Vulnerabilidades

CryptoBuddy 1.0 and 1.2 does not use the user-supplied passphrase to encrypt data, which could allow local users to use their own passphrase to decrypt the data.

RTS CryptoBuddy 1.2 and earlier stores bytes 53 through 55 of a 55-byte passphrase in plaintext, which makes it easier for local users to guess the passphrase.

Desbordamiento de búfer en search.cgi de mnoGoSearch 3.1.20 permite a atacantes remotos ejecutar código arbitrario mediante un parámetro ul largo.

Desbordamiento de búfer en search.cgi de mnoGoSearch 3.2.10 permite a atacantes remotos ejecutar código arbitrario mediante un parámetro tmplt largo.

Vulnerabilidad de atravesamiento de directorios en ASTAware SearchDisk engine en Sun ONE Starter Kit 2.0 permite a atacantes remotos leer ficheros arbitrarios mediante un ataque de .. (punto punto)en los puertos 6015 ó 6016, o una ruta absoluta en el puerto 6017

MsmMask.exe en MondoSearch 4.4 permite a atacantes remotos obtener el código fuente de rutinas mediante el parámetro mask.

Directory traversal vulnerability in ion-p.exe (aka ion-p) allows remote attackers to read arbitrary files via (1) C: (drive letter) or (2) .. (dot-dot) sequences in the page parameter.

Cross-site scripting (XSS) vulnerability in Verity Search97 allows remote attackers to insert arbitrary web content and steal sensitive information from other clients, possibly due to certain error messages from template pages that use the (1) vformat or (2) vfilter functions.

site_searcher.cgi in Super Site Searcher allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter.

search.cgi in AGH HTMLsearch 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the template parameter.

Cross-site scripting vulnerability in search.pl for Fluid Dynamics Search Engine (FDSE) before 2.0.0.0055 allows remote attackers to execute web script via the (1) Rank or (2) Match parameters.

Múltiples desbordamientos de búfer en mnews 1.22 y anteriores permiten: a un servidor NNTP remoto ejecutar código arbitrario mediante respuestas largas, o a usuarios locales ganar privilegios mediante argumentos de línea de comando largos (-f, -n, -D, -M, -p), o mediante variables de entorno largas (JNAMES,…

Directory traversal vulnerability in Wolfram Research webMathematica 1.0.0 and 1.0.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the MSPStoreID parameter.

csSearch.cgi in csSearch 2.3 and earlier allows remote attackers to execute arbitrary Perl code via the savesetup command and the setup parameter, which overwrites the setup.cgi configuration file that is loaded by csSearch.cgi.

Cross-site scripting vulnerability in Novell Web Search 2.0.1 allows remote attackers to execute arbitrary script as other Web Search users via the search parameter.

Buffer overflow in search.cgi in mnoGoSearch 3.1.19 and earlier allows remote attackers to execute arbitrary code via a long query (q) parameter.

El gestor de licencias (mathlm) de Mathematica 4.0 y 4.1 permite que atacantes remotos pasen el control de acceso (especificado por el argumento -restrict) y roben una licencia por medio de una petición cliente que incluye el nombre de una máquina que tiene derecho a la licencia.

keyinit in S/Key does not require authentication to initialize a one-time password sequence, which allows an attacker who has gained privileges to a user account to create new one-time passwords for use in other activities that may use S/Key authentication, such as sudo.

The License Manager (mathlm) for Mathematica 4.0 and 4.1 allows remote attackers to cause a denial of service (resource exhaustion) by connecting to port 16286 and not disconnecting, which prevents users from making license requests.

Search engine in Ultraseek 3.1 and 3.1.10 (aka Inktomi Search) allows remote attackers to cause a denial of service via a malformed URL.

SGI InfoSearch CGI program infosrch.cgi allows remote attackers to execute commands via shell metacharacters.

AltaVista search engine allows remote attackers to read files above the document root via a .. (dot dot) in the query.cgi CGI program.

The Disney Go Express Search allows remote attackers to access and modify search information for users by connecting to an HTTP server on the user's system.

Hyperseek allows remote attackers to modify the hyperseek configuration by directly calling the admin.cgi program with an edit_file action parameter.