Novell ZENworks Asset Management Collection Client Remote Overflow

The remote host is running Novell ZENworks Asset or Inventory Management, a remote desktop and network management software. The remote version of this software has multiple heap overflow vulnerabilities that may be exploited by an attacker to execute arbitrary code on the remote host with SYSTEM...

RHEL 4 : mod_auth_kerb (RHSA-2006:0746)

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2006:0746 advisory. modauthkerb is module for the Apache HTTP Server designed to provide Kerberos authentication over HTTP. An off by one flaw was found in the way...

Debian DSA-1230-1 : l2tpns - buffer overflow

Rhys Kidd discovered a vulnerability in l2tpns, a layer 2 tunnelling protocol network server, which could be triggered by a remote user to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Low mod_auth_kerb security update

5.0-1.3.el4 - add fix for CVE-2006-5989 Nalin Dahyabhai, 216482...

CentOS 4 : mod_auth_kerb (CESA-2006:0746)

Updated modauthkerb packages that fix a security flaw and a bug in multiple realm handling are now available for Red Hat Enterprise Linux 4. This update has been rated as having low security impact by the Red Hat Security Response Team. modauthkerb is module for the Apache HTTP Server designed to...

CVE-2006-6450

Multiple SQL injection vulnerabilities in dagent/downloadreport.asp in Novell ZENworks Patch Management ZPM before 6.3.2.700 allow remote attackers to execute arbitrary SQL commands via the 1 agentid and 2 pass parameters...

CVE-2006-6451

Multiple cross-site scripting XSS vulnerabilities in SWsoft Plesk 8.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to 1 getpassword.php or 2 loginup.php3...

CVE-2006-6453

PHP remote file inclusion vulnerability in JOWAMPShowPage.php in J-OWAMP Web Interface 2.1 allows remote authenticated users to execute arbitrary PHP code via a URL in the link parameter...

CVE-2006-6455

Multiple SQL injection vulnerabilities in admin/default.asp in DUware DUdirectory 3.1, and possibly DUdirectory Pro and Pro SQL 3.x, allow remote attackers to execute arbitrary SQL commands via the 1 Username or 2 Password parameter. NOTE: some of these details are obtained from third party...

CVE-2006-6446

SQL injection vulnerability in index.php in iWare Professional 5.0.4, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the D parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-6454

execInBackground.php in J-OWAMP Web Interface 2.1b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters to the 1 exe and 2 args parameters, which are used in an exec function call. NOTE: the provenance of this information is unknown; the details are obtained...

[SECURITY] [DSA 1233-1] New Linux 2.6.8 packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1233-1 [email protected] http://www.debian.org/security/ Dann Frazier December 10th, 2006 http://www.debian.org/security/faq -...

CVE-2006-6454

CVE-2006-6454 affects J-OWAMP Web Interface 2.1b and earlier. The vulnerability arises in execInBackground.php where remote attackers can cause arbitrary command execution by injecting shell metacharacters into the exe and args parameters used in an exec() call. This is a remote, unauthenticated ...

CVE-2006-6451

Multiple cross-site scripting XSS vulnerabilities in SWsoft Plesk 8.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to 1 getpassword.php or 2 loginup.php3...

CVE-2006-6448

Vulnerability: CVE-2006-6448 affects Vt-Forum Lite 1.3 and earlier. Description: Multiple SQL injection vulnerabilities allow remote attackers to execute arbitrary SQL commands via the user parameter to vf_memberdetail.asp and other vectors. Root cause: unsafely constructed SQL queries in the aff...

CVE-2006-6445

CVE-2006-6445 affects Envolution prior to or including version 1.1.0. It is a directory traversal vulnerability in error.php that allows remote attackers to include and execute arbitrary local files by supplying a .. (dot dot) in the PNSVlang parameter, demonstrated by injecting PHP sequences int...

CVE-2006-6449

Vulnerability CVE-2006-6449 affects Vt-Forum Lite 1.3 and earlier. The issue is that sensitive information (a database) is stored under the web root with insufficient access control, enabling remote attackers to download db/forum.mdb via a direct request. This describes a partial confidentiality ...

CVE-2006-6444

Stack-based buffer overflow in Nostra DivX Player 2.1, 2.2.00.0, and possibly earlier, allows remote attackers to execute arbitrary code via a long string in an M3U file. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-6452

The CVE-2006-6452 entry concerns the MyArticles module for RunCMS (before 0.6 beta 1). The vulnerability is a set of cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary script/HTML via unspecified parameters to topics.php, submit.php, and class/calendar.class.php. The...

CVE-2006-6454

execInBackground.php in J-OWAMP Web Interface 2.1b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters to the 1 exe and 2 args parameters, which are used in an exec function call. NOTE: the provenance of this information is unknown; the details are obtained...