eGroupWare_infoleak.txt

MasterMind Security Group, Inc. Security Brief Date: April 7, 2005 Contact: Gerald Quakenbush Severity: Moderate to Serious Product: Confirmed in eGroupWare 1.001 and 1.006 Synopsis ======== The eGroupWare open-source software www.egroupware.org has a flaw that could expose confidential...

eGroupWare Leaks Files

MasterMind Security Group, Inc. Security Brief Date: April 7, 2005 Contact: Gerald Quakenbush geraldq AT mastermindsecuritygroup.com Severity: Moderate to Serious Product: Confirmed in eGroupWare 1.001 and 1.006 Synopsis ======== The eGroupWare open-source software www.egroupware.org has a flaw...

CVE-2002-1644

SSH Secure Shell for Servers and SSH Secure Shell for Workstations 2.0.13 through 3.2.1, when running without a PTY, does not call setsid to remove the child process from the process group of the parent process, which allows attackers to gain certain privileges...

CVE-2003-1070: Undefined Security Weakness

Unknown vulnerability in rpcbind for Solaris 2.6 through 9 allows remote attackers to cause a denial of service rpcbind crash...

CVE-2003-1069: Undefined Security Weakness

The Telnet daemon in.telnetd for Solaris 2.6 through 9 allows remote attackers to cause a denial of service CPU consumption by infinite loop...

CVE-2003-1067: Undefined Security Weakness

Multiple buffer overflows in the 1 dbmopen function, as used in ndbm and dbm, and the 2 dbminit function in Solaris 2.6 through 9 allow local users to gain root privileges via long arguments to Xsun or other programs that use these functions...

CVE-2004-1124: Undefined Security Weakness

Unknown vulnerability in chroot on SCO UnixWare 7.1.1 through 7.1.4 allows local users to escape the chroot jail and conduct unauthorized activities...

CVE-2001-1328: Undefined Security Weakness

Buffer overflow in ypbind daemon in Solaris 5.4 through 8 allows remote attackers to execute arbitrary code...

CVE-2004-0651: Undefined Security Weakness

Unknown vulnerability in Sun Java Runtime Environment JRE 1.4.2 through 1.4.203 allows remote attackers to cause a denial of service virtual machine hang...

CVE-2003-1026: Undefined Security Weakness

Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back back function is called, as demonstrated by BackToFramedJpu, aka th...

CVE-2003-1027: Undefined Security Weakness

Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching SaveRef to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different...

CVE-2003-0660: Undefined Security Weakness

The Authenticode capability in Microsoft Windows NT through Server 2003 does not prompt the user to download and install ActiveX controls when the system is low on memory, which could allow remote attackers to execute arbitrary code without user approval...

CVE-2003-0809: Undefined Security Weakness

Internet Explorer 5.01 through 6.0 does not properly handle object tags returned from a Web server during XML data binding, which allows remote attackers to execute arbitrary code via an HTML e-mail message or web page...

CVE-2002-0687: Undefined Security Weakness

The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers...

CVE-1999-1571: Undefined Security Weakness

Buffer overflow in sar for SCO OpenServer 5.0.0 through 5.0.5 may allow local users to gain root privileges via a long -f parameter, a different vulnerability than CVE-1999-1570...

CVE-2002-0370: Undefined Security Weakness

Buffer overflow in the ZIP capability for multiple products allows remote attackers to cause a denial of service or execute arbitrary code via ZIP files containing entries with long filenames, including 1 Microsoft Windows 98 with Plus! Pack, 2 Windows XP, 3 Windows ME, 4 Lotus Notes R4 through R...

CVE-2002-0399: Undefined Security Weakness

Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary files during archive extraction via a 1 "/.." or 2 "./.." string, which removes the leading slash but leaves the "..", a variant of CVE-2001-1267...

CVE-2002-0797: Undefined Security Weakness

Buffer overflow in the MIB parsing component of mibiisa for Solaris 5.6 through 8 allows remote attackers to gain root privileges...

PT-2002-1712

Name of the Vulnerable Software and Affected Versions Zope versions 2.0 through 2.5.1 b1 Description The issue allows untrusted users to shut down the Zope server via certain headers, specifically when using the "through the web code" capability. This is caused by a vulnerability that can be...

CVE-2002-0371: Undefined Security Weakness

Buffer overflow in gopher client for Microsoft Internet Explorer 5.1 through 6.0, Proxy Server 2.0, or ISA Server 2000 allows remote attackers to execute arbitrary code via a gopher:// URL that redirects the user to a real or simulated gopher server that sends a long response...