Lotus Domino Web Server vulnerable to buffer overflow via non-existent "h_SetReturnURL" parameter with an overly long "Host Header" field

Overview Lotus Domino Web Server is an application that provides access to Lotus Notes databases via HTTP requests. A vulnerability exists that could permit a remote attacker to execute arbitrary code on the server. Description Lotus Domino Web Server contains a vulnerability in the nhttp.exe...

Lotus iNotes vulnerable to buffer overflow via PresetFields FolderName field

Overview Lotus iNotes contains a buffer overflow that could permit a remote attacker to execute arbitrary code or cause a denial of service on a vulnerable server. Description Lotus iNotes Web Access is a database application that provides "access to corporate messaging services and personal...

Oracle 9iAS Nonexistent .jsp File Request Error Message Path Disclosure

Oracle 9iAS allows remote attackers to obtain the physical path of a file under the server root via a request for a nonexistent .JSP file. The default error generated leaks the pathname in an error message. %NASLMINLEVEL 70300 This script was written by Javier Fernandez-Sanguino This software is...

CuteFTP 5.0 XP, Buffer Overflow

Advisory 07: ------------ Buffer Overflow In CuteFTP 5.0 XP Discovered: ----------- By Me, Lance Fitz-Herbert aka phrizer. September 4th, 2002 Vulnerable Applications: ------------------------ Tested On CuteFTP 5.0 XP, build 50.6.10.2 Others could be vulnerable... Impact: ------- Medium, This cou...

Netscreen Malicious URL feature can be bypassed by fragmenting the request

Netscreen Malicious URL feature can be bypassed by fragmenting the request http://www.cirt.net/advisories/netscreen.shtml Product Description: NetScreen Technologies Inc. is a leading developer of integrated network security solutions that offer the security, performance and total cost of ownersh...

AIM 4.8.2790 remote file execution vulnerability

Description: AOL Instant Messenger version 4.8.2790 will execute programs when a user clicks on a not-so-specially crafted hypertext link. Versions affected: AOL Instant Messenger 4.8.2790. 4.7.2480 is not vulnerable and neither is 5.0.2938. This bug was confirmed on both Windows 2000 and Windows...

WebBoard does not adequately validate user input thereby permitting arbitrary JavaScript execution

Overview WebBoard does not adequately validate user input, allowing attackers to execute arbitrary JavaScript code on other WebBoard users' systems. Description WebBoard is a web application which includes a real-time chat server, using JavaScript alerts to display messages received by other user...

Pi-Soft SpoonFTP does not adequately validate user input thereby allowing directory traversal

Overview SpoonFTP Server does not adequately validate user input, allowing directory traversal. Description SpoonFTP Server does not adequately validate arguments to the CWD command, allowing directory traversal out of the FTP root directory. --- Impact Users may read any directory or file on the...

EFTP does not adequately validate user input thereby allowing directory traversal

Overview Encrypted File Transfer Program EFTP does not properly validate CWD commands, allowing authenticated users to read arbitrary directories and files. Description Encrypted File Transfer Program EFTP is an implementation of the FTP protocol using 448-bit Blowfish encryption. EFTP allows...

Sambar Server Multiple CGI Remote Overflow

It is possible to kill the Sambar web server 'server.exe' by sending it a long request like: /cgi-win/testcgi.exe?XXXX...X /cgi-win/cgitest.exe?XXXX...X /cgi-win/Pbcgi.exe?XXXXX...X or maybe in /cgi-bin/ An attacker may use this flaw to cause the server to crash continuously. %NASLMINLEVEL 70300 ...

Web Server HTTP 1.0 Header Remote Overflow

It was possible to kill the web server by sending an invalid request with a too long HTTP 1.0 header From, If-Modified-Since, Referer or Content-Type. This vulnerability could be exploited to crash the web server. It might even be possible to execute arbitrary code on your system. As this is a...

Canna SR_INIT Command Remote Overflow

The remote host is running Canna, a service that processes Japanese input and translates it from kana to kanji. It was possible to make the remote Canna server crash by sending a SRINIT command with a very long string. A remote attacker could use this to crash the service, or possibly execute...

Gallery includedir Parameter Remote File Inclusion

The version of Gallery installed on the remote host is affected by a remote file inclusion vulnerability due to the application failing to properly sanitize user-supplied input to the 'includedir' parameter. An attacker may use this flaw to inject arbitrary code in the remote host and gain a shel...

Sendmail 8.6.9 IDENT Remote Overflow

The remote Sendmail server, according to its version number, may be vulnerable to the ident overflow which allows any remote attacker to execute arbitrary commands as root. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10278; scriptversion"1.19";...

[Mantis Advisory/2002-07] Bugs in private projects listed on 'View Bugs'

Mantis Advisory/2002-07 Bugs in private projects listed on 'View Bugs' 0. Table of Contents 1. Introduction 2. Summary / Impact analysis 3. Affected versions 4. Workaround / Solution 5. Proof of Vulnerability 6. Credit 7. Contact details 1. Introduction Mantis is an Open Source web-based...

[Mantis Advisory/2002-06] Private bugs accessible in Mantis

Mantis Advisory/2002-06 Private bugs accessible in Mantis 0. Table of Contents 1. Introduction 2. Summary / Impact analysis 3. Affected versions 4. Workaround / Solution 5. Proof of Vulnerability 6. Credit 7. Contact details 1. Introduction Mantis is an Open Source web-based bugtracking system,...

phpAdsNew helperfunction.php Remote File Inclusion

It is possible to make the remote host include PHP files hosted on a third-party server using PHPAdsNew. An attacker may use this flaw to inject arbitrary code in the remote host and gain a shell with the privileges of the HTTP server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Omron WorldView Wnn Multiple Command Remote Overflow

It was possible to make the remote Wnn server crash by sending an oversized string to it. C Tenable Network Security, Inc. References: http://www.tomo.gr.jp/users/wnn/0008ml/msg00000.html http://online.securityfocus.com/advisories/4413 include"compat.inc"; if description scriptid11108;...

[Mantis Advisory/2002-02] Limiting output to reporters can be bypassed

Mantis Advisory/2002-02 Limiting output to reporters can be bypassed 0. Table of Contents 1. Introduction 2. Summary / Impact analysis 3. Affected versions 4. Workaround / Solution 5. Detailed explanation 6. Contact details 1. Introduction Mantis is an Open Source web-based bugtracking system,...

Sendmail -C Malformed Configuration Privilege Escalation

The remote Sendmail server, according to its version number, may be vulnerable to a 'Mail System Compromise' when a user supplies a custom configuration file. Although the mail server is supposed to run as a non-privileged user, a programming error allows the local attacker to regain the extra...