CVE-2004-2713: Undefined Security Weakness

Zone Alarm Pro 1.0 through 5.1 gives full access to %windir%\Internet Logs\ to the EVERYONE group, which allows local users to cause a denial of service by modifying the folder contents or permissions. NOTE: this issue has been disputed by the vendor, who claims that it does not affect product...

CVE-2007-4949: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in phpReactor 1.2.7pl1 allow remote attackers to execute arbitrary PHP code via a URL in the pathtohomedir parameter to 1 ekilat.com-int.tpl.php, 2 phpreactor.org-top.tpl.php, or 3 ekilat.com-top.tpl.php in examples/. NOTE: this issue has been...

vonage-default.txt

Vonage VoIP Telephone Adapter Default Misconfiguration The Vonage VoIP Telephone Adapter device is, by default, accessible from the WLAN/internet. The product ships with the default username of 'user' and default password of 'user' to access the administrative backend. Users are suggested to upda...

Redlevel Advisory #025 - Vonage VoIP Telephone Adapter Default Misconfiguration

Vonage VoIP Telephone Adapter Default Misconfiguration The Vonage VoIP Telephone Adapter device is, by default, accessible from the WLAN/internet. The product ships with the default username of 'user' and default password of 'user' to access the administrative backend. Users are suggested to upda...

Cuyahoga FCKEditor Misconfiguration Unrestricted File Upload

The remote host is running Cuyahoga, an open source .NET website framework. The installation of Cuyahoga fails to require authorization to access the FCKEditor component included with it. An unauthenticated, remote attacker may be able to leverage this flaw to view and upload files with FCKEditor...

vBulletin 2.x3.x - Multiple Cross-Site Scripting Vulnerabilities

vBulletin 2.x3.x - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/18444/info vBulletin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to have...

vBulletin 2.x/3.x - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/18444/info vBulletin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in...

pinentry PIN entering dialogs application privilege escalation

sgid wheel is incorrectly set for application...

PHP3 Physical Path Disclosure Vulnerability

PHP3 will reveal the physical path of the webroot when asked for a non-existent PHP3 file if it is incorrectly configured. SPDX-FileCopyrightText: 2001 Matt Moore Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2005-3171: Undefined Security Weakness

Microsoft Windows 2000 before Update Rollup 1 for SP4 records Event ID 1704 to indicate that Group Policy security settings were successfully updated, even when the processing fails such as when Ntuser.pol cannot be accessed, which could cause system administrators to believe that the system is...

CVE-2001-1434

Cisco IOS 12.05XU through 12.12 allows remote attackers to read system administration and topology information via an "snmp-server host" command, which creates a readable "community" community string if one has not been previously created...

rsync: Directory traversal in rsync daemon

Background rsync is a utility that provides fast incremental file transfers. It is used to efficiently synchronize files between hosts and is used by emerge to fetch Gentoo's Portage tree. rsyncd is the rsync daemon, which listens to connections from rsync clients. Description When rsyncd is used...

Web Server PROPFIND Method Internal IP Disclosure

The remote installation of IIS leaks a private IP address through the WebDAV interface. This may expose internal IP addresses that are usually hidden or masked behind a Network Address Translation NAT Firewall or proxy server. This is typical of IIS installations that are not configured properly...

OpenBSD 3.x - PF RDR Network Information Leakage

OpenBSD 3.x - PF RDR Network Information Leakage source: https://www.securityfocus.com/bid/8082/info OpenBSD PF is prone to an information leakage vulnerability when configured to redirect incoming traffic from standard ports to high ports. This occurs because PF responds different to packets...

Gnutella Root Directory Misconfiguration

The remote host is running the Gnutella servent service. It seems that the root directory of the remote host is visible through this service. Confidential files might be exported. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid11716; scriptversion "1.13";...

Solaris 2.x/7.0/8 - Derived 'login' Remote Buffer Overflow

source: https://www.securityfocus.com/bid/3681/info The 'login' program is used in UNIX systems to authenticate users with a username and password. The utility is typically invoked at the console, by 'telnetd', 'rlogind', and if configured to do so, SSH. Versions of 'login' descended from System ...

Blueworld WebData Engine 1.6.5

The other day i run through a web server that was running Blueworld WebData Engine 1.6.5 and IIS 4, for my surprise after sending a really "simple" attack the server stop responding, could someone thats running WebData engine 1.6.5 verify this. exploit: export ATTACK=perl -e "print 'A' x 1600" wg...

cachemgr.cgi (squid 2.3STABLE4)

IP6 Concept: Squid cachemgr.cgi misconfiguration - IP6 Configuration error BID error class - IP6 Platform investigated: Linux Redhat 6.2 Squid 2.3STABLE4 Apache 1.3.12 - IP6 The problem... Due to a misconfiguration on Apache and Squid Is posible to use cachemgr.cgi shipped with Squid to scan...

[ Hackerslab bug_paper ] Xkas application vulnerability

============================================================================= Hackerslab bugpaper Xkas application vulnerability ============================================================================= File : /usr/etc/appletalk/xkas application SYSTEM : tested irix 6.5 INFO : Xkas is a serve...

CVE-2001-1388

iptables before 1.2.4 does not accurately convert rate limits that are specified on the command line, which could allow attackers or users to generate more or less traffic than intended by the administrator...