what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 6 of 6 RSS Feed

Files

BWL-00-04.txt
Posted Dec 7, 2000
Authored by Black Watch Labs | Site perfectotech.com

Black Watch Labs Security Advisory #00-04 (April 6, 2000) - BizDB is a database and search engine software by Cnctek. Part of the installation is a CGI script, ?bizdb-search.cgi? which is used to search the bizdb database. This script is vulnerable to modification of its paramater, in such way that causes it to run user provided shell commands on the server. Exploit URL's included. These issues have been resolved in newer versions of this software, make sure to upgrade!

tags | shell, cgi
SHA-256 | 24a4ed5c6abb15a3bce91a5494875ecada0d11f6a7bde42b93605a2e1bbe0bd7
BWL-00-01.txt
Posted May 15, 2000
Authored by Black Watch Labs | Site perfectotech.com

Black Watch Labs Security Advisory #00-01 (Feb 17, 2000) - Search Engines (e.g. AltaVista and InfoSeek) can be used to reveal potential application-level vulnerabilities in indexed web sites. Easily formed queries which incorporate the "signature" of a suspected vulnerability can be used to list the sites which match the signature, that is, which contain the "suspicious" content. In some cases, hundreds of thousands of web sites can be located with one query. Check your site with the Site Checker, available here.

tags | web, vulnerability
SHA-256 | b23b5c9a49d3431454f6f18165fc7b311b2ec51ba209fb0c03bbdb689e5d4cb5
BWL-00-02.txt
Posted May 15, 2000
Authored by Black Watch Labs | Site perfectotech.com

Black Watch Labs Security Advisory #00-02 (March 6, 2000) - Weak Token in Mail.Com Application Allows Compromise of Arbitrary User's Data. A mail application used by some free mail services employs a weak security scheme. It assigns session-IDs ("tokens") for logged-in users which allow reading of arbitrary users' messages and private information.

tags | arbitrary
SHA-256 | 7815a9188518f7dca9bb895ee2d46cbe8a4c31d7ce086fa88d7be614939b7586
BWL-00-03.txt
Posted May 15, 2000
Authored by Black Watch Labs | Site perfectotech.com

Black Watch Labs Security Advisory #00-03 (March 21, 2000) - Some Infonautics' applications utilize the getdoc.cgi CGI in such a way that allows attackers to gain (read) access to a document they would otherwise have to pay in order to view. Exploit information included.

tags | cgi
SHA-256 | 452d7b13a78df9296b9e59cb7fe9b53a341a3e312bef4a8b78dbb6ff6b070cba
BWL-00-05.txt
Posted May 15, 2000
Authored by Black Watch Labs | Site perfectotech.com

Black Watch Labs Security Advisory #00-05 (May 5, 2000) - Gossamer Threads DBMan (db.cgi) allows several environment variables to be viewed by the attacker, who can gain useful information on the site, making further attacks more feasible. DBMan dumps useful information (e.g. script location, HTTP root, version of Perl, server_admin, server_name, path) to the browser when the database file provided is incorrect. Perl exploit included.

tags | web, cgi, root, perl
SHA-256 | 485c3ed371b4d4908dc15aa1b5897004475b7ec04963a5c0d18aa9f693cc295d
BWL-00-06.txt
Posted May 15, 2000
Authored by Black Watch Labs | Site perfectotech.com

Black Watch Labs Security Advisory #00-06 (May 10, 2000) - Environment and Setup Variables can be Viewed through FormMail.cgi Script. The FormMail.cgi script allows several environment variables to be viewed by the attacker, who can gain useful information on the site, making further attacks more feasible. The script will also happily send mail to an attackers mail account instead for analysis.

tags | cgi
SHA-256 | 135d0a527bf7c613354d24bb5a6f2d074464d55112223f28116ab0b356802998
Page 1 of 1
Back1Next

Top Authors In Last 30 Days

Recent News

News RSS Feed
Apple Suddenly Drops NSO Group Spyware Lawsuit
Posted Sep 18, 2024

tags | headline, privacy, phone, flaw, israel, spyware, apple
11 Dead, Thousands Injured In Explosive Supply Chain Attack On Hezbollah Pagers
Posted Sep 18, 2024

tags | headline, wireless, cyberwar, israel, terror, backdoor
Cops Across The World Arrest 51 In Orchestrated Takedown Of Ghost Crime Platform
Posted Sep 18, 2024

tags | headline, hacker, government, australia, cybercrime, fraud
Wait... Did Pagers Get Hacked To Blow People Up?
Posted Sep 17, 2024

tags | headline, cyberwar, israel, terror
Predator Spyware Kingpins Added To US Sanctions List
Posted Sep 17, 2024

tags | headline, hacker, government, privacy, spyware
D-Link Patches Critical Router Vulnerabilities
Posted Sep 17, 2024

tags | headline, flaw, patch
France Uses Tough, Untested Cybercrime Law To Target Durov
Posted Sep 17, 2024

tags | headline, government, cybercrime, france, social
Malware Attack Targets US-Taiwan Defense Conference
Posted Sep 17, 2024

tags | headline, government, malware, usa, china, cyberwar, taiwan, military
TikTok Is Getting Its Day In Court
Posted Sep 16, 2024

tags | headline, government, privacy, usa, phone, china, cyberwar, spyware
Ransomware Group Leaks Data Stolen From Kawasaki Motors
Posted Sep 16, 2024

tags | headline, hacker, privacy, cybercrime, data loss, cryptography
View More News →
packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close