CVE-2005-2886

CVE-2005-2886 affects MAXdev MD-Pro 1.0.73 (and possibly earlier) with multiple XSS vulnerabilities. The issue allows remote attackers to inject arbitrary web script or HTML via: (1) the print parameter to the print module, (2) the sitename parameter to the bb_smilies module, (3) the sitename par...

CVE-2005-2881

CVE-2005-2881 affects phpCommunityCalendar 4.0.3. Remote attackers can bypass authentication via a direct request to the admin directory. NVD CVSS v2 base score 7.5 (HIGH): NETWORK vector, low attack complexity, no authentication required; confidentiality, integrity, and availability are partiall...

CVE-2005-2490

Stack-based buffer overflow in the sendmsg function call in the Linux kernel 2.6 before 2.6.13.1 allows local users to execute arbitrary code by calling sendmsg and modifying the message contents in another thread...

CVE-2005-2890

CVE-2005-2890 affects SecureOL VE2 1.05.1008. The issue is improper restriction of public access to physical memory via the PhysicalMemory device, allowing local users to bypass restrictions and gain access to the secured environment. Documented CVSSv2 base metrics: AV:L/AC:L/Au:N/C:P/I:P/A:P (ba...

CVE-2005-2883

CVE-2005-2883 is a duplicate of CVE-2005-2855 and has been deprecated; the connected record CVE-2005-2855 describes a Cross-site scripting (XSS) vulnerability in Unclassified NewsBoard 1.5.3. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the description fiel...

CVE-2005-2904

Zebedee 2.4.1 is affected. If the allowed redirection port is not set, a remote attacker can trigger a denial-of-service (application crash) by sending a zero port number in the protocol option header, causing an assert in makeConnection (zebedee.c). This is a Denial of Service vulnerability with...

CVE-2005-2490

CVE-2005-2490 describes a stack-based buffer overflow in the Linux kernel 2.6 sendmsg() path prior to 2.6.13.1. Local users could cause arbitrary code execution by calling sendmsg and altering message contents in another thread. Public sources in the connected documents corroborate the vulnerabil...

CVE-2005-2882

The CVE-2005-2882 entry covers multiple XSS vulnerabilities in phpCommunityCalendar 4.0.3 (and possibly earlier). The affected components include LocationID-based injections in thankyou.php and day.php; font parameter in calDaily.php, calMonthly.php, calMonthlyP.php, calWeekly.php, calWeeklyP.php...

CVE-2005-2901

CVE-2005-2901 affects CjWeb2Mail 3.0. The vulnerability is described as multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML via the following parameters: (1) name, (2) message, or (3) ip to thankyou.php, and (4) emsg to web2mail.php. The do...

CVE-2005-2894

PBLang 4.65 (and possibly earlier) contains a Cross-site scripting (XSS) vulnerability in the user registration process. The flaw allows remote attackers to inject arbitrary web script or PHP via the location field, as described in CVE-2005-2894. The NVD entry lists this as a MEDIUM-severity issu...

CVE-2005-2884

The connected sources show concrete details for CVE-2005-2884 related to Land Down Under (LDU) <= 801. The vulnerability includes Cross-Site Scripting (XSS) in events.php and, per OpenVAS, multiple issues (including SQL injection) due to inadequate input sanitization in PHP scripts (events.php...

CVE-2005-2889

CVE-2005-2889 concerns Check Point NGX R60 where the CIFS service group implementation may mishandle traffic not designated as CIFS. The CERT/Check Point entry notes that the CIFS service group could allow unintended traffic to pass or cause legitimate traffic to be dropped, depending on rule con...

CVE-2005-2892

CVE-2005-2892 affects PBLang 4.65 (and possibly earlier) with a directory traversal weakness in setcookie.php that lets remote attackers read arbitrary files by manipulating the u parameter (using .. and %00). Documents indicate this is a read-privilege vulnerability (partial confidentiality impa...

CVE-2005-2887

MAXdev MD-Pro 1.0.73 (and possibly earlier) is vulnerable to information disclosure via direct requests to wiki.php, AutoTheme, Blocks, admin.php, pnadmin.php, or Topics directories, where an error message reveals the path. No remediation details are provided in the supplied documents.

[Full-disclosure] [SECURITY] [DSA 811-1] New common-lisp-controller packages fix arbitrary code injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 811-1 [email protected] http://www.debian.org/security/ Martin Schulze September 14th, 2005 http://www.debian.org/security/faq -...

Mac OS X : Java for Mac OS X 1.3.1 and 1.4.2 Release 2 Multiple Vulnerabilities

The remote host is missing a security bugfix for Java 1.4.2 and 1.3.1. This update fixes several security vulnerabilities that may allow a Java applet to escalate its privileges. To exploit these flaws, an attacker would need to lure an attacker into executing a rogue Java applet. C Tenable Netwo...

Debian DSA-811-2 : common-lisp-controller - design error

The bugfix for the problem mentioned below contained an error that caused third-party programs to fail. The problem is corrected by this update. For completeness we're including the original advisory text : Francois-Rene Rideau discovered a bug in common-lisp-controller, a Common Lisp source and...

CVE-2005-2876

umount in util-linux 2.8 to 2.12q, 2.13-pre1, and 2.13-pre2, and other packages such as loop-aes-utils, allows local users with unmount permissions to gain privileges via the -r remount option, which causes the file system to be remounted with just the read-only flag, which effectively clears the...

[SECURITY] [DSA 810-1] New Mozilla packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 810-1 [email protected] http://www.debian.org/security/ Martin Schulze September 13th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 809-1] New squid packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 809-1 [email protected] http://www.debian.org/security/ Martin Schulze September 13th, 2005 http://www.debian.org/security/faq -...