CVE-2002-2058

TeeKai Tracking Online 1.0 is affected by a weak encryption flaw in the stored web usage statistics (data/userlog/log.txt) that enables remote attackers to identify visiting IPs by dividing each octet by the MD5 hash of '20'. The Red Hat advisory and PT-Security notes corroborate the vulnerabilit...

CVE-2002-2055

TeeKai Tracking Online XSS (CVE-2002-2055) affects the TeeKai Tracking Online web app (1.0) via userlog.php, where the id parameter is not properly sanitized, allowing a remote attacker to inject arbitrary script/HTML. Public sources reiterate an XSS risk; OpenVAS/Nessus mention that a crafted UR...

CVE-2002-2055

Cross-site scripting XSS vulnerability in userlog.php in TeeKai Tracking Online 1.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2002-2058

TeeKai Tracking Online 1.0 uses weak encryption of web usage statistics in data/userlog/log.txt, which allows remote attackers to identify IP's visiting the site by dividing each octet by the MD5 hash of '20'...

Security Advisory for Bugzilla 2.18.1 and 2.19.3

Summary ======= Bugzilla is a Web-based bug-tracking system, used by a large number of software projects. This advisory covers two security bugs that have recently been discovered and fixed in the Bugzilla code: + Any user can change a flag on any bug. This also allows the attacker to expose the...

Bugzilla bug tracking system information leak

It's possible to determine if closed product exist, password can be leaked as a part of URL...

[SECURITYREASON.COM] phpAdsNew 2.0.4-pr1 Multiple vulnerabilities cXIb8O3.9

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 phpAdsNew 2.0.4-pr1 Multiple vulnerabilities cXIb8O3.9 Author: Maksymilian Arciemowicz cXIb8O3 Date: 13.3.2005 from securityreason.com TEAM - --- 0.Description --- phpAdsNew is an open-source ad server, with an integrated banner management interface a...

Autocomplete data leak — Mozilla

As users downarrow through autocomplete choices each is copied in turn into the input control. A malicious site could create a page that autocompletes some common data such as phone number or SSN and potentially convince a user to arrow through the values. Script on the page could watch the value...

Moderate: Red Hat Security Advisory: thunderbird security update

An updated Thunderbird package that fixes a security issue is now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Thunderbird is a standalone mail and newsgroup client. A bug was found in the way...

TeeKai Tracking Online XSS

The remote host runs Teekai Tracking Online, a PHP script used for tracking the number of users on a Web site. This version is vulnerable to cross-site scripting attacks. A remote attacker could exploit this by tricking a user into requesting a maliciously crafted URL, resulting in the execution ...

CVSTrac Detection

The remote host is running CVSTrac, a web-based bug and patch-set tracking system for CVS. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; ifdescription scriptid15722; scriptversion"1.14";...

Windows 2003 server services weak permissions

Permissions for distributed Link tracking Server and Internet Connection Firewall Service allow control by unprivileged users...

Debian DSA-161-1 : mantis - privilege escalation

A problem with user privileges has been discovered in the Mantis package, a PHP based bug tracking system. The Mantis system didn't check whether a user is permitted to view a bug, but displays it right away if the user entered a valid bug id. Another bug in Mantis caused the 'View Bugs' page to...

CVE-2002-1116

The CVE-2002-1116 issue affects Mantis: the View Bugs page (view_all_bug_page.php) in Mantis 0.17.4a and earlier exposes summaries of private bugs to users with no project access, potentially leaking private project information. Technical detail from connected sources confirms vulnerable software...

CVSTrac Database Plaintext Password Storage

The remote host seems to be running cvstrac, a web-based bug and patch-set tracking system for CVS. This version contains a flaw related to .db files that may allow an attacker to gain access to plaintext passwords. Nessus has determined the vulnerability exists on the target simply by looking at...

Kerio MailServer < 6.0.1 Embedded HTTP Server Unspecified Issue

The remote host is running a version of Kerio MailServer prior to 6.0.1. Kerio Mailserver is an SMTP server that ships with an embedded HTTP server. It has been reported that there are multiple remote overflows in versions of Kerio prior to 6.0.1, although the exact nature of these overflows is n...

Mandrake Linux Security Advisory : kernel (MDKSA-2002:041)

A problem was discovered in the CIPE VPN tunnel implementation in the Linux kernel where a malformed packet could cause a crash. Andrew Griffiths discovered a vulnerability that allows remote machines to read random memory by utilizing a bug in the ICMP implementation of Linux kernels. This only...

phpBugTracker 0.9.1 - Multiple Vulnerabilities

phpBugTracker 0.9.1 - Multiple Vulnerabilities phpBugTracke Multiple Vulnerabilities Vendor: Benjamin Curtis Product: phpBugTracke Version: query"delete from ".TBLBUGVOTE." where userid = $u and bugid = $bugid"; As we can see from that line of code taken from about line 30 of user.php it is clear...

phpBugTracker < 0.9.1 - Multiple Vulnerabilities

phpBugTracke Multiple Vulnerabilities Vendor: Benjamin Curtis Product: phpBugTracke Version: query"delete from ".TBLBUGVOTE." where userid = $u and bugid = $bugid"; As we can see from that line of code taken from about line 30 of user.php it is clear that the $bugid variable is passed into the...

CVE-2003-0544

OpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs, which allows remote attackers to cause a denial of service crash via an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used...