Fedora 10 : poppler-0.8.7-6.fc10 (2009-6973)

An update to address jbig2-related security issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

DEBIAN-CVE-2009-1513

Buffer overflow in the PATinst function in src/loadpat.cpp in libmodplug before 0.8.7 allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a long instrument name...

[SECURITY] Fedora 10 Update: libmodplug-0.8.7-1.fc10

Modplug mod music file format library...

Fedora 10 : libmodplug-0.8.7-1.fc10 (2009-4068)

Update to 0.8.7: http://sourceforge.net/project/shownotes.php?groupid=1275&releaseid= 675660 http://sourceforge.net/project/shownotes.php?groupid=1275&releaseid= 677065 http://sourceforge.net/project/shownotes.php?groupid=1275&releaseid= 678622 Note that Tenable Network Security has extracted the...

Hiki arbitrary file deletion vulnerability

Overview Hiki, a Wiki clone software developed by Hiki Development Team, contains a vulnerability that allows a remote attacker to delete arbitrary files. Hiki contains a vulnerability that allows an arbitrary file to be deleted on a server running Hiki. This is caused by the improper handling of...

CVE-2008-0786

CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k, when running on older PHP interpreters, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2008-0785

Multiple SQL injection vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote authenticated users to execute arbitrary SQL commands via the 1 graphlist parameter to graphview.php, 2 leafid and id parameters to tree.php, 3 localgraphid parameter to graphxport.php, and 4...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to inject arbitrary web script or HTML via 1 the viewtype parameter to graph.php; 2 the filter parameter to graphview.php; 3 the action parameter to the drawnavigationtext...

CVE-2008-0783

Multiple cross-site scripting XSS vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to inject arbitrary web script or HTML via 1 the viewtype parameter to graph.php; 2 the filter parameter to graphview.php; 3 the action parameter to the drawnavigationtext...

CVE-2008-0784

CVE-2008-0784 affects Cacti: graph.php on 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k. Root cause is insufficient input validation (e.g., invalid local_graph_id) that allows a remote attacker to obtain the full filesystem path, with other vectors not specified in the provided documents. Publicly ...

CVE-2008-0783

Cacti is affected by multiple input-validation and XSS vulnerabilities (CVE-2008-0783 and related CVEs) in versions up to 0.8.7b and 0.8.6k. The OpenVAS/OpenVAS-derived notes identify several specific vectors for CVE-2008-0783: view_type in graph.php; filter in graph_view.php; action in lib/funct...

CVE-2008-0783

Multiple cross-site scripting XSS vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to inject arbitrary web script or HTML via 1 the viewtype parameter to graph.php; 2 the filter parameter to graphview.php; 3 the action parameter to the drawnavigationtext...

Cacti 0.8.7 - graph_view.php?filter Cross-Site Scripting

Cacti 0.8.7 - graphview.php?filter Cross-Site Scripting source: https://www.securityfocus.com/bid/27749/info Cacti is prone to multiple unspecified input-validation vulnerabilities, including: - Multiple cross-site scripting vulnerabilities - Multiple SQL-injection vulnerabilities - An HTTP...

CVE-2003-1352

CVE-2003-1352 relates to Gabber 0.8.7, where an info-leak occurs because the client sends an email to a specific address during user login and logout. This behavior can let an attacker sniff (eavesdrop) user session activity and reveal the Gabber version number. The published data indicates a med...

JVN#05187780 Hiki arbitrary file deletion vulnerability

Hiki contains a vulnerability that allows an arbitrary file to be deleted on a server running Hiki. This is caused by the improper handling of a session management file. Impact A remote attacker may be able to delete arbitrary files with the privilege of the user running Hiki. Solution Upgrade th...

monalbum-exec.txt

"; if isset$mod //submit $fichier = "../conf/config.inc.php"; $fd = fopen$fichier, "w"; $gcfgBase = $POST'gcfgBase'; $gcfgUser = $POST'gcfgUser'; $gcfgPass = $POST'gcfgPass'; $gcfgHote = $POST'gcfgHote'; $gpage = $POST'gpage'; $grepertoire = $POST'grepertoire'; $gfond = $POST'gfond'; $gtitre =...

Code injection

Static code injection vulnerability in admin/adminconfiguration.php in Monalbum 0.8.7 allows remote authenticated users to inject arbitrary PHP code into the conf/config.inc.php file via the 1 gadmpass, 2 gadmuser, 3 gcfgHote, 4 gcfgPass, 5 gcfgUser, 6 gclassementrep, 7 gcontour, 8 gfond, 9...

CVE-2007-2647

Static code injection vulnerability in admin/adminconfiguration.php in Monalbum 0.8.7 allows remote authenticated users to inject arbitrary PHP code into the conf/config.inc.php file via the 1 gadmpass, 2 gadmuser, 3 gcfgHote, 4 gcfgPass, 5 gcfgUser, 6 gclassementrep, 7 gcontour, 8 gfond, 9...

CVE-2007-2647

CVE-2007-2647 affects Monalbum 0.8.7. A static code injection vulnerability in admin/admin_configuration.php allows remote authenticated users to inject arbitrary PHP code into conf/config.inc.php by manipulating one of 28 parameters (e.g., gadm_pass, gadm_user, gcfgBase, etc.). The NVD entry doc...

CVE-2007-2647

Static code injection vulnerability in admin/adminconfiguration.php in Monalbum 0.8.7 allows remote authenticated users to inject arbitrary PHP code into the conf/config.inc.php file via the 1 gadmpass, 2 gadmuser, 3 gcfgHote, 4 gcfgPass, 5 gcfgUser, 6 gclassementrep, 7 gcontour, 8 gfond, 9...