890 matches found
dovecot: insecure mail_extra_groups option
Dovecot before 1.0.11, when configured to use mailextragroups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack...
TopperMod 1.0 (mod.php) Local File Inclusion Vulnerability
No description provided by source. Author: GiReX mySite: girex.altervista.org CMS: TopperMod v1.0 Site: rtcw.ch/mio/index.php Bug: Local File Inclusion File: mod.php Var : $to Bug explanation - Vuln Code: if isset$GET'mod' $mod = stripslashes$GET'mod'; else header"location index.php"; Die; if...
DEBIAN-CVE-2008-1199
Dovecot before 1.0.11, when configured to use mailextragroups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack...
SuSE 10 Security Update : Geronimo (ZYPP Patch Number 4967)
A chown in the geronimo init script could change ownership of directories it did not own, due to following symlinks. The default setup would corrupt /var/tmp on start. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...
CVE-2002-2382
cvsupd.sh in CVSup 1.2 allows local users to overwrite arbitrary files and gain privileges via a symlink attack on /var/tmp/cvsupd.out...
Authentication flaw
initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging...
CVE-2007-5686
initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging...
CVE-2007-5686: Undefined Security Weakness
initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging...
CVE-2003-1386
AXIS 2400 Video Server 2.00 through 2.33 allows remote attackers to obtain sensitive information via an HTTP request to /support/messages, which displays the server's /var/log/messages file...
Linux initscripts weak permissions
Weak permissions for /var/log/btmp files cause information leak about unsuccessful logon attempt...
rPSA-2007-0214-1 initscripts
rPath Security Advisory: 2007-0214-1 Published: 2007-10-11 Products: rPath Linux 1 Rating: Minor Exposure Level Classification: Local Information Exposure Updated Versions: initscripts=conary.rpath.com@rpl:1/8.12-8.10-1 rPath Issue Tracking System: https://issues.rpath.com/browse/RPL-1825...
Improper access control
Adam Scheinberg Flip 3.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing login credentials via a direct request for var/users.txt...
CVE-2007-5063
Adam Scheinberg Flip 3.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing login credentials via a direct request for var/users.txt...
CVE-2007-5063: Undefined Security Weakness
Adam Scheinberg Flip 3.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing login credentials via a direct request for var/users.txt...
CVE-2007-5028
Dibbler 0.6.0 on Linux uses weak world-writable permissions for unspecified files in /var/lib/dibbler, which has unknown impact and local attack vectors...
CVE-2007-5028
Dibbler 0.6.0 on Linux uses weak world-writable permissions for unspecified files in /var/lib/dibbler, which has unknown impact and local attack vectors...
CVE-2007-5028
Dibbler 0.6.0 on Linux uses weak world-writable permissions for unspecified files in /var/lib/dibbler, which has unknown impact and local attack vectors...
Sql injection
SQL injection vulnerability in archshow.asp in BlogMe 3.0 allows remote attackers to execute arbitrary SQL commands via the var parameter, a different vector than CVE-2006-5976...
CVE-2007-2661: Undefined Security Weakness
SQL injection vulnerability in archshow.asp in BlogMe 3.0 allows remote attackers to execute arbitrary SQL commands via the var parameter, a different vector than CVE-2006-5976...