Race condition

Monkey HTTP Daemon 0.9.3 retains the supplementary group IDs of the root account during operations with a non-root effective UID, which might allow local users to bypass intended file-read restrictions by leveraging a race condition in a file-permission check...

CVE-2012-4442

Summary: CVE-2012-4442 affects Monkey HTTP Daemon 0.9.3. The issue arises because the daemon retains the supplementary group IDs of the root account while operating with a non-root effective UID, which could allow local users to bypass file-read restrictions due to a race condition in a file-perm...

CVE-2012-5303

Monkey HTTP Daemon 0.9.3 is vulnerable to a local file overwrite via a symlink attack on its PID file. The issue is a race condition that can occur when a pathname different from the default /var/run/monkey.pid is used, allowing local users to trick the daemon into overwriting arbitrary files. Im...

CVE-2012-4442

Monkey HTTP Daemon 0.9.3 retains the supplementary group IDs of the root account during operations with a non-root effective UID, which might allow local users to bypass intended file-read restrictions by leveraging a race condition in a file-permission check...

CVE-2012-4443

Monkey HTTP Daemon 0.9.3 uses a real UID of root and a real GID of root during execution of CGI scripts, which might allow local users to gain privileges by leveraging cgi-bin write access...

CVE-2012-4443

Monkey HTTP Daemon 0.9.3 uses a real UID of root and a real GID of root during execution of CGI scripts, which might allow local users to gain privileges by leveraging cgi-bin write access...

CVE-2012-4443

Monkey HTTP Daemon 0.9.3 uses a real UID of root and a real GID of root during execution of CGI scripts, which might allow local users to gain privileges by leveraging cgi-bin write access...

PT-2012-5403

Name of the Vulnerable Software and Affected Versions Monkey HTTP Daemon version 0.9.3 Description The issue allows local users to potentially bypass intended file-read restrictions. This is due to the software retaining the supplementary group IDs of the root account during operations with a...

PT-2012-5902

Name of the Vulnerable Software and Affected Versions Monkey HTTP Daemon version 0.9.3 Description The issue allows local users to overwrite arbitrary files via a symlink attack on a PID file. This can be achieved by using a pathname different from the default /var/run/monkey.pid pathname...

CVE-2012-4442: Undefined Security Weakness

Monkey HTTP Daemon 0.9.3 retains the supplementary group IDs of the root account during operations with a non-root effective UID, which might allow local users to bypass intended file-read restrictions by leveraging a race condition in a file-permission check...

PT-2012-5404

Name of the Vulnerable Software and Affected Versions Monkey HTTP Daemon version 0.9.3 Description The issue allows local users to potentially gain privileges by exploiting cgi-bin write access during the execution of CGI scripts, as the software uses a real UID of root and a real GID of root...

CVE-2012-4443: Undefined Security Weakness

Monkey HTTP Daemon 0.9.3 uses a real UID of root and a real GID of root during execution of CGI scripts, which might allow local users to gain privileges by leveraging cgi-bin write access...

CVE-2012-5303: Improper Link Resolution Before File Access

Monkey HTTP Daemon 0.9.3 might allow local users to overwrite arbitrary files via a symlink attack on a PID file, as demonstrated by a pathname different from the default /var/run/monkey.pid pathname...

CVE-2011-0067

Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, does not properly implement autocompletion for forms, which allows remote attackers to read form history entries via a Java applet that spoofs interaction with the autocomplete controls...

Mozilla CSRF risk with plugins and 307 redirects (MFSA 2011-10)

Cross-site request forgery CSRF vulnerability in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, allows remote attackers to hijack the authentication of arbitrary users for requests that were initiated by a plugin and received a 307 redirect to a page on a...

DM FileManager 3.9.11 - Arbitrary File Upload

?php / ----------------------------------------------------------------- DM Filemanager fckeditor Remote Arbitrary File Upload Exploit ----------------------------------------------------------------- Vendor: www.dutchmonkey.com Download :...

Mozilla Cross-origin data leakage from script filename in error messages

dom/base/nsJSEnvironment.cpp in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 does not properly suppress a script's URL in certain circumstances involving a redirect and an error message, which allows...

FreeBSD Ports: monkey

The remote host is missing an update to the system as announced in the referenced advisory. VID 4465c897-ee5c-11de-b6ef-00215c6a37bb OpenVAS Vulnerability Test $ Description: Auto generated from VID 4465c897-ee5c-11de-b6ef-00215c6a37bb Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

FreeBSD Ports: monkey

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD : monkey -- improper input validation vulnerability (4465c897-ee5c-11de-b6ef-00215c6a37bb)

Census Labs reports : We have discovered a remotely exploitable 'improper input validation' vulnerability in the Monkey web server that allows an attacker to perform denial of service attacks by repeatedly crashing worker threads that process HTTP requests. %NASLMINLEVEL 70300 C Tenable Network...