Multiple Vulns in Psychoblogger beta1

--------------------------------------- Title: Multiple vulnerabilities in Psychoblogger CMS package Package description From vendor website: "This is a PHP/MySQL blogging tool with many features." Vendor website: http://www.psychoblogger.com Affected versions: To the best of my knowlege, there i...

IISProtect 2.1/2.2 - Web Administration Interface SQL Injection

source: https://www.securityfocus.com/bid/7675/info The IISProtect web administration interface does not properly sanitize user input. This could allow for SQL injection attacks on a Microsoft IIS server running IISProtect. Successful exploitation could result in a compromise of the IISProtect...

CVE-2002-0700

Buffer overflow in a system function that performs user authentication for Microsoft Content Management Server MCMS 2001 allows attackers to execute code in the Local System context by authenticating to a web page that calls the function, aka "Unchecked Buffer in MDAC Function Could Enable SQL...

CVE-2002-0364

Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise."...

CVE-2002-0364

CVE-2002-0364 describes a heap-based buffer overflow in IIS 4.0/5.0 when processing chunked-encoded HTR requests via the HTR ISAPI extension, allowing an attacker to execute arbitrary code with the privileges of the ISAPI process. The vulnerability stems from chunked encoding handling; impact inc...

CVE-2002-0700

This CVE concerns Microsoft Content Management Server (MCMS) 2001, where a buffer overflow in the Profile Service (an MDAC-related function used during user authentication) can allow an attacker to execute code in the Local System context by authenticating to a vulnerable web page. The issue is c...

CuteNews 0.88 - 'comments.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/6935/info CuteNews is prone to an issue that may allow remote attackers to include files located on remote servers. Under some circumstances, it is possible for remote attackers to influence the include path for several include files to point to an extern...

ghttpd 1.4.x - Log() Remote Buffer Overflow

ghttpd 1.4.x - Log Remote Buffer Overflow // source: https://www.securityfocus.com/bid/5960/info A buffer overflow has been reported in ghttpd which will allow arbitrary code to be executed with the privileges of the webserver. The overflow occurs when the argument to a 'GET' request is of...

Security Bulletin MS02-041: Unchecked Buffer in Content Management Server Could Enable Server Compromise (Q326075)

---------------------------------------------------------------------- Title: Unchecked Buffer in Content Management Server Could Enable Server Compromise Q326075 Date: 07 August 2002 Software: Microsoft Content Management Server Impact: Three vulnerabilities, the most serious of which could...

Security Bulletin MS02-040: Unchecked Buffer in MDAC Function Could Enable SQL Server Compromise (Q326573)

---------------------------------------------------------------------- Title: Unchecked Buffer in MDAC Function Could Enable SQL Server Compromise Q326573 Date: 31 July 2002 Software: Microsoft Data Access Components Impact: Run code of attacker's choice Max Risk: Moderate Bulletin: MS02-040...

Security Advisory: Vulnerability in PHP versions 4.2.0 and 4.2.1

PHP Security Advisory: Vulnerability in PHP versions 4.2.0 and 4.2.1 Issued on: July 22, 2002 Software: PHP versions 4.2.0 and 4.2.1 Platforms: All The PHP Group has learned of a serious security vulnerability in PHP versions 4.2.0 and 4.2.1. An intruder may be able to execute arbitrary code with...

MFC ISAPI Framework Buffer Overflow

Systems Affected: All ISAs written using MFC ISAPI framework Issue: User-input length values can result in a buffer overflow. Risk: Critical Scope: Remote Server Compromise The MFC ISAPI framework is widely used to build ISAs that run on a multitude of web servers. It has been discovered that the...

Re: MFC ISAPI Framework Buffer Overflow

In-Reply-To: [email protected] BadBlue and all vendors who wrote ISAPI extensions with MFC should recompile with Visual Studio 6.0 SP4 or later. There were serious problems with many ISAPI extensions built with earlier versions of the MFC libraries. 2 problems are documente...

CVE-2002-0364

Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise."...

Security Bulletin MS02-028: Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise (Q321599)

---------------------------------------------------------------------- Title: Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise Q321599 Date: 12 June 2002 Software: Internet Information Server Impact: Run Code of Attacker's Choice Max Risk: Moderate Bulletin: MS02-028...

CORE-20011001: Wu-FTP glob heap corruption vulnerability

CORE Security Technologies http://www.corest.com Vulnerability Report For WU-FTPD Server Date Published: 2001-11-28 Last Update: 2001-11-28 Advisory ID: CORE-20011001 Bugtraq ID: 3581 CVE CAN: None currently assigned Title: WU-FTPD Improper Ftpglob Error Handling Vulnerability Class: Failure to...

New getAccess[tm] Vulnerability

Good Morning Listmembers, this is another postingsee 1st here http://www.securityfocus.com/bid/3109 about Entrust s "getAccesstm" product Problem Description: "getAccesstm" still uses default shellscripts which start java-classes for their web-applications. due to missing input-validation it is...

CVE-2000-0954

Shambala Server 4.5 stores passwords in plaintext, enabling local users to obtain passwords and compromise the server. The provided documents do not specify remediation or affected versions beyond 4.5; exploitation details are not described.

Компрометация сервера через URL (URL javascript)

В URL специального вида можно включить javascript, который будет передан атакуемым сервером клиенту. Таким образом можно в контексте клдиента получить доступ к атакуемому серверу...

Security Update for Microsoft .NET Framework 4 on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2 for Itanium-based Systems (KB2518870)

A security issue has been identified that could allow an attacker to compromise your Windows-based system that is running the Microsoft .NET Framework and gain complete control over it. You can help protect your computer by installing this update from Microsoft. After you install this item, you m...