PYSEC-2008-10

The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the 1 list, 2 display, and 3 set methods...

CVE-2008-1475: Undefined Security Weakness

The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the 1 list, 2 display, and 3 set methods...

GLSA-200803-29 : ViewVC: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200803-29 ViewVC: Multiple vulnerabilities Multiple unspecified errors were reportedly fixed by the ViewVC development team. Impact : A remote attacker could send a specially crafted URL to the server to list CVS or SVN commits on...

Microsoft IIS File Change Notification Local Privilege Escalation Vulnerability

Description Microsoft Internet Information Service IIS is prone to a local privilege-escalation vulnerability that occurs when handling file change notifications. A local attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successfully exploiting this issue wil...

Xxe

The XML parsing code in Sun Java Runtime Environment JDK and JRE 6 Update 3 and earlier processes external entity references even when the "external general entities" property is false, which allows remote attackers to conduct XML external entity XXE attacks and cause a denial of service or acces...

CVE-2008-0628

The XML parsing code in Sun Java Runtime Environment JDK and JRE 6 Update 3 and earlier processes external entity references even when the "external general entities" property is false, which allows remote attackers to conduct XML external entity XXE attacks and cause a denial of service or acces...

CVE-2008-0628: Undefined Security Weakness

The XML parsing code in Sun Java Runtime Environment JDK and JRE 6 Update 3 and earlier processes external entity references even when the "external general entities" property is false, which allows remote attackers to conduct XML external entity XXE attacks and cause a denial of service or acces...

PHP 5.2.5 - cURL 'safe_mode' Security Bypass

source: https://www.securityfocus.com/bid/27413/info PHP cURL is prone to a 'safe mode' security-bypass vulnerability. Attackers can use this issue to gain access to restricted files, potentially obtaining sensitive information that may aid in further attacks. The issue affects PHP 5.2.5 and 5.2....

Debian Security Advisory DSA 1109-1 (rssh)

The remote host is missing an update to rssh announced via advisory DSA 1109-1. Russ Allbery discovered that rssh, a restricted shell, performs insufficient checking of incoming commands, which might lead to a bypass of access restrictions. OpenVAS Vulnerability Test $Id: deb11091.nasl 6616...

CVE-2007-6675

The bsystemcommentsshow function in htdocs/modules/system/blocks/systemblocks.php in XOOPS before 2.0.18 does not check permissions, which allows remote attackers to read the comments in restricted modules...

Design/Logic Flaw

The bsystemcommentsshow function in htdocs/modules/system/blocks/systemblocks.php in XOOPS before 2.0.18 does not check permissions, which allows remote attackers to read the comments in restricted modules...

SuSE 10 Security Update : rsync (ZYPP Patch Number 4798)

This update fixes a bug in rsync that allowed remote attackers to access restricted files outside a module's hierarchy if no chroot setup was used. CVE-2007-6199 Please read http://rsync.samba.org/security.html entry from November 28th, 2007 to get more information about a secure configuration of...

DEBIAN-CVE-2007-6199

rsync before 3.0.0pre6, when running a writable rsync daemon that is not using chroot, allows remote attackers to access restricted files via unknown vectors that cause rsync to create a symlink that points outside of the module's hierarchy...

CVE-2007-6199: Undefined Security Weakness

rsync before 3.0.0pre6, when running a writable rsync daemon that is not using chroot, allows remote attackers to access restricted files via unknown vectors that cause rsync to create a symlink that points outside of the module's hierarchy...

Ubuntu 6.10 : linux-restricted-modules-2.6.17 vulnerability (USN-404-1)

Laurent Butti, Jerome Razniewski, and Julien Tinnes discovered that the MadWifi wireless driver did not correctly check packet contents when receiving scan replies. A remote attacker could send a specially crafted packet and execute arbitrary code with root privileges. Note that Tenable Network...

Format string

Multiple format string vulnerabilities in websrv.cpp in Dawn of Time 1.69s beta4 and earlier allow remote attackers to execute arbitrary code via format string specifiers in the 1 username or 2 password fields when accessing certain "restricted zones", which are not properly handled by the a...

CVE-2007-5265

Multiple format string vulnerabilities in websrv.cpp in Dawn of Time 1.69s beta4 and earlier allow remote attackers to execute arbitrary code via format string specifiers in the 1 username or 2 password fields when accessing certain "restricted zones", which are not properly handled by the a...

CVE-2007-5265

Multiple format string vulnerabilities in websrv.cpp in Dawn of Time 1.69s beta4 and earlier allow remote attackers to execute arbitrary code via format string specifiers in the 1 username or 2 password fields when accessing certain "restricted zones", which are not properly handled by the a...

CVE-2007-4651

Unspecified vulnerability in Adobe Connect Enterprise Server 6 allows remote attackers to read certain pages that are restricted to the administrator via unknown vectors...

Microsoft Windows Services for UNIX Local Privilege Escalation Vulnerability

Description Microsoft Windows Services for UNIX is prone to a local privilege-escalation vulnerability. Attackers may exploit this issue to gain elevated privileges on affected computers. This facilitates the complete compromise of vulnerable computers. Microsoft Windows Services for UNIX 3.0 and...