PowerNews 2.5.6 - Local File Inclusion

PowerNews 2.5.6 - Local File Inclusion Digital Security Research Group DSecRG Advisory DSECRG-08-014 Application: PowerNews Newsscript Versions Affected: 2.5.6 Vendor URL: http://www.powerscripts.org/ Bug: Multiple Local File Include Exploits: YES Reported: 01.02.2008 Vendor Response: none...

PowerNews 2.5.6 - Local File Inclusion

Digital Security Research Group DSecRG Advisory DSECRG-08-014 Application: PowerNews Newsscript Versions Affected: 2.5.6 Vendor URL: http://www.powerscripts.org/ Bug: Multiple Local File Include Exploits: YES Reported: 01.02.2008 Vendor Response: none Solution: none Date of Public Advisory:...

DSECRG-08-012.txt

Digital Security Research Group DSecRG Advisory DSECRG-08-012 Application: Azucar CMS Versions Affected: 1.3 Vendor URL: http://azucarcms.sourceforge.net/enhome.htm Bug: Multiple Local File Include Exploits: YES Reported: 30.01.2008 Vendor Response: NONE Date of Public Advisory: 05.02.2008 Author...

DSECRG-08-011.txt

Digital Security Research Group DSecRG Advisory DSECRG-08-011 Application: Astrosoft HelpDesk Versions Affected: Vendor URL: http://astrosoft.ru/ Bugs: Multiple XSS Injections Exploits: YES Reported: 29.01.2008 Vendor response: NONE Date of Public Advisory: 04.02.2008 Authors: Alexandr Polyakov,...

DSECRG-08-009.txt

Digital Security Research Group DSecRG Advisory DSECRG-08-009 Application: XOOPS Versions Affected: XOOPS 2.0.18 Vendor URL: http://www.xoops.org/ Bugs: Local File Include,URL Redirecting phishing Exploits: YES Reported: 28.01.2008 Vendor response: 28.01.2008 Date of Public Advisory: 04.02.2008...

DSECRG-08-010.txt

Digital Security Research Group DSecRG Advisory DSECRG-08-010 Application: VHD Web Pack 2.0 Versions Affected: VHD Web Pack 2.0 Vendor URL: http://www.divideconcept.net/index.php?page=vhdwebpack/index.php Bugs: Local File Include Exploits: YES Reported: 28.01.2008 Vendor response: NONE Date of...

Directory traversal

Directory traversal vulnerability in parser/include/class.cachephpcms.php in phpCMS 1.2.2 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter to parser/parser.php, as demonstrated by a filename ending with %00.gif, a different vector than CVE-2005-1840...

Novell NetWare LSASS CIFS.NLM Driver Stack Buffer Overflow

This module exploits a stack buffer overflow in the NetWare CIFS.NLM driver. Since the driver runs in the kernel space, a failed exploit attempt can cause the OS to reboot. This module requires Metasploit: https://metasploit.com/download Current source:...

Debian Security Advisory DSA 743-1 (ht)

The remote host is missing an update to ht announced via advisory DSA 743-1. Several problems have been discovered in ht, a viewer, editor and analyser for various executables, that may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the...

Debian Security Advisory DSA 1018-1 (kernel-source-2.4.27)

The remote host is missing an update to kernel-source-2.4.27 announced via advisory DSA 1018-1. For details on the issues addressed with this update, please visit the referenced security advisories. OpenVAS Vulnerability Test $Id: deb10181.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description:...

Debian Security Advisory DSA 1208-1 (bugzilla)

The remote host is missing an update to bugzilla announced via advisory DSA 1208-1. Several remote vulnerabilities have been discovered in the Bugzilla bug tracking system, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following...

Debian Security Advisory DSA 944-1 (mantis)

The remote host is missing an update to mantis announced via advisory DSA 944-1. Several security related problems have been discovered in Mantis, a web-based bug tracking system. For details on the issues resolved, please visit the referenced advisories. The old stable distribution woody does no...

Debian Security Advisory DSA 783-1 (mysql-dfsg-4.1)

The remote host is missing an update to mysql-dfsg-4.1 announced via advisory DSA 783-1. Eric Romang discovered a temporary file vulnerability in a script accompanied with MySQL, a popular database, that allows an attacker to execute arbitrary SQL commands when the server is installed or updated...

Debian Security Advisory DSA 707-1 (mysql)

The remote host is missing an update to mysql announced via advisory DSA 707-1. OpenVAS Vulnerability Test $Id: deb7071.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 707-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 1171-1 (ethereal)

The remote host is missing an update to ethereal announced via advisory DSA 1171-1. Several remote vulnerabilities have been discovered in the Ethereal network scanner, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following...

Debian Security Advisory DSA 863-1 (xine-lib)

The remote host is missing an update to xine-lib announced via advisory DSA 863-1. Ulf Härnhammar from the Debian Security Audit Project discovered a format string vulnerability in the CDDB processing component of xine-lib, the xine video/media player library, that could lead to the execution of...

Debian Security Advisory DSA 855-1 (weex)

The remote host is missing an update to weex announced via advisory DSA 855-1. Ulf Härnhammar from the Debian Security Audit Project discovered a format string vulnerability in weex, a non-interactive FTP client for updating web pages, that could be exploited to execute arbitrary code on the...

Debian Security Advisory DSA 1008-1 (kdegraphics)

The remote host is missing an update to kdegraphics announced via advisory DSA 1008-1. Marcelo Ricardo Leitner noticed that the current patch in DSA 932 CVE-2005-3627 for kpdf, the PDF viewer for KDE, does not fix all buffer overflows, still allowing an attacker to execute arbitrary code. The old...

Debian Security Advisory DSA 848-1 (masqmail)

The remote host is missing an update to masqmail announced via advisory DSA 848-1. Jens Steube discovered two vulnerabilities in masqmail, a mailer for hosts without permanent internet connection. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2005-2662 Wh...

Debian Security Advisory DSA 884-1 (horde3)

The remote host is missing an update to horde3 announced via advisory DSA 884-1. Mike O'Connor discovered that the default installation of Horde3 on Debian includes an administrator account without a password. Already configured installations will not be altered by this update. The old stable...