[SECURITY] [DSA 821-1] New python2.3 packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 821-1 [email protected] http://www.debian.org/security/ Martin Schulze September 28th, 2005 http://www.debian.org/security/faq -...

CVE-2005-3096

CVE-2005-3096 concerns Avi Alkalay’s nslookup.cgi CGI script. The vulnerability description states that remote attackers can execute arbitrary commands by supplying shell metacharacters in the query parameter, enabling command execution via a CGI script on the server. Metrics indicate a network-e...

CVE-2005-2557

CVE-2005-2557 is a cross-site scripting (XSS) flaw in MantisBT (0.19.0a1 through 1.0.0a3) exploitable via the dir parameter to view_all_set.php (bug#0005959). The available documents confirm the vulnerability class and affected range; no explicit remediation or exploitation details are provided b...

CVE-2005-3103

Summary: CVE-2005-3103 is an XSS vulnerability in Movable Type prior to 3.2. The issue allows remote attackers to inject arbitrary web script or HTML via multiple form fields (title, category, body, extended body, excerpt) when creating new blog entries. The provided description notes it as a cro...

CVE-2005-3104

Movable Type

CVE-2005-3091

CVE-2005-3091 is a cross‑site scripting vulnerability in Mantis (web-based bug tracker) prior to 1.0.0rc1. The issue allows an attacker to inject arbitrary web script/HTML. OpenVAS and Debian advisories group CVE-2005-3091 with related flaws (CVE-2005-3335/3336/3338/3339) and note remote impact. ...

CVE-2005-3096

Avi Alkalay nslookup.cgi program, dated 16 June 2002, allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter...

CVE-2005-3091

Cross-site scripting XSS vulnerability in Mantis before 1.0.0rc1 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors, as identified by bug0005751 "thraxisp"...

CVE-2005-3103

Cross-site scripting XSS vulnerability in Movable Type before 3.2 allows remote attackers to inject arbitrary web script or HTML via the 1 title, 2 category, 3 body, 4 extended body, and 5 excerpt form fields in new blog entries...

CVE-2005-3090

The CVE-2005-3090 entry describes an XSS vulnerability in Mantis (bug_actiongroup_page.php) affecting 0.19.0a1–1.0.0a3. An attacker can inject arbitrary script/HTML via the bug summary when view_all_bug_page.php is used to delete a bug, since the summary is not quoted. No specific exploit details...

CVE-2005-3093

Technical details about CVE-2005-3093 are not publicly provided in the supplied documents. Monitor for updates from vendors and security advisories.

CVE-2005-2964

AbiWord (GTK2) contains a stack-based buffer overflow in the RTF import mechanism that can allow arbitrary code execution. Affected: AbiWord versions before 2.2.10. Impact: remote code execution with no user interaction required. Remediation: upgrade to AbiWord 2.2.10 or later as indicated by mul...

CVE-2005-3100

Technical details about CVE-2005-3100 are not provided in the connected documents. Available sources mention a PPTP remote DoS vulnerability in Astaro Security Linux 4.027 but do not disclose affected components, versions, exploit details, or fixes. Monitor for updates.

CVE-2005-3097

Directory traversal vulnerability in Avi Alkalay contribute.cgi aka contribute.pl, dated 16 Jun 2002, allows remote attackers to overwrite arbitrary files via ".." sequences in the contribdir variable...

CVE-2005-3095

Avi Alkalay notify program, dated 19 Aug 2001, allows remote attackers to execute arbitrary commands via shell metacharacters in the from parameter...

CVE-2005-3092

CVE-2005-3092 describes a heap-based buffer overflow in Image-Line Software FL Studio 5.0.1. A crafted .flp file with an excessively long path to a referenced (1) .mid or (2) .wav file can allow a remote attacker to execute arbitrary code. Documents do not provide a specific patch or remediation;...

CVE-2005-3094

CVE-2005-3094 concerns a vulnerable Avi Alkalay man-cgi script that allows remote attackers to execute arbitrary code through shell metacharacters in the topic parameter. The NVD entry rates this as HIGH (CVSS v2 base 7.5) with a network attack vector, low complexity, and no authentication requir...

CVE-2005-3095

CVE-2005-3095 concerns the Avi Alkalay notify program (dated 19 Aug 2001). The available documents indicate that remote attackers could execute arbitrary commands by injecting shell metacharacters into the from parameter. CVSS metrics (NVD) specify a Network attack vector with Low complexity, no ...

CVE-2005-3099

The CVE-2005-3099 entry concerns an unspecified vulnerability in the Xsun and Xprt components of Solaris 7–10 that allows local code execution. Connected documents identify concrete remediation patches for Solaris 10: Xsun patches such as 119060-64/65, 119059-66/69, 119059-71/72/74, and 119060-73...

CVE-2005-3101

Movable Type prior to 3.2 exposes username enumeration via the password reset feature: authentication messages differ based on user existence, enabling remote attackers to determine valid usernames. No other details provided in the connected docs.