RHEL 2.1 : openssh (RHSA-2005:481)

Updated openssh packages that fix a potential security vulnerability and various other bugs are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having low security impact by the Red Hat Security Response Team. OpenSSH is OpenBSD's SSH Secure SHell protocol...

CVE-2004-2136

The CVE-2004-2136 entry concerns dm-crypt in the Linux kernel (2.6.x) used on certain filesystems with block sizes of 1024 or greater. The underlying issue is an IV computation weakness in the encryption mode that can allow watermarked files to be detected without decrypting the data. The availab...

CVE-2004-2135

Cryptoloop in Linux kernel 2.6.x, when used on file systems with a block size of 1024 or greater, contains IV computation weaknesses that allow watermarked files to be detected without decryption. The documented impact is PARTIAL confidentiality loss. No exploits, specific remediations, or affect...

HP-UX PHNE_26125 : HP-UX TCP/IP Remote Denial of Service (DoS) (HPSBUX01164 SSRT4884 rev.9)

s700800 11.00 ndd1M cumulative patch : A potential security vulnerability has been identified with HP-UX running TCP/IP. This vulnerability could be remotely exploited by an unauthorized user to cause a Denial of ServiceDoS. References: NISCC VU532967, CAN-2004-0790, CAN-2004-0791, CAN-2004-1060...

RHEL 3 : kernel (RHSA-2005:472)

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating syste...

gd security update

CentOS Errata and Security Advisory CESA-2004:638 Updated gd packages that fix security issues with overflow in various memory allocation calls are now available. Updated 24 May 2005 Multilib packages have been added to this advisory The gd packages contain a graphics library used for the dynamic...

CVE-2004-2124

The registerglobals simulation capability in Gallery 1.3.1 through 1.4.1 allows remote attackers to modify the HTTPPOSTVARS variable and conduct a PHP remote file inclusion attack via the GALLERYBASEDIR parameter, a different vulnerability than CVE-2002-1412...

CVE-2004-2122

CVE-2004-2122 describes a cross-site scripting (XSS) vulnerability in Intra Forum’s intraforum_db.cgi, exploitable via the use_last_read or forum parameters. Affected software/function: Intra Forum web application (intraforum_db.cgi). Root cause: unsanitized input leading to script/HTML injection...

CVE-2004-2111

Stack-based buffer overflow in the site chmod command in Serv-U FTP Server before 4.2 allows remote attackers to execute arbitrary code via a long filename...

CVE-2004-2123

The CVE-2004-2123 entry describes multiple cross-site scripting (XSS) vulnerabilities in Nextplace.com E-Commerce ASP Engine. The issues allow remote attackers to inject arbitrary script/HTML via (1) the level parameter of productdetail.asp, (2) the searchKey parameter of searchresults.asp, and p...

CVE-2004-2107

Finjan SurfinGate 6.0/7.0, when in proxy mode, permits unauthenticated FHTTP commands on TCP port 3141. An attacker can use the finjan-parameter-type header to (1) restart the service, (2) view log information via getlastmsg, or (3) force a policy update from the database server via an online com...

CVE-2004-2105

CVE-2004-2105 affects the webacc servlet in Novell NetWare Enterprise Web Server 5.1 and 6.0. An attacker can read arbitrary .htt files by providing a full pathname in the error parameter, indicating a path traversal flaw in error handling. The vulnerability potentially exposes sensitive files (p...

CVE-2004-2103

The connected records provide concrete details for CVE-2004-2103 family: Novell GroupWise 6.5 WebAccess (webacc servlet) and related Novell NetWare/WebAccess components are vulnerable to cross-site scripting (XSS) via the User.Id parameter (and URL fields in STYLE elements), with exploitation dem...

CVE-2004-2116

CVE-2004-2116: Directory traversal in Tiny Server 1.1 allows read/download of arbitrary files via .. in the URL. Affected product: Tiny Server 1.1. Root cause described as a path traversal flaw in URL handling. Exploitation status is not provided in the documents; no remediation details are given.

CVE-2004-2110

CVE-2004-2110 affects Phorum prior to 3.4.6, where register.php is vulnerable to SQL injection via the hide_email parameter. The underlying issue is unsafely constructed SQL in the registration flow, allowing remote attackers to execute arbitrary SQL commands. The NVD assessment assigns a base sc...

CVE-2004-2102

CVE-2004-2102 describes a cross‑site scripting (XSS) vulnerability in FREESCO 2.05 (a modified version of thttpd). The issue allows remote attackers to inject arbitrary web script or HTML via the test parameter. The connected sources confirm the affected product and parameter, and indicate the vu...

CVE-2004-2098

Cross-site scripting XSS vulnerability in the banner engine TBE 5.0 allows remote attackers to execute arbitrary script as other users via the HTML banner view/preview capability...

CVE-2004-2111

Serv-U FTP Server prior to v4.2 is vulnerable to a stack-based buffer overflow in the SITE CHMOD command. A long filename can trigger arbitrary code execution by a remote attacker via FTP, as documented in CVE-2004-2111 (base CVSS v2.0 score 8.5). Multiple sources (exploit modules and OpenVAS/Ope...

CVE-2004-2129

Technical details (affected product scope, root cause, impact, and fixes) are not publicly provided in the connected documents; monitor for updates.

CVE-2004-2104

Technical details for CVE-2004-2104 are not provided in the connected documents; public specifics (affected products, exploit details) are not available here. Monitor for updates.