osTicket Attachment Handling File Upload Arbitrary Code Execution

The target is running at least one instance of osTicket that enables a remote user to open a new ticket with an attachment containing arbitrary PHP code and then to run that code using the permissions of the web server user. %NASLMINLEVEL 70300 This script was written by George A. Theall, . See t...

Solaris 7 (sparc) : 108319-03

SunOS 5.7: /usr/bin/at patch. Date this patch was last updated by Sun : Jan/27/03 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/10/24. C Tenable Network Security, Inc. if !...

FreeBSD Ports: phpBB < 2.0.8

The remote host has an old version of phpBB installed. phpBB is a PHP-based bulletin board. There is a cross-site scripting issue in the remote version of this software which may allow an attacker to damage the remote phpBB installation %NASLMINLEVEL 999999 @DEPRECATED@ This script has been...

Squid ntlm_check_auth Function NTLM Authentication Helper Password Handling Remote Overflow

The remote server is affected by a remote code execution vulnerability in the Squid Internet Object Cache server due to a failure to test the length of the user-supplied LanMan hash value in the ntlmcheckauth function in libntlmssp.c. An unauthenticated, remote attacker can exploit this, via a...

Cisco IPsec VPNSM vulnerable to DoS via malformed IKE packet

Overview A vulnerability in a Cisco VPN module can allow a remote attacker to cause a denial-of-service to the device in which the module is installed. Description The Cisco IP Security IPsec VPN Services Module VPNSM is a high-speed module for the Cisco Catalyst 6500 Series Switch and the Cisco...

Integrigy Security Alert - Multiple SQL Injection Vulnerabilities in Oracle E-Business Suite

Integrigy Security Alert Oracle E-Business Suite - Multiple SQL Injection Vulnerabilities June 3, 2004 Summary: Multiple SQL injection vulnerabilities exist in the Oracle E-Business Suite 11i and Oracle Applications 11.0. These vulnerabilities can be remotely exploited simply using a browser and...

Microsoft Windows SSP interface fails to properly validate value used during authentication protocol selection

Overview A remotely exploitable vulnerability in Microsoft's Negotiate Security Software Provider SSP interface could permit an attacker to execute arbitrary code on the system. Description Microsoft's Negotiate Security Software Provider SSP interface contains a buffer overflow during the...

Low: Red Hat Security Advisory: quagga security update

Updated Quagga packages that close a locally-exploitable denial of service vulnerability are now available. Quagga is an open source implementation of TCP/IP routing software. Herbert Xu reported that Quagga can accept spoofed messages sent on the kernel netlink interface by other users on the...

IRM 008: Citrix Metaframe XP is vulnerable to Cross Site Scripting

---------------------------------------------------------------------------- IRM Security Advisory No. 008 Citrix Metaframe XP is vulnerable to Cross Site Scripting Vulnerablity Type / Importance: XSS / Medium Problem discovered: August 18th 2003 Vendor contacted: August 18th 2003 Advisory...

Microsoft Exchange Server fails to properly handle specially crafted SMTP extended verb requests

Overview Microsoft Exchange fails to handle certain SMTP extended verbs correctly. In Exchange 5.5, this can lead to a denial-of-service condition. In Exchange 2000, this could permit an attacker to run arbitrary code. Description Microsoft Exchange is a popular collaboration product which includ...

Microsoft Outlook Web Access (OWA) contains cross-site scripting vulnerability in the "Compose New Message" form

Overview There is a cross-site scripting vulnerability in Microsoft Outlook Web Access. Description The "Compose New Message" form of the Outlook Web Access OWA component of Microsoft Exchange 5.5 contains a cross-site scripting vulnerability. For more information about cross-site scripting...

Microsoft Windows RPCSS Service contains heap overflow in DCOM request filename handling

Overview There is a remote buffer overflow in many versions of Microsoft Windows that allows attackers to execute arbitrary code with system privileges. Description The Microsoft RPCSS Service is responsible for managing Remote Procedure Call RPC messages and is enabled by default on many version...

Microsoft Access Snapshot Viewer vulnerable to buffer overflow when validating parameters

Overview A remotely exploitable vulnerability exists in the Microsoft Access Snapshot Viewer ActiveX control. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the local system with the privileges of the current user. Description According to Microsoft'...

Microsoft SQL Server becomes unresponsive when large packet is sent to specific named pipe

Overview A vulnerability in Microsoft SQL Server may allow a local attacker to cause a denial of service. An exploit for this vulnerability is publicly available. Description Microsoft describes SQL Server as, "a fully enterprise-class database product, providing core support for Extensible Marku...

Windows Media Player 9 ActiveX control does not adequately validate access to Windows Media Library

Overview An ActiveX control included with Windows Media Player 9 does not adequately validate script access to the Windows Media Library. This could allow an attacker to read or modify data contained in the library. Description Windows Media Player 9 includes an ActiveX control that can be used t...

Sun Solaris "/usr/lib/utmp_update" contains buffer overflow

Overview A vulnerability in Sun Solaris "/usr/lib/utmpupdate" may allow a local attacker to gain superuser privileges. Description A buffer overflow vulnerability exists in Sun Solaris "/usr/lib/utmpupdate". For more information, please see Sun Alert 55260. --- Impact A local attacker may be able...

Linux kernel IP stack incorrectly calculates size of an ICMP citation for ICMP errors

Overview The Linux 2.0 kernel contains a vulnerability in the way it processes ICMP errors. This could lead to portions of memory being leaked to a malicious user. Description The Linux 2.0 kernel versions 2.0 through 2.0.39 inclusive contains an error in the calculation of the size for an ICMP...

Cisco Catalyst switches allow access to "enable mode" without password

Overview Cisco Catalyst OS 7.51 contains a vulnerability that allows anyone who can obtain command line access to gain "enable" mode access without knowledge of the "enable" password. Description Cisco Catalyst OS is an operating system for Cisco's line of Catalyst switches. Version 7.51 of...

RealNetworks Helix Universal Server vulnerable to buffer overflow when supplied an overly long string for the "Describe" field

Overview The RealNetworks' Helix Universal Server supports delivery of several different media types over the Internet via RTSP Real Time Streaming Protocol. Vulnerabilities have been discovered in the way it handles some RTSP requests. These vulnerabilities could allow a remote attacker to execu...

SRT2003-04-01-1231 - Progress DLC overflows

Secure Network Operations, Inc. http://www.secnetops.com Strategic Reconnaissance Team [email protected] Team Lead Contact [email protected] Our Mission: Secure Network Operations offers expertise in Networking, Intrusion Detection Systems IDS, Software Security Validation, and...