OpenSSL 0.9.x - CBC Error Information Leakage

OpenSSL 0.9.x - CBC Error Information Leakage source: https://www.securityfocus.com/bid/6884/info A side-channel attack against implementations of SSL exists that, through analysis of the timing of certain operations, can reveal sensitive information to an active adversary. This information leake...

Blackboard 5.x Password Retrieval

-- Overview Through the exploitation of a SQL injection vulnerability it is possible for an unauthenticated user to query the Blackboard user directory and: - Enumerate users with a given password. - Extract the MD5 password of any given user. Blackboard Learning System 5.x, level 1 and 2 are...

WinRAR buffer overflow

Stack overflow on oversized file extention during extraction...

Telindus 112x ADSL Router - Weak Password Encryption

Telindus Router series 112x has a well-know authentication problem, which lets to extract router password from a UDP-dump sniffed over 9833 port. More about this at: http://www.securiteam.com/securitynews/5DP0A2K7GY.html or http://neworder.box.sk/showme.php3?id=6730 New firmware 6.0.27, Jul/2002...

Buffer overflow and directory traversal in Microsoft Windows Compressed Folders feature

Buffer overflow and directory traversal while extracting file from .zip archive...

Low: Red Hat Security Advisory: unzip security update

The unzip and tar utilities contain vulnerabilities which can allow arbitrary files to be overwritten during archive extraction. updated Jan 22 2003 Added description of CAN-2002-1216 which was also fixed by these erratum packages. The unzip and tar utilities are used for dealing with archives,...

CVE-2002-0399

CVE-2007-4559 is a directory traversal vulnerability in the tarfile module of Python, allowing a tar archive containing a .. sequence to overwrite arbitrary files during extraction. The issue is referenced in multiple Nessus advisories (e.g., Alibaba Cloud Linux 3 advisory ALINUX3-SA-2024:0040 an...

CVE-2002-0399

Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary files during archive extraction via a 1 "/.." or 2 "./.." string, which removes the leading slash but leaves the "..", a variant of CVE-2001-1267...

KPMG-2002018: Pointsec for PalmOS PIN disclosure

-------------------------------------------------------------------- Title: Pointsec for PalmOS PIN disclosure BUG-ID: 2002018 Released: 03rd May 2002 Discovered by: Laurens Binken, KPMG IRM, the Netherlands -------------------------------------------------------------------- Problem: ========...

CVE-2001-1271

Directory traversal vulnerability in rar 2.02 and earlier allows attackers to overwrite arbitrary files during archive extraction via a .. dot dot attack on archived filenames...

CVE-2002-0343

CVE-2002-0343 affects Hotline Client 1.8.5, where passwords and other sensitive user data are stored in plaintext in the bookmarks file. The underlying issue is plaintext storage accessible to local users, enabling privilege escalation by extracting passwords from the bookmarks file. Impact is de...

CVE-2001-1271

Technical details beyond the provided description are not available in the connected documents; CVE-2001-1271 describes a directory traversal in rar 2.02 and earlier via .. in archived filenames, with no further details in the supplied sources.

CVE-2001-1270

Directory traversal vulnerability in the console version of PKZip pkzipc 4.00 and earlier allows attackers to overwrite arbitrary files during archive extraction with the -rec recursive option via a .. dot dot attack on the archived files...

Microsoft Windows 'Backup Operators' Group User List

Using the supplied credentials, it is possible to extract the member list of the 'Backup Operators' group. Members of this group can logon to the remote host and perform backup operations read/write files but have no administrative rights. C Tenable Network Security, Inc. include"compat.inc"; if...

CVE-2001-0973

BSCW groupware system 3.3 through 4.0.2 beta allows remote attackers to read or modify arbitrary files by uploading and extracting a tar file with a symlink into the data-bag space...

remote memory reading through tcp/icmp

Greets: in no particular order Marty and others for their brilliant work with Snort Fyodor for nmap LBNL Network Research Group zen-parse 4 and jaguar for looking over this and suggesting improvements. It is possible to read parts of a remote machines memory. To be specific, it would have to be...

CVE-2001-1534

modusertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication...

Слабая защита в XIRCOM REX6000 (unauthorized access)

PIN, защищающий устройство, может быть получен через последовательный порт...

BSCW vulnerable to arbitrary file overwriting via symlink redirection of temporary file

Overview BSCW is a groupware system that runs on a web server. BSCW follows symbolic links in tar files that it extracts into a user's local area. Accessing those links may allow the user to view arbitrary files viewable by the web server, and to overwrite files writable by the web server...

Extracting a 3DES key from an IBM 4758

Extracting a 3DES key from an IBM 4758 The IBM 4758 is an extremely secure crytographic co-processor. It is used by banking systems and in other security conscious applications to hold keying material. It is designed to make it impossible to extract this keying material unless you have the correc...