CVE-2000-1176

CVE-2000-1176 describes a directory-traversal vulnerability in YaBB’s search.pl CGI script, permitting remote attackers to read arbitrary files by abusing a .. (dot dot) input in the catsearch form field. The issue is documented for YaBB SE configurations, including references to older plugins th...

CVE-2000-1176

Directory traversal vulnerability in YaBB search.pl CGI script allows remote attackers to read arbitrary files via a .. dot dot attack in the "catsearch" form field...

CVE-2000-0853

YaBB Bulletin Board 9.1.2000 allows remote attackers to read arbitrary files via a .. dot dot attack...

Дырки в YaBB search.pl

Классические ошибки Perl-CGI позволяют доступ к любому файлу и выполнение любых приложений...

Insecure input balidation in YaBB Search.pl

Hi Everybody, Kosak reported this problem to vuln-dev last night. I downloaded the script and did some testing. There is an input validation problem with the 'catsearch' field, which gets interpolated in an open statement: openFILE, "$boardsdir/$cattosearch" || &fatalerror"$txt'23'...

YaBB 9.11.2000 - search.pl Arbitrary Command Execution

YaBB 9.11.2000 - search.pl Arbitrary Command Execution source: https://www.securityfocus.com/bid/1921/info YaBB Yet Another Bulletin Board is a popular perl-based bulletin board scripting package. search. pl, one of several perl scripts which comprise YaBB, fails to properly validate user input...

YaBB 9.11.2000 - 'search.pl' Arbitrary Command Execution

source: https://www.securityfocus.com/bid/1921/info YaBB Yet Another Bulletin Board is a popular perl-based bulletin board scripting package. search. pl, one of several perl scripts which comprise YaBB, fails to properly validate user input which arguments a call to open. A malicious user could...

yabb.txt

YaBB 9.1.2000 Multiple Vulnerabilities + Advisory by pestilence www.synnergy.net |===============================================| Affected program: YABB 9.1.2000 previous ? System : Linux, UNIX, Windows Problem : Problem located in all scripts that handle files. Discovery :...

YaBB YaBB.pl num Parameter Traversal Arbitrary File Access

The 'YaBB.pl' CGI script is installed on the remote host. This script has a well-known security flaw that lets an attacker read arbitrary files with the privileges of the http daemon usually root or nobody. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

YaBB 1.9.2000 Vulnerabilitie

YaBB 9.1.2000 Multiple Vulnerabilities + Advisory by pestilence www.synnergy.net |===============================================| Affected program: YABB 9.1.2000 previous ? System : Linux, UNIX, Windows Problem : Problem located in all scripts that handle files. Discovery :...

Дырка в YaBB

Проблема "ядовитого нуля" poisoned null byte в перл-скрипте позволяет выполнение кода на сервере...

YaBB 9.1.2000 - Arbitrary File Read

YaBB 9.1.2000 - Arbitrary File Read source: https://www.securityfocus.com/bid/1668/info YaBB.pl, a web-based bulletin board script, stores board postings in numbered text files. The numbered file name is specified in the call to YaBB.pl in the variable num=. Before retrieving the file, YaBB will...

YaBB 9.1.2000 - Arbitrary File Read

source: https://www.securityfocus.com/bid/1668/info YaBB.pl, a web-based bulletin board script, stores board postings in numbered text files. The numbered file name is specified in the call to YaBB.pl in the variable num=. Before retrieving the file, YaBB will append a .txt extension to . Due to...