Vulnerability in SpoonFTP

-----BEGIN PGP SIGNED MESSAGE----- Vulnerability in SpoonFTP Overview SpoonFTP v1.1 is an ftp server available from http://www.pi-soft.com/. A vulnerability exists which allows a remote user to break out of the ftp root. Details The following excerpt demonstrates the problem; an ftp root of...

OmniHTTPd Encoded Space Request Script Source Disclosure

OmniHTTPd is affected by a vulnerability that permits malicious users to get the full source code of scripting files. By appending an ASCII/Unicode space char '%20' to a script's suffix, the web server will no longer interpret it and instead send it back as a simple document in the same manner as...

Quikstore Shopping Cart quikstore.cgi Multiple Vulnerabilities

The CGI 'quickstore.cgi' is installed. This CGI has a well known security flaw that lets an attacker read arbitrary files with the privileges of the HTTP daemon. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; ifdescription scriptid10712...

klogd does not adequately handle NULL byte when parsing text using LogLine( )

Overview There is a denial-of-service vulnerability in certain distributions of the Linux kernel logging daemon klogd which could allow an attacker to cause klogd to hang. Description The Linux kernel logging daemon klogd can be forced to hang if it receives a null byte in a log message from the...

Lotus Domino vulnerable to DoS via crafted unicode GET request

Overview The Lotus Domino Web Server contains a flaw that could be exploited to cause a denial of service situation. Description Sending a crafted GET request containing numerous unicode characters can trigger a server exception that will crash the Domino server. If qnc.exe is removed from the...

Linux kernel does not properly validate user input via sysctl for negative value

Overview Unprivileged local users can exploit the sysctl Linux kernel program to gain privileged access. Description A program called sysctl in the Linux kernel allows a privileged local user to read or write runtime system settings. Unprivileged local users are also allowed to use sysctl to read...

Lotus Domino vulnerable to DoS via many large connects sent to 63148/TCP

Overview The Lotus Domino Web Server contains a flaw that could be exploited to cause a denial of service. Description A continuous stream of "connect" requests with a payload of 10K of data to TCP port 63148 DIIOP - CORBA will result in 100% CPU usage, the hard disk constantly being written to,...

tcpdump vulnerable to buffer overflow via parsing of AFS ACL packets

Overview Tcpdump version 3.5 contains a buffer overflow vulnerability permitting unauthorized remote root access. Description Tcpdump version 3.5 added support for handling AFS packets. Unfortunately the code responsible for printing AFS access control lists contains an unchecked buffer that can ...

A1Stats Multiple Script Traversal Arbitrary File Access

The 'aldisp.cgi' CGI script was found on this system. This script allows an attacker to view any file on the target computer by making a specially crafted GET request. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; ifdescription...

UoW imapd (UW-IMAP) Multiple Command Remote Overflows

The remote host appears to be running UoW IMAP Server. The installed version is affected by a buffer overflow vulnerability because the software fails to verify input length of arguments to the 'LIST', 'COPY', 'RENAME', 'FIND', 'LSUB' commands. An attacker, exploiting this flaw could execute...

Commerce.CGI Shopping Cart commerce.cgi page Parameter Traversal Arbitrary File Access

The 'commerce.cgi' CGI is installed. This CGI has a well known security flaw that lets an attacker read arbitrary files with the privileges of the web server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; ifdescription scriptid10612;...

ISC BIND < 4.9.8 / 8.2.3 Multiple Remote Overflows

The remote BIND server, according to its version number, is affected by various buffer overflow vulnerabilities that may allow an attacker to execute arbitrary code on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10605; scriptversion"1.29";...

Mysql 3.22.x3.23.x - Local Buffer Overflow

Mysql 3.22.x3.23.x - Local Buffer Overflow // source: https://www.securityfocus.com/bid/2262/info MySQL is a widely used Open Source database tool. Versions of MySQL up to and including 3.23.30 are vulnerable to a buffer overflow attack. By supplying an excessively long string as an argument for ...

Mysql 3.22.x/3.23.x - Local Buffer Overflow

// source: https://www.securityfocus.com/bid/2262/info MySQL is a widely used Open Source database tool. Versions of MySQL up to and including 3.23.30 are vulnerable to a buffer overflow attack. By supplying an excessively long string as an argument for a SELECT statement, it is possible for a...

Older SSH clients do not allow users to disable X11 forwarding

Overview This vulnerability may allow an attacker to make unauthorized connections to affected client machines. Description Older versions of the SSH client do not allow the user to disable X11 forwarding. As a result, if the client connects to a malicious server, the server can open an X11...

Borland/Inprise Interbase SQL database server contains backdoor superuser account with known password

Overview Description Interbase is an open source database package that is distributed by Borland/Inprise. The server contains a compiled-in backdoor account with a known password.In the following interbase code, references are made about a LOCKSMITH user: ./jrd/dyn.e ./jrd/isc.c ./jrd/jrd.c...

Serv-U CD Command Encoded Traversal Arbitrary File/Directory Access

The remote host is running Serv-U FTP server. The installed version fails to properly sanitize user-supplied input to the 'cd' command. An attacker could exploit this flaw to access arbitrary files on the remote host. C Tenable Network Security, Inc. include"compat.inc"; ifdescription...

Security Update: bash creates insecure temp files

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Caldera Systems, Inc. Security Advisory Subject: bash creates insecure temp files Advisory number: CSSA-2000-042.0 Issue date: 2000 November, 24 Cross reference: 1. Problem Description Bash creates temp files for here scripts insecurely. This can be...

CGIForum cgiforum.pl thesection Parameter Traversal Arbitrary File Access

The 'cgiforum.pl' CGI is installed. This CGI has a well known security flaw that could let a remote attacker read arbitrary files on the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; ifdescription scriptid10552;...

Linux Multiple statd Packages Remote Format String

The remote statd service could be brought down with a format string attack - it now needs to be restarted manually. This means that an attacker may execute arbitrary code thanks to a bug in this daemon. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10544;...