210 matches found
Fetchmail多个密码信息泄露漏洞
Fetchmail是一款多功能的IMAP和POP客户程序。 Fetchmail存在设计问题，远程攻击者可以利用漏洞可能获得用户密码敏感信息。 具体问题如下： -sslcertck/sslfingerprint选项本来必须应用到"sslproto tls1"来迫使使用TLS协商，但程序没有。 -在配置文件中即使使用"sslproto tls1"，但如果STLS/STARTTLS没有使用，获取邮件也是明文过程。 -无论TLS选项是否采用，POP3的抓取完全忽略TLS，因为在检查STLS支持前没有可靠的发送CAPA，而CAPA是STLS所必须的。无论CAPA是否检测到，依靠的是"auth"选项...
CVE-2006-6716
SQL injection vulnerability in administration/administre2.php in Eric GUILLAUME uploader&downloader 3 allows remote attackers to execute arbitrary SQL commands via the iduser parameter...
CVE-2006-6716
The CVE-2006-6716 issue affects Eric GUILLAUME uploader&downloader 3, specifically the administration/administre2.php component. The vulnerability is a SQL injection in the id_user parameter that can allow remote attackers to execute arbitrary SQL commands. This is caused by improper input handli...
Sendmail 8.6.9 IDENT远程缓冲区溢出漏洞
Sendmail是一个广为使用的Internet邮件传输程序。 8.6.9版本的Sendmail的IDENT功能实现上存在缓冲区溢出漏洞，远程攻击者可以利用此漏洞直接得到主机的root权限。 Eric Allman Sendmail 8.6.9 临时解决方法： 如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁： 关闭IDENT协议功能 在Sendmail的配置文件中加入： Orident=0 然后重启Sendmail。 厂商补丁： Eric Allman ----------- 目前厂商已经在新版的软件中修复了这个安全问题，请到厂商的主页下载：...
Fetchmail POP3客户端缓冲区溢出漏洞
BUGTRAQ ID: 14349 CVECAN ID: CVE-2005-2335 fetchmail是免费的软件包，可以从远程POP2、POP3、IMAP、ETRN或ODMR服务器检索邮件并将其转发给本地SMTP、LMTP服务器或消息传送代理。 fetchmail的POP3客户端在处理服务器回应时存在缓冲区溢出漏洞，恶意服务器可能利用此漏洞在客户端上执行任意指令。...
Pubcookie security bypass
It is possible for a malicious user to spoof a user's identity by bypassing the login redirection mechanism in the pubcookie module. The malicious user may gain the privileges of the user they are spoofing, including the administrative user. Versions affected Drupal core is not affected. If you d...
CVE-2006-1667
Summary: CVE-2006-1667 affects Eric Gerdes Crafty Syntax Image Gallery (CSIG) up to version 3.1g. The vulnerability is a SQL injection in slides.php caused when the variable $projectid is less than 1, which prevents the limitquery_s parameter from being set. This enables remote authenticated user...
Cisco Aironet Wireless Access Points - Memory Exhaustion ARP (Denial of Service)
Cisco Aironet Wireless Access Points - Memory Exhaustion ARP Denial of Service // // Cisco Killer - ciskill.c // // Usage: ./ciskill device // // Author: Pasv pasvninja at gmail.com // // Credit: This exploit takes advantage of a vulnerability that was // discovered by Eric Smith on January 12,...
Debian DSA-869-1 : eric - missing input sanitising
The developers of eric, a full featured Python IDE, have fixed a bug in the processing of project files that could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Securi...
[SECURITY] [DSA 869-1] New eric packages fix arbitrary code execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 869-1 [email protected] http://www.debian.org/security/ Martin Schulze October 21st, 2005 http://www.debian.org/security/faq -...
[SECURITY] [DSA 869-1] New eric packages fix arbitrary code execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 869-1 [email protected] http://www.debian.org/security/ Martin Schulze October 21st, 2005 http://www.debian.org/security/faq -...
[Full-disclosure] [SECURITY] [DSA 869-1] New eric packages fix arbitrary code execution
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 869-1 [email protected] http://www.debian.org/security/ Martin Schulze October 21st, 2005 http://www.debian.org/security/faq -...
DSA-869-1 eric - missing input sanitising
Bulletin has no description...
Debian DSA-843-1 : arc - insecure temporary file
Two vulnerabilities have been discovered in the ARC archive program under Unix. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2005-2945 Eric Romang discovered that the ARC archive program under Unix creates a temporary file with insecure permissions...
CVE-2005-3068
Unspecified vulnerability in Eric Integrated Development Environment eric3 before 3.7.2 has unknown impact and attack vectors related to a "potential security exploit."...
CVE-2005-3068
Unspecified vulnerability in Eric Integrated Development Environment eric3 before 3.7.2 has unknown impact and attack vectors related to a "potential security exploit."...
CVE-2005-3068
Unspecified vulnerability in Eric Integrated Development Environment eric3 before 3.7.2 has unknown impact and attack vectors related to a "potential security exploit."...
CVE-2005-3068
Unspecified vulnerability in Eric Integrated Development Environment eric3 before 3.7.2 has unknown impact and attack vectors related to a "potential security exploit."...
CVE-2005-3068
Unspecified vulnerability in Eric Integrated Development Environment eric3 before 3.7.2 has unknown impact and attack vectors related to a "potential security exploit."...
CVE-2005-3068
Summary : CVE-2005-3068 affects the Eric IDE (eric3). Debian security advisory DSA-869-1 states the vulnerability is caused by missing input sanitising in eric, which could lead to arbitrary code execution. Affected releases: eric before 3.7.2; the fix is in eric 3.7.2-1 (and 3.6.2-2 for the rele...