PeerCast procConnectArgs() Function URL Handling Remote Overflow

The version of PeerCast installed on the remote host copies the supplied option string without limit into a finite-size buffer. An unauthenticated attacker can leverage this issue to crash the affected application and possibly to execute arbitrary code on the remote host subject to the privileges...

Microsoft CryptoAPI Version Check

Binary data 3381.prm...

Unreal Tournament 2004 "secure" Overflow (Win32)

This is an exploit for the GameSpy secure query in the Unreal Engine. This exploit only requires one UDP packet, which can be both spoofed and sent to a broadcast address. Usually, the GameSpy query server listens on port 7787, but you can manually specify the port as well. The RunServer.sh scrip...

MyBloggie 2.1.1 2.1.2 - SQL Injection

MyBloggie 2.1.1 2.1.2 - SQL Injection !/usr/bin/perl -w SQL Injection Exploit for myBloggie 2.1.1 - 2.1.2 This exploit show the username of the administrator of the blog and his password crypted in MD5 Related advisories: Italian...

iTunes < 4.8.0 MPEG-4 Parsing Overflow (Mac OS X)

The remote host is running a version of iTunes which is older than version 4.8.0. Such versions reportedly fail to perform certain validation checks on MPEG4 files, and hence it could be possible to trigger a buffer overflow condition. Successful exploitation of this issue could lead to a denial ...

Berlios gpsd gpsd_report() Function Format String

The remote host is running GPSD, a daemon which monitors a GPS device and publishes its data over the network. The remote version of this software is vulnerable to format string attack due to the way it uses the syslog call. An attacker may exploit this flaw to execute arbitrary code on the remot...

ISC BIND < 9.3.1 Validator Self Checking Remote DoS

The remote BIND server, according to its version number, has a flaw in the way 'authvalidator' is implemented. Provided DNSSEC has been enabled in the remote name server, an attacker may be able to launch a denial of service attack against the remote service. C Tenable Network Security, Inc...

MS05-002: Cursor and Icon Format Handling Code Execution (891711)

The remote host contains a version of the Windows kernel that is affected by a security flaw in the way that cursors and icons are handled. An attacker may be able to execute arbitrary code on the remote host by constructing a malicious web page and entice a victim to visit this web page. An...

MySQL < 3.23.59 / 4.0.21 Multiple Vulnerabilities

The remote host is running a version of the MySQL database which is older than 4.0.21 or 3.23.59. MySQL is a database which runs on both Linux/BSD and Windows platform. The remote version of this software is vulnerable to specially crafted 'ALTER TABLE SQL' query which can be exploited to bypass...

Mozilla Firefox Error Reporting Version Check (deprecated)

Binary data 2285.prm...

JetRoot_pl.txt

!/usr/bin/perl use IO::Socket; This is an exploit for HP Web JetAdmin, the printer management server from HP. It is NOT about printers! The service usually runs on port 8000 on Windows, Solaris or Linux boxes. Greetz: The Phenoelit People, c-base crew, EEyE rock!, Halvar on the other side of the...

HP Web JetAdmin 6.5 - 'connectedNodes.ovpl' Remote Code Execution

!/usr/bin/perl use IO::Socket; This is an exploit for HP Web JetAdmin, the printer management server from HP. It is NOT about printers! The service usually runs on port 8000 on Windows, Solaris or Linux boxes. Greetz: The Phenoelit People, c-base crew, EEyE rock!, Halvar on the other side of the...

Apache 2.0.x < 2.0.49 mod_ssl Plain HTTP Request DoS

The remote host appears to be running a version of Apache 2.0.x prior to 2.0.49. It is, therefore, affected by a denial of service vulnerability in the 'modssl' module. An attacker can exploit this to deny service to the Apache server. C Tenable Network Security, Inc. include"compat.inc"; if...

Exim < 4.22 smtp_in.c HELO/EHLO Remote Overflow

According to its banner, the version of Exim running on the remote host has a remote heap-based buffer overflow vulnerability. A remote, unauthenticated attacker could potentially exploit this to execute arbitrary code. C Tenable Network Security, Inc. include"compat.inc"; ifdescription...

ProFTPD 1.2.0rc2 Malformed cwd Command Format String

The remote ProFTPd server is as old or older than 1.2.0rc2 There is a very hard to exploit format string vulnerability in this version that could allow an attacker to execute arbitrary code on this host. The vulnerability is believed to be nearly impossible to exploit though. C Tenable Network...

Sendmail < 8.7.6 Multiple Local Vulnerabilities

The remote Sendmail server, according to its version number, has a buffer overflow and denial of service problem. Using a flaw in the GECOS field handling, it may allow a local user to gain root access. C Tenable Network Security, Inc. Original script by Xue Yong Zhi Changes by Tenable: - Revised...

Sendmail < 8.10.0 mail.local Newline Handling Remote DoS

mail.local in the remote Sendmail server, according to its version number, does not properly identify the .\n string which identifies the end of message text, which allows a remote attacker to cause a denial of service or corrupt mailboxes via a message line that is 2047 characters long and ends ...

mod_frontpage for Apache fpexec Remote Overflow

The remote host is using the Apache modfrontpage module. modfrontpage older than 1.6.1 is vulnerable to a buffer overflow that could allow an attacker to gain root access. Since Nessus was not able to remotely determine the version of modfrontage you are running, you are advised to manually check...

IRIX talkd vulnerability

-----BEGIN PGP SIGNED MESSAGE----- SGI Security Advisory Title: talkd vulnerability Number: 20020603-01-I Date: June 10, 2002 Reference: CVE-2000-1010 - ----------------------- - --- Issue Specifics --- - ----------------------- It's been reported that the /usr/etc/talkd daemon contains a format...

MediaMail vulnerability

-----BEGIN PGP SIGNED MESSAGE----- SGI Security Advisory Title: MediaMail vulnerability Number: 20020602-01-I Date: June 6, 2002 Reference: CAN-2002-0358 - ----------------------- - --- Issue Specifics --- - ----------------------- It's been reported that the "MediaMail" and "MediaMail Pro" the...