3310 matches found
Debian DSA-067-1 : apache - Remote exploit
We have received reports that the apache' package, as included in the Debian stable' distribution, is vulnerable to the artificially long slash path directory listing vulnerability' as described on SecurityFocus. This vulnerability was announced to bugtraq by Dan Harkless. Quoting the SecurityFoc...
Debian DSA-079-2 : uucp - uucp uid/gid access
Zenith Parsec discovered a security hole in Taylor UUCP 1.06.1. It permits a local user to copy any file to anywhere which is writable by the uucp uid, which effectively means that a local user can completely subvert the UUCP subsystem, including stealing mail, etc. If a remote user with UUCP...
CVE-2004-1680
application.cgi in the Pingtel Xpressa handset running firmware 2.1.11.24 allows remote authenticated users to cause a denial of service VxWorks OS crash via a long HTTP GET request, possibly triggering a buffer overflow...
CVE-2002-1538
Acuma Acusend 4, and possibly earlier versions, allows remote authenticated users to read the reports of other users by inferring the full URL, whose name is easily predictable...
Compulsive Media CNU5 - News.mdb Database Disclosure
Compulsive Media CNU5 - News.mdb Database Disclosure source: https://www.securityfocus.com/bid/11004/info CNU5 is reported prone to a database disclosure vulnerability. It is reported that remote users may download the database file 'news.mdb' and gain access to sensitive information including...
SoX - .wav Local Buffer Overflow
SoX - .wav Local Buffer Overflow //--------------------------------- Begin Code: sox-exploiter.c --------------------------------- / Copyright Rosiello Security 2004 http://www.rosiello.org CVE Reference: CAN-2004-0557 Bug Type: Stack Overflow Date: 01/08/2004 Ulf Harnhammar reported that there a...
Mandrake Linux Security Advisory : htdig (MDKSA-2001:083)
A problem was discovered in the ht://Dig web indexing and searching program. Nergal reported a vulnerability in htsearch that allows a remote user to pass the -c parameter, to use a specific config file, to the htsearch program when running as a CGI. A malicious user could point to a file like...
Zixforum - ZixForum.mdb Database Disclosure
source: https://www.securityfocus.com/bid/10982/info Zixforum is reported prone to a database disclosure vulnerability. It is reported that remote users may download the database file ''ZixForum.mdb' and gain access to sensitive information including unencrypted authentication credentials. All...
phpMyAdmin257.txt
Software : phpMyAdmin Version : 2.5.7 Vulnerability : php codes injection Problem-Type : remote user phpMyAdmin is web-based mysql administration written in PHP. There is a vulnerability in phpMyAdmin version 2.5.7. This vulnerability would allow remote user to inject php codes to be executed by...
php codes injection in phpMyAdmin version 2.5.7.
Software : phpMyAdmin Version : 2.5.7 Vulnerability : php codes injection Problem-Type : remote user phpMyAdmin is web-based mysql administration written in PHP. There is a vulnerability in phpMyAdmin version 2.5.7. This vulnerability would allow remote user to inject php codes to be executed by...
Full path disclosure csFAQ
http://www.swp-zone.org/archivos/advisory-08.txt ------------------------------------------------------------------------------------------------- :.: Full path disclosure csFAQ :.: PROGRAM: csFAQ HOMEPAGE: http://www.cgiscript.net/ BUG: Full path disclosure DATE: 23/05/2004 AUTHOR: DarkBicho web...
[Full-Disclosure] Multiple vulnerabilities PowerPortal
http://www.swp-zone.org/archivos/advisory-07.txt ------------------------------------------------------------------------------------------------- :.: Multiple vulnerabilities PowerPortal :.: PROGRAM: PowerPortal HOMEPAGE: http://powerportal.sourceforge.net/ VERSION: v1.x BUG: Multiple...
Web Wiz Forums 7.x - 'Registration_Rules.asp' Cross-Site Scripting
source: https://www.securityfocus.com/bid/10555/info A vulnerability exists in the Web Wiz Forums software that may allow a remote user to launch cross-site scripting attacks. The problem is reported to exist due to improper sanitizing of user-supplied data passed to the 'registrationrules.asp'...
Virtual Programming VP-ASP Shoperror Script 4/5 - Cross-Site Scripting
source: https://www.securityfocus.com/bid/10534/info A vulnerability exists in the software that may allow a remote user to launch cross-site scripting attacks. The problem is reported to exist due to improper sanitizing of user-supplied data in the 'shoperror.asp' script. An attacker can exploit...
Multiple vulnerabilities PHP-Nuke
original advisory : http://bichosoft.webcindario.com/advisory-05.txt ------------------------------------------------------------------------------------------------- :.: Multiple vulnerabilities PHP-Nuke :.: PROGRAM: PHP-Nuke HOMEPAGE: http://phpnuke.org/ VERSION: 6.x, 7.2, 7.3 BUG: Multiple...
Mailman Crated Email Remote User Password Disclosure
The target is running a version of the Mailman mailing list software that allows a list subscriber to retrieve the mailman password of any other subscriber by means of a specially crafted mail message to the server. That is, a message sent to $listname-request@$target containing the lines :...
TurboTrafficTrader C 1.0 - Multiple Cross-Site Scripting HTML Injection Vulnerabilities
TurboTrafficTrader C 1.0 - Multiple Cross-Site Scripting HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/10359/info It has been reported that TurboTrafficTrader C does not properly sanitize input received from users. It has been conjectured that this may allow a remote us...
TurboTrafficTrader C 1.0 - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities
source: https://www.securityfocus.com/bid/10359/info It has been reported that TurboTrafficTrader C does not properly sanitize input received from users. It has been conjectured that this may allow a remote user to launch cross-site scripting and HTML injection attacks. The cross-site scripting...
CVE-2004-0437
Titan FTP Server version 3.01 build 163, and possibly other versions before build 169, allows remote authenticated users to cause a denial of service crash by disconnecting from the system during a "LIST -L" command, which causes Titan to access an invalid socket...