CVE-2007-1849

CVE-2007-1849 describes a directory traversal vulnerability in Drake CMS (in the 404.php script) that allows remote attackers to include and execute arbitrary local files via a ".." in the d_private parameter. The vulnerability affects the beta version of Drake CMS, and the vendor has stated they...

CentOS 4 : zlib (CESA-2005:584)

Updated zlib packages that fix a buffer overflow are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. Zlib is a general-purpose lossless data compression library that is used by many different...

CVE-2006-1849

The CVE-2006-1849 entry describes multiple SQL injection vulnerabilities in the web component members_only/index.cgi of xFlow (versions 5.46.11 and earlier). The underlying issue is improper handling of user-supplied input, allowing an attacker to manipulate SQL queries through the (1) position a...

Mandrake Linux Security Advisory : sash (MDKSA-2006:070)

Tavis Ormandy of the Gentoo Security Project discovered a vulnerability in zlib where a certain data stream would cause zlib to corrupt a data structure, resulting in the linked application to dump core CVE-2005-2096. Markus Oberhumber discovered additional ways that a specially crafted compresse...

Mandrake Linux Security Advisory : perl-Compress-Zlib (MDKSA-2005:196)

The perl Compress::Zlib module contains an internal copy of the zlib library that was vulnerable to CVE-2005-1849 and CVE-2005-2096. This library was updated with version 1.35 of Compress::Zlib. An updated perl-Compress-Zlib package is now available to provide the fixed module. %NASLMINLEVEL 7030...

[SECURITY] [DSA 797-1] New zsync packages fix DOS

-------------------------------------------------------------------------- Debian Security Advisory DSA 797-1 [email protected] http://www.debian.org/security/ Michael Stone September 1st, 2005 http://www.debian.org/security/faq -...

CVE-2005-1849

CVE-2005-1849 affects zlib 1.2.2, where inftrees.h can be exploited by a malicious file to cause a denial of service (application crash) via a large dynamic tree. The vulnerability is exploitable remotely and does not require authentication. The initial description confirms the crash is caused by...

Fedora Core 4 : zlib-1.2.2.2-5.fc4 (2005-626)

Fri Jul 22 2005 Ivana Varekova 1.2.2.2-5.fc4 - fix bug 163038 - CVE-2005-1849 - zlib buffer overflow Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

Fedora Core 3 : zlib-1.2.1.2-3.fc3 (2005-625)

Fri Jul 22 2005 Ivana Varekova 1.2.1.2-3.fc3 - fix bug 163038 - CVE-2005-1849 - zlib overflow problem Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

RHEL 4 : zlib (RHSA-2005:584)

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:584 advisory. Zlib is a general-purpose lossless data compression library that is used by many different programs. A previous zlib update, RHSA-2005:569 CAN-2005-20...

CVE-2004-1849

The CVE-2004-1849 entry describes multiple cross-site scripting (XSS) vulnerabilities in cPanel version 9.1.0. The affected components are the web pages dodelautores.html (email parameter) and addhandle.html (handle parameter). Exploitation leads to injection of arbitrary web script or HTML by re...

CVE-2002-1849

ParaChat Server 4.0 does not log users off if the browser's back button is used, which allows remote attackers to cause a denial of service by repeatedly logging into a chat room, hitting the back button, then logging into the same chat room as a different user, which fills the chat room with...