Дырка в SiteMinder

С помощью специально сконструированной URL можно получить доступ к закрытым документам, кроме того, можно получить исходные тексты CGI-приложений...

Security Bulletin (MS00-057)

Microsoft Security Bulletin MS00-057 - -------------------------------------- Patch Available for "File Permission Canonicalization" Vulnerability Originally posted: August 10, 2000 Summary ======= Microsoft has released a patch that eliminates a security vulnerability in Microsoftr Internet...

CVE-2000-0030

Solaris dmispd dmicmd allows local users to fill up restricted disk space by adding files to the /var/dmi/db database...

bugzpladv1_eng.txt

0x15.0x05.Y2K ------------------------------------- BugzPL ADVISORY 1, final version ------------------------------------- Bypassing restricted bash for fun and profit ; I. Introduction bash-2 gives us a possibility to use a shell in restricted mode. This mode can be initiated using several metho...

NTMail Proxy Exploit

NTmail version 5.x possibly other versions, I haven't checked has two web functions. One is a web configuration server which lets you configure the mail server via a browser. The other is it can also work as a proxy server. These two functions are set by default to use two different ports 8000 fo...

sshd.locked-accts.txt

NAME sshd-restricted-users-incorrect-configuration AUTHOR Marc SCHAEFER Andreas Trottmann THANKS OpenBSD security team VERSION $Id: sshd-restricted-users-incorrect-configuration,v 1.2 2000/01/25 10:27:56 schaefer Exp $ ABSTRACT In some cases where a system must be configured so that specific user...

CVE-1999-0587

A WWW server is not running in a restricted file system, e.g. through a chroot, thus allowing access to system-critical data...

CVE-1999-0753

The w3-msql CGI script provided with Mini SQL allows remote attackers to view restricted directories...

CVE-1999-0753

CVE-1999-0753 affects the Mini SQL package via the w3-msql CGI script. The issue allows remote attackers to view restricted directories through the CGI, exposing partial confidentiality (per CVSS: Network, Low attack complexity, No authentication, Partial confidentiality/Integrity/Availability). ...

CVE-1999-0289

The Apache web server for Win32 may provide access to restricted files when a . dot is appended to a requested URL...

PT-1999-1033 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache web server for Win32 affected versions not specified Description: The issue allows access to restricted files when a . dot is appended to a requested URL. Recommendations: At the moment, there is no information about a newer version th...

CVE-1999-0433

XFree86 startx command is vulnerable to a symlink attack, allowing local users to create files in restricted directories, possibly allowing them to gain privileges or cause a denial of service...

CVE-1999-0433

XFree86 startx is affected by a symlink attack allowing local users to create files in restricted directories, potentially gaining privileges or causing a denial of service. The provided documents do not specify affected versions or a fix; one PT Security entry notes no information about a newer ...

CVE-1999-0289

The CVE-1999-0289 entry concerns the Apache HTTP Server for Win32. Affected component: the Web server handling URLs; issue described as: the server may provide access to restricted files when a "." is appended to a requested URL. The core impact is restricted-file disclosure. Public details acros...

CVE-1999-0183

CVE-1999-0183 affects Linux implementations of TFTP, described as allowing traversal to read files outside the restricted directory. The OpenVAS/Nessus entries confirm a directory-traversal vulnerability enabling arbitrary file reads via TFTP server responses (e.g., tftpd misconfiguration allows ...

CVE-1999-0289

The Apache web server for Win32 may provide access to restricted files when a . dot is appended to a requested URL...

CVE-1999-0753

The w3-msql CGI script provided with Mini SQL allows remote attackers to view restricted directories...

sudo.info.txt

Date: Tue, 8 Jun 1999 21:23:55 +0200 From: Bencsath Boldizsar To: [email protected] Subject: unneeded information in sudo Sudo debian , v1.5.6p2-2 tells anyone if a file exists or not. It's not a very big problem, but when i set a directory not accessible to anyone but root, I want to make sur...

CVE-1999-0916

WebTrends software stores account names and passwords in a file which does not have restricted access permissions...

CVE-1999-1367

Internet Explorer 5.0 does not properly reset the username/password cache for Web sites that do not use standard cache controls, which could allow users on the same system to access restricted web sites that were visited by other users...