SecurITeam Advisories
SecurITeam, Beyond Security’s research group is dedicated to performing ongoing research to discover vulnerabilities in commercial products and protocols.
Most of these vulnerabilities are discovered while testing our own tools within our research labs, and are then released to the public in order to allow our readers to protect themselves against these problems.
We strive to cooperate with the product vendors in order to make sure a viable solution is available before the information is released.
All the released advisories also appear on the main www.SecuriTeam.com web site; the unreleased advisories are pending until a workaround is available by the vendor.
Upcoming advisories:
- Wireshark RMI Protocol Dissector
These are just some of the vulnerabilities we have discovered in the last 7 years:
- Wireshark DNP3 Protocol Dissector
- ImLib _LoadBMP Endless Loop (BPP, biBitCount)
- hpaftpd Multiple Buffer Overflows
- Microsoft ISA Server 2004 Log Manipulation
- Notify Message Spoofing Vulnerability With VoIP Phones (Exploit)
- Ethereal DistCC Buffer Overflow (Exploit)
- Ethereal SIP Dissector Overflow (Exploit)
- GNU oSIP URI Parsing Heap Overflows
- TowerBlog Administrative Authentication Bypassing
- Kmail HTML Support Allows Spoofing of Emails’ Content
- PlaySMS SQL Injection via Cookie
- Serena Software’s TeamTrack Sensitive Content Disclosure
- Internet Software Sciences’s Web+Center SQL Injection
- LBE Web HelpDesk SQL Injection
- NetSupport DNA HelpDesk SQL Injection
- Polar HelpDesk Inadequate Security Checks
- HelpBox Multiple SQL Injection Vulnerabilties
- Mollensoft Lightweight FTP Server CWD Buffer Overflow
- Firebird Database Remote Database Name Overflow
- Titan FTP Server Aborted LIST DoS
- Serv-U LIST -l Parameter Buffer Overflow
- KPhone STUN DoS (Malformed STUN Packets)
- Zaep AntiSpam Cross Site Scripting
- GlobalSCAPE Secure FTP Server Buffer Overflow (Parameter Handling)
- WFTPD GUI DoS
- ArGoSoft FTP Server Multiple Vulnerabilities (SITE ZIP, UNZIP, COPY, PASS)
- Xlight FTP Server PASS Buffer Overflow
- sipD Format String Vulnerability
- sipD gethostbyname_r DoS
- NIPrint LPD-LPR Print Server (Exploit)
- IA WebMail Server Buffer Overflow Exploit
- Security Vulnerability in WinSyslog (DoS)
- Multiple SQL Injection Vulnerabilities in DeskPRO
- Security Vulnerability in Tellurian TftpdNT (Long Filename)
- Everybuddy Vulnerable to a DoS Attack (Long Message)
- Exploit Released for Buffer Overrun in WebAdmin.exe
- Multiple Vulnerabilities Found in Mailtraq (DoS, Password Decryption, Directory Traversal)
- Symantec Security Check Service ActiveX Buffer Overflow
- WebBBS Pro Multiple Denial of Service Vulnerabilities (AUX, *, LPT)
- PKZip Plaintext Attack Using Pkcrack (Step by Step)
- RealSystem Server and Proxy Buffer Overflow Vulnerability
- TFTPD32 Directory Traversal Vulnerability
- TFTPD32 Buffer Overflow Vulnerability (Long filename)
- Outlook Remote Code Execution in Preview Pane (S/MIME)
- Bypassing SMTP Content Protection with a Flick of a Button
- Webmin Vulnerability Leads to Remote Compromise (RPC CGI)
- TrendMicro’s VirusWall Space Gap (Exploit)
- TrendMicro’s VirusWall Space Gap (Virus Protection Bypassing)
- Keyservers Cross Site Scripting (When CSS Gets Dangerous)
- Exchange Public Folders Information Leakage
- Lil’ HTTP Server “Referer” Cross Site Scripting Vulnerability
- CMail Vulnerable To a Buffer Overflow Attack (HELO)
- Palm HotSync Manager is vulnerable to Denial of Service attack
- Did you really think you can copy protect your documents?