CVE-2005-4655

CVE-2005-4655 refers to a cross-site scripting (XSS) vulnerability in PHP-Fusion 6.0.204, specifically in submit.php where the news_body parameter accepts input that can be crafted with nested HTML tags (for example "<meta" or "<sc[removed]ript>") to inject arbitrary script or HTML. The ...

CVE-2005-4658

CVE-2005-4658 describes multiple cross-site scripting (XSS) vulnerabilities in ASP-Programmers.com ASPKnowledgebase. Affected component: the administrative interface of ASPKnowledgebase. Root cause: unspecified XSS flaws that allow remote attackers to inject arbitrary scripts or HTML via unknown ...

CVE-2005-4653

CVE-2005-4653 affects AL-Caricatier 2.5 and earlier. The vulnerability is in ss.php and allows an unauthenticated attacker to bypass login by a sequence: request view_caricatier.php, then request any file in the admin directory with a cookie_username=admin. Impact: partial confidentiality (per CV...

CVE-2005-4654

Technical details of CVE-2005-4654 are not provided in the supplied documents. No specific affected products, vulnerable components, or remediation are disclosed here; monitor for updates.

CVE-2005-4662

The CVE-2005-4662 entry concerns OcoMon 1.20 (and possibly earlier) with multiple SQL injection vulnerabilities that may allow remote attackers to execute arbitrary SQL via an input form with unknown vectors. The description does not specify exact affected inputs, versions beyond 1.20, or concret...

CVE-2005-4661

The CVE-2005-4661 entry affects Campsite prior to version 2.3.3. The notifyendsubs cron job sends an e-mail that contains an unencrypted MySQL password, which can be captured by remote attackers and leads to partial confidentiality loss. The public documents do not provide explicit remediation st...

CVE-2005-4657

The CVE-2005-4657 entry concerns Ocean12 Calendar Manager Pro 1.01, where remote attackers may bypass authentication and obtain sensitive information via a direct request to /admin/view.asp. The description notes that provenance is unknown and details come from third-party information; no vendor-...

CVE-2005-4659

CVE-2005-4659 affects IPCop (IPCop Firewall) prior to 1.4.10. The backup.key file has world-readable permissions, potentially allowing local users to overwrite system configuration files by creating a malicious encrypted backup archive owned by nobody and then running ipcoprscfg to restore from t...

USN-242-1: mailman vulnerabilities

Aliet Santiesteban Sifontes discovered a remote Denial of Service vulnerability in the attachment handler. An email with an attachment whose filename contained invalid UTF-8 characters caused mailman to crash. CVE-2005-3573 Mailman did not sufficiently verify the validity of email dates. Very lar...

[SECURITY] [DSA 943-1] New Perl packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 943-1 [email protected] http://www.debian.org/security/ Martin Schulze January 16th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 943-1] New Perl packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 943-1 [email protected] http://www.debian.org/security/ Martin Schulze January 16th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 941-1] New tuxpaint packages fix insecure temporary file creation

-------------------------------------------------------------------------- Debian Security Advisory DSA 941-1 [email protected] http://www.debian.org/security/ Martin Schulze January 16th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 941-1] New tuxpaint packages fix insecure temporary file creation

-------------------------------------------------------------------------- Debian Security Advisory DSA 941-1 [email protected] http://www.debian.org/security/ Martin Schulze January 16th, 2006 http://www.debian.org/security/faq -...

freeFTPd 1.0 Username Overflow

This module exploits a stack buffer overflow in the freeFTPd multi-protocol file transfer service. This flaw can only be exploited when logging has been enabled non-default. This module requires Metasploit: https://metasploit.com/download Current source:...

ethereal security update

CentOS Errata and Security Advisory CESA-2006:0156-01 Updated Ethereal packages that fix various security vulnerabilities are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ethereal is a program for monitoring network traffic. T...

[Full-disclosure] [USN-242-1] mailman vulnerabilities

=========================================================== Ubuntu Security Notice USN-242-1 January 16, 2006 mailman vulnerabilities CVE-2005-3573, CVE-2005-4153 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 4.10 Warty...

VMware vmnat.exe/vmnet-natd Multiple FTP Command Remote Overflow

According to its version number, the VMware program on the remote host may allow an attacker to execute code on the system hosting the VMware instance. The vulnerability can be exploited by sending specially crafted FTP PORT and EPRT requests. To be exploitable, the VMware system must be configur...

[Full-disclosure] [SECURITY] [DSA 943-1] New Perl packages fix arbitrary code execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 943-1 [email protected] http://www.debian.org/security/ Martin Schulze January 16th, 2006 http://www.debian.org/security/faq -...

[Full-disclosure] [SECURITY] [DSA 941-1] New tuxpaint packages fix insecure temporary file creation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 941-1 [email protected] http://www.debian.org/security/ Martin Schulze January 16th, 2006 http://www.debian.org/security/faq -...

SUSE Security Announcement: novell-nrm remote heap overflow (SUSE-SA:2006:002)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUSE Security Announcement Package: novell-nrm Announcement ID: SUSE-SA:2006:002 Date: Fri, 13 Jan 2006 15:00:00 +0000 Affected Products: Open Enterprise Server Vulnerability Type: remote code execution Severity 1-10: 10 SUSE Default Package: yes...