[Full-Disclosure] Buffer Overflow in SYS_CONTEXT() in Oracle 9i Rel.2

http://www.red-database-security.com/advisory/advisory200409032.htm RDS200409032 - Red-Database-Security GmbH Research Advisory Name Buffer Overflow in SYSCONTEXT in Oracle 9i Rel.2 Systems Affected Oracle9i Rel. 2 Windows platform only Severity Medium Risk Category Buffer Overflow Vendor URL...

[Full-Disclosure] Buffer Overflow in DBMS_SYSTEM.KSDWRT() in Oracle8i - 9i

http://www.red-database-security.com/advisory/advisory200409033.htm RDS200409032 - Red-Database-Security GmbH Research Advisory Name Buffer Overflow in DBMSSYSTEM.KSDWRT in Oracle8i - 9i Systems Affected Oracle 8i - Oracle9i all platforms Severity Medium Risk Category Buffer Overflow/Denial of...

Fedora Core 1 : kernel-2.4.22-1.2138.nptl (2003-046)

Paul Starzetz discovered a flaw in bounds checking in mremap in the Linux kernel versions 2.4.23 and previous which may allow a local attacker to gain root privileges. No exploit is currently available; however, it is believed that this issue is exploitable although not trivially. The Common...

Solaris 2.5.1 (sparc) : 103630-15

SunOS 5.5.1: ip ifconfig arp udp icmp patch. Date this patch was last updated by Sun : Oct/29/99 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

LHA 1.x - Remote Buffer Overflow Directory Traversal

LHA 1.x - Remote Buffer Overflow Directory Traversal // source: https://www.securityfocus.com/bid/10243/info LHA has been reported prone to multiple vulnerabilities that may allow a malicious archive to execute arbitrary code or corrupt arbitrary files when the archive is operated on. The first...

Microsoft Windows ASN.1 library contains a memory management vulnerability

Overview Microsoft's ASN.1 library contains a memory management error that could be exploited by a remote attacker to cause a denial-of-service situation, or execute arbitrary code. Description Microsoft's ASN.1 library contains a memory management error, potentially a "double-free" condition. By...

Microsoft Windows fails to properly create entries in the Local Descriptor Table (LDT)

Overview Microsoft Windows NT4.0 and Windows 2000 contain a vulnerability that could permit a local user to gain elevated privileges on the system. Description Microsoft Windows NT4.0 and Windows 2000 provide an API to the kernel to create Local Descriptor Tables LDT for applications. A failure t...

Microsoft Windows Utility Manager contains vulnerability in the way it launches applications

Overview Microsoft Windows Utility Manager contains a vulnerability that may permit an authenticated user to launch applications with elevated privileges. Description Microsoft Windows 2000's Utility Manager is a program that permits users to monitor and launch various accessibility applications....

Microsoft Windows XP creates tasks with elevated privileges

Overview Microsoft Windows XP contains a vulnerability in the way that tasks are created that may permit an authenticated user to launch applications with elevated privileges. Description Microsoft Windows creates tasks when a user launches an application. A vulnerability in the way that Windows ...

[UNIX] tHTTPd Virtual Hosting Security Hole (Host: ../..)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

MSIE->BackMyParent2:Multi-Thread version

BackMyParent2:Multi-Thread version tested Browser Ver MS Internet Explorer: 6.0.2600.0000.xpclntqfe.021108-2107; Encryption: 128-bit; Patch:; Q810847; So, it's far from fully patched. OS Ver: "Windows XP Cn ver" demo http://www.safecenter.net/liudieyu/BackMyParent2/BackMyParent2-MyPage.HTM or...

MSIE->NAFfileJPU

NAFfileJPU tested Browser Ver MS Internet Explorer: 6.0.2600.0000.xpclntqfe.021108-2107; Encryption: 128-bit; Patch:; Q810847; So, it's far from fully patched. OS Ver: "Windows XP Cn ver" demo http://www.safecenter.net/liudieyu/NAFfileJPU/NAFfileJPU-MyPage.HTM or http://umbrella.mx.tc ---...

PUPET-simpnews.txt

original File name : PUPET-simpnews.txt date releases : july 15, 2003 Informations : ========================= Advisory Name: Simpnews include file Vulnerability Author: PUPET Discover by: PUPET Website vendor : http://www.boesch-it.de/ Versions : tested on V2.01 - V2.13 Problem : Include file PH...

WAnewsletter (PHP)

Informations : °°°°°°°°°°°°°° Website : http://www.phpcodeur.net Versions : 2.0beta - 2.1.0 Problem : Include file PHP Code/Location : °°°°°°°°°°°°°°°°°°° newsletter.php 2.1beta - 2.1.0 : ---------------------------------------------------- if !empty$HTTPPOSTVARS'action' $action =...

MS02-037: Microsoft Exchange EHLO Long Hostname Overflow

A security vulnerability results because of an unchecked buffer in the IMC code that generates the response to the EHLO protocol command. If the buffer were overrun with data it would result in either the failure of the IMC or could allow the attacker to run code in the security context of the IM...

wp-02-0001: GoAhead Web Server Directory Traversal + Cross Site Scripting

Westpoint Security Advisory Title: GoAhead Web Server Directory Traversal + Cross Site Scripting Risk Rating: Medium Software: GoAhead Web Server v2.1 Platforms: Windows NT/98/95/CE Embedded Linux Linux QNX Novell Netware + others Vendor URL: www.goahead.com/webserver/webserver.htm Author: Matt...

Oracle Reports Server Buffer Overflow (#NISR12062002B)

NGSSoftware Insight Security Research Advisory Name: Oracle 9iAS Reports Server Systems: All Severity: High Risk Category: Remote Buffer Overrun Vulnerability Vendor URL: http://www.oracle.com/ Author: David Litchfield [email protected] Advisory URL:...

OpenBSD kernel fails to properly check closed file descriptors "0-2" when running setuid program

Overview The OpenBSD kernel does not adequately check file descriptors 0-2 prior to execing setuid binaries. Other OS kernels may be vulnerable as well. Description The OpenBSD kernel does not adequately check file descriptors 0-2 prior to execing setuid binaries. As a result, an attacker may be...

Cgisecurity Advisory #9: Novell Websearch, and Microsoft IIS XSS Issues

Just two XSS holes. I only bothered releasing them because both microsoft and novell seemed to suffer a similar problem. I like to know about a hole no matter how small it is, if its in a product I use. Advisory www.cgisecurity.com/advisory/9.txt - [email protected] NOTE: Novell issued a patch...

Bug in QPopper (All Versions?)

Description: When sending a string that has 2048+ characters in it, the in.qpopper or popper process will begin to use massive amounts of CPU and will not stop until it is manually killed. Versions Affected: I tested this on 4.0.1 and 4.0.3. 4.0.2 is probably vulnerable also. Older versions may...