2108 matches found
phpMyAdmin 2.1.0 + world readable (apache) log files enable remote user to run arbitrary PHP Codes as apache user.
Note : sorry for my pity english. First of all, i want to ask a question, is it normal that if, in a MySQL query -via PHP-, i put "select from $table" . "files where ID=1" and i post table="atable ", MySQL consider the new query as a valid one so the final query will be "select from atable" ? It'...
cue.sh
!/usr/bin/ksh THIS IS A DANGEROUS SCRIPT !!! READ THE CODE PRIOR TO ./! This is just a proof of concept. Don't use for malicious purpose. If ever you decide to run that script, please read the code carefully before! Emilie Chang, 2001. Dedicated to Scriptors of Doom and HERT people. Good job...
gpm-root fails to correctly release GID 0 membership for user defined menus
Overview gpm-root does not properly drop group privileges. Local users can gain group privileges by starting a utility from gpm-root. The gpm package is usually included in Linux distributions, and can be started from the command line or in the startup script /etc/rc.d/rc.local. Description gpm...
xlock.txt
Hi, I came across a nice xlock bug when i noticed i couldnt log in again as user after i "locked" my windowmaker screen. Xlock afaik is suid by default to read passwords from /etc/shadow. I removed most suidbits on my Slackware 7.1 box. Also the suidbit on my xlock has been removed. Problem: Any...
Mysql 3.22.x/3.23.x - Local Buffer Overflow
// source: https://www.securityfocus.com/bid/2262/info MySQL is a widely used Open Source database tool. Versions of MySQL up to and including 3.23.30 are vulnerable to a buffer overflow attack. By supplying an excessively long string as an argument for a SELECT statement, it is possible for a...
xconq7.4.1 exploit.
i saw some mention of xconq on bugtraq, but no exploit. decided to take a lookie at it...took a little more work than expected to successfully exploitwithout a display, but none-the-less: originalunwarpped/working: http://realhalo.org/xxconq.c xxconq.cwrapped:...
format string in ssl dump
Sorry if this has already got posted. Seeweed found this in ssldump the other day. The follwoing text is from his website http://dropwire.dhs.org/seeweed/: SSLDUMP is a program witch is simallar to tcpdump, but also adds encryption to its network debugging procedures..It captures traffic then...
CVE-2000-1023
CVE-2000-1023 concerns the Alabanza Control Panel. The vulnerability arises because the nsManager.cgi CGI program does not require passwords to access administrative commands, enabling remote attackers to modify domain name information. Connected scan entries (Nessus/OpenVAS) reference this CVE a...
ecurity Advisory: Cisco IOS HTTP Server Query Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Cisco IOS HTTP Server Query Vulnerability Revision 1.0 For public release 2000 October 25 at 08:00 US/Pacific UTC+0700 Summary A defect in multiple releases of Cisco IOS software will cause a Cisco router or switch to halt and reload if the IOS HTTP service is...
Дырка в HP Openview Network Node Manager
Можно вызвать переполнение буфера в CGI-скрипте требующем авторизованного доступа...
Re: Re[4]: mailbox parsing problem in imap-4.7c
3APA3A [email protected] wrote: Hello Mark, Thursday, August 10, 2000, 9:14:25 PM, you wrote: MC This is not a sendmail issue, since sendmail is an MTA, not an MDA. Sendmail MC calls MDA programs. Sendmail works splendidly for us. sendmail contains mail.local. mail.local is MDA. At least BS...
Cobalt RaQ 2.0/3.0 / qpopper 2.52/2.53 - 'EUIDL' Format String Input
// source: https://www.securityfocus.com/bid/1242/info A vulnerability exists in version 2.53 and prior of qpopper, a popular POP server, from Qualcomm. By placing machine executable code in the X-UIDL header field, supplying formatting strings in the "From:" field in a mail header, and then...
CVE-1999-0569
A URL for a WWW directory allows auto-indexing, which provides a list of all files in that directory if it does not contain an index.html file...
FreeBSD 3.3 - gdc Symlink
FreeBSD 3.3 - gdc Symlink source: https://www.securityfocus.com/bid/835/info It is possible to write debug ouput from gdc to a file /var/tmp/gdbdump. Unfortunately, gdc follows symbolic links which can be created in tmp and will overwrite any file on the system thanks to it being setiud root. Thi...
rxvt.sh
There is a major security hole in rxvt, a terminal emulator for X, when it is run on systems suid root, as is required on many configurations in order to write to the utmp file. It is obvious from the code that this program was not written to be run suid root, its a pity that sysadmins that insta...
IBM AIX 4.2 - '/usr/sbin/lchangelv' Local Buffer Overflow
/ source: https://www.securityfocus.com/bid/389/info A buffer overflow can occur in lchangelv under some versions of AIX. Note that an attacker must already have the GID or EGID of 'system' to execute lchangelv. Because lchangelv is SUID root, this overflow will grant the attacker root privileges...
CVE-2025-29572
CVE-2025-29572 is rejected/not used; this CVE ID does not represent an active vulnerability entry.
Visual Studio 2019 version 16.11.27 update
This security update applies to all editions of Visual Studio 2019 between versions 16.0.0 and 16.11.26, and will update client machines to version 16.11.27. The client machines must be enabled to receive this administrator update, and by default Visual Studio must be closed on the client in orde...
Windows Malicious Software Removal Tool x64 - v5.121 (KB890830)
After the download, this tool runs one time to check your computer for infection by specific, prevalent malicious software including Blaster, Sasser, and Mydoom and helps remove any infection that is found. If an infection is found, the tool will display a status report the next time that you sta...