1704 matches found
Linux Kernel 2.22.4 - Deep Symbolic Link Denial of Service
Linux Kernel 2.22.4 - Deep Symbolic Link Denial of Service source: https://www.securityfocus.com/bid/3444/info A denial-of-service vulnerability exists in several versions of the Linux kernel. The problem occurs when a user with local access creates a long chain of symbolically linked files. When...
Microsoft IIS 5.0 - In-Process Table Privilege Escalation
Microsoft IIS 5.0 - In-Process Table Privilege Escalation source: https://www.securityfocus.com/bid/3193/info A vulnerability exists in Microsoft's Internet Information Services 5.0 which could allow a user with write permission to run any code with System privileges...
[SECURITY] [DSA-071-1] fetchmail remote exploit
Package : fetchmail Problem type : memory corruption Debian-specific: no Salvatore Sanfilippo found two remotely exploitable problems in fetchmail while doing a security audit. In both the imap and pop3 code the input is not verified and used to store a number in an array. Since no bounds checkin...
Fetchmail 5.x - IMAP Reply Signed Integer Index
Fetchmail 5.x - IMAP Reply Signed Integer Index // source: https://www.securityfocus.com/bid/3166/info Fetchmail is a unix utility for downloading email from mail servers via POP3 and IMAP. Fetchmail contains a vulnerability that may allow for remote attackers to gain access to client systems. Th...
top format string bug exploit code (exploitable)
hi. It still seems to be affected under 3.5beta9 including this version someone said it's not the problem of exploitable vulnerability about 8 month ago , but it's possible to exploit though situation is difficult. following code and some procedure comments demonstrate it. possible to get kmem...
FreeBSD - '/usr/bin/top' Format String
/ freebsd x86 top exploit affected under top-3.5beta9 including this version 1. get the address of .dtors from /usr/bin/top using objdump , 'objdump -s -j .dtors /usr/bin/top' 2. divide it into four parts, and set it up into an environment variable like "XSEO=" 3. run top, then find "your parted...
CVE-2001-1078
Format string vulnerability in flog function of eXtremail 1.1.9 and earlier allows remote attackers to gain root privileges via format specifiers in the SMTP commands 1 HELO, 2 EHLO, 3 MAIL FROM, or 4 RCPT TO, and the POP3 commands 5 USER and 6 other commands that can be executed after POP3...
ghttpd 1.4 - Daemon Buffer Overflow
// source: https://www.securityfocus.com/bid/2879/info ghttpd is a freely available, open source web server for Unix systems. ghttpd supports CGI and is easy to configure and use. A buffer overflow is known to exist in ghttp which will allow arbitrary code to be executed with the privileges of th...
MDBms 0.96/0.99 - Query Display Buffer Overflow
source: https://www.securityfocus.com/bid/2867/info MDBMS is a free relational database management system. A buffer overflow condition exists in MDBMS. By issuing the '\s' command to display the query buffer when it contains a large amount of data, it may be possible for a remote user to trigger...
Microsoft IIS 3.04.05.0 - PWS Escaped Characters Decoding Command Execution (5)
Microsoft IIS 3.04.05.0 - PWS Escaped Characters Decoding Command Execution 5 source: https://www.securityfocus.com/bid/2708/info Due to a flaw in the handling of CGI filename program requests, remote users can execute arbitrary commands on an IIS host. When IIS receives a CGI filename request, i...
IRIX 5.36.26.36.46.56.5.11 - usrlibprintnetprint Local Privilege Escalation
IRIX 5.36.26.36.46.56.5.11 - usrlibprintnetprint Local Privilege Escalation !/bin/sh copyright LAST STAGE OF DELIRIUM jul 2000 poland ://lsd-pl.net/ /usr/lib/print/netprint This code gets released due to another post to the Bugtraq mailing list. For IRIX 6.3 and above this privilage escalation...
Vixie Cron crontab 3.0 - Privilege Lowering Failure (1)
Vixie Cron crontab 3.0 - Privilege Lowering Failure 1 source: https://www.securityfocus.com/bid/2687/info Vixie cron is an implementation of the popular UNIX program that runs user-specified programs at periodic scheduled times. When a parsing error occurs after a modification operation, crontab...
Hexyn-sa-18.txt
Hexyn / Securax Advisory 18 - Savant WWW Unicode Directory Traversal Topic: Savant WWW Unicode Directory Traversal Announced: 2001-02-17 Affects: Savant WWW Unicode version 2.1 DISCLAIMER: THE ENTIRE ADVISORY HAS BEEN BASED UPON TRIAL AND ERROR RESULTS. THEREFORE WE CANNOT ENSURE YOU THE...
Дырка в Ultimate Bulletin Board
Можно посмотреть сообщения в закрытой паролем конференции используя функцию ответа с квотированием...
CVE-2001-0197
Format string vulnerability in printclient in icecast 1.3.8beta2 and earlier allows remote attackers to execute arbitrary commands...
FreeBSD 3.5.1/4.2 - Ports Package 'elvrec' Local Privilege Escalation
/ ja-elvis & ko-helvis - FreeBSD 3.5.1 & 4.2 ports package local root exploit vulnerable: versions prior to ja-elvis-1.8.41 and ko-helvis-1.8h21 The above two packages contain a file recovery utility 'elvrec', installed suid root4755 by default. The utility is subject to a buffer overflow leading...
Joe Text Editor 2.8 - '.joerc' Arbitrary Command Execution
source: https://www.securityfocus.com/bid/2437/info Joe is a text editor originally written by Joseph Allen. Joe offers a user-friendly interface, with key binding and configuration familiar to many users of Microsoft Word Processing tools. A problem in the sourcing of the .joerc file could lead ...
Elm 2.5.3 - Alternative-Folder Buffer Overflow
// source: https://www.securityfocus.com/bid/2403/info There is a buffer overflow in elm 2.5 PL3. This overflow is accessible by passing a long string to the -f Alternative-Folder command-line option. This vulnerability may not be restricted to this version of elm. / ------------- elm253-exploit....
Way-Board 2.0 - File Disclosure
source: https://www.securityfocus.com/bid/2370/info A remote user could gain read access to known files outside of the root directory where Way-Board resides. Requesting a specially crafted URL composed of '%00' sequences along with the known filename will disclose the requested file...