acroread: script injection vulnerability (APSB10-02)

The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanced Security feature, which has unspecified impact and attack vectors, related to a "script injection vulnerability," as demonstrated by Acrobat Forms Data...

TinyBrowser (TinyMCE Editor File browser) 1.41.6 - Multiple Vulnerabilities

TinyBrowser TinyMCE Editor File browser 1.41.6 - Multiple Vulnerabilities ============================================================================== TinyBrowser TinyMCE Editor File browser 1.41.6 - Multiple Vulnerabilities...

CVE-2009-2213

The default configuration of the Security global settings on the Citrix NetScaler Access Gateway appliance with Enterprise Edition firmware 9.0, 8.1, and earlier specifies Allow for the Default Authorization Action option, which might allow remote authenticated users to bypass intended access...

IE default settings exposes Intranet to attacks

From DarkReading Kelly Jackson Higgins Internet Explorer 7 and 8’s default security settings can be unsafe for internal, intranet-based Web applications, according to newly published research. Cesar Cerrudo, founder and CEO of Argennis, a security consulting firm in Argentina, has demonstrated th...

Belkin F5D8233-4 Wireless N Router (Multiple Scripts) - Authentication Bypass

Belkin F5D8233-4 Wireless N Router Multiple Scripts - Authentication Bypass source: https://www.securityfocus.com/bid/32275/info The Belkin F5D8233-4 Wireless N Router is prone to multiple vulnerabilities because of a lack of authentication when users access specific administration scripts...

zubrag-upload.txt

//Title - Zubrag Uploader 1.0 Arbitrary Shell Upload Vulnerability //Vendor - zubrag.com/scripts/file-upload-form.php //Version - 1.0 //Status - vendor has been notified //Author - Dentrasi //Description It is possible to upload a php script to the remote site. The script attempts to hide the...

Cacti: SQL injection vulnerability

Background Cacti is a complete web-based front end to rrdtool. Description Cacti is vulnerable to a SQL injection attack where an attacker may inject SQL into the Username field. Impact An attacker could compromise the Cacti service and potentially execute programs with the permissions of the use...

TREND MICRO: The Protector Becomes The Vector Take II

Monday, June 07, 2004 !-- 1. When the product alerts it creates an html file in the temporary file of the user's machine the so-called "local zone" screen shot: http://www.malware.com/weallcar.png 29KB This html file is viewed from an Internet Explorer "browser object" and indicates what file is...

PHP setting leaks from .htaccess files on virtual hosts

Background PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. Description If the server configuration "php.ini" file has "registerglobals = on" and a request is made to one virtual host which has "phpadminflag...

CVE-2003-0983

Cisco Unity on IBM servers is shipped with default settings that should have been disabled by the manufacturer, which allows local or remote attackers to conduct unauthorized activities via 1 a "bubba" local user account, 2 an open TCP port 34571, or 3 when a local DHCP server is unavailable, a...

CVE-2003-1346

D-Link wireless access point DWL-900AP+ 2.2, 2.3 and possibly 2.5 allows remote attackers to set factory default settings by upgrading the firmware using AirPlus Access Point Manager...

CVE-2003-0983

Cisco Unity on IBM servers is shipped with default settings that should have been disabled by the manufacturer, enabling unauthorized activity via (1) a local user account named “bubba,” (2) an open TCP port 34571, or (3) a DHCP server on the manufacturer’s test network when a local DHCP server i...

CVE-2003-0983

Cisco Unity on IBM servers is shipped with default settings that should have been disabled by the manufacturer, which allows local or remote attackers to conduct unauthorized activities via 1 a "bubba" local user account, 2 an open TCP port 34571, or 3 when a local DHCP server is unavailable, a...

Unauthorized access via Xerox DocuTech

Default system settings and admin password...

Beck GmbH IPC@Chip FtpD allows an attacker to gain access to the device

Overview There is a vulnerability in the Beck IPC@CHIP that allows an attacker to gain access to the device. Description The Beck IPC@CHIP is a single chip embedded webserver. This device also contains an ftp server that is configured by default to allow anonymous access. Additionally, the device...

Beck GmbH IPC@CHIP HTTPD vulernable to arbitrary file disclosure

Overview The Beck IPC@CHIP web server permits intruders to access files outside the web root. Description The Beck IPC@CHIP is a single chip embedded webserver. The Web Server's root directory is set to / by default. Because of this default setting, an attacker can download arbitrary files from a...

Netscape E.S. Web Publisher ACL Vulnerabilities

Vendor: Netscape Product: Enterprise Server 3.5.1 and others? Specifics: Netscape Web Publisher Vulnerability Briefing: A very wide problem with ACL settings and default settings with Netscape Enterprise Server Publisher. Description: With the default installation of Netscape Enterprise Server...

WinVNC 3.3.x

So, you use WinVNC and Windows NT4 Workstation/Server...? During the InstallShield setup utility, it creates the registry key: HKEYLOCALMACHINESoftwareORLWinVNC3 which is used to store all of WinVNC's default settings. By default, Administrator and SYSTEM have full control, and Everybody has...

CVE-1999-0725

When IIS is run with a default language of Chinese, Korean, or Japanese, it allows a remote attacker to view the source code of certain files, a.k.a. "Double Byte Code Page"...

oracle.8.passwd.txt

Date: Thu, 4 Mar 1999 15:44:37 -0600 From: James Kivisild To: [email protected] Subject: Oracle Plaintext Password I now know this has been mentioned before, however I've gotten a large number of responses from people about Oracle problems similar to this. As a first time Oracle installer, I...