Beck GmbH IPC@Chip does not adequately validate user input thereby disclosing sensitive network data via crafted URL

Overview An insecure default configuration in the Beck IPC@CHIP allows an intruder to obtain priviledged system information. Description The Beck IPC@CHIP is a single chip embedded webserver. The Beck IPC@CHIP ships with a cgi script named "ChipCfg". Using a specially crafted url, an attacker can...

CVE-1999-1054

The default configuration of FLEXlm license manager 6.0d, and possibly other versions, allows remote attackers to shut down the server via the lmdown command...

CVE-1999-1515: Undefined Security Weakness

A non-default configuration in TenFour TFS Gateway 4.0 allows an attacker to cause a denial of service via messages with incorrect sender and recipient addresses, which causes the gateway to continuously try to return the message every 10 seconds...

Microsoft Windows NT and 2000 Domain Name Servers allow non-authoritative RRs to be cached by default

Overview Microsoft Domain Name Servers hosted on Windows NT or Windows 2000 Server systems run with permissive DNS cache defaults. This may allow unauthorized remote intruders to redirect sites that rely on the vulnerable DNS servers for legitimate information. Description The Domain Name System,...

Обход checkpoint через RDP-пакеты (protection bypass)

В конфигурации по-умолчанию пропускаются RDP-пакеты UDP/259...

smbd remote file creation vulnerability

Please hold with approving this one before Monday, if possible. This is a forced release. Author: Michal Zalewski [email protected] Topic: Insufficient parameter validation and unsafe default configuration make numerous systems running samba SMB file sharing daemon vulnerable to remote...

IBM Tivoli NetView 56 - OVActionD SNMPNotify Command Execution

IBM Tivoli NetView 56 - OVActionD SNMPNotify Command Execution source: https://www.securityfocus.com/bid/2845/info ovactiond is part of the system management software packages OpenView and Netview, distributed by HP and IBM. It is designed for use on enterprise systems, and offers remote...

CVE-2000-1016

The CVE-2000-1016 entry concerns the default Apache httpd.conf alias on SuSE 6.4 that exposes /usr/doc via /doc/packages, enabling remote read of package documentation and system configuration information. The vulnerability is an information disclosure in the web server configuration, with the af...

CVE-2000-0869

The default configuration of Apache 1.3.12 in SuSE Linux 6.4 enables WebDAV, which allows remote attackers to list arbitrary directories via the PROPFIND HTTP request method...

CVE-2000-1100

The vulnerability CVE-2000-1100 affects the PostACI webmail system where the default configuration installs /includes/global.inc in the web root, enabling remote reads of sensitive data (e.g., database usernames and passwords) via a direct HTTP GET. The NVD description confirms this exposure; no ...

CVE-2000-1100

The default configuration for PostACI webmail system installs the /includes/global.inc configuration file within the web root, which allows remote attackers to read sensitive information such as database usernames and passwords via a direct HTTP GET request...

CVE-2000-1015

The default configuration of Slashcode before version 2.0 Alpha has a default administrative password, which allows remote attackers to gain Slashcode privileges and possibly execute arbitrary commands...

Trlinux Postaci Webmail 1.1.3 - Password Disclosure

Trlinux Postaci Webmail 1.1.3 - Password Disclosure source: https://www.securityfocus.com/bid/2029/info Postaci Webmail is a database-driven web e-mail system. PostACI contains a vulnerability in its default configuration that may allow a remote attacker to gain access to the underlying database...

CVE-2000-0374

The default configuration of kdm in Caldera and Mandrake Linux, and possibly other distributions, allows XDMCP connections from any host, which allows remote attackers to obtain sensitive information or bypass additional access restrictions...

CVE-2000-0642

The default configuration of WebActive HTTP Server 1.00 stores the web access log active.log in the document root, which allows remote attackers to view the logs by directly requesting the page...

CVE-2000-0500

The default configuration of BEA WebLogic 5.1.0 allows a remote attacker to view source code of programs by requesting a URL beginning with /file/, which causes the default servlet to display the file without further processing...

PT-2000-1437 · Bea · Bea Weblogic

Name of the Vulnerable Software and Affected Versions: BEA WebLogic versions 3.1.8 through 4.5.1 Description: The default configuration of the software allows a remote attacker to view the source code of a JSP program. This can be achieved by requesting a URL that provides the JSP extension in...

Intel Corporation Shiva Access Manager 5.0 - Solaris World Readable LDAP Password

Intel Corporation Shiva Access Manager 5.0 - Solaris World Readable LDAP Password source: https://www.securityfocus.com/bid/1329/info The Shiva Access Manager is a solution for centralized remote access authentication, authorization, and accounting offered by Intel. It runs on Solaris and Windows...

Intel Corporation Shiva Access Manager 5.0 - Solaris World Readable LDAP Password

source: https://www.securityfocus.com/bid/1329/info The Shiva Access Manager is a solution for centralized remote access authentication, authorization, and accounting offered by Intel. It runs on Solaris and Windows NT. Shiva Access Manager is vulnerable to a default configuration problem in its...

NetStructure 7180 remote backdoor vulnerability

@Stake Inc. L0pht Research Labs www.atstake.com www.L0pht.com Security Advisory Advisory Name: NetStructure 7180 remote backdoor vulnerability Release Date: May 8th, 2000 Application: Intel NetStructure 7180 previously the Ipivot Commerce Accelerator 8000 Severity: Compromise from a remote networ...