ASI Oracle Security Alert: Oracle Home Environment Variable Buffer Overflow

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Oracle Home Environment Variable Buffer Overflow For additional details, the official advisories from Oracle Corporation can be downloaded from: http://otn.oracle.com/deploy/security/pdf/dbsmpalert.pdf Summary: By setting a long ORACLEHOME value more...

NetBSD Security Advisory 2001-016: unsafe chdir usage in fts(3)

-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 2001-016 ================================= Topic: unsafe chdir usage in fts3 Version: All NetBSD releases prior to July 9, 2001. Severity: Local users can trick processes that walk file system trees to perform their actions in the wrong...

Обратный путь в директориях в функциях fts из libc (directory traversal)

Сконструировав специальные имена файлов можно выйти за пределы дерева директорий...

Обход защиты в CylantSecure (protection bypass)

Из-за зажержки в обработке, программа может подгрузить модель с перенаправлением функций для обхода защиты...

Несанкционированный доступ в Active Web Classifieds (unauthorized access)

Ко многим конфигурационным функциям можно обратиться в обход защиты паролем...

Неавторизованный доступ через SSL к LDAP в Windows 2000 (unauthorized access)

При разрешенном доступе к LDAP через SSL можно получить неавторизованный доступ к ряду функций LDAP, включая смену пароля...

Buffer Overflow

Overview Affected versions of this package are vulnerable to Buffer Overflow. Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary commands via a long pattern string containing a sequence, as seen in 1 gopendir, 2 glstat, 3 gstat, and 4 the glob0 buffer as used i...

[SNS Advisory No.30] Trend Micro InterScan VirusWall for Windows NT 3.51 reconfiguration without authentication

SNS Advisory No.30 Trend Micro InterScan VirusWall for Windows NT 3.51 reconfiguration without authentication Problem first discovered: 24 May 2001 Published: 12 Jun 2001 Last Updated:12 Jun 2001 ----------------------------------------------------------------------- Overview --------- It is...

insecure signal handler design

"Delivering Signals for Fun and Profit" Understanding, exploiting and preventing signal-handling related vulnerabilities. Michal Zalewski [email protected] C Copyright 2001 BindView Corporation 0 Introduction --------------- According to a popular belief, writing signal handlers has litt...

Aladdin Knowledge Systems eSafe Gateway 3.0 - HTML tag Script-filtering Bypass

Aladdin Knowledge Systems eSafe Gateway 3.0 - HTML tag Script-filtering Bypass source: https://www.securityfocus.com/bid/2800/info eSafe Gateway is a security utility used for filtering internet content. It is possible to craft an html file that slips through eSafe Gateway's script filtering...

CVE-2001-0247

Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary commands via a long pattern string containing a sequence, as seen in 1 gopendir, 2 glstat, 3 gstat, and 4 the glob0 buffer as used in the glob functions glob2 and glob3...

CVE-2001-0192

Buffer overflows in CTRLServer in XMail allows attackers to execute arbitrary commands via the cfgfileget or domaindel functions...

FreeBSD-SA-01:35.licq

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:35 Security Advisory FreeBSD, Inc. Topic: licq contains multiple remote vulnerabilities Category: ports Module: licq Announced: 2001-04-23 Credits: Stan Bubrouski Affects...

CVE-1999-0760

Undocumented ColdFusion Markup Language CFML tags and functions in the ColdFusion Administrator allow users to gain additional privileges...

CVE-2000-0894

HTTP server on the WatchGuard SOHO firewall does not properly restrict access to administrative functions such as password resets or rebooting, which allows attackers to cause a denial of service or conduct unauthorized activities...

CVE-2000-1069

pollit.cgi in Poll It 2.01 and earlier allows remote attackers to access administrative functions without knowing the real password by specifying the same value to the enteredpassword and adminpassword parameters...

CVE-2000-1069

The CVE concerns pollit.cgi in Poll It 2.01 and earlier, where remote attackers can access administrative functions without the real password by supplying the same value to entered_password and admin_password. The provided references confirm the vulnerable component and the authentication bypass,...

Informix Webdriver 1.0 - Remote Administration Access

source: https://www.securityfocus.com/bid/2166/info Informix Webdriver, the web-to-DB interface used by Informix database products, may permit unauthorized remote access to the system's administration functions. Under very specific circumstances, if webdriver is called directly, without any...

webevent.txt

To whom it may concern, I found what seems to be a bug in a program called webevent www.webevent.com. Webevent is a calander program that allows multiple users to post to, and read the calander. The bug comes in from the fact that you still have access to the perl file that is run when the...

statd bounce vulnerability

Overview statd allows access to RPC services it shouldn't. Description Background rpc.statd and rpc.lockd are designed to work in conjunction with each other to manage NFS lock information in the event of a crash of an NFS client or server. The rpc service rpc.statd is a program designed to...