Possible DOS in Bind 8.2.2-P5

Hi, playing with bind and ZXFR feature zone transfer compressed with a possible insecure execlp"gzip", "gzip", NULL; , i discovered a Denial Of Service against Bind 8.2.2-P5 . By default Bind 8.2.2-P5 it's not compiled with ZXFR support unless you define it with define BINDZXFR so it will refuse...

Mandrake 6.17.07.1 - perl HTTP Directory Disclosure

Mandrake 6.17.07.1 - perl HTTP Directory Disclosure source: https://www.securityfocus.com/bid/1678/info The default configuration files for versions of modperl shipped with Mandrake Linux 6.1 through 7.1 contain a misconfiguration that can be a security concern in some situations. The /perl...

LPPlus 3.2.23.3 - Permissions Denial of Service

LPPlus 3.2.23.3 - Permissions Denial of Service source: https://www.securityfocus.com/bid/1643/info Vulnerability 1: Several files that are part of the LPPlus print management system are installed setuid root by default. These files include: $LPHOME/bin/dccsched $LPHOME/bin/dcclpdser...

LPPlus 3.2.2/3.3 - dccscan Unprivileged read

source: https://www.securityfocus.com/bid/1644/info $LPHOME/bin/dccscan is suid-root and can be executed by any user. It is possible for an unprivileged user to print files to which he does not have read access. In testing, this works even for printers to which the user is is not given any access...

Multiple Web Server ~nobody/ Request Arbitrary File Access

It is possible to access arbitrary files on the remote web server by appending nobody/ in front of their name as in nobody/etc/passwd. This problem is due to a misconfiguration in the web server that sets 'UserDir' or its equivalent to './'. C Tenable Network Security, Inc. include"compat.inc";...

Black Watch Labs Vulnerability Alert

Dear Security Professional, The following vulnerability: "Lotus Domino Server Misconfiguration – Documents Can Be Modified over the Web" is in the text of the message below and has just been posted to the Black Watch Labs Web site at http://www.perfectotech.com/blackwatchlabs/ Thank you, Black...

CVE-1999-0551

HP OpenMail is affected by CVE-1999-0551 due to a misconfiguration that allows users to run arbitrary commands via malicious print requests. The vulnerability is described as a LOCAL issue with LOW complexity and requires no authentication, with the potential impact to confidentiality, integrity,...

CVE-1999-0551

HP OpenMail can be misconfigured to allow users to run arbitrary commands using malicious print requests...

Webcart Default Install Configuration Disclosure

At least one of these file or directories is world readable : /webcart/orders/ /webcart/orders/import.txt /webcart/carts/ /webcart/config/ /webcart/config/clients.txt /webcart-lite/orders/import.txt /webcart-lite/config/clients.txt This misconfiguration may allow an attacker to gather the credit...

TFS Gateway 4.0 - Denial of Service

source: https://www.securityfocus.com/bid/613/info TFS Gateway 4.0, when configured in a specific non-default manner, is vulnerable to a remotely exploitable denial of service attack. If 'return entire message to sender' is enabled for failed send attempts, and an email is sent to the TFS Gateway...

cognos.powerplay.txt

Date: Mon, 28 Jun 1999 07:29:37 -0400 From: Darin White To: [email protected] Subject: Cognos PowerPlay Web Edition security WEB SECURITY ADVISORY ------------- Release Date: 1999-06-25 Application: Cognos PowerPlay Web Edition Severity: Unauthenticated web users can sniff cube data Author:...

perlshop.cc.txt

Date: Tue, 27 Apr 1999 14:39:47 +0200 From: Bo Elkjaer To: [email protected] Subject: Re: Shopping Carts exposing CC data Been doing some more searches for misconfigured webcarts exposing cc-information. Seems like a pandora's box, that just opened. Perlshop is vulnerable too if misconfigured:...

Cognos Powerplay WE Multiple Information Disclosure Vulnerabilities

The CGI script ppdscgi.exe, part of the PowerPlay Web Edition package, is installed. Due to design problems as well as some potential web server misconfiguration PowerPlay Web Edition may serve up data cubes in a non-secure manner. Execution of the PowerPlay CGI pulls cube data into files in an...

CVE-1999-0643

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration CCE. Notes: the former description i...

CVE-1999-1582

By design, the "established" command on the Cisco PIX firewall allows connections from one host to arbitrary ports of a target host if an alternative conduit has already been allowed, which can cause administrators to configure less restrictive access controls than intended if they do not...

CVE-1999-0551

HP OpenMail can be misconfigured to allow users to run arbitrary commands using malicious print requests...