[SECURITY] [DSA 777-1] New Mozilla packages fix frame injection spoofing vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 777-1 [email protected] http://www.debian.org/security/ Martin Schulze August 17th, 2005 http://www.debian.org/security/faq -...

CVE-2005-2610

The CVE-2005-2610 entry describes a Cross‑Site Scripting (XSS) vulnerability in VegaDNS where index.php accepts a message parameter. Affected versions include VegaDNS 0.8.1 and 0.9.8 (and possibly other versions). The underlying issue allows remote attackers to inject arbitrary web script or HTML...

CVE-2005-2604

Technical details for CVE-2005-2604 are not publicly available in the provided documents. Monitor for updates and new connected sources to confirm affected product/version, root cause, impact, and remediation.

CVE-2005-2596

User.php in Gallery, as used in Postnuke, allows users with any Admin privileges to gain access to all galleries...

CVE-2005-2612

The CVE covers a Direct code injection vulnerability in WordPress 1.5.1.3 and earlier that allows remote attackers to execute arbitrary PHP code via the cache_lastpostdate[server] cookie. Affected software is WordPress (versions prior to 1.5.1.3). Root cause is improper handling of the cache_last...

CVE-2005-2598

CVE-2005-2598 affects Dokeos 1.6 and earlier, and possibly Claroline. The issue consists of multiple directory traversal vulnerabilities that allow remote attackers to (1) delete arbitrary files or directories via the delete parameter to claroline/scorm/scormdocument.php, (2) move arbitrary files...

CVE-2005-2614

Discuz! 4.0 rc4 does not properly restrict types of files that are uploaded to the server, which allows remote attackers to execute arbitrary commands via a filename containing ".php.rar" or other multiple extensions that include .php...

CVE-2005-2101

langen2kvtml in KDE 3.0 to 3.4.2 creates insecure temporary files in /tmp with predictable names, which allows local users to overwrite arbitrary files...

CVE-2005-2610

Cross-site scripting XSS vulnerability in index.php in VegaDNS 0.8.1, 0.9.8, and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the message parameter...

CVE-2005-2606

Technical details about CVE-2005-2606 are not publicly available in the provided documents. No concrete affected products, root causes, or remediation are specified here. Monitor for updates.

CVE-2005-2609

Technical details about CVE-2005-2609 are not publicly available in the provided connected documents. Monitor for updates from official advisories before assessing impact or remediation.

CVE-2005-2602

Technical details about CVE-2005-2602 are not publicly provided in the supplied documents. Monitor for updates from vendors and vulnerability trackers.

CVE-2005-2594

CVE-2005-2594 affects Apple Safari 1.3 (132) on Mac OS X 1.3.9. The vulnerability allows remote attackers to cause a denial of service (crash) through certain Javascript, possibly involving a function that defines a handler for itself within the function body. The connected documents provide the ...

CVE-2005-2591

Parlano MindAlign 5.0 and later versions are reported to be vulnerable to a User Enumeration flaw that allows remote attackers to list valid users via unknown vectors. The description confirms the affected product line but does not provide concrete exploit details, affected components, root cause...

CVE-2005-2615

Technical details about CVE-2005-2615 are not publicly available in the provided documents; no concrete affected versions, impact, or remediation are described. Monitor for updates.

CVE-2005-2620

The CVE affects Novell GroupWise Windows clients (5.x–6.5.2) where the grpWise.exe process stores passwords in plaintext in memory. This allows a local attacker with access (e.g., via memory dump/read mechanisms or a debugger) to recover credentials. The issue is a memory-credential caching probl...

CVE-2005-2616

CVE-2005-2616 concerns ezUpload version 2.2 where multiple PHP files (initialize.php, customize.php, form.php, index.php) are vulnerable to improper handling of the path parameter used for including PHP code. The underlying issue enables remote attackers to cause arbitrary code execution by manip...

CVE-2005-2617

The CVE-2005-2617 entry describes a vulnerability in Linux kernel 2.6.12 and later on 64-bit x86 where syscall32_setup_pages (syscall32.c) does not check the return value of insert_vm_struct. This can allow local users to trigger a memory leak via a crafted 32‑bit ELF header. Affected component: ...

CVE-2005-2596

CVE-2005-2596 concerns a programming error in the Gallery component used with Postnuke that allows any user with Admin privileges to access all galleries. Open-source advisories and Debian security notes describe a remote-attack surface stemming from a bug in the gallery code that grants full gal...

CVE-2005-2593

Parlano MindAlign 5.0 and later versions are described as using weak encryption, with unknown impact and attack vectors. The CVSS v2.0 data from NVD lists a base score of 10.0, attack vector Network, complexity Low, authentication None, and Confidentiality/Integrity/Availability Impact as Complet...