Sql injection

The original distribution of MyBulletinBoard MyBB to update from older versions to 1.0.2 omits or includes older versions of certain critical files, which allows attackers to conduct 1 SQL injection attacks via an attachment name that is not properly handled by inc/functionsupload.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in DCP-Portal 5.3 through 6.1.1 allow remote attackers to inject arbitrary web script or HTML via 1 the day parameter in calendar.php and 2 the input form in search.php. NOTE: the provenance of this information is unknown; the details are obtained...

CVE-2005-4660

CVE-2005-4660 concerns IPCop Firewall prior to 1.4.10, where a race condition may allow a local attacker to overwrite system configuration files. The underlying flaw involves replacing a backup archive during the window when it is owned by namebody but not yet encrypted, and then executing ipco...

CVE-2005-4655

CVE-2005-4655 refers to a cross-site scripting (XSS) vulnerability in PHP-Fusion 6.0.204, specifically in submit.php where the news_body parameter accepts input that can be crafted with nested HTML tags (for example "<meta" or "<sc[removed]ript>") to inject arbitrary script or HTML. The ...

CVE-2005-4664

CVE-2005-4664 concerns OcoMon 1.21 (and possibly earlier versions). It describes a SQL injection vulnerability that can be triggered when magic_quotes_gpc is disabled, allowing remote attackers to execute arbitrary SQL commands through the logon page. The Connected documents also indicate exploit...

CVE-2005-4663

The CVE-2005-4663 entry describes a cross-site scripting (XSS) vulnerability in OcoMon 1.20 and possibly earlier versions, allowing remote attackers to inject arbitrary web script or HTML via unknown attack vectors. The vulnerability affects the web-facing components of OcoMon, enabling potential...

CVE-2005-4653

CVE-2005-4653 affects AL-Caricatier 2.5 and earlier. The vulnerability is in ss.php and allows an unauthenticated attacker to bypass login by a sequence: request view_caricatier.php, then request any file in the admin directory with a cookie_username=admin. Impact: partial confidentiality (per CV...

CVE-2005-4662

The CVE-2005-4662 entry concerns OcoMon 1.20 (and possibly earlier) with multiple SQL injection vulnerabilities that may allow remote attackers to execute arbitrary SQL via an input form with unknown vectors. The description does not specify exact affected inputs, versions beyond 1.20, or concret...

CVE-2005-4657

The CVE-2005-4657 entry concerns Ocean12 Calendar Manager Pro 1.01, where remote attackers may bypass authentication and obtain sensitive information via a direct request to /admin/view.asp. The description notes that provenance is unknown and details come from third-party information; no vendor-...

CVE-2005-4658

CVE-2005-4658 describes multiple cross-site scripting (XSS) vulnerabilities in ASP-Programmers.com ASPKnowledgebase. Affected component: the administrative interface of ASPKnowledgebase. Root cause: unspecified XSS flaws that allow remote attackers to inject arbitrary scripts or HTML via unknown ...

CVE-2005-4654

Technical details of CVE-2005-4654 are not provided in the supplied documents. No specific affected products, vulnerable components, or remediation are disclosed here; monitor for updates.

CVE-2005-4661

The CVE-2005-4661 entry affects Campsite prior to version 2.3.3. The notifyendsubs cron job sends an e-mail that contains an unencrypted MySQL password, which can be captured by remote attackers and leads to partial confidentiality loss. The public documents do not provide explicit remediation st...

CVE-2005-4659

CVE-2005-4659 affects IPCop (IPCop Firewall) prior to 1.4.10. The backup.key file has world-readable permissions, potentially allowing local users to overwrite system configuration files by creating a malicious encrypted backup archive owned by nobody and then running ipcoprscfg to restore from t...

USN-242-1: mailman vulnerabilities

Aliet Santiesteban Sifontes discovered a remote Denial of Service vulnerability in the attachment handler. An email with an attachment whose filename contained invalid UTF-8 characters caused mailman to crash. CVE-2005-3573 Mailman did not sufficiently verify the validity of email dates. Very lar...

[SECURITY] [DSA 943-1] New Perl packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 943-1 [email protected] http://www.debian.org/security/ Martin Schulze January 16th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 943-1] New Perl packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 943-1 [email protected] http://www.debian.org/security/ Martin Schulze January 16th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 941-1] New tuxpaint packages fix insecure temporary file creation

-------------------------------------------------------------------------- Debian Security Advisory DSA 941-1 [email protected] http://www.debian.org/security/ Martin Schulze January 16th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 941-1] New tuxpaint packages fix insecure temporary file creation

-------------------------------------------------------------------------- Debian Security Advisory DSA 941-1 [email protected] http://www.debian.org/security/ Martin Schulze January 16th, 2006 http://www.debian.org/security/faq -...

freeFTPd 1.0 Username Overflow

This module exploits a stack buffer overflow in the freeFTPd multi-protocol file transfer service. This flaw can only be exploited when logging has been enabled non-default. This module requires Metasploit: https://metasploit.com/download Current source:...

ethereal security update

CentOS Errata and Security Advisory CESA-2006:0156-01 Updated Ethereal packages that fix various security vulnerabilities are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ethereal is a program for monitoring network traffic. T...