Debian DSA-215-1 : cyrus-imapd - buffer overflow

Timo Sirainen discovered a buffer overflow in the Cyrus IMAP server, which could be exploited by a remote attacker prior to logging in. A malicious user could craft a request to run commands on the server under the UID and GID of the cyrus server. %NASLMINLEVEL 70300 C Tenable Network Security,...

CVE-2004-0261

OpenJournal 2.0 (2.0–2.0.5) is affected by an authentication bypass in oj.cgi, where a uid parameter set to 0 allows remote attackers to access the control panel. The root cause and specific exploit details are not elaborated beyond this description in the provided documents. Impact is elevated (...

OpenSSH < 2.1.1 UseLogin Local Privilege Escalation

Binary data 1991.prm...

RHEL 2.1 : pam (RHSA-2004:304)

Updated pam packages that fix a security vulnerability are now available for Red Hat Enterprise Linux 2.1. PAM Pluggable Authentication Modules is a system security tool that allows system administrators to set an authentication policy without having to recompile programs that handle...

Mandrake Linux Security Advisory : rsync (MDKSA-2002:009)

Sebastian Krahmer of the SuSE Security Team performed an audit on the rsync tool and discovered that in several places signed and unsigned numbers were mixed, with the end result being insecure code. These flaws could be abused by remote users to write 0 bytes into rsync's memory and trick rsync...

wu-ftpd ftpaccess `restricted-uid'/`restricted-gid' directive may be bypassed

Glenn Stewart reports a bug in wu-ftpd's ftpaccess restricted-uid'/restricted-gid' directives: Users can get around the restriction to their home directory by issuing a simple chmod command on their home directory. On the next ftp log in, the user will have '/' as their root directory. Matt...

CVE-2003-1340

Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 5.6 and 6.5 allow remote authenticated users to execute arbitrary SQL commands via 1 a uid user cookie to modules.php; and allow remote attackers to execute arbitrary SQL commands via an aid admin cookie to the WebLinks module in ...

My_eGallery Module 3.1.1 - Remote File Inclusion Command Injection

source: https://www.securityfocus.com/bid/9113/info A problem has been identified in the handling of input by MyeGallery. Because of this, it may be possible for a remote user to gain unauthorized access to a system using the vulnerable software. MyeGallery exploit Spawn bash style Shell with...

DSR-wmapm.sh

/bin/sh Pretty useless, we can mess up /etc/dumpdates or run shutdown on FreeBSD systems with wmapm from ports. If wmapm is installed from source we get root instead, so I suppose this might be worth somethinguid 0 on linux. kokanin@dtors pkginfo | grep -i wmapm wmapm-3.1 Laptop battery status...

man-db 2.4.1 - open_cat_stream() Local uidman

man-db 2.4.1 - opencatstream Local uidman !/bin/bash xmandb.sh: shell command file. man-dbv2.4.1-: local uid=man exploit. by: vade79/v9 v9 fakehalo deadpig org fakehalo opencatstream privileged call exploit. i've been conversing with the new man-db maintainer, and after the initial post sent to...

man-db 2.4.1 - 'open_cat_stream()' Local uid=man

!/bin/bash xmandb.sh: shell command file. man-dbv2.4.1-: local uid=man exploit. by: vade79/v9 v9 fakehalo deadpig org fakehalo opencatstream privileged call exploit. i've been conversing with the new man-db maintainer, and after the initial post sent to bugtraqwhich i forgot to inform him, i sent...

man-db 2.4.1 open_cat_stream() Local uid=man Exploit

No description provided by source. !/bin/bash xmandb.sh: shell command file. man-dbv2.4.1-: local uid=man exploit. by: vade79/v9 v9 fakehalo deadpig org fakehalo opencatstream privileged call exploit. i've been conversing with the new man-db maintainer, and after the initial post sent to...

man-db 2.4.1 open_cat_stream() Local uid=man Exploit

Exploit for linux platform in category local exploits ==================================================== man-db 2.4.1 opencatstream Local uid=man Exploit ==================================================== !/bin/bash xmandb.sh: shell command file. man-dbv2.4.1-: local uid=man exploit. by:...

Cisco IOS - using hping Remote Denial of Service

!/bin/tcsh -f Remote DoS exploit against the recent Cisco IOS vuln. Cisco doc. 44020 Vulnerable versions - all Cisco devices running IOS. Requirements : tcsh, and hping. Get hping @ www.hping.org And you know the best part? This script actually works! Unlike the few .c's floating around the net...

HappyMall E-Commerce Software 4.34.4 - Member_HTML.cgi Command Execution

HappyMall E-Commerce Software 4.34.4 - MemberHTML.cgi Command Execution source: https://www.securityfocus.com/bid/7530/info It has been reported that a problem in the HappyMall E-Commerce software package could allow an attacker to pass arbitrary commands through the memberhtml.cgi script. This...

ShopCart.pl

Shopcart exploit Spawn bash style Shell with webserver uid Spabam 2003 PRIV8 code hackarena irc.brasnet.org This Script is currently under development use strict; use IO::Socket; my $host; my $port; my $command; my $url; my @results; my $probe; my @U; my $shit; $U1 = "/cgi-local/shop.pl/page=;";...

Multiple glftpd bugs

Directory traversal in messaging system, archive extraction, effective uid problem...

Cyrus IMAP pre-authentication heap overflow vulnerability

In December 2002, Timo Sirainen reported: Cyrus IMAP server has a remotely exploitable pre-login buffer overflow. ... Note that you don't have to log in before exploiting this, and since Cyrus runs everything under one UID, it's possible to read every user's mail in the system. It is unknown...

DSA-195 apache-perl - several vulnerabilities

Bulletin has no description...

CVE-2002-0097

CVE-2002-0097 affects Geeklog 1.3, where remote attackers can hijack user accounts (including the administrator) by modifying a user’s permanent cookie UID to the target account. The root cause is manipulating the UID in the persistent cookie to assume another user’s session. The available connec...