301 matches found
AWStats 5.x/6.x - 'Logfile' Remote Command Execution
source: https://www.securityfocus.com/bid/12572/info AWStats is reported prone to a remote arbitrary command-execution vulnerability. This issue occurs because the application fails to properly sanitize user-supplied data. Specifically, the user-specified 'logfile' URI parameter is supplied to th...
[SA12736] CUPS Logfile User Credentials Disclosure
TITLE: CUPS Logfile User Credentials Disclosure SECUNIA ADVISORY ID: SA12736 VERIFY ADVISORY: http://secunia.com/advisories/12736/ CRITICAL: Less critical IMPACT: Exposure of sensitive information WHERE: Local system SOFTWARE: CUPS 1.x http://secunia.com/product/921/ DESCRIPTION: Gary Smith has...
Debian DSA-125-1 : analog - XSS
Yuji Takahashi discovered a bug in analog which allows a cross-site scripting type attack. It is easy for an attacker to insert arbitrary strings into any web server logfile. If these strings are then analysed by analog, they can appear in the report. By this means an attacker can introduce...
CVE-2002-1513
The CVE-2002-1513 issue concerns the UCX POP server in HP TCP/IP services for OpenVMS 4.2–5.3. A local user can truncate arbitrary files through the -logfile command line option, because the server runs with SYSPRV and BYPASS privileges, which override file system permissions. NVD assigns a base ...
AWStats rawlog.pm logfile Parameter Arbitrary Command Execution
The remote host is running AWStats, a free real-time logfile analyzer. The AWStats Rawlog Plugin which is installed is prone to an input validation vulnerability. The issue exists in the 'logfile' URI data passwed to the 'awstats.pl' script. An attacker may exploit this to execute commands remote...
fidogate -- write files as `news' user
Neils Heinen reports that the setuid news' binaries installed as part of fidogate may be used to create files or append to file with the privileges of the news' user by setting the LOGFILE environmental variable...
CVE-2004-0450
Format string vulnerability in the printlog function in log2mail before 0.2.5.2 allows local users or remote attackers to execute arbitrary code via format string specifiers in a logfile monitored by log2mail...
textutil symbolic links problem
synboli links problem on logfile creation...
security flaw
split-logfile in Apache 1.3.20 allows remote attackers to overwrite arbitrary files that end in the .log extension via an HTTP request with a / slash in the Host: header...
Sonicwall SOHO Content Blocking Script Injection, LogFile Denial of Service
This advisory may be reproduced unmodified. Sonicwall SOHO Content Blocking Script Injection and Logfile DoS Test Unit : Sonicwall SOHO3 Firmware version: 6.3.0.0 ROM version: 5.0.1.0 Severity : Medium Issue : Sonicwall Allows administrators to block websites based on a user entered list of...
CVE-2002-0166
Cross-site scripting vulnerability in analog before 5.22 allows remote attackers to execute Javascript via an HTTP request containing the script, which is entered into a web logfile and not properly filtered by analog during display...
CVE-2001-0730
CVE-2001-0730 affects Apache 1.3.x by a flaw in the split-logfile support: a crafted HTTP request with a slash in the Host header can cause the server to overwrite any file ending in ".log" on the system. Affected version in public reports centers on Apache 1.3.20 with the ability to write arbitr...
lastlines.cgi path traversal and command execution vulns
Lastlines.cgi path traversal and command execution vulnerabilities discovered by BrainRawt. I wasn't planning on submitting this to bugtraq for its not a widely used cgi but it is still available for download and some people may be using it. lastlines.cgi is a script coded by David Powell that...
Apache Httpd < 1.3.22 : split-logfile can cause arbitrary log files to be written to
A vulnerability was found in the split-logfile support program. A request with a specially crafted Host: header could allow any file with a .log extension on the system to be written to...
Дырка в analog (logfile analysis program)
Переполнение буфера при разборе переменных...
scx-sa-12.txt
============================================================================= Securax-SA-12 Security Advisory belgian.networking.security Dutch ============================================================================= Topic: Remote hiding from accesslog and errorlog Announced: 2000-12-28...
CVE-2000-1048
CVE-2000-1048 affects Wingate 4.1 Beta A and earlier, specifically the logfile service. A directory traversal vulnerability allows remote attackers to read arbitrary files by crafting an HTTP GET request that carries encoded characters in the URL (..). The provided sources confirm the existence o...
wgate41a.txt
================================================================= Blue Panda Vulnerability Announcement: Wingate 4.1 Beta A 16/10/2000 dd/mm/yyyy [email protected] http://bluepanda.box.sk/ ================================================================= Problem: ========= The logfile servic...
Wingate 4.1 Beta A vulnerability
================================================================= Blue Panda Vulnerability Announcement: Wingate 4.1 Beta A 16/10/2000 dd/mm/yyyy [email protected] http://bluepanda.box.sk/ ================================================================= Problem: ========= The logfile servic...
Дырка в WinGate (logfile service)
Пользователь, имеющий доступ к журналам может получить доступ к любым файлам в системе...