CVSS: 6.8EPSS: 93%CPEs: 38EXPL: 2CVE-2004-0595 – PHP 4.x/5.0 - 'Strip_Tags()' Function Bypass
https://notcve.org/view.php?id=CVE-2004-0595
The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities. La función strip_tags en PHP 4.x hasta 4.3.7, y 5.x hasta 5.0.0RC3, no filtra caractéres null() dentro de nombreres de etiquetas cuanto se restringe la entrada a etiquetas permitidas, lo que permite que etiquetas peligrosas sean procesadas por navegadores como Internet Explorer y Safari, que ignoran caractéres nulos y facilita la explotación de vulnerabilidades de secuencias de comandos en sitios cruzados (XSS). • https://www.exploit-db.com/exploits/24280 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000847 http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023909.html http://marc.info/?l=bugtraq&m=108981780109154&w=2 http://marc.info/?l=bugtraq&m=108982983426031&w=2 http://marc.info/?l=bugtraq&m=109051444105182&w=2 http://marc.info/? •
CVSS: 7.5EPSS: 37%CPEs: 28EXPL: 2CVE-2004-2044 – PHP-Nuke 5.x/6.x/7.x - Direct Script Access Security Bypass
https://notcve.org/view.php?id=CVE-2004-2044
PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP function with $_SERVER['PHP_SELF'] to identify the calling script, which allows remote attackers to directly access scripts, obtain path information via a PHP error message, and possibly gain access, as demonstrated using an HTTP request that contains the "admin.php" string. • https://www.exploit-db.com/exploits/24166 http://archives.neohapsis.com/archives/bugtraq/2004-06/0005.html http://archives.neohapsis.com/archives/bugtraq/2004-06/0006.html http://marc.info/?l=bugtraq&m=108611606320559&w=2 http://marc.info/?l=bugtraq&m=108611643614881&w=2 http://marc.info/?l=bugtraq&m=108662955105757&w=2 http://secunia.com/advisories/11766 http://www.osvdb.org/6593 http://www.securityfocus.com/bid/10447 https://exchange.xforce.ibmcloud.com/vulnerabi •
CVSS: 7.2EPSS: 0%CPEs: 112EXPL: 3CVE-2004-0077 – Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2004-0077
The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985. La función do_remap en mremap de Linux 2.2 a 2.2.25, 2.4 a 2.4.24, y 2.6 a 2.6.2 no comprueba adecuadamente el valor devuelto por la función do_munmap cuando se excede el número máximo de descriptores VMA, lo que permite a usuarios locales ganar privilegios de root, una vulnerabilidad distinta de CAN-2004-0985. A critical security vulnerability has been found in the Linux kernel memory management code inside the mremap(2) system call due to missing function return value check. This bug is completely unrelated to the mremap bug disclosed on 05-01-2004 except concerning the same internal kernel function code. Versions affected: 2.2 up to 2.2.25, 2.4 up to 2.4.24, 2.6 up to 2.6.2. • https://www.exploit-db.com/exploits/160 https://www.exploit-db.com/exploits/154 http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0040.html http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000820 http://fedoranews.org/updates/FEDORA-2004-079.shtml http://frontal2.mandriva.com/security/advisories?name=MDKSA-2004:015 http://isec.pl/vulnerabilities/isec-0014-mremap-unmap.txt http://marc.info/?l=bugtraq&m=107711762014175&w=2 http://marc.info/?l=bugtraq&m=10771 •
CVSS: 10.0EPSS: 1%CPEs: 38EXPL: 1CVE-2002-0083 – OpenSSH 2.x/3.0.1/3.0.2 - Channel Code Off-by-One
https://notcve.org/view.php?id=CVE-2002-0083
Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges. Error 'off-by-one' en el código de canal de OpenSSH 2.0 a 3.0.2 permite a usuarios locales o a servidores remotos ganar privilegios. • https://www.exploit-db.com/exploits/21314 ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:13.openssh.asc ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-004.txt.asc ftp://stage.caldera.com/pub/security/openserver/CSSA-2002-SCO.10/CSSA-2002-SCO.10.txt ftp://stage.caldera.com/pub/security/openunix/CSSA-2002-SCO.11/CSSA-2002-SCO.11.txt http://archives.neohapsis.com/archives/bugtraq/2002-03/0108.html http://archives.neohapsis.com/archives/vulnw • CWE-193: Off-by-one Error •
CVSS: 10.0EPSS: 95%CPEs: 7EXPL: 5CVE-2000-0917 – LPRng (RedHat 7.0) - 'lpd' Format String
https://notcve.org/view.php?id=CVE-2000-0917
Format string vulnerability in use_syslog() function in LPRng 3.6.24 allows remote attackers to execute arbitrary commands. • https://www.exploit-db.com/exploits/227 https://www.exploit-db.com/exploits/230 https://www.exploit-db.com/exploits/226 https://www.exploit-db.com/exploits/16842 ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:56.lprng.asc http://archives.neohapsis.com/archives/bugtraq/2000-09/0293.html http://www.calderasystems.com/support/security/advisories/CSSA-2000-033.0.txt http://www.cert.org/advisories/CA-2000-22.html http://www.redhat.com/support/errata/RH •