Ethereal integer underflow when parsing malformed PGM packets with NAK lists

Overview Ethereal fails to properly parse Pragmatic General Multicast PGM packets containing a crafted negative acknowledgement NAK list. Description Ethereal is a network traffic analysis package. It includes the ability to decode packets containing PGM data. There is a vulnerability in the way...

Ethereal contains multiple vulnerabilities in the IGAP protocol dissector

Overview Ethereal contains multiple buffer overflows in the Internet Group Membership Authentication Protocol IGAP protocol dissector. These vulnerabilities could allow a remote, unauthenticated attacker to execute arbitrary code. Description Ethereal is a network traffic analysis package. It...

ISS BlackICE Multiple Remote Vulnerabilities

ISS BlackICE is a personal Firewall/IDS for windows Desktops. Several remote holes have been found in the product. An attacker, exploiting these flaws, would be able to either crash the remote firewall/IDS service or execute code on the target machine. According to the remote version number, the...

WS_FTP Pro Client ASCII Mode Directory Listing Handling Overflow

The version of WSFTP Pro, an FTP client, installed on the remote host is earlier than 9.0. Such versions are reportedly affected by a remote overflow triggered by an overly long string of ASCII mode directory data from a malicious server. If an attacker can trick a user on this system to connect ...

WU-FTPD restricted-gid Directory Access Restriction Bypass

The remote host is running wu-ftpd 2.6.2 or older. There is a bug in this version which may allow an attacker to bypass the 'restricted-gid' feature and gain unauthorized access to otherwise restricted directories. Nessus solely relied on the banner of the remote FTP server, so this might be a...

Courier < 0.45 Multiple Remote Overflows

According to its version number, the version of Courier MTA running on the remote host has multiple buffer overflow vulnerabilities. A remote attacker could exploit this to crash the service, or possibly execute arbitrary code. C Tenable Network Security, Inc. include"compat.inc"; ifdescription...

F-Secure SSH Password Authentication Policy Evasion

According to its banner, the version of F-Secure SSH running on the remote host allows a user to log in using a password, even though the server policy disallows it. An attacker could exploit this flaw to run a dictionary attack against the SSH server. C Tenable Network Security, Inc...

vHost < 3.10r1 Unspecified XSS

The remote host is running a version of vHost that is older than 3.10r1. There is a cross-site scripting vulnerability in this version that may allow an attacker to steal the cookies of the legitimate users of this site. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

DreamFTP Server username Remote Format String

The remote DreamFTP server is vulnerable to a format string attack when processing the USER command. An attacker may exploit this flaw to gain a shell on this host. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid12086; scriptcveid"CVE-2004-2074"; scriptbugtraqid9800;...

SpiderSales Shopping Cart SQL injection

The remote host is running the SpiderSales Shopping Cart CGI suite. There is a bug in this suite which may allow an attacker to force it to execute arbitrary SQL statements on the remote host. An attacker may use this flaw to gain the control of the remote website and possibly execute arbitrary...

SandSurfer < 1.7.1 XSS

The remote host is running SandSurfer, a web-based time keeping application. A vulnerability has been disclosed in all versions of this software, up to version 1.7.0 included which may allow an attacker to use it to perform cross-site scripting attacks against third-party users. %NASLMINLEVEL 703...

FreeBSD-SA-04:03.jail

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-04:03.jail Security Advisory The FreeBSD Project Topic: Jailed processes can attach to other jails Category: core Module: kernel Announced: 2004-02-25 Credits: JA...

Jigsaw < 2.2.4 Unspecified URI Parsing Unspecified Vulnerability

According to its banner, the remote version of Jigsaw web server has an unspecified vulnerability related to the way it parses URIs. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid12071; scriptversion"1.16"; scriptcveid"CVE-2004-2274"; scriptbugtraqid9711;...

Oracle Database 9i Multiple Functions Local Overflow

The remote Oracle Database, according to its version number, is vulnerable to a buffer overflow in the query SET TIMEZONE. An attacker with a database account may use this flaw to gain the control on the whole database, or even to obtain a shell on this host. %NASLMINLEVEL 70300 C Tenable Network...

RealPlayer File Handler Arbitrary Code Execution

According to its build number, the installed version of RealPlayer / RealOne Player / RealPlayer Enterprise has a flaw that may allow an attacker to execute arbitrary code on the remote host, with the privileges of the user running RealPlayer, using specially crafted RP, RT, RAM, RPM or SMIL file...

Check Point ISAKMP vulnerable to buffer overflow via Certificate Request

Overview A buffer overflow vulnerability exists in the Internet Security Association and Key Management Protocol ISAKMP implementation used in Check Point VPN-1, SecuRemote, and SecureClient products. An unauthenticated, remote attacker could execute arbitrary code with the privileges of the ISAK...

Aprox PHP Portal index.php Arbitrary File View

The remote host is running Aprox Portal - a PHP-based content management system. There is a bug in this software that may allow an attacker to read arbitrary files on the remote web server with the privileges of the web user. In addition, this software is reportedly vulnerable to a local file...

Gallery HTTP Global Variables File Inclusion

It is possible to make the remote host include PHP files hosted on a third-party server using the version of Gallery installed on the remote host. An attacker may use this flaw to inject arbitrary code in the remote host and gain a shell with the privileges of the web server. %NASLMINLEVEL 70300 ...

Mambo mod_mainmenu.php mosConfig_absolute_path Parameter Remote File Inclusion

There is a flaw in the installed version of Mambo Open Source that may allow an attacker to execute arbitrary remote PHP code on this host because it fails to sanitize input to the 'mosConfigabsolutepath' of 'modules/modmainmenu.php' before using it to include PHP code from another file. Note tha...

CVS PServer CVSROOT Passwd File Arbitrary Code Execution

According to its version number, the remote CVS server has an arbitrary code execution vulnerability. Any user with the ability to write the CVSROOT/passwd file could execute arbitrary code as root. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid11970; scriptversion...