CVE-2001-0288

Cisco switches and routers running IOS 12.1 and earlier produce predictable TCP Initial Sequence Numbers ISNs, which allows remote attackers to spoof or hijack TCP connections...

CVE-2001-0295

Directory traversal vulnerability in War FTP 1.67.04 allows remote attackers to list directory contents and possibly read files via a "dir ./../.." command...

Buffer Overflows in Netscape6

iXsecurity, Stockholm, january 2001 Summary There are at least three buffer overflow vulnerabilities in Netscape6 verified with version 6.0 on Win2k and Win98. We cannot currently use any of them to execute code on the system. But if someone finds a way to do that, they are really dangerous! The...

scx-sa-12.txt

============================================================================= Securax-SA-12 Security Advisory belgian.networking.security Dutch ============================================================================= Topic: Remote hiding from accesslog and errorlog Announced: 2000-12-28...

Technote 20002001 - Filename Command Execution File Disclosure

Technote 20002001 - Filename Command Execution File Disclosure source: https://www.securityfocus.com/bid/2156/info Technote Inc. offers a multi-communication Package that includes a web board type of service. A script that ships with Technote, 'main.cgi', accepts a parameter called 'filename'. Th...

Phorum 3.x - Arbitrary File Read

source: https://www.securityfocus.com/bid/1997/info Phorum is a PHP based web forums package. Due to an error in the handling of user input in administrative scripts, any user can view the any file readable by the webserver on the target host. This is due to user-supplied input being referenced a...

Linux Multiple statd Packages Remote Format String

The remote statd service could be brought down with a format string attack - it now needs to be restarted manually. This means that an attacker may execute arbitrary code thanks to a bug in this daemon. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10544;...

icq.greeting-card.txt

Hi, I don't know if this has been reported before. ICQ's Greeting Card service allow you to send message with HTML commands so you can crash target computer or run script codes. If you write this in message box target computer should be crash in 3 seconds. Meliksah Ozoral [email protected]...

Tomcat 3.0/3.1 Snoop Servlet - Information Disclosure

source: https://www.securityfocus.com/bid/1532/info A vulnerability exists in the snoop servlet portion of the Tomcat package, version 3.1, from the Apache Software Foundation. Upon hitting an nonexistent file with the .snp extension, too much information is presented by the server as part of the...

Conserver Overflow

This overflow is trivial to fix and I've already emailed the developer, but I'm curious to know if it would be at all possible to exploit this overflow. In conserver-GNAC-6.15 in the source for the conserver daemon: group.c line 376: ------------------------- int CheckPasswdpCLServing, pwstring...

Potential security problem with mtr

Hi. One of my users asked me to install mtr, most adequately described as a GUI:ed combination of traceroute and ping. I thought it looked cool, and had a closer look. In this mail follows a warning about a potential security problem with this program if installed as suggested. No exploit has bee...

unpassworded.dsl.routers.txt

Kewlhair Security Advisory Advisory Name: Router Passwords Advisory Released: 03/09/00 Severity: Moderate Summary: An attacker can seize control of an SBC customer=92s router. Overview: SBC is currently deploying the Cayman-DSL router to its DSL customer=92s.SBC communications being the parent...

unixware.chown.txt

Greetings, OVERVIEW Any user can change the owner of any file he or she owns. BACKGROUND All my testing was done on UnixWare 7.1, however chances are excellent that this problem exists for all versions of UnixWare. DETAILS This hole is, erm, different. Apparently any user can change the ownership...

proftpd.1.2.0pre6.txt

Tymm Twillman [email protected] Sent: Friday, September 17, 1999 2:15 PM Subject: proftpd 1.2.0pre6 patch Before I release the exploit, I'd like to give people a chance to fix the problem. Here's the patch. Note that there are other potential problems; I've been in contact with MacGyver and a...

RPC database Service Detection

The database RPC service is running. If you do not use this service, then you should disable it as it may become a security threat in the future, if a vulnerability is discovered. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10214; scriptversion"1.22";...

RPC alis Service Detection

The alis RPC service is running. If you do not use this service, then you should disable it as it may become a security threat in the future, if a vulnerability is discovered. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10210; scriptversion"1.22";...

X11.tmp.txt

Date: Mon, 2 Nov 1998 23:04:43 +0100 From: Pavel Kankovsky To: [email protected] Subject: X11 cookie hijacker drwxrwxrwx 2 root root 1024 Oct 30 19:57 /tmp/.X11-unix Hang on, aren't those dangerous permissions? Pretty dangerous. Shall I look for my old cookie hijacker? Please post the bloody...

netscapemail.txt

Date: Wed, 29 Jul 1998 10:04:05 +0200 From: Paul Boehm Subject: Re: netscape mail overflowanother one On Tue, Jul 28, 1998 at 08:21:41PM +0200, Paul Boehm wrote: Hi, netscape mail crashes when trying to the attachment ^- save from the following pseudo mime mail: sorry for posting twice, but this ...

Anonymous FTP Writable root Directory

It is possible to write on the root directory of the remote anonymous FTP server. This allows an attacker to upload arbitrary files which can be used in other attacks, or to turn the FTP server into a software distribution point. TRUSTED...

NetManage Chameleon SMTPd Remote Overflow DoS

The remote host appears to be running NetManage Chameleon SMTPd. This version of the software has a remote buffer overflow vulnerability. Nessus crashed the service by issuing a long argument to the HELP command. A remote attacker could exploit this issue to crash the service, or possibly execute...