CVE-2006-2790

A package component in Sun Storage Automated Diagnostic Environment StorADE 2.4 uses world-writable permissions for certain critical files and directories, which allows local users to gain privileges...

CVE-2006-2790

A package component in Sun Storage Automated Diagnostic Environment StorADE 2.4 uses world-writable permissions for certain critical files and directories, which allows local users to gain privileges...

CVE-2006-2790

Technical details about CVE-2006-2790 are not publicly available in the provided documents; StorADE 2.4 is described to use world-writable permissions, but no vendor/version/fix information is provided here. Monitor for updates.

CVE-2006-2614

Sun N1 System Manager 1.1 for Solaris 10 before patch 121161-01 records system passwords in the world-readable scripts 1 /cr/hdjobsdb.sh, 2 /cr/hdplancheckin.sh, and 3 /cr/oracleplancheckin.sh, which allows local users to obtain System Manager passwords...

CVE-2003-1301

CVE-2003-1301 affects Sun Java Runtime Environment (JRE) 1.x before 1.4.2_11 and 1.5.x before 1.5.0_06 (and usage in multiple web browsers), where deeply nested object arrays are not properly handled by the garbage collector, enabling remote denial of service (application crash) via invalid memor...

CVE-2006-2614

The CVE-2006-2614 entry concerns Sun N1 System Manager 1.1 running on Solaris 10 before patch 121161-01. The flaw arises because /cr/hd_jobs_db.sh, /cr/hd_plan_checkin.sh, and /cr/oracle_plan_checkin.sh store System Manager passwords in world-readable scripts, enabling local users to obtain passw...

CVE-2006-2614

Sun N1 System Manager 1.1 for Solaris 10 before patch 121161-01 records system passwords in the world-readable scripts 1 /cr/hdjobsdb.sh, 2 /cr/hdplancheckin.sh, and 3 /cr/oracleplancheckin.sh, which allows local users to obtain System Manager passwords...

Sun Server Console Authentication Bypass

The remote host is running the Sun ONE Server Console, which provides an administrative interface to the Sun Java System Directory Server installed there. The Server Console instance on the remote host allows authentication using a default set of credentials - 'admin' / 'admin'. This is likely th...

CVE-2005-4804

Technical details about CVE-2005-4804 are not publicly available in the provided documents. Monitor for updates.

CVE-2005-4804

Unspecified vulnerability in Sun Java System Application Server Platform Edition and Enterprise Edition 8.1 2005 Q1, and Platform Edition UR1, allows remote attackers to read .jar files via unknown vectors related to deployed web applications...

CVE-2005-4806

CVE-2005-4806 affects Sun Java System Web Proxy Server 3.6 SP7 and earlier. The vulnerability is described as multiple unspecified remote vulnerabilities that allow an attacker to cause a denial of service (unresponsive service) via unknown vectors. The provided sources identify the affected prod...

CVE-2005-4805

Unspecified vulnerability in Sun Java System Application Server 7 Standard and Platform Edition 6 and earlier, and 2004Q2 Standard and Platform Edition Update 2 and earlier, allows remote attackers to obtain the source code for Java Server pages JSP via unknown vectors...

CVE-2005-4806

Multiple unspecified vulnerabilities in Sun Java System Web Proxy Server 3.6 SP7 and earlier allow remote attackers to cause a denial of service unresponsive service via unknown vectors...

CVE-2005-4805

Technical details about CVE-2005-4805 are not publicly available in the provided documents; no specifics on affected product versions, vectors, or fixes are provided. Monitor for updates.

Write-up by Amit Klein: "IE + some popular forward proxy servers = XSS, defacement (browser cache poisoning)"

IE + some popular forward proxy servers = XSS, defacement browser cache poisoning Or "Exploiting the XmlHttpRequest object in IE" part II Amit Klein, May 2006 Preface ======= When I published my Exploiting the XmlHttpRequest object in IE - Referrer spoofing and a lot more..." 1 paper, I only...

CVE-2006-2539

CVE-2006-2539 : Sybase EAServer exposes cleartext passwords entered in GUI. Local users can recover passwords via javax.swing.JPasswordField.getSelectedText. Affected products/versions: EAServer 5.0 on HP-UX Itanium; 5.2 on IBM AIX, HP-UX PA-RISC, Linux x86, Sun Solaris SPARC; 5.3 on Sun Solaris ...

CVE-2006-2513

Unspecified vulnerability in the installation process in Sun Java System Directory Server 5.2 causes wrong user data to be written to a file created by the installation, which allows remote attackers or local users to gain privileges...

CVE-2006-2513

Sun Java System Directory Server 5.2 contains a flaw in the installation process that writes incorrect user data to a file created during installation, enabling privilege elevation for remote attackers or local users. The connected Nessus entry (Sun Server Console Authentication Bypass) notes a d...

CVE-2006-2513

Unspecified vulnerability in the installation process in Sun Java System Directory Server 5.2 causes wrong user data to be written to a file created by the installation, which allows remote attackers or local users to gain privileges...

Cross site scripting

Cross-site scripting XSS vulnerability in Sun ONE Web Server 6.0 SP9 and earlier, Java System Web Server 6.1 SP4 and earlier, Sun ONE Application Server 7 Platform and Standard Edition Update 6 and earlier, and Java System Application Server 7 2004Q2 Standard and Enterprise Edition Update 2 and...