eRoom Multiple Security Issues

/ $ An open security advisory 9 - eRoom v6. Vulnerabilities 1: Bug Researcher: c0ntex - c0ntexbatgmail.com 2: Bug Released: July 06 2005 3: Bug Impact Rate: Medium / Hi 4: Bug Scope Rate: Remote $ This advisory and/or proof of concept code must not be used for commercial gain. Documentum eRoom...

CVE-2005-1334

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-1579. Reason: This candidate is a duplicate of CVE-2005-1579. Notes: All CVE users should reference CVE-2005-1579 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2005-0157

The confirm add-on in SmartList 3.15 and earlier allows attackers to subscribe arbitrary e-mail addresses by using a valid cookie that specifies an address other than the address for which the cookie was assigned...

ignitionServer SERVER Command Spoofed Server Saturation DoS

The remote host is running a version of the IgnitionServer IRC service that could be vulnerable to a denial of service in the SERVER command. An attacker could crash the remote host by misusing the SERVER command repeatdly. C Tenable Network Security, Inc. include"compat.inc"; ifdescription...

ProFTPd - 'ftpdctl' 'pr_ctrls_connect' Local Overflow

/ This is simple local exploit Proof of Concept? for local bug in ProFTPd not in default options must be configured with option --enable-ctrls. Bug exist in func tion prctrlsconnect in file "src/ctrls.c", look: "src/ctrls.c" int prctrlsconnectconst char socketfile ... struct sockaddrun clsock,...

CVE-2004-0080

The login program in util-linux 2.11 and earlier uses a pointer after it has been freed and reallocated, which could cause login to leak sensitive data...

kpopup 0.9.x - Privileged Command Execution

// source: https://www.securityfocus.com/bid/8915/info It has been alleged that it is possible for local attackers to gain root privileges through kpopup, which is is installed setuid root by default. According to the report, kpopup uses the system3 C-library function insecurely to run other...

a NEW vulnerability in REGEDIT.EXE

Hi list, I have found a new vulnerability in regedit.exe that can be exploited localy or remotely by trapping our registery. --- SNIP --- / 09/04/2003 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ Trapped Registery for REGEDIT.EXE exploit @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@...

CVE-2002-0024

File Download box in Internet Explorer 5.01, 5.5 and 6.0 allows an attacker to use the Content-Disposition and Content-Type HTML header fields to modify how the name of the file is displayed, which could trick a user into believing that a file is safe to download...

CVE-2002-1789

Format string vulnerability in newsx NNTP client before 1.4.8 allows local users to execute arbitrary code via format string specifiers that are not properly handled in a call to the syslog function...

CVE-2000-1208

Format string vulnerability in startprinting function of printjob.c in BSD-based lpr lpd package may allow local users to gain privileges via an improper syslog call that uses format strings from the checkremote call...

QNX RTOS 4.25/6.1 - 'phgrafx' Local Privilege Escalation

source: https://www.securityfocus.com/bid/4915/info The QNX phgrafx utility is prone to an issue which may make it possible for local attackers to escalate privileges. This issue is due to unsafe use of the system function to invoke other programs. This vulnerability may be trivially exploited to...

PHP-Nuke 5.5 , Phortail 1.2.1 , Avotravis 2.1

PHP-Nuke 5.5 - Cross Site Scripting - Bad use of cookies. More details : In french : http://www.ifrance.com/kitetoua/tuto/PHPNuke55.txt Translated by Google : http://translate.google.com/translate?u=http3A 2F2Fwww.ifrance.com2Fkitetoua2Ftuto 2FPHPNuke55.txt&langpair=fr7Cen&hl=en&prev=...

Security Advisory: IOS HTTP authorization vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Security Advisory: IOS HTTP authorization vulnerability Revision 1.0 - INTERIM For public release 2001 June 27 08:00 UTC -0800 Summary When HTTP server is enabled and local authorization is used, it is possible, under some circumstances, to bypass the...

CVE-2001-0424

Summary: CVE-2001-0424 affects BubbleMon 1.31, where the process does not drop group privileges before executing programs. This results in a local privilege escalation where local users can run arbitrary commands with the kmem group id. Impact (as described in sources): Local users gain complete ...

SSH authentication agent follows symlinks via a UNIX domain socket

Overview Older versions of SSH allow local attackers to to establish ssh sessions as the victim user without authentication. Description The text of this document was originally released on January 20, 1998, as SNI-23, developed by Secure Networks, Inc. SNI. To more widely broadcast this...

Solaris patchadd(1) (3) symlink vulnerabilty

Greetings Bugtraq, I was playing around with patchadd and the bug was found when I issued a "truss -f -o patch.log patchadd patch" where patch was a tarball and then patchadd omitted an error because of it being a tarball, so then when I went through the debug output, i found out that there was a...

Дырки в Mac OS Runtime for Java

Некорректное исопльзование аттрибутов CODEBASE и ARCHIVE повзояет скомпрометировать клиента...

ISS.txt

ISS products are meant to be used in a defensive role. Here we will look at using them in an offensive role. ===Please note that the writer has NO responsibility for YOUR actions with this === ===information! I did not make you do it. I just made you aware it COULD be done.=== Internet Scanner an...

dosemu.sh

[email protected] - Corel Linux dosemu config error. Local root compromise. Software: Corel Linux 1.0 dosemu distribution configuration URL: http://linux.corel.com Version: Version 1.0 The system.com command is available to any user who runs the dos emulator. This is a direct violation of the advice...