Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in CubeCart 3.0.7-pl1 allow remote attackers to inject arbitrary web script or HTML via the 3 redir, 4 productId, 5 docId, 6 act, and 7 catId parameters in index.php; and the 8 username field in a login action in index.php. NOTE: the cart.php/redi...

[Full-disclosure] Oracle Reports - Overwrite any application server file via desname (fixed after 889 days)

Hello FD-Reader It took only 889 days to fix this problem. Summary and additional information concerning the Oracle January 2006 CPU is available here: http://www.red-database-security.com/advisory/oraclecpujan2006.html http://www.red-database-security.com/advisory/oraclereportsoverwritea...

[VulnWatch] iDefense Security Advisory 01.17.06: EMC Legato Networker nsrd.exe DoS Vulnerability

EMC Legato Networker nsrd.exe DoS Vulnerability iDefense Security Advisory 01.17.06 http://www.idefense.com/intelligence/vulnerabilities/display.php?id=375 January 17, 2006 I. BACKGROUND EMC Legato NetWorker is a cross-platform backup and recovery application. II. DESCRIPTION Remote exploitation ...

CVE-2005-3126

The CVE-2005-3126 issue affects antiword scripts (kantiword.sh and gantiword.sh) in antiword up to version 0.35 and earlier. A symlink-based insecure temporary file creation in the scripts allows local attackers to overwrite arbitrary files via temporary output and error files. Debian DSAs (DSA-9...

[Full-disclosure] [USN-244-1] Linux kernel vulnerabilities

=========================================================== Ubuntu Security Notice USN-244-1 January 18, 2006 linux-source-2.6.8.1/-2.6.10/-2.6.12 vulnerabilities CVE-2005-3356, CVE-2005-4605, CVE-2005-4618, CVE-2005-4639, CVE-2006-0095, CVE-2006-0096...

[SECURITY] [DSA 945-1] New antiword packages fix insecure temporary file creation

-------------------------------------------------------------------------- Debian Security Advisory DSA 945-1 [email protected] http://www.debian.org/security/ Martin Schulze January 17th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 945-1] New antiword packages fix insecure temporary file creation

-------------------------------------------------------------------------- Debian Security Advisory DSA 945-1 [email protected] http://www.debian.org/security/ Martin Schulze January 17th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 944-1] New mantis packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 944-1 [email protected] http://www.debian.org/security/ Martin Schulze January 17th, 2006 http://www.debian.org/security/faq -...

Moderate: Red Hat Security Advisory: apache security update

Updated Apache httpd packages that correct a security issue are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popular and freely-available Web server. A flaw in modim...

[Full-disclosure] [SECURITY] [DSA 945-1] New antiword packages fix insecure temporary file creation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 945-1 [email protected] http://www.debian.org/security/ Martin Schulze January 17th, 2006 http://www.debian.org/security/faq -...

Fedora Core 4 : kdegraphics-3.5.0-0.2.fc4 (2006-037)

Several flaws were discovered in Xpdf. An attacker could construct a carefully crafted PDF file that could cause xpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-3193 to these issues. Users of kdegraphics...

RHEL 2.1 : apache (RHSA-2006:0158)

Updated Apache httpd packages that correct a security issue are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popular and freely-available Web server. A flaw in modim...

Sql injection

Multiple unspecified vulnerabilities in MyBulletinBoard MyBB before 1.0.2 have unspecified impact and attack vectors, related to 1 admin/moderate.php, 2 admin/themes.php, 3 inc/functions.php, 4 inc/functionsupload.php, 5 printthread.php, and 6 usercp.php, and probably related to SQL injection...

CVE-2006-0220

Multiple cross-site scripting XSS vulnerabilities in DCP-Portal 5.3 through 6.1.1 allow remote attackers to inject arbitrary web script or HTML via 1 the day parameter in calendar.php and 2 the input form in search.php. NOTE: the provenance of this information is unknown; the details are obtained...

Sql injection

The original distribution of MyBulletinBoard MyBB to update from older versions to 1.0.2 omits or includes older versions of certain critical files, which allows attackers to conduct 1 SQL injection attacks via an attachment name that is not properly handled by inc/functionsupload.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in DCP-Portal 5.3 through 6.1.1 allow remote attackers to inject arbitrary web script or HTML via 1 the day parameter in calendar.php and 2 the input form in search.php. NOTE: the provenance of this information is unknown; the details are obtained...

CVE-2005-4660

CVE-2005-4660 concerns IPCop Firewall prior to 1.4.10, where a race condition may allow a local attacker to overwrite system configuration files. The underlying flaw involves replacing a backup archive during the window when it is owned by namebody but not yet encrypted, and then executing ipco...

CVE-2005-4664

CVE-2005-4664 concerns OcoMon 1.21 (and possibly earlier versions). It describes a SQL injection vulnerability that can be triggered when magic_quotes_gpc is disabled, allowing remote attackers to execute arbitrary SQL commands through the logon page. The Connected documents also indicate exploit...

CVE-2005-4663

The CVE-2005-4663 entry describes a cross-site scripting (XSS) vulnerability in OcoMon 1.20 and possibly earlier versions, allowing remote attackers to inject arbitrary web script or HTML via unknown attack vectors. The vulnerability affects the web-facing components of OcoMon, enabling potential...

CVE-2005-4655

CVE-2005-4655 refers to a cross-site scripting (XSS) vulnerability in PHP-Fusion 6.0.204, specifically in submit.php where the news_body parameter accepts input that can be crafted with nested HTML tags (for example "<meta" or "<sc[removed]ript>") to inject arbitrary script or HTML. The ...