CVE-2002-2103

CVE-2002-2103 affects Apache before 1.3.24. When writing to the log file, Apache may record a spoofed hostname from reverse DNS for an IP address, even if a double-reverse lookup fails, allowing remote attackers to hide the original source of activities. The provided documents do not include expl...

CVE-2001-1556

Technical details for CVE-2001-1556 are not publicly provided in the connected documents. Monitor for updates.

CVE-2001-1519

RunAs runas.exe in Windows 2000 allows local users to create a spoofed named pipe when the service is stopped, then capture cleartext usernames and passwords when clients connect to the service. NOTE: the vendor disputes this issue, saying that administrative privileges are already required to...

VoIP-Phones: Weakness in proccessing SIP-Notify-Messages

Tele-Consulting GmbH security | networking | training advisory 05/07/06 URL of this advisory: http://pentest.tele-consulting.com/advisories/050706voip-phones.txt Topic: Weakness in implemenation of proccessing SIP-Notify-Messages in VoIP-Phones. Summary: Due to ignoring the value of 'Call-ID' and...

Cisco VoIP Phone CP-7940 3.x - Spoofed SIP Status Message Handling

source: https://www.securityfocus.com/bid/14174/info Multiple Vendor VoIP Phones handle spoofed SIP status messages in an improper manner. This issue could potentially lead a to a denial of service condition against a server. The issue arises because the affected phones do not verify the 'Call-ID...

kernel -- TCP connection stall denial of service

Problem Description Two problems have been discovered in the FreeBSD TCP stack. First, when a TCP packets containing a timestamp is received, inadequate checking of sequence numbers is performed, allowing an attacker to artificially increase the internal "recent" timestamp for a connection. Secon...

CVE-2002-1790

CVE-2002-1790 affects the SMTP service in Microsoft IIS 4.0/5.0, where the root cause is bypassing anti-relaying rules by using encapsulated SMTP addresses, enabling remote attackers to send spam or spoofed messages. This CVE is linked to the prior CVE-1999-0682 remediation lineage. The connected...

CVE-2002-1790

The SMTP service in Microsoft Internet Information Services IIS 4.0 and 5.0 allows remote attackers to bypass anti-relaying rules and send spam or spoofed messages via encapsulated SMTP addresses, a similar vulnerability to CVE-1999-0682...

Mandrake Linux Security Advisory : squid (MDKSA-2005:104)

A bug was found in the way that Squid handles DNS replies. If the port Squid uses for DNS requests is not protected by a firewall, it is possible for a remote attacker to spoof DNS replies, possibly redirecting a user to spoofed or malicious content. %NASLMINLEVEL 70300 C Tenable Network Security...

MS05-029: Vulnerability in Exchange Server 5.5 Outlook Web Access XSS (895179)

The remote host is running a version of the Outlook Web Access that is affected by a cross-site scripting flaw. This vulnerability could allow an attacker to convince a user to run a malicious script. If this malicious script is run, it would execute in the security context of the user. Attempts ...

PT-2005-1107

Name of the Vulnerable Software and Affected Versions Microsoft Terminal Server using Remote Desktop Protocol RDP 5.2 Description The issue concerns the storage of an RSA private key in mstlsapi.dll, which is used to sign a certificate. This allows remote attackers to spoof public keys of...

CVE-2005-0356

Multiple TCP implementations with Protection Against Wrapped Sequence Numbers PAWS with the timestamps option enabled allow remote attackers to cause a denial of service connection loss via a spoofed packet with a large timer value, which causes the host to discard later packets because they appe...

CVE-2005-0356

Multiple TCP implementations with Protection Against Wrapped Sequence Numbers PAWS with the timestamps option enabled allow remote attackers to cause a denial of service connection loss via a spoofed packet with a large timer value, which causes the host to discard later packets because they appe...

TCP TIMESTAMPS Denial of Service Exploit

Exploit for multiple platform in category dos / poc ======================================== TCP TIMESTAMPS Denial of Service Exploit ======================================== / TCP does not adequately validate segments before updating timestamp value http://www.kb.cert.org/vuls/id/637934 RFC-1323...

TCP TIMESTAMPS Denial of Service Exploit

No description provided by source. / TCP does not adequately validate segments before updating timestamp value http://www.kb.cert.org/vuls/id/637934 RFC-1323 TCP Extensions for High Performance 4.2.1 defines how the PAWS algorithm should drop packets with invalid timestamp options: R1 If there is...

TCP TIMESTAMPS - Denial of Service

/ TCP does not adequately validate segments before updating timestamp value http://www.kb.cert.org/vuls/id/637934 RFC-1323 TCP Extensions for High Performance 4.2.1 defines how the PAWS algorithm should drop packets with invalid timestamp options: R1 If there is a Timestamps option in the arrivin...

CVE-2005-1504

The CVE-2005-1504 entry concerns GameSpy SDK CD-Key Validation Toolkit. The vulnerability is a remote bypass of CD-key validation by sending a spoofed \disc\ command, causing the server to believe the CD key is no longer in use. Affected component: the CD-key validation mechanism within the GameS...

CVE-2005-1504

GameSpy SDK CD-Key Validation Toolkit, as used by many online games, allows remote attackers to bypass the CD key validation by sending a spoofed \disc\ command, which tells the server the CD key is no longer in use...

CVE-2005-1504

GameSpy SDK CD-Key Validation Toolkit, as used by many online games, allows remote attackers to bypass the CD key validation by sending a spoofed \disc\ command, which tells the server the CD key is no longer in use...

CVE-2004-1799

CVE-2004-1799 describes a vulnerability in PF (packet filter) on certain OpenBSD versions where, when stateful filtering is enabled, packets for a session are not limited to the original interface. This allows a remote attacker to bypass intended packet filters by sending spoofed packets to other...