ttcms and ttforum exploits

hope this is the right place to send this exploit info, I found three diffrent exploits for a forum software / cms software: ------------------------------------------------------------------------------------------------------------------------------------------------ Affected Product: ttCMS or...

Microsoft Internet Explorer 5/6 - 'file://' Request Zone Bypass

source: https://www.securityfocus.com/bid/7539/info Internet Explorer is reported to be vulnerable to a zone bypass issue. Allegedly, if Internet Explorer attempts to open a web page containing numerous 'file://' requests each contained in a separate Iframe, the requested file will eventually be...

HappyMall E-Commerce Software 4.3/4.4 - 'Member_HTML.cgi' Command Execution

source: https://www.securityfocus.com/bid/7530/info It has been reported that a problem in the HappyMall E-Commerce software package could allow an attacker to pass arbitrary commands through the memberhtml.cgi script. This could lead to attacks against system resources. HappyMall explo vulnerabl...

Leksbot 1.2 - Multiple Vulnerabilities

Leksbot 1.2 - Multiple Vulnerabilities / source: https://www.securityfocus.com/bid/7505/info Multiple vulnerabilities have been reported for Leksbot. The precise nature of these vulnerabilities are currently unknown however, exploitation of this issue may result in an attacker obtaining elevated...

Xinetd 2.1.x2.3.x - Rejected Connection Memory Leakage Denial of Service

Xinetd 2.1.x2.3.x - Rejected Connection Memory Leakage Denial of Service source: https://www.securityfocus.com/bid/7382/info A denial of service vulnerability has been reported for Xinetd. The vulnerability exists due to memory leaks occuring when connections are rejected. Numerous, repeated...

Winamp < 3.0b Multiple File Handling DoS

The remote host is using Winamp3, a popular media player which handles many files format mp3, wavs and more... This version suffers from multiple buffer overflow and denial of service issues that can be triggered by specially crafted b4s files. To perform an attack, the attack would have to send ...

Poptop < 1.1.3-b3 and 1.1.3-20030409 Negative Read Overflow

No description provided by source. $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require...

Netgear FM114P ProSafe Wireless Router - Rule Bypass

source: https://www.securityfocus.com/bid/7270/info The Netgear FM114P allows certain ports to be blocked, both for external users attempting to enter the local network and for local users connecting to the WAN. If Remote Access and Universal Plug and Play are both enabled on the WAN interface, a...

Edikon Release 0.6 of PHPShop

Product : Edikon Release 0.6 of PHPShop Version : 0.6.1 WebSite : http://www.phpshop.org Problem : Viewing dbase information Description: ------------ eng In phpShop we can get access to a database of the server as the file of a configuration is accessible to each user. As we can find out a full...

Kebi Academy Home Page Administration file Parameter Traversal Arbitrary File Access

Kebi Academy, a Korean web application, fails to sanitize user input to the 'file' parameter to the 'home' script of directory traversal sequences. A remote attacker can leverage this issue to read arbitrary files or even upload arbitrary code to the affected host, to be executed subject to the...

Platform Load Sharing Facility 45 - LSF_ENVDIR Local Command Execution

Platform Load Sharing Facility 45 - LSFENVDIR Local Command Execution source: https://www.securityfocus.com/bid/7655/info It has been reported that Load Sharing Facility LSF does not properly handle input in environment variables. Because of this, an attacker may be able to gain escalated...

Outblaze Webmail - Cookie Authentication Bypass

// source: https://www.securityfocus.com/bid/7115/info Outblaze web mail service has been reported prone to an authentication cookie spoofing vulnerability. This issue may allow a malicious attacker to bypass the cookie-based authentication mechanisms used by the affected Outblaze web mail server...

RSA ClearTrust ct_logon.asp Multiple Parameter XSS

The remote ClearTrust server is vulnerable to a cross-site scripting attack that can be exploited using specially crafted calls to its 'ctlogon.asp' or 'ctlogon.jsp' scripts. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Date: Fri, 14 Mar 2003 18:42:02 -0800 To: [email protected]...

MySQL datadir/my.cnf Modification Privilege Escalation

The remote version of MySQL is older than 3.23.56. Such versions are affected by an issue that may allow the mysqld service to start with elevated privileges. An attacker can exploit this vulnerability by creating a 'DATADIR/my.cnf' that includes the line 'user=root' under the 'mysqld' option...

Microsoft Windows Server 2000 - Help Facility .CNT File :Link Buffer Overflow

Microsoft Windows Server 2000 - Help Facility .CNT File :Link Buffer Overflow // source: https://www.securityfocus.com/bid/7102/info The Microsoft Windows 2000 Help facility does not perform sufficient bounds checking on .cnt files. If a .cnt file containing an unusually long :Link URI was opened...

File 3.x - Utility Local Memory Allocation

File 3.x - Utility Local Memory Allocation // source: https://www.securityfocus.com/bid/7009/info It has been reported that a memory allocation issue exists the file program. Although details of this issue are currently unavailable, it is likely that this issue could be exploited to cause a denia...

Typo3 3.5 b5 - HTML Hidden Form Field Information Disclosure (2)

source: https://www.securityfocus.com/bid/6993/info Clients of TYPO3 systems may access potentially sensitive data that have been obfuscated through hidden form fields. This may aid in exploiting other known issues in the software. !/usr/bin/perl use strict; use Getopt::Std; use LWP::UserAgent; u...

Linux-ATM LES 2.4 - Command Line Argument Buffer Overflow

// source: https://www.securityfocus.com/bid/7437/info The linux-atm 'les' executable has been reported prone to a buffer overflow vulnerability. This issue is due to a lack of sufficient bounds checking performed on data supplied via specific command line arguments to the 'les' executable...

Microsoft Internet Explorer 5 - ShowHelp Arbitrary Command Execution

source: https://www.securityfocus.com/bid/6780/info Microsoft Internet Explorer implements the showHelp function as a means of displaying help content contained in HTML pages. However, this function is capable of performing too many other actions outside of its intended functionality through...

mpg123 pre0.59s - Invalid MP3 Header Memory Corruption

// source: https://www.securityfocus.com/bid/6593/info A memory corruption vulnerability has been reported for mpg123 that may result in code execution. The vulnerability exists when mpg123 is used to play certain MP3 files. Specifically, when playing MP3 files with malformed headers, it may be...