Cart32 admin password vulnerability

Joint advisory issued by Cart32 and Colin Hart --------------------------------------- Date Published: 6th November 2000 --------------------------------------- Title: Cart32 admin password vulnerability --------------------------------------- Vulnerable Packages/Systems: Cart32 v3.5 build 619, i...

Security Advisory YYYY-NNN

-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 2000-014 ================================= Topic: Global-3.55 allows world-wide executable cgi. Version: any before 4.01 Severity: permits remote execution of arbitrary shell commands Abstract ======== When using the CGI interface of the...

FreeBSD-SA-00:56.lprng

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:56 Security Advisory FreeBSD, Inc. Topic: LPRng contains potential root compromise Category: ports Module: LPRng Announced: 2000-10-13 Credits: Chris Evans Affects: Ports...

thttpd ssi Servlet Encoded Traversal Arbitrary File Access

The version of thttpd running on the remote host comes with a CGI script, 'ssi', that fails to completely sanitize its PATHTRANSLATED argument of encoded directory sequences. An unauthenticated, remote attacker can use this issue to read arbitrary files on the remote host, subject to the privileg...

Sambar Server ISAPI Search Utility search.dll Arbitrary Directory Listing

The 'search.dll' CGI that comes with Sambar server can be used to obtain a listing of the remote web server directories even if they have a default page, such as index.html. This allows an attacker to gain valuable information about the directory structure of the remote host and could reveal the...

Microsoft FrontPage Extensions MS-DOS Device Request DoS

It is possible to disable FrontPage extensions on the remote host by requesting a URL containing the name of a DOS device via shtml.exe, such as : GET /vtibin/shtml.exe/aux.htm An attacker could use this flaw to disable FrontPage. C Tenable Network Security, Inc. include"compat.inc"; if descripti...

IMail Host: Header Field Handling Remote Overflow

The remote web server crashes when it is issued a too long argument to the 'Host:' field of an HTTP request. An attacker may use this flaw to either completely prevent this host from serving web pages to the world, or to make it die by crashing several threads of the web server until the complete...

Serv-U 2.5e Null Byte Saturation DoS

It is possible to crash the remote FTP service by sending it a large number of null bytes. An attacker could exploit this flaw to deny access to the FTP server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10488; scriptversion"1.35"; scriptcvsdate"Date: 2018/11/15...

Dragon FTP USER Command Remote Overflow

It was possible to crash the remote FTP server by issuing a USER command followed by a very long argument over 16,000 characters. This is likely due to a remote buffer overflow vulnerability. A remote attacker could exploit this to crash the server, or possibly execute arbitrary code. C Tenable...

Dragon Telnet Server Login Name Handling Remote Overflow DoS

It was possible to shut down the remote telnet server by issuing a far too long login name over 16,000 chars This problem allows an attacker to prevent remote administration of this host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10451; scriptversion"1.27";...

FreeBSD-SA-00:22.apsfilter

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:22 Security Advisory FreeBSD, Inc. Topic: apsfilter allows users to execute arbitrary commands as user lpd Category: ports Module: apsfilter Announced: 2000-06-07 Credits...

RFP2K05 - NetProwler "Fragmentation" Issue

NetProwler 3.0 will crash if the Man-in-the-Middle signature encounters a packet for which the following expression evaluates to true: IPHEADERLENGTH + TCPHEADERLENGTH IPTOTALLENGTH This is not a packet fragmentation problem. It is an issue with specific malformed packets. This problem has been...

Rockliffe MailSite Management Agent wconsole.dll GET Request Overflow

The version of Rockliffe MailSite installed on the remote host is prone to a buffer overflow attack that can be triggered by a request like : GET /cgi-bin/wconsole.dll?AAAA....AAAA This may be of some use to an attacker to run arbitrary code on this system and/or crash it. C Tenable Network...

INFO:AppleShare IP 6.3.2 squashes security bug

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 AppleShare IP Web & File 6.3.2 fixes a potential security problem in the Web server in versions of AppleShare IP 6.1 and later. When an invalid range request is made to the Web server by a client computer, the Web server can return an extra 32 kilobyt...

RealServer Port 7070 Malformed Input DoS

It was possible to crash the remote RealServer by sending it a specially crafted packet. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Original exploit code : see http://www.ussrback.com include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid10377; scriptversion"1.26...

AVM KEN! ISDN Proxy Server Malformed Request Remote DoS

It was possible to crash the remote service - very likely Ken! ISDN Proxy Software - by sending it a non-HTTP request. Note that in the case of the Ken!, exploitation requires that the attacker be on the local network. C Tenable Network Security, Inc. include"compat.inc"; if description...

AnalogX SimpleServer:WWW Short GET /cgi-bin Remote DoS

The remote host is running a version of the AnalogX SimpleServer web server that is affected by a remote denial of service vulnerability. An attacker could exploit this vulnerability to crash the affected application by requesting a URL with exactly 8 characters following the '/cgi-bin/' director...

TalentSoft Web+ webplus CGI Traversal Arbitrary File Access

The 'webplus' CGI allows an attacker to view any file on the target computer by requesting : GET /cgi-bin/webplus?script=/../../../../etc/passwd %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include 'compat.inc' ; ifdescription scriptid10367; scriptversion"1.33"; scriptcveid"CVE-2000-0282"...

Axis Storpoint CD Admin Authentication Bypass

The remote host is running Axis StorPoint. It is possible to access the administration interface with a specially crafted URL that contains directory traversal characters. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

FreeBSD-SA-00:06.htdig

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:06 Security Advisory FreeBSD, Inc. Topic: htdig port allows remote reading of files Category: ports Module: htdig Announced: 2000-03-01 Affects: Ports collection before...