CVE-2008-3729

CVE-2008-3729 affects MicroWorld Technologies MailScan Web-Based Administration (MailScan 5.6.a espatch 1). The issue allows remote attackers to bypass authentication and obtain administrative access by sending a direct request with (1) an IsAdmin=true cookie value or (2) no cookie. This is a coo...

MailScan Web管理接口多个安全漏洞

BUGTRAQ ID: 30700 MailScan是先进的邮件服务器实时杀毒和反垃圾邮件解决方案。 MailScan提供了基于Web的管理功能，管理控制台（Server.exe）是以LocalSystem权限运行在TCP 10443端口上的HTTP服务。该服务存在多个输入验证错误，允许恶意攻击者泄露敏感信息、执行跨站脚本或绕过某些安全限制。 1 远程攻击者可以向Web管理接口发送特制请求执行目录遍历攻击，下载任意文件。 2 Web管理接口没有正确地限制对某些页面的访问，攻击者可以绕过认证直接访问受保护的页面。 3...

Re: MicroWorld MailScan - Multiple Vulnerabilities within Admin-Webinterface

MicroWorld MailScan - Multiple Vulnerabilities within Admin-Webinterface ======================================================================== Affected Products - MailScan for Mail Servers Version: 5.6.a with espatch1 Win32 Platform Other Mailscan Products, Versions, also, if available for oth...

mailscan-multi.txt

MicroWorld MailScan - Multiple Vulnerabilities within Admin-Webinterface ======================================================================== Affected Products Product/Company Information Vulnerabilities Directory Traversal It is possible to access files on the system outside of the webroot...

microworld-traverse.txt

Luigi Auriemma Application: MicroWorld eScan Server aka eScan Management Console http://www.mwti.net Versions: From vendor's website: "The Powerful Management Console of eScan provides options for system administrators to remotely administer a vast network of clients. It also allows them to...

Path traversal

Absolute path traversal vulnerability in the FTP server in MicroWorld eScan Corporate Edition 9.0.742.98 and eScan Management Console aka eScan Server 9.0.742.1 allows remote attackers to read arbitrary files via an absolute pathname in the RETR get command...

CVE-2008-1221

Absolute path traversal vulnerability in the FTP server in MicroWorld eScan Corporate Edition 9.0.742.98 and eScan Management Console aka eScan Server 9.0.742.1 allows remote attackers to read arbitrary files via an absolute pathname in the RETR get command...

CVE-2008-1221

Absolute path traversal vulnerability in the FTP server in MicroWorld eScan Corporate Edition 9.0.742.98 and eScan Management Console aka eScan Server 9.0.742.1 allows remote attackers to read arbitrary files via an absolute pathname in the RETR get command...

CVE-2008-1221

CVE-2008-1221 describes an absolute path traversal in the FTP server of MicroWorld eScan Corporate Edition 9.0.742.98 and eScan Management Console (eScan Server) 9.0.742.1. The vulnerability allows a remote attacker to read arbitrary files via an absolute pathname in the RETR (get) command. Affec...

MicroWorld eScan Server directory traversal

Embedded TCP/2021 FTP server directory traversal...

MicroWorld eScan Server目录遍历漏洞

BUGTRAQ ID: 28127 eScan是一款全面的杀毒、内容过滤解决方案。 eScan在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞非授权访问系统文件。 eScan Server（eserv.exe）在2021端口监听FTP连接。如果远程攻击者向该服务提交的FTP请求中在所选定磁盘的根路径文件名包含有斜线或反斜线的话（如/boot.ini或\windows\win.ini），就可以下载远程系统磁盘上的任意文件。 MicroWorld Technologies eScan Corporate Edition 9.0.742.98 MicroWorld...

Directory traversal in MicroWorld eScan Server 9.0.742.98

Luigi Auriemma Application: MicroWorld eScan Server aka eScan Management Console http://www.mwti.net Versions: = 9.0.742.98 Platforms: Windows Bug: directory traversal Exploitation: remote Date: 06 Mar 2008 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1 Introduction 2 Bug 3...

Microworld eScan Server 9.0.742 - Directory Traversal

Microworld eScan Server 9.0.742 - Directory Traversal source: https://www.securityfocus.com/bid/28127/info MicroWorld eScan Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting this issue allows an attacker to access...

Microworld eScan Server 9.0.742 - Directory Traversal

source: https://www.securityfocus.com/bid/28127/info MicroWorld eScan Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting this issue allows an attacker to access arbitrary files outside of the FTP server root...

Information disclosure

MicroWorld eScan Virus Control 9.0.722.1, Anti-Virus 9.0.722.1, and Internet Security 9.0.722.1 use weak permissions Everyone:Full Control for their installation directory trees, which allows local users to gain privileges by replacing application files, as demonstrated by traysser.exe...

CVE-2007-4649

MicroWorld eScan Virus Control 9.0.722.1, Anti-Virus 9.0.722.1, and Internet Security 9.0.722.1 use weak permissions Everyone:Full Control for their installation directory trees, which allows local users to gain privileges by replacing application files, as demonstrated by traysser.exe...

[Full-disclosure] Multiple eScan products insecure file permissions

========================================================================= Team Intell Security Advisory TISA2007-13-Public ------------------------------------------------------------------------- Multiple eScan products insecure file permissions...

Microworld eScan (Multiple Products) - Local Privilege Escalation

Microworld eScan Multiple Products - Local Privilege Escalation source: https://www.securityfocus.com/bid/25493/info Multiple MicroWorld eScan products are vulnerable to a local privilege-escalation vulnerability because of insecure default file permissions. Attackers can exploit this issue to...

Microworld eScan (Multiple Products) - Local Privilege Escalation

source: https://www.securityfocus.com/bid/25493/info Multiple MicroWorld eScan products are vulnerable to a local privilege-escalation vulnerability because of insecure default file permissions. Attackers can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful...

Secunia Research: eScan Products Agent Service Command Decryption Buffer Overflow

====================================================================== Secunia Research 23/05/2007 - eScan Products Agent Service Command Decryption Buffer Overflow - ====================================================================== Table of Contents Affected...