Comdev eCommerce 3.0 Multiple Vulnerabilities (RFI, Traversal)

The remote host is running eCommerce, a web-based shopping system from Comdev. The installed version of eCommerce allows remote attackers to control the 'pathdocroot' parameter used when including PHP code in the 'config.php' script. By leveraging this flaw, an attacker may be able to view...

RHEL 3 : glibc (RHSA-2005:256)

Updated glibc packages that address several bugs are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The GNU libc packages known as glibc contain the standard C libraries used by applications. It was discovered that the use of LDDEBUG...

Kerberos configuration

This plugin lets a user enter information about the Kerberos server that will be queried by some scripts SMB and SSH to log into the remote hosts. TRUSTED...

security flaw

KPPP 2.1.2 in KDE 3.1.5 and earlier, when setuid root without certain wrappers, does not properly close a privileged file descriptor for a domain socket, which allows local users to read and write to /etc/hosts and /etc/resolv.conf and gain control over DNS name resolution by opening a number of...

XSLT can include stylesheets from arbitrary hosts — Mozilla

xsl:include and xsl:import can include XSLT stylesheets from arbitrary domains including those behind the user's firewall. This at least allows for existence checking of these files; it's not clear how much, if any, data could be extracted from arbitrary XML files...

Trend Micro IWSS Console Management Detection

The remote host appears to run the Trend Micro Interscan Web Security Suite. Make sure that only authorized hosts can connect to this service, as the information of its existence may help an attacker to make more sophisticated attacks against the remote network. C Tenable Network Security, Inc...

GLSA-200502-11 : Mailman: Directory traversal vulnerability

The remote host is affected by the vulnerability described in GLSA-200502-11 Mailman: Directory traversal vulnerability Mailman contains an error in private.py which fails to properly sanitize input paths. Impact : An attacker could exploit this flaw to obtain arbitrary files on the web server...

Null Payload ICMP

Some worms, such as Sasser, use ICMP echo request packets with null payload to detect potentially vulnerable hosts...

CVE-2004-1182

hfaxd in HylaFAX before 4.2.1, when installed with a "weak" hosts.hfaxd file, allows remote attackers to authenticate and bypass intended access restrictions via a crafted 1 username or 2 hostname that satisfies a regular expression that is matched against a hosts.hfaxd entry without a password...

DEBIAN-CVE-2004-1182

hfaxd in HylaFAX before 4.2.1, when installed with a "weak" hosts.hfaxd file, allows remote attackers to authenticate and bypass intended access restrictions via a crafted 1 username or 2 hostname that satisfies a regular expression that is matched against a hosts.hfaxd entry without a password...

NFS Share User Mountable

Nessus was either able to mount some of the NFS shares exported by the remote server or disclose potentially sensitive information such as a directory listing. An attacker may exploit this issue to gain read and possibly write access to files on remote host. Note that root privileges were not...

CVE-2004-0750

Unknown vulnerability in redhat-config-nfs before 1.0.13, when shares are exported to multiple hosts, can produce incorrect permissions and prevent the allsquash option from being applied...

CVE-2004-0750

Unknown vulnerability in redhat-config-nfs before 1.0.13, when shares are exported to multiple hosts, can produce incorrect permissions and prevent the allsquash option from being applied...

security flaw

Unknown vulnerability in redhat-config-nfs before 1.0.13, when shares are exported to multiple hosts, can produce incorrect permissions and prevent the allsquash option from being applied...

CVE-2004-0263

Technical details (affected product/version, root cause, impact, and remediation) are not publicly provided in the supplied connected documents. Monitor for updates.

Linux kernel fails to properly handle floating point signals generated by "fsave" and "frstor"

Overview The Linux kernel contains a denial-of-service vulnerability that allows local users to disable affected hosts. Description Several versions of the Linux kernel contain a defect in their use of the Intel processor instruction set. The "fsave" and "frstor" instructions are used to store an...

mDNS Detection (Remote Network)

The remote service understands the Bonjour also known as ZeroConf or mDNS protocol, which allows anyone to uncover information from the remote host such as its operating system type and exact version, its hostname, and the list of services it is running. This plugin attempts to discover mDNS used...

Microsoft Exchange Server 2003 Outlook Web Access Random Mailbox Access Vulnerability

Description A vulnerability has been reported in Exchange Server 2003 with Outlook Web Access OWA configured. Exploitation of this vulnerability could allow an authenticated OWA user to connect to another user's OWA mailbox. Technologies Affected Microsoft Exchange Server 2003 Recommendations Blo...

tHTTPd directory traversal

If virtual hosts are usid it's possible to traverse directories with ../ in Host: header...

Exclude top-level domain wildcard hosts

This host has an IP address known to be a wildcard record for a top- level domain TLD or for a host within the 'nessus.org' domain. It has been blacklisted and will not be scanned. C Tenable Network Security, Inc. Known top level domain wildcards, from http://www.imperialviolet.org/dnsfix.html .C...