PHP-Nuke v5.6 - Users can compromise admin accts.

Tested on PHP-Nuke v5.6 with Mozilla on Linux should work on past versions and on most browsers Impact: --------------------------------------------- Allows any user to get admin access to a PHP-Nuke site. Summary: ---------------------------------------------- Due to a XSS flaw in PHPNuke's...

BlueFace Falcon Web Server 2.0 - Error Message Cross-Site Scripting

source: https://www.securityfocus.com/bid/5435/info Falcon Webserver does not sufficiently sanitize HTML tags from error message output. In particular, attackers may inject HTML into 301 and 404 error pages. It is possible to create a malicious link to the server which will generate an error page...

CVE-2002-0146

fetchmail email client before 5.9.10 does not properly limit the maximum number of messages available, which allows a remote IMAP server to overwrite memory via a message count that exceeds the boundaries of an array...

3CDaemon 2.0 - Buffer Overflow (1)

3CDaemon 2.0 - Buffer Overflow 1 // source: https://www.securityfocus.com/bid/4638/info 3CDaemon is an FTP server developed by Dan Gill of 3Com. Reportedly, it is possible to initiate a buffer overflow on a host running 3CDaemon. Submitting an unusually large amount of data to the ftp server, cou...

Qualcomm QPopper 4.0.x - Remote Denial of Service

source: https://www.securityfocus.com/bid/4295/info Qualcomm's QPopper is a POP3 mail server for Linux and Unix based systems. Recent versions of QPopper have been released as open source projects. A vulnerability has been reported in some versions of qpopper. Reportedly, if a string of longer th...

CVE-2001-1009

Fetchmail aka fetchmail-ssl before 5.8.17 allows a remote malicious 1 IMAP server or 2 POP/POP3 server to overwrite arbitrary memory and possibly gain privileges via a negative index number as part of a response to a LIST request...

BrowseFTP Client 1.62 - Remote Buffer Overflow

BrowseFTP Client 1.62 - Remote Buffer Overflow source: https://www.securityfocus.com/bid/3781/info BrowseFTP is an ftp client that runs on various Microsoft Windows operating systems. An issue has been reported which could allow for a malicious ftp server to execute arbitrary code on a BrowseFTP...

CVE-2001-0901

Hypermail allows remote attackers to execute arbitrary commands on a server supporting SSI via an attachment with a .shtml extension, which is archived on the server and can then be executed by requesting the URL for the attachment...

advisory

------------ advisory ------------ name: eshop Online-Shop System author: WEBDISCOUNT, Inh. Michael Boehme Problem: Script doesnt check for symbol ";". any user can execute any nix commands on webserver. exploit: host/cgi-bin/eshop.pl?seite=;ls| ex...

CVE-2001-1009

Fetchmail aka fetchmail-ssl before 5.8.17 allows a remote malicious 1 IMAP server or 2 POP/POP3 server to overwrite arbitrary memory and possibly gain privileges via a negative index number as part of a response to a LIST request...

Microsoft IIS 4.0/5.0 - SSI Buffer Overrun Privilege Escalation

// source: https://www.securityfocus.com/bid/3190/info A vulnerability exists in Microsoft IIS 4.0 and 5.0 that could allow a user with permission to write content to the IIS server to run any code in Local System context. / jim.c - IIS Server Side Include exploit by Indigo 2001 Usage: jim This...

ADV: Quake 3 Arena 1.29f/g Vulnerability

-------------------------------------- :: Q30wnerz Advisory v1.0 - PUBLIC :: written by ttol -------------------------------------- :: Quake 3 Arena 1.29f/g Vulnerability -------------------------------------- ----------- :: Summary ----------- There exists a very large hole in Quake 3 Arena,...

cesarFTP v0.98b 'HELP' buffer overflow

DESCRIPTION CesarFTP v0.98b is vulnerable to a buffer overflow when sending the HELP command followed by a very long string of characters. Example : Sending the following perl string : "HELP " . "A" x 1978 . "CCCCx00x0Dx0A" Happily reroutes the SERVER.EXE EIP to 43434343 "CCCC". This way, anyone...

WebTrends Enterprise Reporting Server 3.1 c3.5 - Source Code Disclosure

WebTrends Enterprise Reporting Server 3.1 c3.5 - Source Code Disclosure source: https://www.securityfocus.com/bid/2812/info WebTrends Live is a web-based reporting service which provides interactive tracking of usage statistics and E-commerce revenue. It is possible to view the source code of...

ACLogic CesarFTP 0.98b - Directory Traversal

source: https://www.securityfocus.com/bid/2786/info CesarFTP is a freely available FTP Server for Microsoft Windows 9x/ME systems. CesarFTP on Windows 98/Me platforms contains a 'directory traversal' vulnerability. If a user requests to change directories to "..." from within a mapped directory,...

ACLogic CesarFTP 0.98b - Directory Traversal

ACLogic CesarFTP 0.98b - Directory Traversal source: https://www.securityfocus.com/bid/2786/info CesarFTP is a freely available FTP Server for Microsoft Windows 9x/ME systems. CesarFTP on Windows 98/Me platforms contains a 'directory traversal' vulnerability. If a user requests to change...

ISC BIND 8.2.x - TSIG Remote Stack Overflow (3)

ISC BIND 8.2.x - TSIG Remote Stack Overflow 3 / copyright LAST STAGE OF DELIRIUM feb 2001 poland ://lsd-pl.net/ / / bind 8.2 8.2.1 8.2.2 8.2.2-PX Solaris 2.7 x86 / / The code establishes a TCP connection with port 53 of a target system. / / It makes use of the "infoleek" bug through UDP to obtain...

CVE-2000-1110

document.d2w CGI program in the IBM Net.Data db2www package allows remote attackers to determine the physical path of the web server by sending a nonexistent command to the program...

Bypass MDaemon 3.5.1 "Lock Server" Protection

Ok, This is my second post in the years and I have been reading all your postings so far. You all are doing a great job indeed. I would like to point out a security problem in MDaemon mail server even in ver 3.5.1 the latest. My setup: Windows NT 4.0 server SP 6.0a MDaemon Pro ver 3.5.1 The lates...

phpix 1.0 - Directory Traversal

phpix 1.0 - Directory Traversal source: https://www.securityfocus.com/bid/1773/info PHPix is a web-based photo-album system written in PHP. It is vulnerable to an attack that allows a malicious remote user to view arbitrary files on the target webserver with the privileges of the webserver. The...