Multiple FTP Server quote stat Command Traversal Arbitrary Directory Access

The remote FTP server is vulnerable to a flaw that allows users to access files outside the FTP server root. An attacker may break out of his FTP jail by issuing the command : ftp quote stat ../ Some versions of VisNetic FTP Server and Titan FTP Server are known to be affected by this issue. C...

ST FTP Service Arbitrary File/Directory Access

The remote FTP server is vulnerable to a flaw that allows users to access files that are outside the FTP server root. An attacker may break out of his FTP jail by issuing the command : CWD C: TRUSTED...

pam_xauth may insecurely forward "X MIT-Magic-Cookies" to new sessions

Overview A vulnerability exists in pamxauth that may allow a local attacker to gain access to an administrator's X session. Description pamxauth is used to forward xauth keys or cookies between users. From the pamxauth man page:Without pamxauth, when xauth is enabled and a user uses the su comman...

BadBlue ISAPI Extension .hts Crafted File Extension Request Authentication Bypass

The remote host is running the BadBlue web server earlier than 2.2. Such versions are reportedly affected by an authentication bypass vulnerability. It is possible for an attacker to gain administrative access using a filename with a .ats extension instead of a .hts extension. C Tenable Network...

SRT2003-04-24-1532 - Options Parsing Tool library buffer overflows.

Secure Network Operations, Inc. http://www.secnetops.com Strategic Reconnaissance Team [email protected] Team Lead Contact [email protected] Our Mission: Secure Network Operations offers expertise in Networking, Intrusion Detection Systems IDS, Software Security Validation, and...

ActivCard password cache memory leakage

In December of the 2002 I was analysing the ActivCard product for a client. During the analysis I noticed that making a memory dump of the process "scardsrv" was possible to obtain the users stored staticaly in the card. This issue at first, could seem smaller, although in depth already it has a...

[SECURITY] [DSA 283-1] New xfsdump packages fix insecure file creation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 283-1 [email protected] http://www.debian.org/security/ Martin Schulze April 11th, 2003 http://www.debian.org/security/faq -...

Flaw in Microsoft VM Could Enable System Compromise

TITLE : Microsoft Virtual Machine Bytecode Verifier Vulnerability CRITICAL : Highly critical IMPACT : System access OPERATING SYSTEM: Microsoft Windows 95 Microsoft Windows 98 and 98SE Microsoft Windows Millennium Microsoft Windows NT 4.0, beginning with Service Pack 1 Microsoft Windows 2000...

Apache vulnerable to DoS

Overview A remotely exploitable denial-of-service vulnerability exists in the Apache HTTP Server. Exploitation of this vulnerability may allow an attacker to consume all available system resources, resulting in a denial-of-service condition. Description The Apache HTTP Server is a very popular...

Vignette StoryServer TCL Server Crash Information Disclosure

The remote host is running Vignette StoryServer, a web interface to Vignette's Content Management suite. A flaw in this product may allow an attacker to extract information about the other users session and other sensitive information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: Dat...

Sendmail < 8.12.9 NOCHAR Control Value prescan Overflow

The remote Sendmail server, according to its version number, may be vulnerable to a remote buffer overflow allowing remote users to gain root privileges. Sendmail versions from 5.79 to 8.12.8 are vulnerable. NOTE: manual patches do not change the version numbers. Vendors who have released patched...

DCP-Portal Multiple Script Path Disclosure

DCP-Portal discloses its physical path when an empty request to adduser.php is made In addition, several other scripts may disclose the path if an invalid language is supplied, although Nessus has not checked for them. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ahmet Sabri ALPER To:...

Sun RPC XDR xdrmem_getbytes Function Remote Overflow

The RPC library has an integer overflow in the function xdrmemgetbytes. An attacker may use this flaw to execute arbitrary code on this host with the privileges your RPC programs are running with typically root, by sending a specially crafted request to them. Note that this issue affects Solaris,...

SquirrelMail 1.2.9 / 1.2.10 read_body.php Multiple Parameter XSS

The remote host seems to be vulnerable to a security problem in SquirrelMail. The 'readbody.php' script doesn't filter out user input for multiple parameters, allowing for XSS attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This script was rewritten by Tenable Network Security, Inc....

Samba < 2.2.8 Multiple Vulnerabilities

The remote Samba server, according to its version number, is vulnerable to a remote buffer overflow when receiving specially crafted SMB fragment packets. An attacker needs to be able to access at least one share to exploit this flaw. In addition, it is reported that Samba contains a flaw related...

Thunderstone Software Texis Crafted Request Information Disclosure

The remote installation of Texis can be abused to disclose potentially sensitive information about the remote host, such as its internal IP address and the path to various components eg, cmd.exe. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Cisco IOS SSH Large Packet CPU Consumption DoS (CSCdw33027)

It is possible to make the remote IOS crash when sending it malformed SSH packets. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid11381; scriptversion"1.26"; scriptcveid"CVE-2002-1024"; scriptbugtraqid5114; scriptnameenglish:"Cisco IOS SSH Large Packet CPU Consumption...

Microsoft IIS fpcount.exe CGI Remote Overflow

Nessus detected the 'fpcount.exe' CGI on the remote web server. Some versions of this CGI have a remote buffer overflow vulnerability. A remote attacker could exploit it to crash the web server, or possibly execute arbitrary code. Nessus did not actually check for this flaw, but solely relied on...

SunFTP GET Request Remote Overflow

Buffer overflow in SunFTP build 91 allows remote attackers to cause a denial of service or possibly execute arbitrary commands by sending more than 2100 characters to the server. This script was written by Xue Yong Zhi See the Nessus Scripts License for details Changes by Tenable: - Revised plugi...

Auction Deluxe auction.pl Multiple Parameter XSS

The remote Auction Deluxe server is vulnerable to a cross-site scripting attack. As a result, a user could easily steal the cookies of your legitimate users and impersonate them. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc';...