USN-38-1: Linux kernel vulnerabilities

CAN-2004-0814: Vitaly V. Bursov discovered a Denial of Service vulnerability in the "serio" code; opening the same tty device twice and doing some particular operations on it caused a kernel panic and/or a system lockup. Fixing this vulnerability required a change in the Application Binary...

CVE-2004-0320

Unknown vulnerability in nCipher Hardware Security Modules HSM 1.67.x through 1.99.x allows local users to access secrets stored in the module's run-time memory via certain sequences of commands...

PhpWebSite contains multiple cross-site scripting vulnerabilities

Overview PhpWebSite contains multiple cross-site scripting vulnerabilities that may allow an attacker to execute arbitrary code on users' web browser. Description PhpWebSite is an open-source web content management system. Certain PhpWebSite modules fail to properly filter URLs for malicious...

Multiple Cyrus-SASL bugs

Buffer overflow in digestmda5.c and during environment parsing. User supplied modules are loaded into suid application...

Multiple Full Disclosure Path in postnuke 0.750 phoenix

CODEBUG Labs Advisory 6 Title: Multiple Full Disclosure Path in postnuke 0.750 phoenix Author: FAiN182 - [email protected] Product: Postnuke 0.750 Phoenix Type: Full disclosure path Web: http://www.mantralab.org Personal Site: http://fain182.altervista.org --- the product Postnuke is a CMS...

GLSA-200409-06 : eGroupWare: Multiple XSS vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200409-06 eGroupWare: Multiple XSS vulnerabilities Joxean Koret recently discovered multiple cross site scripting vulnerabilities in various modules for the eGroupWare suite. This includes the calendar, address book, messenger and...

CVE-2004-0320

CVE-2004-0320 concerns nCipher Hardware Security Modules (HSM) versions 1.67.x–1.99.x. It describes a local-access flaw where an attacker can access secrets stored in the module’s run-time memory via certain sequences of commands. The publicly stated impact is partial confidentiality with local a...

CVE-2004-0320: Undefined Security Weakness

Unknown vulnerability in nCipher Hardware Security Modules HSM 1.67.x through 1.99.x allows local users to access secrets stored in the module's run-time memory via certain sequences of commands...

eGroupWare 1.0 Calendar Module - 'date' Cross-Site Scripting

source: https://www.securityfocus.com/bid/11013/info It is reported that eGroupWare is susceptible to multiple cross-site scripting and HTML injection vulnerabilities. The cross-site scripting issues present themselves in the various parameters of the 'addressbook' and 'calendar' modules. It is...

CVE-2004-0663

Cross-site scripting XSS vulnerability in modules.php in PowerPortal 1.x allows remote attackers to inject arbitrary script or HTML via the 1 id parameter to the a privatemessages module; 2 search parameter to the b links and c content modules; and 3 files parameter to the gallery module...

Mandrake Linux Security Advisory : kdebase (MDKSA-2003:091)

A vulnerability was discovered in all versions of KDE 2.2.0 up to and including 3.1.3. KDM does not check for successful completion of the pamsetcred call and in the case of error conditions in the installed PAM modules, KDM may grant local root access to any user with valid login credentials. It...

Mandrake Linux Security Advisory : XFree86 (MDKSA-2003:118)

A vulnerability was discovered in the XDM display manager that ships with XFree86. XDM does not check for successful completion of the pamsetcred call and in the case of error conditions in the installed PAM modules, XDM may grant local root access to any user with valid login credentials. It has...

Mandrake Linux Security Advisory : openssh (MDKSA-2002:040-1)

An input validation error exists in the OpenSSH server between versions 2.3.1 and 3.3 that can result in an integer overflow and privilege escalation. This error is found in the PAMAuthenticationViaKbdInt code in versions 2.3.1 to 3.3, and the ChallengeResponseAuthentication code in versions 2.9....

SUSE-SA:2002:041: perl-MailTools

The remote host is missing the patch for the advisory SUSE-SA:2002:041 perl-MailTools. The SUSE Security Team reviewed critical Perl modules, including the Mail::Mailer package. This package contains a security hole which allows remote attackers to execute arbitrary commands in certain...

Fedora Core 1 2004-087: libxml2

The remote host is missing the patch for the advisory FEDORA-2004-087 libxml2. This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or...

RHEL 2.1 : XFree86 (RHSA-2003:289)

Updated XFree86 packages provide security fixes to font libraries and XDM. XFree86 is an implementation of the X Window System providing the core graphical user interface and video drivers. XDM is the X display manager. Multiple integer overflows in the transfer and enumeration of font libraries ...

Vulnerability: Arbitrary File Access & DoS in Crystal Reports

Dear List, Impervatm's Applidcation Defense Center has recently discovered a vulnerability in Business Objects' Crystal Reports Web Delivery Modules. This vulnerability may lead to arbitrary file access and denial of service. Following are the advisory's details...

imperva.crystal2.txt

Dear List, Impervatm's Applidcation Defense Center has recently discovered a vulnerability in Business Objects' Crystal Reports Web Delivery Modules. This vulnerability may lead to arbitrary file access and denial of service. Following are the advisory's details...

PostNuke Phoenix 0.726 - openwindow.php?hlpfile Cross-Site Scripting

PostNuke Phoenix 0.726 - openwindow.php?hlpfile Cross-Site Scripting source: https://www.securityfocus.com/bid/10191/info Multiple vulnerabilities were reported to exist in PostNuke Phoenix. The following specific vulnerabilities were reported: - Multiple path disclosure vulnerabilities that occu...

Phorum 3.x - 'profile.php?target' Cross-Site Scripting

source: https://www.securityfocus.com/bid/9882/info It has been reported that Phorum is prone to a cross-site scripting vulnerability across multiple modules. The issue presents itself across multiple modules including 'login.php', 'register.php', and 'profile.php'. These modules employ two hidde...