SSH (x2) Remote Root Exploit

No description provided by source. http://www.milw0rm.com/sploits/x2.tgz milw0rm.com 2002-05-01...

[SECURITY] [DSA 119-1] ssh channel bug

Package: openssh Vulnerability: local root exploit, remote client exploit Debian-specific: no Joost Pol [email protected] reports that OpenSSH versions 2.0 through 3.0.2 have an off-by-one bug in the channel allocation code. This vulnerability can be exploited by authenticated users to gain root...

Ximian Mozilla: The 2618 Bug

NOTE TO THE MODERATOR: This was sent yesterday but i guess didn't make it since this doesn't seem to affect a redhat itself, it affects the mozilla packages distrbuted by Ximian: The test system look like: bash rpm -qa | grep mozilla mozilla-0.9.8-1.ximian.2 mozilla-mail-0.9.8-1.ximian.2...

rsync <= 2.5.1 Remote Exploit

No description provided by source. / 7350fuqnut - rsync include include include include include include include include include define MAXPATHLEN 4096 define VERSION "@RSYNCD: 26\n" define PORT 873 define NULLOFFSET -48 define STARTNULLBRUTE -44 define ENDNULLBRUTE -56 define BRUTEBASE 0xbfff7777...

rsync 2.5.1 - Remote (2)

rsync 2.5.1 - Remote 2 / 7350rsync - rsync include include include include include include include include include include define MAXPATHLEN 4096 define VERSION "@RSYNCD: 26\n" define PORT 873 define NULLOFFSET -48 define STARTNULLBRUTE -44 define ENDNULLBRUTE -56 define BRUTEBASE 0xbfff7777 defi...

EasyNews 1.5 - NewsDatabase/Template Modification

source: https://www.securityfocus.com/bid/3643/info EasyNews is a free, open-source script for displaying news stories on a website. EasyNews is prone to a vulnerability which may allow a remote attacker to modify information in its Newsdatabase. As a result, a remote attacker may post unmoderate...

ActivePerl perlIS.dll Remote Buffer Overflow

An attacker can run arbitrary code on the remote computer. This is because the remote IIS server is running a version of ActivePerl prior to 5.6.1.630 and has the Check that file exists option disabled for the perlIS.dll. %NASLMINLEVEL 70300 This script was written by Drew Hintz http://guh.nu It ...

[SECURITY] [DSA-071-1] fetchmail remote exploit

Package : fetchmail Problem type : memory corruption Debian-specific: no Salvatore Sanfilippo found two remotely exploitable problems in fetchmail while doing a security audit. In both the imap and pop3 code the input is not verified and used to store a number in an array. Since no bounds checkin...

Fetchmail 5.x - IMAP Reply Signed Integer Index

Fetchmail 5.x - IMAP Reply Signed Integer Index // source: https://www.securityfocus.com/bid/3166/info Fetchmail is a unix utility for downloading email from mail servers via POP3 and IMAP. Fetchmail contains a vulnerability that may allow for remote attackers to gain access to client systems. Th...

ghttpd 1.4 - Daemon Buffer Overflow

// source: https://www.securityfocus.com/bid/2879/info ghttpd is a freely available, open source web server for Unix systems. ghttpd supports CGI and is easy to configure and use. A buffer overflow is known to exist in ghttp which will allow arbitrary code to be executed with the privileges of th...

MDBms 0.96/0.99 - Query Display Buffer Overflow

source: https://www.securityfocus.com/bid/2867/info MDBMS is a free relational database management system. A buffer overflow condition exists in MDBMS. By issuing the '\s' command to display the query buffer when it contains a large amount of data, it may be possible for a remote user to trigger...

[SECURITY] [DSA-048-1] remote cfingerd exploit

Package : cfingerd Problem type : remote printf format attack Debian-specific: no Megyer Laszlo report on Bugtraq that the cfingerd Debian as distributed with Debian GNU/Linux 2.2 was not careful in its logging code. By combining this with an off-by-one error in the code that copied the username...

IBM Websphere/Net.Commerce 3 - CGI-BIN Macro Denial of Service

source: https://www.securityfocus.com/bid/2588/info Net.Commerce is part of the Websphere platform of products distributed by IBM. Net.Commerce provides several versatile features to facilitate e-commerce, and features in performance and reliability. A problem in the Net.Commerce package could...

CVE-2001-0197

Format string vulnerability in printclient in icecast 1.3.8beta2 and earlier allows remote attackers to execute arbitrary commands...

CVE-2000-1110

document.d2w CGI program in the IBM Net.Data db2www package allows remote attackers to determine the physical path of the web server by sending a nonexistent command to the program...

BFTPd 1.0.12 - Remote Overflow

/ Creates a filname to exploit the bug in bftpd 1.0.12 Create the file, cwd in the shell directory and nlist the file directory. Coded by korty / include include include include define LEN 205 int main int argc, char argv char bufLEN + 12; int ret = 0xbffffa80; int p; int fp; char code= / Linux/x...

bigbrother-1.4g.txt

/ Big Brother Exploit For ALL Versions prior to v.1.4h Desc: View the contents of any file on the remote system. Including /etc/passwd. Contributions: Identified and Proof of Concept by [email protected] and Loki LoA Greets and shouts to: smile, Vastervik, Self, alucard, RootHat, Lammie The...

Linuxconf 1.1.6 r10 - Remote Buffer Overflow

Linuxconf 1.1.6 r10 - Remote Buffer Overflow // source: https://www.securityfocus.com/bid/2352/info Linuxconf is a Linux configuration utility from Solucorp. An attacker supplying excess data to the USERAGENT field in vulnerable versions of Linuxconf. This data can overflow the relevant buffer,...

Allaire ColdFusion Server 4.0 - Remote File Display / Deletion / Upload / Execution

source: https://www.securityfocus.com/bid/115/info To display and delete any file on the system use an URL of the following form: http://www.victim.test/cfdocs/expeval/ExprCalc.cfm?OpenFilePath=C:\the\target\file To upload files to the sever first find out the location of the sample code on the...