Ruby XMLRPC Arbitrary Command Execution Vulnerability

Overview utils.rb in The Ruby XMLRPC server sets an insecure default value for the publicinstancemethods function, which could cause the highly privileged function to be exposed. Impact An attacker could execute arbitrary command on the system running Ruby XMLRPC. Solution Please refer to the...

CVE-2005-2932: Undefined Security Weakness

Multiple Check Point Zone Labs ZoneAlarm products before 7.0.362, including ZoneAlarm Security Suite 5.5.062.004 and 6.5.737, use insecure default permissions for critical files, which allows local users to gain privileges or bypass security controls...

CVE-2006-5842

The keystore file in Unicore Client before 5.6 build 5, when running on Unix systems, has insecure default permissions, which allows local users to obtain sensitive information...

CVE-2006-5842: Undefined Security Weakness

The keystore file in Unicore Client before 5.6 build 5, when running on Unix systems, has insecure default permissions, which allows local users to obtain sensitive information...

CVE-2006-5808

The CVE covers Cisco Secure Desktop (CSD) prior to version 3.1.1.45, where insecure default permissions for the CSD directory and its parent (full control for all users) allow local users to escalate privileges by replacing CSD executables. Affected component: CSD installation directories; root c...

Secunia Research: IBM Lotus Notes Insecure Default FolderPermissions

====================================================================== Secunia Research 18/10/2006 - IBM Lotus Notes Insecure Default Folder Permissions - ====================================================================== Table of Contents Affected...

CVE-2005-2454

IBM Lotus Notes 6.5.4/6.5.5 and 7.0.0/7.0.1 are affected by insecure default permissions on the Notes directory (Everyone: Full Control), enabling local users to gain unintended access and modify, add, or delete files in that folder. The issue is due to default folder permissions applied to the N...

CVE-2006-3114

PC Tools AntiVirus 2.1.0.51 uses insecure default permissions on the "PC Tools AntiVirus" directory, which allows local users to gain privileges and execute commands...

CVE-2006-3114

PC Tools AntiVirus 2.1.0.51 is vulnerable due to insecure default permissions on the PC Tools AntiVirus directory, allowing local users to gain SYSTEM privileges by accessing and manipulating application files. The issue arises from granting Everyone Full Control on the directory and all child ob...

Linux-HA Heartbeat 1.2.3/2.0.x - Insecure Default Permissions on Shared Memory

// source: https://www.securityfocus.com/bid/19186/info Since Linux-HA Heartbeat has insecure default permissions set on shared memory, local attackers may be able to cause a denial of service. Exploitation would most likely result in a system crash, loss of data, and resource exhaustion, leading...

[SA20445] Sun StorADE Privilege Escalation Vulnerability

---------------------------------------------------------------------- Want to join the Secunia Security Team? Secunia offers a position as a security specialist, where your daily work involves reverse engineering of software and exploit code, auditing of source code, and analysis of vulnerabilit...

CVE-2006-0023

Microsoft Windows XP SP1 and SP2 before August 2004, and possibly other operating systems and versions, uses insecure default ACLs that allow the Authenticated Users group to gain privileges by modifying critical configuration information for the 1 Simple Service Discovery Protocol SSDP, 2...

CVE-2005-2454

IBM Lotus Notes 6.5.4 and 6.5.5, and 7.0.0 and 7.0.1, uses insecure default permissions Everyone/Full Control for the "Notes" folder and all children, which allows local users to gain privileges and modify, add, or delete files in that folder...

CVE-2005-3360: Undefined Security Weakness

The installation of Trend Micro PC-Cillin Internet Security 2005 12.00 build 1244, and probably previous versions, uses insecure default ACLs, which allows local users to cause a denial of service disabled service and gain system privileges by modifying or moving critical program files...

Lantronix Secure Console Server SCS820/SCS1620 - Multiple Local Vulnerabilities

source: https://www.securityfocus.com/bid/14486/info Lantronix Secure Console Server SCS820/SCS1620 devices are susceptible to multiple local vulnerabilities. The first issue is an insecure default permission vulnerability. Attackers may exploit this vulnerability to write data to arbitrary files...

Lantronix Secure Console Server SCS820SCS1620 - Multiple Local Vulnerabilities

Lantronix Secure Console Server SCS820SCS1620 - Multiple Local Vulnerabilities source: https://www.securityfocus.com/bid/14486/info Lantronix Secure Console Server SCS820/SCS1620 devices are susceptible to multiple local vulnerabilities. The first issue is an insecure default permission...

CVE-2004-2203

CVE-2004-2203 affects Ansel 1.2 through 2.0. The vulnerability stems from insecure default permissions, which can allow remote attackers to access web-readable directories. The available connected documents confirm the affected product versions and the underlying issue (default permissions), but ...

CVE-2005-1107: Undefined Security Weakness

McAfee Internet Security Suite 2005 uses insecure default ACLs for installed files, which allows local users to gain privileges or disable protection by modifying certain files...

Insecure Default Service DACL's in Windows 2003

To the list, In my documentation of the Default DACL on Windows 2003 Services, I have found and confirmed the following: Both the Distributed Link tracking Server Service and Internet Connection Firewall Service have the Default DACL of Everyone:Full Control, which basically lets anyone connect t...

Sun J2EE/RI 1.4 / Sun JDK 1.4.2 - JDBC Database Insecure Default Policy

source: https://www.securityfocus.com/bid/9444/info It has been reported that multiple JDBC database implementations include insecure default security policies. This could expose vulnerable databases to denial of service attacks. This could also permit remote attackers to execute arbitrary comman...