clamav shell characters

Shell characters problem in filename if f option is used...

Buffer overflows and format string bugs in Emil

Ulf Härnhammar reports multiple buffer overflows in Emil, some of which are triggered during the parsing of attachment filenames. In addition, some format string bugs are present in the error reporting code. Depending upon local configuration, these vulnerabilities may be exploited using speciall...

Reget directory traversal

Directory is traversed with 2F.. in filename...

TypSoft FTP Server DoS

DoS on UNC filename...

CVE-2004-0172

Heap-based buffer overflow in the searchforcommand function of ltrace 0.3.10, if it is installed setuid, could allow local users to execute arbitrary code via a long filename. NOTE: It is unclear whether there are any packages that install ltrace as a setuid program, so this candidate might be...

hsftp format string bug

filename format string bug...

GoAhead script source leak

It's possible to obtain content of .asp or cgi-bin file by adding special characters to filename...

[SECURITY] [DSA 419-1] New phpgroupware packages fix unintended PHP execution and SQL injection

-------------------------------------------------------------------------- Debian Security Advisory DSA 419-1 [email protected] http://www.debian.org/security/ Martin Schulze January 9th, 2003 http://www.debian.org/security/faq -...

Yahoo Instant Messenger buffer overflow

Buffer overflow on oversized filename...

DSA-419 phpgroupware - missing filename sanitising, SQL injection

Bulletin has no description...

Yahoo Instant Messenger Long Filename Downloading Buffer Overflow

Yahoo Instant Messenger Long Filename Downloading Buffer Overflow ================================================= PROGRAM: Yahoo Instant Messenger YIM HOMEPAGE: http://messenger.yahoo.com VULNERABLE VERSIONS: 5.6.0.1351 and below DESCRIPTION ================================================= YIM...

CVE-2003-1508

Buffer overflow in mIRC 6.12, when the DCC get dialog window has been minimized and the user opens the minimized window, allows remote attackers to cause a denial of service crash via a long filename...

DEBIAN-CVE-2003-1308

CRLF injection vulnerability in fvwm-menu-directory for fvwm 2.5.x before 2.5.10 and 2.4.x before 2.4.18 allows local users to execute arbitrary commands via carriage returns in a filename...

MS Windows XP Workstation Service Remote Exploit (MS03-049)

漏洞描述：Microsoft DCE/RPC服务可以提供网络管理功能，这些功能提供管理用户帐户和网络资源管理的功能。部分网络管理功能在Windows目录下的"debug"子目录会生成调试日志文件。Microsoft Workstation服务在处理日志记录时缺少充分的边界缓冲区检查，远程攻击者可以利用这个漏洞提供超长参数触发缓冲区溢出，以SYSTEM权限在系统上执行任意指令。 日志功能中使用vsprintf在日志文件中生成字符串，日志文件名为"NetSetup.LOG"，其保存在Windows "debug"目录中。...

DEBIAN-CVE-2002-1569

gv 3.5.8, and possibly earlier versions, allows remote attackers to execute arbitrary commands via shell metacharacters in the filename for 1 a PDF file or 2 a gzip file...

(Fw) : mIRC 6.12 (latest) DCC Exploit

this news was found on irchelp, DCC Exploit Affecting mIRC 6.12 : another exploit was identified which can crash even the recently released version 6.12. It only seems to affect people who minimize DCC get dialog windows manually or by default, and then open those windows to get a file with an...

CVE-2003-0729

Buffer overflow in Tellurian TftpdNT 1.8 allows remote attackers to execute arbitrary code via a TFTP request with a long filename...

DEBIAN-CVE-2003-0805

Multiple buffer overflows in UMN gopher daemon gopherd 2.x and 3.x before 3.0.6 allows attackers to execute arbitrary code via 1 a long filename as a result of a LIST command, and 2 the GSisText function, which calculates the view-type...

CVE-2003-0805

Multiple buffer overflows in UMN gopher daemon gopherd 2.x and 3.x before 3.0.6 allows attackers to execute arbitrary code via 1 a long filename as a result of a LIST command, and 2 the GSisText function, which calculates the view-type...

Microsoft Windows - RPC DCOM Long Filename Overflow (MS03-026)

Microsoft Windows - RPC DCOM Long Filename Overflow MS03-026 include include include include include include pragma commentlib,"ws232" unsigned char bindstr= 0x05,0x00,0x0B,0x03,0x10,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x7F,0x00,0x00,0x00,...