DoS - Polycom MGC 25 Control Port

------------------------------------------------------------------ - EXPL-A-2003-014 exploitlabs.com Advisory 014 ------------------------------------------------------------------ -= Polycom MGC25 =- Nutcase July 12, 2003 Vunerabilitys: ---------------- Denial of Service Product: -------- Polyco...

StarSiege Tribes Server - Denial of Service (2)

source: https://www.securityfocus.com/bid/8184/info StarSiege Tribes Game Server has been reported prone to a remotely triggered denial of service vulnerability. The issue presents itself when the affected server receives and processes a malformed UDP datagram. Reportedly when the server handles ...

FoxWeb 2.5 - PATH_INFO Remote Buffer Overrun

source: https://www.securityfocus.com/bid/8547/info FoxWeb is prone to a remotely exploitable buffer overrun vulnerability. This is due to insufficient bounds checking of user-supplied PATHINFO data to the Foxweb CGI and ISAPI extension. Successful exploitation would permit a remote attacker to...

PerlEdit

------------------------------------------------------------------ - EXPL-A-2003-010 exploitlabs.com Advisory 010 ------------------------------------------------------------------ -= PerlEdit =- exploitlabs.com June 21, 2003 Vunerability: ------------- Remote Buffer Overflow Product: --------...

MS Windows IIS 5.0 - 5.1 Remote Denial of Service Exploit

Exploit for unknown platform in category dos / poc ========================================================= MS Windows IIS 5.0 - 5.1 Remote Denial of Service Exploit ========================================================= / Microsoft IIS versions 5.0 and 5.1 remote denial of service exploit th...

Activity Monitor 2002 2.6 - Remote Denial of Service

// source: https://www.securityfocus.com/bid/7748/info A vulnerability has been reported for Activity Monitor 2002 that may be exploited to remotely trigger a denial of service condition. The problem occurs while handling data received from hosts that are not registered in the Activity Monitor...

CVE-2003-0228

Directory traversal vulnerability in Microsoft Windows Media Player 7.1 and Windows Media Player for Windows XP allows remote attackers to execute arbitrary code via a skins file with a URL containing hex-encoded backslash characters %5C that causes an executable to be placed in an arbitrary...

Working Resources BadBlue 1.7.x2.x - Unauthorized HTS Access

Working Resources BadBlue 1.7.x2.x - Unauthorized HTS Access source: https://www.securityfocus.com/bid/7638/info BadBlue is prone to a vulnerability that could allow remote attackers to gain unauthorized access to administrative functions. It is possible to bypass BadBlue security checks when...

Drag And Zip File Name Handling Overflow

The remote host is running Drag And Zip - a file compression utility. There is a flaw in this program which may allow a remote attacker to execute arbitrary code on this host. To exploit this flaw, an attacker would need to craft a special Zip file and send it to a user on this host. Then, the us...

Info-ZIP UnZip 5.50 - Encoded Character Hostile Destination Path

Info-ZIP UnZip 5.50 - Encoded Character Hostile Destination Path source: https://www.securityfocus.com/bid/7550/info Info-ZIP UnZip contains a vulnerability during the handling of pathnames for archived files. Specifically, when certain encoded characters are inserted into '../' directory travers...

ListProc 8.2.9 - Catmail ULISTPROC_UMASK Buffer Overflow

source: https://www.securityfocus.com/bid/7533/info ListProc catmail has been reported prone to a buffer overflow vulnerability when handling a ULISTPROCUMASK environment variable of excessive length. The issue is likely due to a lack of sufficient bounds checking performed when copying the...

KDE Konqueror 3.0.3 - Malformed HTML Page Denial of Service

KDE Konqueror 3.0.3 - Malformed HTML Page Denial of Service source: https://www.securityfocus.com/bid/7486/info KDE Konqueror has been reported prone to a denial of service vulnerability when rendering a HTML page that contains malformed data. Although unconfirmed, code execution may be possible...

Sendmail <= 8.12.8 prescan() BSD Remote Root Exploit

No description provided by source. / Sendmail 8.12.8 prescan PROOF OF CONCEPT exploit by bysin This is to prove that the bug in sendmail 8.12.8 and below is vulnerable. On sucessful POC exploitation the program should crash with the following: Program received signal SIGSEGV, Segmentation fault...

Qpopper 4.0.x - 'poppassd' Privilege Escalation

/ Title: Qpopper v4.0.x poppassd local root exploit. Exploit code: 0x82-Local.Qp0ppa55d.c -- ./0x82-Local.Qp0ppa55d -u x82 -p mypasswd Qpopper v4.0.x poppassd local root exploit. by Xpl017Elz / include include include include define BUFSZ 0x82 define DPOPPASS "/usr/local/bin/poppassd" define DNAM...

MDaemon SMTP/POP/IMAP server: =>6.0.7: POP remote DoS

-----BEGIN PGP SIGNED MESSAGE----- Damage Hacking Group security advisory www.dhgroup.org Product: MDaemon SMTP/POP/IMAP server =v.6.0.7 Authors: Alt-N Technologies www.mdaemon.com Vulnerability: remote DoS via POP3 service Overview----------------------------------------------------- - From...

Exploit for PoPToP PPTP server

hello bugtraq, Here is an exploit for a recently discovered vulnerability in PoPToP PPTP server under Linux. Versions affected are all prior to 1.1.4-b3 and 1.1.3-20030409. The exploit is capable of bruteforcing the RET address to find our buffer in the stack. Upon a successfull run it brings up ...

SETI@home Clients - Remote Buffer Overflow

SETI@home Clients - Remote Buffer Overflow / Seti@Home exploit by zillionatsafemode.org 2003/01/07 Credits for the vulnerability go to: SkyLined http://spoor12.edup.tudelft.nl/SkyLined%20v4.2/?Advisories/Seti@home Use this exploit in combination with a DNS spoofing utility such as the one provide...

CVE-2003-0147

...

CVE-2003-0150

MySQL 3.23.55 and earlier creates world-writeable files and allows mysql users to gain root privileges by using the "SELECT INFO OUTFILE" operator to overwrite a configuration file and cause mysql to run as root upon restart, as demonstrated by modifying my.cnf...

CuteNews Multiple Script cutepath Parameter Arbitrary Command Execution

The version of CuteNews installed on the remote host fails to sanitize input to the 'cutepath' parameter before using it in various scripts to include PHP code. An attacker may use this flaw to inject arbitrary code in the remote host and gain a shell with the privileges of the web server...