ISC BIND < 4.9.7 / 8.1.2 Inverse-Query Remote Overflow

The remote BIND server, according to its version number, is vulnerable to an inverse query overflow which could allow an attacker to execute arbitrary code on the remote host. C Tenable Network Security, Inc. This script replaces bindbof.nes include"compat.inc"; if description scriptid10329;...

ReBB javascripts vulnerability

Hi! Another php - board named ReBB http://www.rebb.net has a img vulnerability. Exploit: Use this string my favorite : - imgjavascript:alert'test'/img Possible decision: All urls in img tag should start with http:// SliderGod...

ScriptEase MiniWeb Server DoS Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ScriptEase MiniWeb Server DoS Vulnerability Type: DoS, crashes Daemon Release Date: February 19, 2002 Product / Vendor: The ScriptEase MiniWeb Server, written entirely in ScriptEase, is being distributed free by Nombas. This server is not intended to...

[ WWWThreads, UBBThreads ] Security Hole in upload system

WWWThreads, UBBThreads Security Hole in upload system Author: RootExtractor, CompuMe [email protected], [email protected] I. Details II. Vulnerable ver's III. Example, Xploit IV. Solution Details : ..: config.inc.php :.. ------------------------- snip ------------------------------ //...

AgoraCart agora.cgi cart_id Parameter XSS

Agora is a CGI-based, e-commerce package. Due to poor input validation, Agora allows an attacker to execute cross-site scripting attacks. %NASLMINLEVEL 70300 This script was written by Matt Moore See the Nessus Scripts License for details include'deprecatednasllevel.inc'; include'compat.inc'; if...

zml.cgi Directory Traversal

ZML.cgi is vulnerable to a directory traversal attack. It enables a remote attacker to view any file on the computer with the privileges of the cgi/httpd user. %NASLMINLEVEL 70300 This script was written by Drew Hintz http://guh.nu It is based on scripts written by Renaud Deraison and HD Moore Se...

zml.cgi.txt

-----BEGIN PGP SIGNED MESSAGE----- --blackshell security advisory no2-- --zml.cgi remote exploit-- vendor details & history zml.cgi for webservers by jero.cc http://www.jero.cc/zml/zml.html details of exploit this is a classic CGI bug which uses ../../../../ to read remote files. example:...

ht://Dig htsearch Multiple Vulnerabilities

The remote CGI htsearch allows the user to supply his own configuration file using the '-c' switch, as in : /cgi-bin/htsearch?-c/some/config/file This file is not displayed by htsearch. However, if an attacker manages to upload a configuration file to the remote server, it may make htsearch read...

IBM AIX portmir vulnerable to buffer overflow via echo_error

Overview There is a buffer overflow in the IBM AIX portmir command that may allow local users to gain root privileges. Description There is a buffer overflow in the echoerror routine of the IBM AIX portmir command. An attacker may be able to corrupt lock files in the "/etc/locks" directory. ---...

Trend Micro InterScan eManager vulnerable to remotely exploitable buffer overflow

Overview A remotely exploitable buffer overflow exists in Trend Micro InterScan eManager. Description Trend Micro InterScan eManager is an application that inspects email traffic flowing into and out of a network for confidential or inappropriate material entering and/or leaving the network. This...

Sendmail < 8.11.6 -d category Value Local Overflow

The remote Sendmail server, according to its version number, may be vulnerable to a local buffer overflow allowing local users to gain root privileges. C Tenable Network Security, Inc. References also vulnerable to a heap overflow Date: Mon, 28 May 2001 18:16:57 -0400 EDT From: "Michal Zalewski"...

glFTPd 1.x - LIST Denial of Service

glFTPd 1.x - LIST Denial of Service source: https://www.securityfocus.com/bid/3201/info glFtpD contains an input validation error that may allow a malicious user to cause a denial of service against a host running the daemon. The problem occurs when a specially crafted 'LIST' command is received ...

Local exploit for TrollFTPD-1.26

Affects: TrollFTPD 1.26 probably earlier Severity: local users can gain root access. Fix: upgrade to TrollFTPD-1.27 Fix URL: ftp://ftp.trolltech.com/freebies/ftpd/troll-ftpd-1.27.tar.gz Description: An error in the handling of recursive directory listings can result in an exploitable buffer...

Cisco IOS vulnerable to DoS via crafted PPTP packet sent to port 1723/tcp

Overview Cisco IOS contains a vulnerability that allows an intruder to crash the router. Description By sending a specially crafted PPTP packet to port 1723, an intruder can crash a device running a vulnerable version of IOS. Quoting from the Cisco Advisory: By sending a crafted PPTP packet to a...

Linux kernel contains race condition via ptrace/procfs/execve

Overview Unprivileged local users can use the ptrace function to take advantage of a privileged program, while that program is performing a privileged operation, to gain privileged access. Description Ptrace is a function, which is often used for debugging, that allows one process to attach to...

SimpleServer:WWW Encoded Traversal Arbitrary Command Execution

By sending a specially encoded string to the remote server, it is possible to execute remote commands with the privileges of the server. This script was written by Mathieu Meadele Script audit and contributions from Carmichael Security Erik Anderson nb: domain no longer exists Added BugtraqID...

BroadVision One-To-One Enterprise Nonexistent JSP Request Path Disclosure

BroadVision reveals the physical path of the webroot when asked for a nonexistent .jsp file if it is configured incorrectly. While displaying errors is useful for debugging applications, this feature should not be enabled on production servers. A remote attacker could use this information to moun...

HP OpenView NNM v6.1 buffer overflow

HP OpenView NNM v6.1 buffer overflow The problem.. HP OpenView NNM v6.1 has a buffer overflow in the suid-root file ecsd located in the /opt/OV/bin/ directory. ecsd is not used in NNM, but is shipped and installed suid-root as default. Details.. je@openview uname -a SunOS openview 5.8...

Vulnerabilities in CrushFTP Server

----- Begin Hush Signed Message from [email protected] ----- Vulnerabilities in CrushFTP Server Overview CrushFTP Server 2.1.4 is a java ftp server available from http://www.crushftp.com. Multiple vulnerabilities exist which allow users to change directories outside of the ftp root and downlo...

tinyProxy Long Connect Request Overflow

It was possible to make the remote service crash by sending it the command : connect AAA...AAAA:// It may be possible for an attacker to execute arbitrary code on this host thanks to this flaw. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10596; scriptversion "1.26"...