1574 matches found
DEBIAN-CVE-2006-0987
The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service traffic amplification via DNS queries with...
Default configuration
The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service traffic amplification via DNS queries with...
CVE-2006-0642
Trend Micro ServerProtect 5.58, and possibly InterScan Messaging Security Suite and InterScan Web Security Suite, have a default configuration setting of "Do not scan compressed files when Extracted file count exceeds 500 files," which may be too low in certain circumstances, which allows remote...
Default configuration
Trend Micro ServerProtect 5.58, and possibly InterScan Messaging Security Suite and InterScan Web Security Suite, have a default configuration setting of "Do not scan compressed files when Extracted file count exceeds 500 files," which may be too low in certain circumstances, which allows remote...
Default configuration
The default configuration of the America Online AOL client software allows all users to modify a certain registry value that specifies a DLL file name, which might allow local users to gain privileges via a Trojan horse program...
Design/Logic Flaw
The default configuration of Fluffington FLog 1.01 installs users.0.dat under the web document root with insufficient access control, which might allow remote attackers to obtain sensitive information login credentials via a direct request. NOTE: It was later reported that 1.1.2 is also affected...
CVE-2006-0352
The default configuration of Fluffington FLog 1.01 installs users.0.dat under the web document root with insufficient access control, which might allow remote attackers to obtain sensitive information login credentials via a direct request. NOTE: It was later reported that 1.1.2 is also affected...
Oracle 9i Application Server SOAP Default Configuration Vulnerability - Active Check
In a default installation of Oracle 9i Application Server AS v.1.0.2.2, it is possible to deploy or undeploy SOAP services without the need of any kind of credentials. SPDX-FileCopyrightText: 2003 Javier Fernandez-Sanguino Some text descriptions might be excerpted from a referenced sources, and a...
[Full-disclosure] ELSA Lancom Router Discloses the Administrator Password to Remote Users
It is reported that the default configuration allows a remote user to connect to the router via port 80 with a web browser and obtain the remote access password, which is apparently stored in clear text. The remote user can also change the router's configuration and can remotely upgrade the...
CVE-2004-2320
The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are...
IBM Lotus Domino HTML Hidden Field Encrypted Password Disclosure
The remote host is running a version of Lotus Domino Server that is prone to several information disclosure vulnerabilities. Specifically, users' password hashes and other data are included in hidden fields in the public address book 'names.nsf' readable by default by all users. Moreover, Domino...
Siemens SANTIS 50 Authentication Vulnerability
Secure Network - Security Research Advisory Vuln name: Siemens SANTIS 50 Authentication Vulnerability Systems affected: Siemens Santis 50 Wireless router firmware version: 4.2.8.0 Likely to be affected: Ericsson HN294dp Dynalink RTA300W Severity: medium risk Local/Remote: Remote limited to the LA...
Microsoft Internet Explorer Malformed URI Buffer Overflow Vulnerability
Description A buffer overflow vulnerability is reported in Microsoft Internet Explorer. This issue is due to insufficient boundary verification of user-supplied input data causing a fixed-sized memory buffer to be overrun when attempting to copy data into it. This vulnerability allows...
Microsoft Internet Explorer DHTML Object Race Condition Memory Corruption Vulnerability
Description A vulnerability in Microsoft Internet Explorer may allow remote attackers to execute arbitrary code in the context of users visiting malicious Web sites. This issue presents itself the affected application attempts to process certain script objects, a race condition may lead to the...
CVE-2004-1653
The default configuration for OpenSSH enables AllowTcpForwarding, which could allow remote authenticated users to perform a port bounce, when configured with an anonymous access program such as AnonCVS...
Microsoft Windows XP - Weak Default Configuration
Microsoft Windows XP - Weak Default Configuration // source: https://www.securityfocus.com/bid/11410/info Microsoft Windows XP Service Pack 2 is reported prone to a weak default configuration vulnerability. Internet Connection Firewall ICF includes functionality that controls what binaries are...
Microsoft Windows XP - Weak Default Configuration
// source: https://www.securityfocus.com/bid/11410/info Microsoft Windows XP Service Pack 2 is reported prone to a weak default configuration vulnerability. Internet Connection Firewall ICF includes functionality that controls what binaries are permitted to listen for incoming connections. It is...
aspWebCalendar /aspWebAlbum: SQL injection
1Introduction "aspWebCalendar is an .asp Active Server Pages script that allows you to easily create an online events calendar that supports multiple users. Easy installation and usage are the key features of aspWebCalendar. The script contains a text file with a few configuration variables that...
Apache 1.3.x < 2.0.48 mod_userdir - Remote Users Disclosure
/ m00-apache-w00t.c Apache 1.3.-2.0.48 remote users disclosure exploit by m00 Security. Proof-of-Concept edition This tool scans remote hosts with httpd apache and disclosure information about existens users accounts via wrong default configuration of moduserdir default apache module. Then attemp...
JBoss 3.2.1: Remote Command Injection
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ================================ Illegalaccess.org Security Alert ================================ Date : 10/04/2003 Application : JBoss, java server for running J2EE enterprise applications Version : 3.2.1 Website : http://www.jboss.org Problems :...