[SECURITY] [DSA 900-3] New fetchmail-ssl packages fix potential information leak

-------------------------------------------------------------------------- Debian Security Advisory DSA 900-3 [email protected] http://www.debian.org/security/ Martin Schulze November 22nd, 2005 http://www.debian.org/security/faq -...

CVE-2005-3745

Cross-site scripting XSS vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message...

CVE-2005-3744

SQL injection vulnerability in index.php in phpComasy 0.7.5 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: an examination of the 0.7.5 source code suggests that there is no id parameter being handled directly by index.php...

CVE-2005-3745

Cross-site scripting XSS vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message...

CVE-2005-3741

Almond Classifieds does not properly verify the password, which allows attackers to bypass access restrictions...

CVE-2005-3747

Jetty (web server/container) affected by CVE-2005-3747: Unspecified vulnerability in Jetty before 5.1.6 could allow remote attackers to obtain the source code of JSP pages, potentially by requesting .jsp files with URL-encoded backslash characters ("%5C"). The issue is noted as possibly the same ...

CVE-2005-3744

CVE-2005-3744 describes a SQL injection vulnerability in the PHP application phpComasy, affecting version 0.7.5 and earlier. The flaw is claimed to be exploitable via the parameter in index.php, allowing remote attackers to execute arbitrary SQL commands. Note: the 0.7.5 source reportedly does n...

CVE-2005-3748

CVE-2005-3748 describes an SQL injection in the Search module of Tru-Zone Nuke ET 3.2 (and possibly earlier versions). The vulnerability allows remote attackers to manipulate the database by injecting SQL via the query parameter. The NVD entry records a CVSS v2 base score of 7.5 (HIGH) with netwo...

CVE-2005-3742

CVE-2005-3742 describes a cross-site scripting (XSS) vulnerability in the popup.php component of Advanced Poll 2.0.3 and earlier. The issue allows remote attackers to inject arbitrary web script or HTML via the poll_ident parameter. The vulnerability affects the affected Poll software as document...

CVE-2005-3745

CVE-2005-3745 is an XSS vulnerability in Apache Struts 1.x (notably 1.2.7) where an attacker can inject arbitrary script/HTML via the query string in error messages due to improper quoting/ filtering. Connected documents corroborate multiple vendor advisories: Red Hat notes that Struts 1.2.8 fixe...

CVE-2005-3743

SQL injection vulnerability in SimplePoll’s results.php allows remote attackers to execute arbitrary SQL commands via the pollid parameter. The issue affects the poll results handling and is described with a CVSSv2 base score of 7.5 (HIGH). Exploitation details, affected versions, and remediation...

CVE-2005-3741

CVE-2005-3741 affects Almond Classifieds, where improper password verification allows bypassing access restrictions. Descriptions across sources consistently state the issue as a password verification problem enabling unauthorized access. No specific affected versions or root-cause details beyond...

CVE-2005-3739

The vulnerability (CVE-2005-3739) affects PHP-Fusion 6.00.206 and earlier, with the flaw in subheader.php enabling remote attackers to obtain the full path via unspecified vectors. The provided sources do not specify exploit details, affected versions beyond those, or concrete remediation steps. ...

CVE-2005-3749

CVE-2005-3749 concerns IBM AIX 5.2/5.3 diagela (diagela.sh) with unspecified absolute path vulnerabilities. Connected documents indicate remediation via AIX security patches for bos.diag.rte: U477539 (AIX 5.2 TL 8) and U800632 (AIX 5.3 TL 4). These patches address the security of the diag.rte pac...

CVE-2005-3734

Cross-site scripting XSS vulnerability in the "add content" page in phpMyFAQ 1.5.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 thema, 2 username, and 3 usermail parameters...

CVE-2005-3734

The CVE-2005-3734 entry describes a Cross-site scripting (XSS) vulnerability in the phpMyFAQ 1.5.3 and earlier "add content" page. The issue allows remote attackers to inject arbitrary web script or HTML via the (1) thema, (2) username, and (3) usermail parameters. Affected product: phpMyFAQ (ver...

CVE-2005-3735

CVE-2005-3735 involves multiple SQL injection vulnerabilities in the e-Quick Cart system. The affected components/parameters are: (1) productid in shopaddtocart.asp, (2) strpemail in shopprojectlogin.asp, and (3) id in shoptellafriend.asp. The underlying issue is unsafely constructed SQL queries ...

CVE-2005-3737

Inkscape (versions 0.41–0.42.2) is affected by CVE-2005-3737 due to a buffer overflow in the SVG importer (style.cpp). A crafted SVG with long CSS style values could allow remote code execution. Debian/DSA-916-1 notes fixes: 0.41-4.99.sarge2 for sarge and 0.42.2+0.43pre1-1 for sid; Gentoo GLSA 20...

CVE-2005-3733

The Internet Key Exchange version 1 IKEv1 implementation in Juniper JUNOS and JUNOSe software for M, T, and J-series routers before release 6.4, and E-series routers before 7-1-0, allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IKE packets, as...

CVE-2005-3733

The Internet Key Exchange version 1 IKEv1 implementation in Juniper JUNOS and JUNOSe software for M, T, and J-series routers before release 6.4, and E-series routers before 7-1-0, allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IKE packets, as...