SUSE-SA:2005:030: MozillaFirefox

The remote host is missing the patch for the advisory SUSE-SA:2005:030 MozillaFirefox. This update upgrades Mozilla Firefox to version 1.0.4, fixing the following security problems: MFSA 2005-42: A problem in the install confirmation dialog together with a bad fix for MFSA 2005-41 allowed a remot...

RHEL 4 : Mozilla (RHSA-2005:386)

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:386 advisory. Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Vladimir V. Perepelitsa...

RHEL 4 : firefox (RHSA-2005:383)

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:383 advisory. Mozilla Firefox is an open source Web browser. Vladimir V. Perepelitsa discovered a bug in the way Firefox handles anonymous functions during...

GLSA-200504-18 : Mozilla Firefox, Mozilla Suite: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200504-18 Mozilla Firefox, Mozilla Suite: Multiple vulnerabilities The following vulnerabilities were found and fixed in the Mozilla Suite and Mozilla Firefox: Vladimir V. Perepelitsa reported a memory disclosure bug in JavaScript...

Microsoft Security Bulletin MS05-020 Cumulative Security Update for Internet Explorer (890923)

Microsoft Security Bulletin MS05-020 Cumulative Security Update for Internet Explorer 890923 Issued: April 12, 2005 Version: 1.0 Summary Who should read this document: Customers who use Microsoft Windows Impact of Vulnerability: Remote Code Execution Maximum Severity Rating: Critical...

Microsoft Internet Explorer DHTML objects contain a race condition

Overview A race condition in the way that Internet Explorer handles DHTML objects may allow a remote attacker to execute arbitrary code on a vulnerable system. Description According to Microsoft:Dynamic HTML DHTML is built on an object model that extends the traditional static HTML document which...

Cisco Security Advisory: ACNS Denial of Service and Default Admin Password Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Security Advisory: ACNS Denial of Service and Default Admin Password Vulnerabilities ====================================================================== Revision 1.0 For Public Release 2005 February 24 1600 UTC GMT...

Debian DSA-689-1 : libapache-mod-python - missing input sanitizing

Graham Dumpleton discovered a flaw which can affect anyone using the publisher handle of the Apache Software Foundation's modpython. The publisher handle lets you publish objects inside modules to make them callable via URL. The flaw allows a carefully crafted URL to obtain extra information that...

RHEL 4 : mod_python (RHSA-2005:100)

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2005:100 advisory. Modpython is a module that embeds the Python language interpreter within the Apache web server, allowing handlers to be written in Python. Graham...

mod_python vulnerable to information disclosure via crafted URL

Overview The Apache modpython module is vulnerable to unintended remote information disclosure using specially crafted URLs. Description From the modpython web page:Modpython is an Apache module that embeds the Python interpreter within the server. With modpython you can write web-based...

Fedora Core 3 : mod_python-3.1.3-5.2 (2005-140)

Graham Dumpleton discovered a flaw affecting the publisher handler of modpython, used to make objects inside modules callable via URL. A remote user could visit a carefully crafted URL that would gain access to objects that should not be visible, leading to an information leak. The Common...

Fedora Core 2 : mod_python-3.1.3-1.fc2.2 (2005-139)

Graham Dumpleton discovered a flaw affecting the publisher handler of modpython, used to make objects inside modules callable via URL. A remote user could visit a carefully crafted URL that would gain access to objects that should not be visible, leading to an information leak. The Common...

RHEL 2.1 / 3 : mod_python (RHSA-2005:104)

An Updated modpython package that fixes a security issue in the publisher handler is now available. Modpython is a module that embeds the Python language interpreter within the Apache web server, allowing handlers to be written in Python. Graham Dumpleton discovered a flaw affecting the publisher...

Microsoft Security Bulletin MS05-012

Microsoft Security Bulletin MS05-012 Vulnerability in OLE and COM Could Allow Remote Code Execution 873333 Issued: February 8, 2005 Version: 1.0 Summary Who should read this document: Customers who use Microsoft Windows, Microsoft Exchange Server, Microsoft Office, or other third party applicatio...

Microsoft Security Bulletin MS05-014 Cumulative Security Update for Internet Explorer (867282)

Microsoft Security Bulletin MS05-014 Cumulative Security Update for Internet Explorer 867282 Issued: February 8, 2005 Version: 1.0 Summary Who should read this document: Customers who use Microsoft Windows Impact of Vulnerability: Remote Code Execution Maximum Severity Rating: Critical...

Microsoft DHTML Drag-and-Drop events insufficiently validated

Overview Microsoft DHTML Drag-and-Drop events can manipulate windows to copy objects from one domain to another, including the Local Machine Zone. This vulnerability could allow an attacker to write arbitrary files to the local file system. Description Microsoft Drag-and-Drop events do not proper...

Microsoft Hyperlink Object Library buffer overflow

Overview A buffer overflow exists in the Microsoft Windows system library used when handling hyperlinks. All currently supported versions of Microsoft Windows are affected. Description An unchecked buffer in the Microsoft Object Library is vulnerable to attack when malformed hyperlinks are handle...

Microsoft Windows HTML Help ActiveX control does not adequately validate window source

Overview The Microsoft Windows HTML Help ActiveX control contains a cross-domain vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands or code with the privileges of the user running the control. The HTML Help control can be instantiated by an HTML...

Saleslogix-1-2004.txt

Agenda Security Services Security Vulnerability Advisory Product: SalesLogix Server and Web Client Vendor: Sage Homepage: http://www.saleslogix.com Platforms: Microsoft Windows Impact: Bypass authentication Privilege escalation SQL injection Information leaks Arbitrary file creation Directory...

Multiple vulnerabilities in Sage Saleslogix

Agenda Security Services Security Vulnerability Advisory Product: SalesLogix Server and Web Client Vendor: Sage Homepage: http://www.saleslogix.com Platforms: Microsoft Windows Impact: Bypass authentication Privilege escalation SQL injection Information leaks Arbitrary file creation Directory...