964 matches found
CVE-2004-0749
The modauthzsvn module in Subversion 1.0.7 and earlier does not properly restrict access to all metadata on unreadable paths, which could allow remote attackers to gain sensitive information via 1 svn log -v, 2 svn propget, or 3 svn blame, and other commands that follow renames...
CVE-2004-0601
distcc before 2.16, when running on 64-bit platforms, does not interpret IP-based access control rules correctly, which could allow remote attackers to bypass intended restrictions...
CVE-2004-0811
Unknown vulnerability in Apache 2.0.51 prevents "the merging of the Satisfy directive," which could allow attackers to obtain access to restricted resources contrary to the specified authentication configuration...
Apache <= 2.0.51 Satisfy Directive Access Control Bypass
The remote host is running Apache web server 2.0.51. It is reported that this version of Apache is vulnerable to an access control bypass attack. This issue occurs when using the 'Satisfy' directive. An attacker may gain unauthorized access to restricted resources if access control relies on this...
CVE-2004-0148
wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead...
CVE-2004-0582
Unknown vulnerability in Webmin 1.140 allows remote attackers to bypass access control rules and gain read access to configuration information for a module...
PHP-Nuke 0-7 - Delete God Admin Access Control Bypass
source: https://www.securityfocus.com/bid/10861/info PHP-Nuke is reported prone to an access control bypass vulnerability. Reports indicate that a PHP-Nuke superuser may bypass access controls and privilege restrictions, to delete the PHP-Nuke "God Admin" account. This may be accomplished by maki...
Mandrake Linux Security Advisory : squid (MDKSA-2004:025)
A vulnerability was discovered in squid version 2.5.STABLE4 and earlier with the processing of %-encoded characters in a URL. If a squid configuration uses ACLs Access Control Lists, it is possible for a remote attacker to create URLs that would not be properly tested against squid's ACLs,...
CVE-2004-0582
Unknown vulnerability in Webmin 1.140 allows remote attackers to bypass access control rules and gain read access to configuration information for a module...
DSA-512 gallery - unauthenticated access
Bulletin has no description...
PHP-Nuke 5.x/6.x/7.x - Direct Script Access Security Bypass
source: https://www.securityfocus.com/bid/10447/info PHP-Nuke is affected by a direct script access security vulnerability. This issue is due to a failure to properly validate the location and name of the file being accessed. This issue will allow an attacker to gain access to sensitive scripts...
DSA-474 squid - ACL bypass
Bulletin has no description...
Squid ACL [url_regex] bypass vulnerability
Background Squid is a fully-featured Web Proxy Cache designed to run on Unix systems that supports proxying and caching of HTTP, FTP, and other URLs, as well as SSL support, cache hierarchies, transparent caching, access control lists and many other features. Description A bug in Squid allows use...
Microsoft Internet Explorer 6 - Codebase Double Backslash Local Zone File Execution
Microsoft Internet Explorer 6 - Codebase Double Backslash Local Zone File Execution source: https://www.securityfocus.com/bid/10344/info A vulnerability has been reported that may potentially permit HTML documents to gain unauthorized access to local resources by using specific syntax when...
Microsoft Outlook Express 6.0 - MHTML Forced File Execution (2)
source: https://www.securityfocus.com/bid/9105/info A vulnerability has been discovered in Microsoft Outlook Express when handling MHTML file and res URIs that could lead to an unexpected file being downloaded and executed. The problem occurs due to the component failing to securely handle MHTML...
CVE-2002-1227
PAM 0.76 treats a disabled password as if it were an empty null password, which allows local and remote attackers to gain privileges as disabled users...
CVE-2001-0514
SNMP service in Atmel 802.11b VNET-B Access Point 1.3 and earlier, as used in Netgear ME102 and Linksys WAP11, accepts arbitrary community strings with requested MIB modifications, which allows remote attackers to obtain sensitive information such as WEP keys, cause a denial of service, or gain...
EServ 2.9x - Password-Protected File Access
EServ 2.9x - Password-Protected File Access source: https://www.securityfocus.com/bid/3838/info EServ is a combination Mail, News, Web, FTP and Proxy Server for Microsoft Windows 9x/NT/2000 systems. It is possible to construct a web request which is capable of accessing the contents of password...