Microsoft Windows SMB Registry : WinVNC's Key Permissions

The registry key HKLM\Software\ORL\WinVNC3 is writeable and/or readable by users who are not in the admin group. This key contains the VNC password of this host, as well as other configuration setup. As this program allows remote access to this computer with the privileges of the currently logged...

RedHat 6.2 - '/sbin/restore' Local Privilege Escalation

!/bin/sh /sbin/restore exploit for rh6.2 I did not find this weakness my self, all i did was writing this script and some more to make it automatic and easy to use. This exploit should work on all redhat 6.2 systems with /sbin/restore not "fucked up". May work on other distros too, but only teste...

HP-UX 10.20 - registrar Local Arbitrary File Read

source: https://www.securityfocus.com/bid/1919/info The registrar service that ships with version 10.20 possibly others of HP's HP-UX operating system contains a vulnerability that may allow a local user to read any file on the hosts filesystem. The service which listens on tcp port 1712 writes t...

Дырка в xfce (startup script desktop access)

Скрипт, запускаемый при старте программы, позволяет доступ к рабочему столу любым локальным пользователям, что позволяет, например, перехватывать события клавиатуры...

Solaris 2.67.0 locale - Subsystem Format String

Solaris 2.67.0 locale - Subsystem Format String / source: https://www.securityfocus.com/bid/1634/info nectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String Many UNIX operating systems provi...

Cisco Catalyst 3500 XL - Arbitrary Command Execution

Cisco Catalyst 3500 XL - Arbitrary Command Execution source: https://www.securityfocus.com/bid/1846/info A vulnerability exists in the webserver configuration interface which will allow an anonymous user to execute commands. A http request which includes /exec and a known filename will reveal the...

CVE-2000-0604

gkermit in Red Hat Linux is improperly installed with setgid uucp, which allows local users to modify files owned by uucp...

CVE-2000-0458

The MSWordView application in IMP creates world-readable files in the /tmp directory, which allows other local users to read potentially sensitive information...

CVE-2000-0515

The snmpd.conf configuration file for the SNMP daemon snmpd in HP-UX 11.0 is world writable, which allows local users to modify SNMP configuration or gain privileges...

CVE-2000-0494

Veritas Volume Manager contains a local-privilege issue where a world-writable .server_pids file can be modified by an unprivileged user to inject commands. Those commands are then executed by the vmsa_server script, enabling potentially arbitrary code execution with local access. The CVE descrip...

CVE-2000-0322

The passwd.php3 CGI script in the Red Hat Piranha Virtual Server Package allows local users to execute arbitrary commands via shell metacharacters...

CVE-2000-0164

The installation of Sun Internet Mail Server SIMS creates a world-readable file that allows local users to obtain passwords...

CVE-2000-0786

GNU userv 1.0.0 and earlier does not properly perform file descriptor swapping, which can corrupt the USERVGROUPS and USERVGIDS environmental variables and allow local users to bypass some access restrictions...

CVE-2000-0164

Sun Internet Mail Server (SIMS) installations create a world-readable file that allows local users to obtain passwords. Affected: SIMS. Issue: world-writable or world-readable file exposure leading to complete confidentiality impact for local users. Root cause and exact file/path are not specifie...

CVE-2000-0552

ICQwebmail client for ICQ 2000A creates a world readable temporary file during login and does not delete it, which allows local users to obtain sensitive information...

CVE-2000-0475

Windows 2000 allows a local user process to access another user's desktop within the same windows station, aka the "Desktop Separation" vulnerability...

[SECURITY] New versions of Debian traceroute packages

---------------------------------------------------------------------------- Debian Security Advisory [email protected] http://www.debian.org/security/ Daniel Jacobowitz October 13, 2000 - ---------------------------------------------------------------------------- Package: traceroute...

DST2K0040: QuotaAdvisor 4.1 by WQuinn susceptible to any user bei ng able to list (not read) all files on any server running QuotaAdvisor.

============================================================================ Delphis Consulting Plc ============================================================================ Security Team Advisories 26/09/2000 [email protected] http://www.delphisplc.com/thinking/whitepapers/...

SmartWin CyberOffice Shopping Cart 2.0 - Client Information Disclosure

source: https://www.securityfocus.com/bid/1734/info Smartwin Technology CyberOffice Shopping Cart is a shopping cart application for e-commerce enabled websites running Windows NT 4.0 or 2000. It is possible for a remote user to gain read access to the private directory on a website running...

OpenSSH 1.2 - .scp File CreateOverwrite

OpenSSH 1.2 - .scp File CreateOverwrite source: https://www.securityfocus.com/bid/1742/info A vulnerability exists in the 1.2.x releases of scp which, if properly exploited using a modified scp binary on the server end, can permit the remote server to spoof local pathnames and overwrite files...