Exploit the possiblities
Showing 1 - 25 of 28 RSS Feed

Files Date: 2000-07-01

asb00-15.jrun.samplecode
Posted Jul 1, 2000
Site allaire.com

Allaire Security Bulletin (ASB00-15) - JRun 2.3.x includes a number of example applications and sample code that expose security issues. JRun 3.0 addresses the viewsource.jsp issue. Allaire strongly recommends that customers follow the best practice of not installing sample code and documentation on production servers, and removing the sample code and documentation files from production servers and restricting access to those directories where they are installed on workstations.

MD5 | e94d56741d8066033490a1a8293fb3f2
asb00-14.coldfusion.admin
Posted Jul 1, 2000
Site allaire.com

Allaire Security Bulletin (ASB00-14) - Allaire has recently been notified by Foundstone, Inc. (see Revisions section below for contact information) of a denial of service attack against an unprotected installation of the ColdFusion Administrator. This issue only affects ColdFusion Servers that have not followed Allaire's recommendations in the Allaire Security Best Practices article 10954.

tags | denial of service, add administrator
MD5 | ceccb518e5bf04b3975045321d9b1a9f
asb00-13.iis.htr.request
Posted Jul 1, 2000
Site allaire.com

Allaire Security Bulletin (ASB00-13) - Microsoft has released a patch for two security vulnerabilities in Microsoft(r) Internet Information Server. The vulnerabilities could, respectively, be used to slow an affected web server's response or to obtain the source code of certain types of files under very restricted conditions. This is not a problem with ColdFusion Server itself, but it is an issue that can affect ColdFusion users. Allaire recommends that customers follow the instructions posted on the Microsoft Web site to address this issue.

tags | web, vulnerability
MD5 | 193258e275f4bf44ef3af0b0281e1d78
asb00-11.iis.imagemap
Posted Jul 1, 2000
Site allaire.com

Allaire Security Bulletin (ASB00-11) - A procedure is available to eliminate a security vulnerability affecting several web server products. The vulnerability could potentially allow a malicious web site visitor to perform actions that the system permissions authorize him to perform, but which he previously may have had no means of actually carrying out. This is not a problem with ColdFusion Server itself, but it is an issue that can affect ColdFusion users. Allaire recommends that customers follow the instructions posted on the Microsoft Web site to address this issue.

tags | web
MD5 | 64ff08b95cf484851db9a133fc6d98ca
asb00-08.iis.escaped
Posted Jul 1, 2000
Site allaire.com

Allaire Security Bulletin (ASB00-08) - Microsoft has announced a Microsoft has released a patch for a security vulnerability in Microsoft(r) Internet Information Server. The vulnerability could allow a malicious user to slow a web server's response or prevent it from providing service altogether for a period of time. This is not a problem with ColdFusion Server itself, but it is an issue that can affect ColdFusion users. Allaire recommends that customers follow the instructions posted on the Microsoft Web site to address this issue.

tags | web
MD5 | e01a1fb4c6360ab15acd88334ccf22d3
asb00-09.iis.linkview
Posted Jul 1, 2000
Site allaire.com

Allaire Security Bulletin (ASB00-09) - Microsoft has released a procedure to eliminate a security vulnerability that could allow a malicious user to cause a web server to crash, or potentially run arbitrary code on the server, if certain permissions have been changed from their default settings to inappropriate ones. This is not a problem with ColdFusion Server itself, but it is an issue that can affect ColdFusion users. Allaire recommends that customers follow the instructions posted on the Microsoft Web site to address this issue.

tags | web, arbitrary
MD5 | 7c7ebab5aa6415205df2158a47166718
asb00-10.spectra.preview
Posted Jul 1, 2000
Site allaire.com

Allaire Security Bulletin (ASB00-10) - The Spectra Container Editor Preview does not properly enforce object security. Allaire has released a patch that addresses this issue.

MD5 | d68c2c3a601ef9b11f343fd1985abf10
asb00-07.hithighlight
Posted Jul 1, 2000
Site allaire.com

Allaire Security Bulletin (ASB00-07) - Microsoft has announced a vulnerability for Microsoft IIS which exposes the ability to use a malformed URL to read the source code of ASP, CFML, Perl and other files that are on a server. This is not a problem with ColdFusion Server itself, but it is an issue that can affect ColdFusion users.

tags | perl, asp
MD5 | ff8f49f8316ff6560f047c56fabef015
asb00-06.forums
Posted Jul 1, 2000
Site allaire.com

Allaire Security Bulletin (ASB00-06) - Allaire has recently been notified of a security issue in the Allaire Forums 2.0.5 software. This behavior allows users to view and post to secure discussion threads via unsecured conferences and/or through email. This issue affects multiple templates in the Forums software. Updated versions of the affected templates are available from the following link: Download - Allaire Forums 2.0.5 Security Patch.

MD5 | ade5ff08b372e1c1e6fb121a559ddeb9
asb99-11.mdac_rds
Posted Jul 1, 2000

asb99-11.mdac_rds

MD5 | e2179c59cb2a70cdd3142b67c23b99dc
asb00-05.cross.site.scripting
Posted Jul 1, 2000
Site allaire.com

Allaire Security Bulletin (ASB00-05) - A new type of security attack called "cross-site scripting" has surfaced which is based on common website design flaws and data manipulation that web browsers use when communicating with web servers. While the problem is not a vendor-specific issue, it does affect many web servers and virtually all web browsers currently in use. The problem lies with the design and coding techniques of web sites that serve dynamically generated HTML pages rather than the software the websites themselves run on.

tags | web, xss
MD5 | bcc7a83a8dc1242efc0a3a693d749170
asb00-04.spectraauth
Posted Jul 1, 2000
Site allaire.com

Allaire Security Bulletin (ASB00-04) - There is a security issue with the Spectra 1.0 Remote Access Service invoke.cfm template. Normally users must be authenticated in the webtop security context in order to even attempt to use the Remote Access Service. However, if the user passes a parameter called "bAuthenticated" via the URL, a form field, or a WDDX packet, and the user does not specify a username, a bug allows them to use the Remote Access Service even if they are not in the webtop user directory.

tags | remote
MD5 | 51ea1428a3787f7ea58db829256c3d14
asb00-01.spectrawebtop
Posted Jul 1, 2000
Site allaire.com

Allaire Security Bulletin (ASB00-01) - The Allaire Spectra 1.0 Webtop allows authenticated users to access sections of the Webtop they may not have been granted access to by typing explicit URLs. This exploit does not give anyone access to the Webtop who does not already have permissions to at least one section of the Webtop.

MD5 | fb2f039affb384c48bc2d1a8e9b964e2
asb00-02.spectrados
Posted Jul 1, 2000
Site allaire.com

Allaire Security Bulletin (ASB00-02) - When installing Allaire Spectra 1.0, a web-based Configuration Wizard is used to finalize a number of configuration settings, including a step which indexes data collections on the server. This step of the Configuration Wizard can be accessed via URL and the collections can be resubmitted for indexing. This could be used in a denial of service attack on an Allaire Spectra server.

tags | web, denial of service
MD5 | b301a471c650bc6cb84cd31459e26055
asb00-03.cfcache
Posted Jul 1, 2000
Site allaire.com

Allaire Security Bulletin (ASB00-03) - Patch Available For Potential Information Exposure by the CFCACHE Tag. The CFCACHE tag is a feature available in ColdFusion 4.x to perform template caching to increase page delivery performance by intelligently compiling and storing the output of CFML pages for faster access. When this tag is utilized in a .CFM page it creates several temporary files, including one that contains absolute filenames with directory path information, URL parameters and timestamps. In ColdFusion 4.0x, these files are stored in the same directory as the .CFM page, usually in a publicly accessible web document directory.

tags | web
MD5 | db11e35811a8db95e915bfbd5d9a53ff
asb00-12.querystring
Posted Jul 1, 2000
Site allaire.com

Allaire Security Bulletin (ASB00-12) - ClusterCATS Appends Stale Query String to URL Line during HTML Redirection. The vulnerability potentially releases confidential query string information on redirect. Affected software versions include ClusterCATS ColdFusion.

MD5 | a1ab2891a0e9049c67bc337d3d3a1d2d
pscan2.c
Posted Jul 1, 2000
Authored by Ozone

pscan2.c is a simple tcp port scanner.

tags | tool, scanner, tcp
systems | unix
MD5 | 20cfda79f08a7d2ebc8be6b97c40b47c
killbgproc.pl
Posted Jul 1, 2000
Authored by Doxavg

killbgproc.pl daemonizes, watches for running processes with no attached terminal and kills it. Easily configureable to define the minimum user id that you want to start killing.

tags | tool
systems | unix
MD5 | 2c12f355de93e5f73484bcf81f2a95a8
cpd.c
Posted Jul 1, 2000
Authored by Antipent

CheckPoint IP firewall crashes when it detects packets coming from a different MAC with the same IP address as itself. We simply send a few spoofed UDP packets to it.

tags | exploit, udp, spoof
MD5 | 43e50de928baed23be3b74113f73d89c
ms00-042
Posted Jul 1, 2000

Microsoft Security Bulletin (MS00-042) - Microsoft has released a patch for a security vulnerability in an ActiveX control that ships with Microsoft Internet Explorer. The "Active Setup Download" vulnerability can be used to overwrite files on the computer of a user who visits a malicious web site. Microsoft FAQ on this issue available here.

tags | web, activex
MD5 | 22a784f90f4b447cf69b83af480a365b
wuXploit.tgz
Posted Jul 1, 2000
Authored by WC

Wu-Ftpd 2.4.2, 2.5, and 2.6 are commonly misconfigured on linux to allow users which only have a valid FTP account to execute code. This code takes advantage of this configuration, mentioned in SUID Advisory #1 to execute a backdoor on the remote host.

tags | exploit, remote
systems | linux
MD5 | d42dbe704ceb3b2ece51cbe5bab0635d
SuSeLocaltmpXploit.c
Posted Jul 1, 2000
Authored by WC

SuSe 6.1 through 6.4 local exploit - when root switches users, /tmp/ will be the $HOME. This exploit will create a suid (user) shell when root su's to a user account.

tags | exploit, shell, local, root
systems | linux, suse
MD5 | 91f2f626de87a360c208460fa31313ef
Xnapster.c
Posted Jul 1, 2000
Authored by WC

Gnapster 1.3.8 and Knapster 0.9 remote view file exploit.

tags | exploit, remote
MD5 | 1523a31999d4f7263643b1735108fd4e
proftpX.c
Posted Jul 1, 2000
Authored by WC

ProFTPD 1.2pre4 remote buffer overflow exploit. Requires a writable directory.

tags | exploit, remote, overflow
MD5 | 96b755d8aece2dbd1fe702946b84faf3
JRUNremoteXploit.tgz
Posted Jul 1, 2000
Authored by WC

JRun 2.3 remote buffer overflow exploit. Runs a shell on the port where the JRun webserver daemon is running.

tags | exploit, remote, overflow, shell
MD5 | ad2ba8019d3b2e08fa6b1c043b6d1ed7
Page 1 of 2
Back12Next

File Archive:

November 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    22 Files
  • 2
    Nov 2nd
    28 Files
  • 3
    Nov 3rd
    10 Files
  • 4
    Nov 4th
    1 Files
  • 5
    Nov 5th
    5 Files
  • 6
    Nov 6th
    15 Files
  • 7
    Nov 7th
    15 Files
  • 8
    Nov 8th
    13 Files
  • 9
    Nov 9th
    9 Files
  • 10
    Nov 10th
    9 Files
  • 11
    Nov 11th
    3 Files
  • 12
    Nov 12th
    2 Files
  • 13
    Nov 13th
    15 Files
  • 14
    Nov 14th
    17 Files
  • 15
    Nov 15th
    19 Files
  • 16
    Nov 16th
    15 Files
  • 17
    Nov 17th
    19 Files
  • 18
    Nov 18th
    4 Files
  • 19
    Nov 19th
    2 Files
  • 20
    Nov 20th
    9 Files
  • 21
    Nov 21st
    15 Files
  • 22
    Nov 22nd
    23 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close