NAI WebShield SMTP GET_CONFIG Information Disclosure

The remote NAI WebShield SMTP Management tool gives away its configuration when it is issued the command : GETCONFIG This may be of some use to an attacker to gain more knowledge about this system. C Tenable Network Security, Inc. include 'compat.inc' ; ifdescription scriptid10424; scriptversion...

Sambar Server /cgi-bin/mailit.pl Arbitrary Mail Relay

The Sambar web server is running and the 'mailit.pl' cgi is installed. This CGI takes a POST request from any host and sends a mail to a supplied address. %NASLMINLEVEL 70300 Copyright 2000 by Hendrik Scholz Changes by Tenable: - Revised plugin title 4/2/2009 - Updated to use compat.inc, added CV...

spin_client.cgi Remote Overflow

There is a buffer overrun in the 'spinclient.cgi' CGI program, which will allow anyone to execute arbitrary commands with the same privileges as the web server root or nobody. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Thanks to Tollef Fog Heen for his help include 'compat.inc' ;...

Microsoft IIS repost.asp File Upload

The script '/scripts/repost.asp' is installed on the remote IIS web server and allows an attacker to upload arbitrary files to the '/Users' directory if it has not been configured properly. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Script audit and contributions from Carmichael Securit...

Первый российский антивирус для Firewall!

No description provided...

rpm_query CGI System Information Disclosure

The rpmquery CGI is installed. This CGI allows anyone who can connect to this web server to obtain the list of the installed RPMs. This allows an attacker to determine the version number of your installed services, hence making their attacks more accurate. %NASLMINLEVEL 70300 C Tenable Network...

Sambar Server Multiple Script Arbitrary Code Execution

At least one of these CGI scripts is installed : hello.bat echo.bat They allow any attacker to execute commands with the privileges of the web server process. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid10246;...

frontpage.doubledot.txt

Description: Doubledot bug in FrontPage FrontPage Personal Web Server. Compromise: Accessing drive trough browser. Vulnerable Systems: Frontpage-PWS32/3.0.2.926 other versions not tested. Details: When FrontPage-PWS runs a site on your c:\ drive your drive could be = accessed by any user accessin...

metasearch

Vulnerable Program: Meta Tag Generator meta.pl Platform : UNIX Company : www.cgi-access.com Impact : Remote users can view arbitary files with httpd privilidges Found by : slackette [email protected] Date : 14th November Meta Tag Generator As quoted from their site, "You can now offer your...

Vermillion FTPD Long CWD Commands DoS

It was possible to make the remote FTP server crash by issuing the commands : CWD CWD CWD Where is longer than 504 chars. An attacker can use this problem to prevent your FTP server from working properly, thus preventing legitimate users from using it. C Tenable Network Security, Inc...

Microsoft SQL Server TCP/IP Listener Detection

The remote host is running MSSQL, a database server from Microsoft. It is possible to extract the version number of the remote installation from the server pre-login response. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10144; scriptversion"1.63";...

Sendmail decode Alias Arbitrary File Overwrite

The remote SMTP server seems to pipe mail sent to the 'decode' alias to a program. There have been in the past a lot of security problems regarding this, as it would allow an attacker to overwrite arbitrary files on the remote server. We suggest you deactivate this alias. C Tenable Network...

Sendmail mail from/rcpt to Pipe Arbitrary Command Execution

The remote SMTP server did not complain when issued the command : MAIL FROM: root@thishost RCPT TO: |testing This probably means that it is possible to send mail directly to programs, which is a serious threat, since this allows anyone to execute arbitrary commands on this host. This security hol...

HylaFAX faxsurvey Arbitrary Command Execution

The 'faxsurvey' CGI does not sanitize input to the query string. A remote attacker could exploit this to execute arbitrary commands. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; ifdescription scriptid10067; scriptversion"1.45";...

O'Reilly WebSite uploader.exe Arbitrary File Upload

The remote web server contains a CGI script named 'uploader.exe' in '/cgi-win'. Versions of O'Reilly's Website product before 1.1g included a script with this name that allows an attacker to upload arbitrary CGI and then execute them. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

WinGate Telnet Proxy localhost Connection Saturation DoS

The remote Wingate service can be forced to connect to itself continually until it runs out of buffers. When this happens, the telnet proxy service will be disabled. An attacker may block your telnet proxy this way, thus preventing your system from working properly if you need telnet. An attacker...

Finger Recursive Request Arbitrary Site Redirection

The remote finger service accepts redirect requests. That is, users can perform requests like : finger user@host@victim This allows an attacker to use this computer as a relay to gather information on a third-party network. In addition, this type of syntax can be used to create a denial of servic...

Anonymous FTP Writable root Directory

It is possible to write on the root directory of the remote anonymous FTP server. This allows an attacker to upload arbitrary files which can be used in other attacks, or to turn the FTP server into a software distribution point. TRUSTED...

Multiple Mail Server EXPN/VRFY Information Disclosure

The remote SMTP server answers to the EXPN and/or VRFY commands. The EXPN command can be used to find the delivery address of mail aliases, or even the full name of the recipients, and the VRFY command may be used to check the validity of an account. Your mailer should not allow remote users to u...

WFTP Unpassworded Guest Account

The remote FTP server accepts any user/password combination. This can allow remote attackers to access the FTP account, which can lead to information disclosure and uploads of arbitrary files on the remote host. C Tenable Network Security, Inc. include 'compat.inc' ; if description scriptid10305;...