Sun Solaris DTrace动态追踪框架信息泄露漏洞

BUGTRAQ ID: 27942 Solaris是一款由Sun开发和维护的商业性质UNIX操作系统。 Solaris 10 DTrace（请见dtrace1M）动态追踪框架中的安全漏洞可能允许给予了PRIVDTRACEUSER或PRIVDTRACEPROC权限（请见privileges5）的本地用户或非全局区执行一些内核级追踪，然后这些用户就可以访问敏感信息。 Sun Solaris 10x86 Sun Solaris 10.0 临时解决方法：...

Design/Logic Flaw

Unspecified vulnerability in the dynamic tracing framework DTrace in Sun Solaris 10 allows local users with PRIVDTRACEUSER or PRIVDTRACEPROC privileges to obtain sensitive kernel information via unspecified vectors, a different vulnerability than CVE-2007-4126...

Design/Logic Flaw

Unspecified vulnerability in the dynamic tracing framework DTrace on Sun Solaris 10 before 20070730 allows local users with PRIVDTRACEUSER privileges to cause a denial of service panic or hang via unspecified use of certain DTrace programs...

Cross site scripting

Mbedthis AppWeb before 2.2.2 enables the HTTP TRACE method, which has unspecified impact probably related to remote information leaks and cross-site tracing XST attacks, a related issue to CVE-2004-2320 and CVE-2005-3398...

CVE-2007-3008

Mbedthis AppWeb before 2.2.2 enables the HTTP TRACE method, which has unspecified impact probably related to remote information leaks and cross-site tracing XST attacks, a related issue to CVE-2004-2320 and CVE-2005-3398...

CVE-2007-3008

Mbedthis AppWeb before 2.2.2 enables the HTTP TRACE method, which has unspecified impact probably related to remote information leaks and cross-site tracing XST attacks, a related issue to CVE-2004-2320 and CVE-2005-3398...

security flaw

The selinuxptrace logic in hooks.c in SELinux for Linux 2.6.6 allows local users with ptrace permissions to change the tracer SID to an SID of another process...

Technical Note by Amit Klein: "XST Strikes Back"

Technical note XST Strikes Back or perhaps "Return from the Proxy"... Amit Klein, January 2006 Introduction ============ About three years ago, the concept of "Cross Site Tracing" 1 was introduced to the web application security community. In essence, the classic XST is about amplifying an existi...

Crossite browsing tracing attacks

Multiple browsing components allow to trace user browsing and to gather different information about user...

IIS ASP.NET Application Trace Enabled

The ASP.NET web application running in the root directory of this web server has application tracing enabled. This would allow an attacker to view the last 50 web requests made to this server, including sensitive information like Session ID values and the physical path to the requested file...

HTTP Debugging Methods (TRACE/TRACK) Enabled

The remote web server supports the TRACE and/or TRACK methods. TRACE and TRACK are HTTP methods which are used to debug web server connections. SPDX-FileCopyrightText: 2003 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Microsoft Internet Information Services (IIS) ASP.NET Application Trace Enabled

The ASP.NET web application running in the root directory of this web server has application tracing enabled. SPDX-FileCopyrightText: 2002 Digital Defense Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2004-2320

The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are...

CVE-2004-2320

The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are...

security flaw

fs/exec.c in Linux 2.6, when one thread is tracing another thread that shares the same memory map, might allow local users to cause a denial of service deadlock by forcing a core dump when the traced thread is in the TASKTRACED state...

CVE-2004-2320

The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are...

CVE-2004-2320

The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are...

PT-2004-3214

Name of the Vulnerable Software and Affected Versions: BEA WebLogic Server and Express versions 5.1 through SP13 BEA WebLogic Server and Express versions 6.1 through SP6 BEA WebLogic Server and Express versions 7.0 through SP4 BEA WebLogic Server and Express versions 8.1 through SP2 Description:...

CVE-2004-0513

Unspecified vulnerability in Mac OS X before 10.3.4 has unknown impact and attack vectors related to "logging when tracing system calls."...

Systrace 1.x - Local Policy Bypass

Systrace 1.x - Local Policy Bypass // source: https://www.securityfocus.com/bid/9998/info Systrace has been reported prone to a vulnerability that may permit an application to completely bypass a Systrace policy. The issue presents itself because Systrace does not perform sufficient sanity checks...