HP-UX FTP daemon is vulnerable to a buffer overflow

Overview The HP-UX FTP daemon ftpd contains a buffer overflow that may allow an unauthenticated, remote attacker to execute arbitrary code. Description The HP-UX FTP daemon ftpd is vulnerable to a buffer overflow when the FTP daemon is configured to log debugging information. Debug logging is...

[SCAN Associates Security Advisory] vbulletin 3.0.6 and below php code injection

Summary: vbulletin 3.0.6 and below php code injection Description =========== vBulletin is a powerful, scalable and fully customizable forums package for your web site. It has been written using the Web's quickest-growing scripting language; PHP, and is complimented with a highly efficient and...

Sybase SQL sa Account Blank Password

The remote Sybase SQL server has the default 'sa' account enabled without any password. An attacker may use this flaw to execute commands against the remote host as well as read database content. C Tenable Network Security, Inc. This script is based on mssqlblankpassword.nasl which is C H D Moore...

vbulletin 3.0.x PHP code execution

Vulnerable Systems: ---------------- vBulletin version 3.0 up to and including version 3.0.4 Immune systems: ---------------- vBulletin version 3.0.5 vBulletin version 3.0.6 Vulnerable code in forumdisplay.php : if $vboptions'showforumusers' . . . . if $bbuserinfo'userid' . . . . $comma = ', ';...

CVE-2005-0311

Ingate Firewall 4.1.3 and earlier does not terminate the PPTP session for an active user when the administrator disables that user from a resource, which could allow remote authenticated users to retain unauthorized access to resources...

Microsoft Internet Explorer Unspecified ActiveX Image Control Vulnerability

Description Microsoft has announced in the MS05-014 Cumulative Internet Explorer bulletin that the ActiveX Image Control 1.0 is no longer supported due to an unspecified security vulnerability. The cumulative update addresses the vulnerability by setting the kill-bit on the control so that it may...

PT-2005-1326 · Postgresql +1 · Postgresql +1

Name of the Vulnerable Software and Affected Versions: PostgreSQL versions 8.0.0 and earlier Description: The issue allows attackers to cause a denial of service, resulting in a crash, by utilizing crafted arrays. A valid login is required to exploit this issue. Recommendations: For versions 8.0....

Microsoft Internet Explorer contains a DHTML method heap memory corruption vulnerability

Overview Microsoft Internet Explorer contains a flaw in DHTML method handling which may allow a remote attacker to execute arbitrary code. Description The DHTML method handling in Internet Explorer fails to perform proper bounds checking. This vulnerability may allow data to be written outside th...

PT-2005-1308 · Postgresql +1 · Postgresql +1

Name of the Vulnerable Software and Affected Versions: PostgreSQL versions 7.2.x through 7.4.x PostgreSQL affected versions not specified Description: The issue allows local users to load arbitrary shared libraries and execute code via the LOAD extension. Any database user is permitted to load...

Squid LDAP authentication routines fail to check for invalid input

Overview The Squid LDAP authentication routine squidldapauth fails to check for input characters, such as whitespace, that could be misused to possibly bypass access restrictions. Description Squid functions as a web proxy and cache application for a number of protocols, and includes support for...

PT-2005-1146 · Ethereal +1 · Ethereal +1

Name of the Vulnerable Software and Affected Versions: Ethereal versions 0.10.6 through 0.10.8 Description: The issue is related to an unknown vulnerability in the Gnutella dissector, which allows remote attackers to cause a denial of service, resulting in an application crash. Recommendations: F...

BIND 8.4.4 and 8.4.5 vulnerable to buffer overflow in q_usedns

Overview A vulnerability in the BIND name server could allow a remote attacker to cause a denial of service against an affected system. Description The Berkeley Internet Name Domain BIND is a popular Domain Name System DNS implementation from Internet Systems Consortium ISC. A buffer overflow err...

RealPlayer ActiveX control contains buffer overflow in "ShowPreferences"

Overview The RealPlayer ActiveX control contains a stack-based buffer overflow in the ShowPreferences method. This may permit a remote attacker to execute arbitrary code on the user's system. Description RealNetworks RealPlayer is a multimedia application that allows users to view local and remot...

UMN Gopherd Unauthorized FTP Proxy

The remote host is running a UMN Gopher server. It is possible to make the remote server connect to third party FTP sites by sending the request 'ftp://hostname.of.the.ftp.server'. An attacker may exploit this flaw to connect to use the remote gopher daemon as a proxy to connect to FTP servers...

Konqueror fails to restrict access to Java classes

Overview The Konqueror web browser may allow Java applets and JavaScripts to bypass the Java security settings and access restricted Java classes. Exploitation may allow a remote attacker to read and write arbitrary files on a vulnerable system. Description Konqueror is a web browser and file...

PT-2004-3257 · Phpx · Phpx

Name of the Vulnerable Software and Affected Versions: PHPX versions 3.0 through 3.2.6 Description: The issue allows remote attackers to conduct cross-site scripting XSS attacks via hex-encoded tags. This is achieved by bypassing the check for literal "", "", and "" characters in the checkURI...

Sun and Blackdown Java: Applet privilege escalation

Background Sun and Blackdown both provide implementations of Java Development Kits JDK and Java Runtime Environments JRE. All these implementations provide a Java plug-in that can be used to execute Java applets in a restricted environment for web browsers. Description All Java plug-ins are subje...

CVE-2004-1003

Trend ScanMail allows remote attackers to obtain potentially sensitive information or disable the anti-virus capability via the smency.nsf file...

MailPost discloses sensitive system information when operating in debug mode

Overview A vulnerability is reported to exist in MailPost version 5.1.1sv and possibly earlier versions that may permit a remote attacker to gain sensitive information about the server configuration and environment.. Description According to the ProCheckUp report, MailPost contains a vulnerabilit...

Unpassworded 'bash' Backdoor Account

The account 'bash' has no password set. An attacker may use it to gain further privileges on this system. This account was likely created by a backdoor installed by a fake Linux RedHat patch. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc...