KAME Racoon IKE daemon fails to properly verify client RSA signatures

Overview The KAME Racoon IKE daemon fails to properly verify client RSA signatures when using Main or Aggressive Mode during a Phase 1 IKE exchange. Description Racoon is an IKE Key Management daemon that negotiates and configures a set of parameters for IPSec. When authenticating a peer in Phase...

HP-UX CDE library libDtSvc contains unspecified buffer overflow

Overview CDE, the default X Windows environment in HP-UX, ships with a libraray called libDtSvc. It has a locally-exploitable buffer overflow in some versions. Description Please see HP Security Bulletin HPSBUX0401-308 SSRT3492 for more details. --- Impact A local user may be able to gain...

TalentSoft Web+ webplus.exe Path Disclosure

The remote host appears to be running Web+ Application Server. The version of Web+ installed on the remote host reveals the physical path of the application when it receives a script file error. %NASLMINLEVEL 70300 This script was written by David Kyger See the Nessus Scripts License for details...

ZH2004-05SA (security advisory): Sql Injection Vulnerability in BosDates

ZH2004-05SA security advisory: Sql Injection Vulnerability in BosDates Published: 11 february 2004 Released: 11 february 2004 Name: BosDates Affected Systems: current and prior versions Issue: Sql Injection Vulnerability Author: G00db0y from Zone-h Security Labs - [email protected] Vendor:...

SRT2003-11-02-0115 - NIPrint LPD-LPR Remote overflow

Secure Network Operations, Inc. http://www.secnetops.com/research Strategic Reconnaissance Team [email protected] Team Lead Contact [email protected] Our Mission: Secure Network Operations offers expertise in Networking, Intrusion Detection Systems IDS, Software Security Validation, and...

Comment Board XSS Vulnerability

Comment Board XSS Vulnerability Published: 24 September 2003 Released: 24 September 2003 Affected Systems: Comment Board Vendor: http://www.ymonda.co.uk Issue: Remote attackers can inject XSS script. Description: ============ "Comment Board works straight away with little or no configuration...

[UNIX] DCForum+ XSS Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

IRISconsole allows login to the "iceadmin" account with incorrect password

Overview SGI IRIS console contains a vulnerability which may allow a local attacker to gain elevated privileges. Description SGI describes IRISconsole as a "central control point that manages and monitors servers and logs their activity." A vulnerability in IRISconsole may allow a local attacker ...

ZH2003-24SA (security advisory): ChitChat.NET XSS Vulnerability

ZH2003-24SA security advisory: ChitChat.NET XSS Vulnerability Published: 13 august 2003 Released: 13 august 2003 Name: ChitChat.NET Affected Systems: 2.0 Issue: Remote attackers can inject XSS script Author: [email protected] Vendor: http://clickcess.com/ Description Zone-h Security Team has...

ZH2003-18SA (security advisory): News Wizard Path Disclosure

ZH2003-18SA security advisory: News Wizard Path Disclosure Published: 10 august 2003 Released: 10 august 2003 Name: News Wizard Affected Systems: 2.0 Issue: Remote attackers can know the path of the site Author: G00db0y zone-h org Vendor: http://www.imediasoftware.com/products/newswizard/...

paFileDB 3.1

============================ Security REPORT paFileDB 3.1 ============================ Product: paFileDB Version 3.1 and earlier Vulnerablities: arbitrary file-upload, path-traversal, arbitrary OS command-execution Vuln.-classes: http://www.owasp.org/asac/parametermanipulation/forms.shtml...

Hosting Controller Multiple Script Arbitrary Directory Browsing

The Hosting Controller application resides on this server. This version is vulnerable to multiple remote exploits. At attacker may make use of this vulnerability and use it to gain access to confidential data and/or escalate their privileges on the Web server. %NASLMINLEVEL 70300 This script was...

PDGSoft Shopping Cart Multiple Vulnerabilities

The executables 'redirect.exe' and/or 'changepw.exe' exist on this web server. Some versions of these files are vulnerable to remote exploit. An attacker can use this hole to gain access to confidential data or escalate their privileges on the web server. As Nessus solely relied on the existence ...

Lucent VitalNet VsSetCookie.exe Unauthorized Access

The VsSetCookie.exe CGI exists on the remote web server. Some versions of this file have an unauthorized access vulnerability. Making a request similar to : http://www.example.com/cgi-bin/VsSetCookie.exe?vsuser= will result in full access if a valid username is provided. Please note Nessus solely...

PostNuke Rating System DoS

The remote host is running PostNuke. PostNuke Phoenix 0.721, 0.722 and 0.723 allows a remote attacker causes a denial of service to legitmate users, by submitting a string to its rating system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Note: Based on the proof of concept example, NOT...

zlib "gzprintf()" function vulnerable to buffer overflow

Overview A buffer overflow exists in one of the functions included with the zlib compression library. This vulnerability may allow a remote attacker to execute arbitrary code or cause a denial of service. An exploit for this vulnerability is publicly available. Description The zlib website...

Proxy Web Server XSS

The remote host is running a proxy web server that fails to adequately sanitize request strings of malicious JavaScript. By leveraging this issue, an attacker may be able to cause arbitrary HTML and script code to be executed in a user's browser within the security context of the affected site. C...

tcpdump enters infinite loop when parsing crafted ISAKMP packets

Overview There is a denial-of-service vulnerability in tcpdump that may allow a remote attacker to cause tcpdump to enter an infinite loop. Description tcpdump, a tool used to monitor network traffic, has the ability to capture Internet Security Association and Key Management Protocol ISAKMP...

Oracle E-Business Suite Report Review Agent (RRA) allows arbitrary files to be retrieved with no authentication

Overview A vulnerability in Oracle's E-Business Suite Report Review Agent RRA allows arbitrary files to be retrieved with no authentication. Description A vulnerability exists in the Oracle E-Business Suite Report Review Agent RRA. This vulnerability may allow a remote attacker to retrieve...

SGI IRIX "xfsdump" creates quota information files insecurely

Overview A vulnerability exists in xfsdump on SGI IRIX. Exploitation of this vulnerability may allow a local attacker to gain root privileges. Because other operating systems ship with xfsdump, vendors other than SGI may be affected. Description From the xfsdump man page:xfsdump backs up files an...