602 aka WG602v1 Wireless Access Point firmware 1.04.0 and 1.5.67 has a hardcoded account of username "super" and password "5777364", which allows remote attackers to modify the configuration...

CVE-2004-0913

Unknown vulnerability in ecartis 0.x before 0.129a+1.0.0-snap20020514-1.3 and 1.x before 1.0.0+cvs.20030911-8 allows attackers in the same domain to gain administrator privileges and modify configuration...

CVE-2004-0913

Unknown vulnerability in ecartis 0.x before 0.129a+1.0.0-snap20020514-1.3 and 1.x before 1.0.0+cvs.20030911-8 allows attackers in the same domain to gain administrator privileges and modify configuration...

CVE-2004-2739

The setup routine setup.php in PHProjekt 4.2.1 and earlier allows remote attackers to modify system configuration via unknown attack vectors...

CVE-2004-2126

The upgrade for BlackICE PC Protection 3.6 and earlier sets insecure permissions for .INI files such as 1 blackice.ini, 2 firewall.ini, 3 protect.ini, or 4 sigs.ini, which allows local users to modify BlackICE configuration or possibly execute arbitrary code by exploiting vulnerabilities in the...

PT-2004-2618 · Unknown · Blackice Server Protection +1

Name of the Vulnerable Software and Affected Versions: BlackICE PC Protection and Server Protection affected versions not specified Description: The issue allows local users to cause a denial of service or modify configuration due to the installation of certain files with Everyone Full Control...

osTicket setup.php Accessibility

The target is running at least one instance of an improperly secured installation of osTicket and allows access to setup.php. Since that script does not require authenticated access, it is possible for an attacker to modify osTicket's configuration using a specially crafted call to setup.php to...