IE Remote Compromise by Getting Cache Location

IE Remote Compromise by Getting Cache Location tested OS:WinXp, CN version Microsoft Internet Explorer v6.Sp1; up-to-date on 2003/11/16 overview With the help of LocalZoneInCacherefer to "technical details" part, an attacker can compromise a user's system even though the user has: 1. Customized I...

Microsoft Outlook Express 6.0 - MHTML Forced File Execution (2)

Microsoft Outlook Express 6.0 - MHTML Forced File Execution 2 source: https://www.securityfocus.com/bid/9105/info A vulnerability has been discovered in Microsoft Outlook Express when handling MHTML file and res URIs that could lead to an unexpected file being downloaded and executed. The problem...

Internet Explorer Vulnerability: Content-Location works with both triple and double slash

After I reported the Content-Location Vulnerability http://www.securityfocus.com/archive/1/342317, Thor Larholm explained that the html execution was not caused by the Content-Location header, but instead by the triple slash file:///. I have tested it with double slash and I even tested the tripl...

Macromedia Flash Player 6.0.x - Flash Cookie Predictable File Location

Macromedia Flash Player 6.0.x - Flash Cookie Predictable File Location source: https://www.securityfocus.com/bid/8900/info Macromedia Flash Player is reported to store Flash cookies .sol files in a predictable location on client systems. Other attacks are possible given the ability to store conte...

Macromedia Flash Player 6.0.x - Flash Cookie Predictable File Location

source: https://www.securityfocus.com/bid/8900/info Macromedia Flash Player is reported to store Flash cookies .sol files in a predictable location on client systems. Other attacks are possible given the ability to store content on a system in a predictable location, such as referencing the conte...

PayPal Store Front 3.0 - index.php Remote File Inclusion

PayPal Store Front 3.0 - index.php Remote File Inclusion source: https://www.securityfocus.com/bid/8791/info PayPal Store Front is prone to a remote file include vulnerability. It may be possible for a remote attacker to influence the include path for an external page to point to an...

CVE-2003-0802

Nokia Electronic Documentation NED 5.0 allows remote attackers to obtain a directory listing of the WebLogic web root, and the physical path of the NED server, via a "retrieve" action with a location parameter of . dot...

atomicboard 0.6.2 - Directory Traversal

source: https://www.securityfocus.com/bid/8236/info It has been reported that attackers may be able to modify the 'location' variable passed to the index.php file to cause the Web server to return arbitrary files. This script is prone to a directory traversal vulnerability, allowing attackers to...

UPnP TCP Helper Detection

The remote host is running Microsoft UPnP TCP helper. If the tested network is not a home network, you should disable this service. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid11765; scriptversion"1.19"; scriptcvsdate"Date: 2019/11/22"; scriptnameenglish:"UPnP TCP...

Microsoft Windows Media Player 7.1 - Skin File Code Execution

source: https://www.securityfocus.com/bid/7517/info Windows Media Player is vulnerable to code execution through skin files. WMP does not properly validate URLs that are passed to initiate a skin file download and installation. This could allow a malicious file advertised as a skin file to be...

eject 2.0.10 vulnerability

Application: eject Version: 2.0.10 Platforms: Linux Distribution: SuSE 7.3, most likely other versions of SuSE Linux as well also all distributions that make eject SUID root Bugs: verbose error messages reveal location of files/directories Risk: low Author: nordi e-mail: [email protected] 1...

CVE-2002-1258

Two vulnerabilities in Microsoft Virtual Machine VM up to and including build 5.0.3805, as used in Internet Explorer and other applications, allow remote attackers to read files via a Java applet with a spoofed location in the CODEBASE parameter in the APPLET tag, possibly due to a parsing error...

Security Update: [CSSA-2002-048.0] Linux: wwwoffled remote access vulnerability

To: [email protected] [email protected] [email protected] [email protected] SCO Security Advisory Subject: Linux: wwwoffled remote access vulnerability Advisory number: CSSA-2002-048.0 Issue date: 2002 November 18 Cross reference: 1. Problem...

More OmniHTTPd Problems

I've discovered another vulnerability in one of the OmniHTTPd sample apps. This time, the culprit is "/cgi-bin/redir.exe". This app is vulnerable to a newline injection issue. The vulnerability occurs because the "URL" query parameter case sensitive is decoded and placed directly into the respons...

WHERE'S THE CA$H: Internet Explorer 6.00. Outlook Express 6.00

Saturday, July 27, 2002 Trivial lead-up to yet another silent delivery and installation of an executable on the target computer using Outlook Express 6. This can be achieved combining several past possibilities, specifically the following: http://www.securityfocus.com/bid/1033...

Vulnerability in Apache Tomcat v3.23 & v3.24 (part 2)

Procheckup Ltd www.procheckup.com Procheckup Security Bulletin PR02-06 Description: Tomcat realPath.jsp gives location of web root. Date: 8/1/2002 Application: Apache Tomcat Java server versions 3.23 and 3.24 Platform: Linux/Unix Severity: Remote attackers can obtain the location of webroot...

Vulnerability in Apache Tomcat v3.23 & v3.24 (part 3)

Procheckup Ltd www.procheckup.com Procheckup Security Bulletin PR02-7 Description: Tomcat multiple sample files display webroot location on default configuration on request. Date: 8/1/2002 Application: Apache Tomcat java server v3.23, 3.24. Platform: Linux/Unix Severity: Remote attackers can obta...

Oracle9i Application Server Apache PL/SQL module vulnerable to buffer overflow via HTTP Location header

Overview A buffer overflow vulnerability exists in the Apache Procedural Language/Structured Query Language PL/SQL module used by Oracle9i Application Server iAS. This vulnerability could allow an unauthenticated remote attacker to cause a denial of service or execute arbitrary code on the system...

Несанкционированный доступ через xitami (privelege escalation)

Пароль администратора хранится в открытом на чтение файле. Сам веб-сервер работает с привилегиями root. Администратор может изменить расположение Cgi-bin получив доступ с правами root...

RADIX1112200102

Team RADIX Research Report: RADIX1112200102 Date Published: 11-12-2001 Research Report ID: RADIX1112200102 Bugtraq ID: 3184 CVE CAN: N/A Title: RunAs Sensitive Data Exposure Class: Sensitive data exposure Remotely Exploitable: No Locally Exploitable: Yes Vulnerability Description: The command lin...