BSCW vulnerable to arbitrary file overwriting via symlink redirection of temporary file

Overview BSCW is a groupware system that runs on a web server. BSCW follows symbolic links in tar files that it extracts into a user's local area. Accessing those links may allow the user to view arbitrary files viewable by the web server, and to overwrite files writable by the web server...

Extracting a 3DES key from an IBM 4758

Extracting a 3DES key from an IBM 4758 The IBM 4758 is an extremely secure crytographic co-processor. It is used by banking systems and in other security conscious applications to hold keying material. It is designed to make it impossible to extract this keying material unless you have the correc...

Lotus Notes: File attachments may be extracted regardless of document security

Hello, This is my first post to the list. I'll try to get this right. The short version is that file attachments and other objects may be extracted from Notes databases regardless of any author or reader fields on the documents the objects are attached to. This goes back to the structure of Notes...

Извлечение паролей из памяти в Password Safe (protection bypass)

В отдельных случаях пароль можно найти в памяти в открытом тексте...

Sambar Server 4.x/5.0 - Insecure Default Password Protection

source: https://www.securityfocus.com/bid/3095/info Sambar Server is a multi-threaded HTTP server for Microsoft Windows and Unix systems. Sambar Server provides insecure default protection for user passwords. The default password decryption algorithm employs only a single key, built into the serv...

CVE-2001-1271

Directory traversal vulnerability in rar 2.02 and earlier allows attackers to overwrite arbitrary files during archive extraction via a .. dot dot attack on archived filenames...

CVE-2001-1269

Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction via filenames in the archive that begin with the '/' slash character...

CVE-2001-1268

Directory traversal vulnerability in Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction via a .. dot dot in an extracted filename...

CVE-2001-1270

Directory traversal vulnerability in the console version of PKZip pkzipc 4.00 and earlier allows attackers to overwrite arbitrary files during archive extraction with the -rec recursive option via a .. dot dot attack on the archived files...

SECURITY.NNOV: special devices access in multiple archivers

Hello, Topic: Special devices access in multiple archivers Author: 3APA3A [email protected] Platform: Windows Affected Software: WinZIP Computing's WinZIP 8.0, PKWare PkZip 4.0, RARSoft WinRar 2.80 Risk: average Released: July, 5, 2001 SECURITY.NNOV advisories:...

Доступ к специальным устройствам во многих архиваторах (special device)

При извлечении файла файл может быть послан в специальное устройство...

SECURITY.NNOV: directory traversal and path globbing in multiple archivers

Hello, Topic: Directory traversal and path globbing in multiple archivers Author: 3APA3A [email protected] Affected Software: GNU tar = 1.13.19, Info-Zip UnZip = 5.42, RARSoft rar = 2.02, PKWare pkzipc = 4.00 Not affected: rar 2.80, WinZIP 8.0 Risk: low/average Released: July, 2, 2001...

CVE-2001-0001

cookiedecode function in PHP-Nuke 4.4 allows users to bypass authentication and gain access to other user accounts by extracting the authentication information from a cookie...

Multiple archivers special DOS/Windows devices access

Topic: Special devices access in multiple archivers Author: 3APA3A Platform: Windows Affected Software: WinZIP Computing's WinZIP 8.0, PKWare PkZip 4.0, RARSoft WinRar 2.80 Risk: average Released: July, 5, 2001 SECURITY.NNOV advisories: http://security.nnov.ru/advisories Background: Archive...

IBM NetCommerce Security

hola friends, while i was participating on the openhack contest i found a couple of serious security-holes within ibm s so called "netcommerce" thing which seems to be a mixture of websphere, net.data, servlets, jsp s and db2? however..summary: class: input validation error remote: yes local: yes...

tar-symlink.txt

Title : GNU tar Tape ARchive symlinkvulnerability Author : Marco van Berkum Organisation : OBIT b.v. URL : http://www.obit.nl Email : [email protected] Date : 06-01-2001 The usefull program tar Tape ARchive is used by all UNIX, Linux and BSD versions around and is used to ARCHIVE files to disk o...

Несколько дырок в WebPlus

Различные дырки дают возможность получения полного пути к документам, получение текста исполняемых приложений и др...

И еще одна проблема с паролями в MS SQL 7

При использовании Data Transformation Services пароль пользователя показывается в качестве поля типа password в одной из диалоговых форм, что позволяет его оттуда извлечь...

Уязвимость в NTLMv1

Используется операция побитового илсключаещего или XOR с битовой последовательностью. Пароль передается как Unicode-строка, при этом используется большое количество нулевых байт в известных позициях, что позволяет обнаружить последовательность и извлечь пароль в случае перехвата пакета...

Aladdin eToken 3.3.3.x Hardware USB Key Private Data Extraction

@Stake Inc. L0pht Research Labs www.atstake.com www.L0pht.com Security Advisory Advisory Name: eToken Private Information Extraction and Physical Attack Release Date: May 4, 2000 Application: N/A Platform: Aladdin eToken USB Key 3.3.3.x Severity: An attacker can access all private information...