Sun Java System Web Proxy Server vulnerable to buffer overflow

Overview Buffer overflow vulnerabilities in the Java System Web Proxy Server may allow remote attackers to execute arbitrary code or cause a denial-of-service condition. Description The Java System Web Proxy Server is a caching HTTP proxy server. A lack of bounds checking in the Java System Web...

SecureCRT SSH-1 Protocol Version String Remote Overflow

The remote host is using a vulnerable version of SecureCRT, a SSH/Telnet client built for Microsoft Windows operating systems. It has been reported that SecureCRT contains a remote buffer overflow allowing an SSH server to execute arbitrary commands via an especially long SSH1 protocol version...

Sun Java Plug-in fails to restrict access to private Java packages

Overview There is a vulnerability in the Sun Java Plug-in that could allow a malicious Java applet to bypass restrictions for untrusted applets. Description The Java Plug-in is part of the Java 2 Runtime Environment JRE and establishes a framework for displaying Java applets within a web browser...

Fastream NETFile FTP/Web Server HEAD Request Saturation DoS

The remote host appears to be running FastStream NETFile Server version 7.1 or older. These versions do not close the connection when an HTTP HEAD request is received with the keep-alive option set. An attacker may exploit this flaw by sending multiple HEAD requests to the remote host, thus...

miniBB index.php user Parameter SQL Injection

The remote host is using the miniBB forum management system. According to its version number, this forum is vulnerable to a SQL injection attack. Input to the 'user' parameter of index.php not properly sanitized. A remote attacker could exploit this to execute arbitrary SQL queries against the...

BNC IRC Server Incorrect Password Authentication Bypass

The remote host is running a version of the BNC IRC proxy that contains a flaw in its authentication process that accepted only logins with incorrect passwords. An attacker may use this issue to gain access to the remote IRC proxy server. C Tenable Network Security, Inc. include"compat.inc";...

TikiWiki tiki-error.php XSS

The remote host is running TikiWiki, a content management system written in PHP. The version of this software running on the remote host has a cross-site scripting vulnerability in tiki-error.php. A remote attacker could exploit this by tricking a user into requesting a maliciously crafted URL,...

Debian DSA-591-1 : libgd2 - integer overflows

'infamous41md' discovered several integer overflows in the PNG image decoding routines of the GD graphics library. This could lead to the execution of arbitrary code on the victim's machine. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

HTTP Header Name Remote Format String

The remote web server seems to be vulnerable to a remote format string attack based on the way it responds to a request containing a header whose name includes a format string. An anonymous attacker may be able to leverage this flaw to make the affected service crash or to execute arbitrary code ...

Cherokee Web Server URI Traversal Arbitrary File Access

The remote host is running Cherokee - a fast and tiny web server. The remote version of this software is vulnerable to directory traversal flaw when appending a '../' sequence to the web request. Additionally, this version fails to drop root privileges after it binds to listen port. Remote attack...

Cherokee Web Server Malformed POST Request Remote DoS

The remote host is running Cherokee - a fast and tiny web server. The remote version of this software is affected by a remote denial of service vulnerability when handling a specially crafted HTTP 'POST' request. An attacker may exploit this flaw to disable this service remotely. C Tenable Networ...

Cherokee Web Server auth_pam Authentication Format String

The remote host is running Cherokee - a fast and tiny web server. The remote version of this software is vulnerable to a format string attack when processing authentication requests using authpam. This could allow a remote attacker to cause a denial of service, or potentially execute arbitrary...

PostNuke Trojaned Distribution

The remote host seems to be running a copy of a trojaned version of the 'PostNuke' content management system. PostNuke is a content management system in PHP whose main website has been compromised between the 24th and 26th of October 2004. An attacker modified some of the source code of the tool ...

Abyss Web Server MS-DOS Device Name DoS

It was possible to kill the web server by sending an MS-DOS device name in an HTTP request. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid15563; scriptversion"1.19"; scriptxrefname:"Secunia", value:"12900"; scriptnameenglish:"Abyss Web Server MS-DOS Device Name DoS"...

ProFTPD Login Timing Account Name Enumeration

The remote ProFTPd server is as old or older than 1.2.10 It is possible to determine which user names are valid on the remote host based on timing analysis attack of the login procedure. An attacker may use this flaw to set up a list of valid usernames for a more efficient brute-force attack...

GLSA-200410-13 : BNC: Input validation flaw

The remote host is affected by the vulnerability described in GLSA-200410-13 BNC: Input validation flaw A flaw exists in the input parsing of BNC where part of the sbufgetmsg function handles the backspace character incorrectly. Impact : A remote user could issue commands using fake authenticatio...

w-Agora Multiple Script Traversal Arbitrary File Access

The remote host is running w-agora, a web-based forum application written in PHP. The remote version of this software is prone to directory traversal attacks. A remote attacker could send specially crafted URL to read arbitrary files from the remote system with the privileges of the web server...

Helix Universal Server Remote Integer Handling DoS

The remote host is running Helix Universal Server, a digital media delivery platform. There is a flaw in the remote version of this software that could allow an attacker to crash this service by sending a malformed POST request to the remote host. C Tenable Network Security, Inc...

Icecast HTTP Basic Authorization Remote Overflow DoS

The remote server runs Icecast 2.0.0, an open source streaming audio server. This version is affected by a remote denial of service. A remote attacker could send a specially crafted URL, with a long string passed in an Authorization header that will result in a loss of availability for the servic...

Kerio MailServer < 6.0.3 Unspecified Vulnerability

The remote host is running a version of Kerio MailServer prior to 6.0.3. There is an undisclosed flaw in the remote version of this server that might allow an attacker to execute arbitrary code on the remote host. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid15404;...