CVE-2007-3095

Unspecified vulnerability in Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec AntiVirus Corporate Edition SAV CE 10.1 and later, allows attackers to "disable the authentication system" and bypass authenticati...

CVE-2007-3095

The vulnerability CVE-2007-3095 affects Symantec Reporting Server versions prior to 1.0.224.0 (including 1.0.197.0) as used with Symantec Client Security 3.1+ and SAV CE 10.1+. The issue is an authentication bypass that allows an attacker to disable authentication and access restricted functional...

CVE-2007-3095: Undefined Security Weakness

Unspecified vulnerability in Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec AntiVirus Corporate Edition SAV CE 10.1 and later, allows attackers to "disable the authentication system" and bypass authenticati...

SYM07-012 Symantec Reporting Server elevation of privilege

SYM07-012 Symantec Reporting Server Elevation of Privilege June 5, 2007 Risk Impact Medium Remote Access: Yes Local Access: Yes Authentication Required: No Exploit available: No Overview Files created by a Reporting Server may be accessible to an unauthorized user. Affected Products Reporting...

Code injection

Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec AntiVirus Corporate Edition SAV CE 10.1 and later, does not initialize a critical variable, which allows attackers to create arbitrary executable files via...

CVE-2007-3022

Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec AntiVirus Corporate Edition SAV CE 10.1 and later, displays the password hash for a user after a failed login attempt, which makes it easier for remote attacke...

CVE-2007-3021

Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec AntiVirus Corporate Edition SAV CE 10.1 and later, does not initialize a critical variable, which allows attackers to create arbitrary executable files via...

Design/Logic Flaw

Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec AntiVirus Corporate Edition SAV CE 10.1 and later, displays the password hash for a user after a failed login attempt, which makes it easier for remote attacke...

CVE-2007-3021

Symantec Reporting Server before 1.0.224.0 (used with SCS 3.1 and SAV CE 10.1+) fails to initialize a critical variable during data export, allowing an attacker to manipulate the exported file to create arbitrary executable files. This could lead to remote code execution in the web server context...

CVE-2007-3021

Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec AntiVirus Corporate Edition SAV CE 10.1 and later, does not initialize a critical variable, which allows attackers to create arbitrary executable files via...

CVE-2007-3022

Symantec Reporting Server (versions affected: 1.0.197.0 up to 1.0.224.0), used with Symantec Client Security 3.1 and SAV CE 10.1, discloses the password hash for a user after a failed login. This plaintext-like disclosure enables brute-force attempts and could let an attacker gain access to the R...

CVE-2007-3022

Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec AntiVirus Corporate Edition SAV CE 10.1 and later, displays the password hash for a user after a failed login attempt, which makes it easier for remote attacke...

Symantec Reporting Server Password Disclosure

SUMMARY The administrator password for Symantec Reporting Server could be disclosed after a failed login attempt. Risk Impact Medium Remote Access | Yes ---|--- Local Access | Yes Authentication Required | Yes Exploit publicly available | No AFFECTED PRODUCTS Affected Products Product | Affected...

Symantec Reporting Server Elevation of Privilege

SUMMARY Files created by Reporting Server may be accessible to an unauthorized user. Risk Impact Medium Remote Access | Yes ---|--- Local Access | Yes Authentication Required | No Exploit publicly available | No AFFECTED PRODUCTS Product | Affected Version | Updated Version | Solution...

CVE-2007-3021: Undefined Security Weakness

Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec AntiVirus Corporate Edition SAV CE 10.1 and later, does not initialize a critical variable, which allows attackers to create arbitrary executable files via...

CVE-2007-3022: Undefined Security Weakness

Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec AntiVirus Corporate Edition SAV CE 10.1 and later, displays the password hash for a user after a failed login attempt, which makes it easier for remote attacke...

USN-458-1: MoinMoin vulnerabilities

A flaw was discovered in MoinMoin's error reporting when using the AttachFile action. By tricking a user into viewing a crafted MoinMoin URL, an attacker could execute arbitrary JavaScript as the current MoinMoin user, possibly exposing the user's authentication information for the domain where...

WinMail Server 4.4 build 1124 - 'WebMail' Remote Add Super User

tempfolder."sessions/".$this-sid.".sess"; if!fileexists$sessionfile return false; $size = filesize$sessionfile; $fp = fopen$sessionfile, "rb"; if $fp $result = fread$fp, $size; fclose$fp; $result = unserializebase64decode$result; return $result; ... This function should check for session files...

rps62-sql.txt

? //RPS 6.2 SQL Injection Exploit //http://www.rps-project.com/ //Need magicquotesgpc = Off; //by s0cratex //Contact: s0cratexathotmaildotcom //Salu2: rgod, 0pt1x 'n mechas. errorreporting0; iniset"maxexecutiontime",0; iniset"defaultsockettimeout",5; $host = "localhost"; $path="/rps"; $id=1; echo...

PT-2007-2343

Name of the Vulnerable Software and Affected Versions: MoinMoin version 1.5.7 Description: The issue concerns an information leak in the debug reporting feature of MoinMoin, potentially exposing details about the software versions running on the host system. This could allow remote attackers to...