CVE-2008-2406

The CVE-2008-2406 issue affects Sun Java System Active Server Pages (ASP) Server prior to 4.0.3. The vulnerability allows remote attackers to bypass authentication by sending direct requests to the administration server, which listens on TCP port 5102, enabling unauthorized access to the administ...

CVE-2008-2404

CVE-2008-2404 affects Sun Java System Active Server Pages (ASP) Server prior to 4.0.3. The issue is a stack-based buffer overflow in the request handling code that allows remote code execution via an unspecified string field. Exploitation is described as possible from the web context, with no aut...

CVE-2008-2404

Stack-based buffer overflow in the request handling implementation in Sun Java Active Server Pages ASP Server before 4.0.3 allows remote attackers to execute arbitrary code via an unspecified string field...

CVE-2008-2405

Sun Java Active Server Pages ASP Server before 4.0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in HTTP requests to unspecified ASP applications...

CVE-2008-2403

Multiple directory traversal vulnerabilities in unspecified ASP applications in Sun Java Active Server Pages ASP Server before 4.0.3 allow remote attackers to read or delete arbitrary files via a .. dot dot in the Path parameter to the MapPath method...

CVE-2008-2401

The Admin Server in Sun Java Active Server Pages ASP Server before 4.0.3 allows remote attackers to append to arbitrary new or existing files via the first argument to a certain file that is included by multiple unspecified ASP applications...

CVE-2008-2406

The administration application server in Sun Java Active Server Pages ASP Server before 4.0.3 allows remote attackers to bypass authentication via direct requests on TCP port 5102...

CVE-2008-2402

CVE-2008-2402 involves Sun Java System Active Server Pages (ASP) Server prior to 4.0.3. The Admin Server stores sensitive information under the web root with insufficient access control, allowing remote attackers to read password hashes and configuration data via direct requests for unspecified d...

CVE-2008-2403

Sun Java System Active Server Pages (ASP) Server before 4.0.3 contains multiple directory traversal vulnerabilities in ASP applications that allow remote attackers to read or delete arbitrary files by supplying a dot-dot sequence in the Path parameter to MapPath. Affected software is the Sun Java...

Code injection

The Sun Cluster Global File System in Sun Cluster 3.1 on Sun Solaris 8 through 10, when an underlying ufs filesystem is used, might allow local users to read data from arbitrary deleted files, or corrupt files in global filesystems, via unspecified vectors...

CVE-2008-2539

The Sun Cluster Global File System in Sun Cluster 3.1 on Sun Solaris 8 through 10, when an underlying ufs filesystem is used, might allow local users to read data from arbitrary deleted files, or corrupt files in global filesystems, via unspecified vectors...

CVE-2008-2538

Unspecified vulnerability in crontab on Sun Solaris 8 through 10, and OpenSolaris before snv93, allows local users to insert cron jobs into the crontab files of arbitrary users via unspecified vectors...

CVE-2008-2539

The CVE-2008-2539 issue concerns the Sun Cluster Global File System within Sun Cluster 3.1 on Solaris 8–10 that uses an underlying UFS filesystem. The vulnerability describes that local users may read data from arbitrarily deleted files or corrupt files in global filesystems via unspecified vecto...

CVE-2008-2538

CVE-2008-2538 affects Sun Solaris 8–10 and OpenSolaris before snv_93. The vulnerability allows a local user to insert cron jobs into arbitrary users’ crontab files via unspecified vectors, due to an unspecified flaw in crontab handling. Impact is local privilege escalation (crontab modification f...

CVE-2008-2538

Unspecified vulnerability in crontab on Sun Solaris 8 through 10, and OpenSolaris before snv93, allows local users to insert cron jobs into the crontab files of arbitrary users via unspecified vectors...

CVE-2008-2539

The Sun Cluster Global File System in Sun Cluster 3.1 on Sun Solaris 8 through 10, when an underlying ufs filesystem is used, might allow local users to read data from arbitrary deleted files, or corrupt files in global filesystems, via unspecified vectors...

CVE-2008-2518

CVE-2008-2518 is an XSS vulnerability in Sun Java System Web Server 6.1 before SP9 and 7.0 before Update 3, affecting the advanced search (webapps/search/advanced.jsp). The underlying issue is an HTML/script injection via unspecified vectors (likely related to the next parameter). Exploitation de...

Solaris 10 (sparc) : 137019-02

SunOS 5.10: snmpXdmid patch. Date this patch was last updated by Sun : Jun/11/08 %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if ! definedfunc"bnrandom...

Sun Java系统Web服务器高级搜素机制跨站脚本漏洞

BUGTRAQ ID: 29355 Sun Java System Web Server是高性能的WEB服务器。 Sun Java系统Web服务器的高级搜素机制没有正确地过滤某些用户输入，远程非特权可以通过提交恶意搜索请求执行跨站脚本攻击，导致用户在客户端的web浏览器中执行任意JavaScript命令，这可能允许远程用户窃取cookie信息、劫持会话或导致损失数据保密性。 Sun Java System Web Server 7.0 Update 2 Sun Java System Web Server 7.0 Update 1 Sun Java System Web Server 7...

CA ARCserve Backup xdr_rwsstring buffer overflow

Added: 05/27/2008 CVE: CVE-2008-2242 BID: 29283 OSVDB: 45368 Background CA ARCserve Backup formerly BrightStor ARCserve Backup is a backup and recovery solution. It runs several services which use the SUN Remote Procedure Call SUN-RPC protocol. SUN-RPC messages are defined using the External Data...