[SECURITY] [DSA 1411-1] New libopenssl-ruby packages fix insecure SSL certificate validation

------------------------------------------------------------------------ Debian Security Advisory DSA-1411-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 24, 2007 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1410-1] New ruby1.8 packages fix insecure SSL certificate validation

------------------------------------------------------------------------ Debian Security Advisory DSA-1410-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 24, 2007 http://www.debian.org/security/faq -...

Unfixed XSS vulnerability at www.haberdiyarbakir.com

Security researcher CCC, has submitted on 25/11/2007 a cross-site-scripting XSS vulnerability affecting www.haberdiyarbakir.com, which at the time of submission ranked 517648 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 29/11/2007. It is...

rubygem-rails -- session-fixation vulnerability

Rails core team reports: The rails core team has released ruby on rails 1.2.6 to address a bug in the fix for session fixation attacks CVE-2007-5380. The CVE Identifier for this new issue is CVE-2007-6077...

DSA-1412-1 ruby1.9 - possible man-in-the-middle attacks

Bulletin has no description...

CVE-2007-6110

Cross-site scripting XSS vulnerability in htsearch in htdig 3.2.0b6 allows remote attackers to inject arbitrary web script or HTML via the sort parameter...

CVE-2007-6100

Cross-site scripting XSS vulnerability in libraries/auth/cookie.auth.lib.php in phpMyAdmin before 2.11.2.2, when logins are authenticated with the cookie authtype, allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter to index.php, a different vulnerability...

CVE-2007-6118

The MEGACO dissector in Wireshark formerly Ethereal 0.9.14 to 0.99.6 allows remote attackers to cause a denial of service long loop and resource consumption via unknown vectors...

CVE-2007-6121

Wireshark formerly Ethereal 0.8.16 to 0.99.6 allows remote attackers to cause a denial of service crash via a malformed RPC Portmap packet...

CVE-2007-6102

Cross-site scripting XSS vulnerability in Feed to JavaScript Feed2JS 1.91 allows remote attackers to inject arbitrary web script or HTML via a URL in a feed...

CVE-2007-6113

Integer signedness error in the DNP3 dissector in Wireshark formerly Ethereal 0.10.12 to 0.99.6 allows remote attackers to cause a denial of service long loop via a malformed DNP3 packet...

CVE-2007-6115

Buffer overflow in the ANSI MAP dissector for Wireshark formerly Ethereal 0.99.5 to 0.99.6, when running on unspecified platforms, allows remote attackers to cause a denial of service and possibly execute arbitrary code via unknown vectors...

CVE-2007-6116

The Firebird/Interbase dissector in Wireshark formerly Ethereal 0.99.6 allows remote attackers to cause a denial of service infinite loop or crash via unknown vectors...

DEBIAN-CVE-2007-6121

Wireshark formerly Ethereal 0.8.16 to 0.99.6 allows remote attackers to cause a denial of service crash via a malformed RPC Portmap packet...

CVE-2007-6106

AlstraSoft E-Friends up to version 4.98 and earlier is affected by an SQL injection in index.php via the seid parameter in the viewevent action, allowing remote attackers to execute arbitrary SQL commands. The connected documents provide the affected product/version and the vulnerable parameter, ...

CVE-2007-6111

Summary: CVE-2007-6111 pertains to multiple vulnerabilities in Wireshark (Eth­er­eal) with remote DoS possibilities. Related connected advisories indicate several CVEs (e.g., 2007-6111, 2007-6112, 2007-6113, 2007-6114, 2007-6115, 2007-6116, 2007-6117, 2007-6118, 2007-6119, 2007-6120, 2007-6121, 2...

CVE-2007-6102

CVE-2007-6102 is a cross-site scripting vulnerability in Feed2JS (Feed to JavaScript) 1.91. The flaw allows remote attackers to inject arbitrary web script or HTML via a URL in a feed, enabling arbitrary script execution in the victim’s browser. The affected component is Feed2JS’s feed-to-JS conv...

CVE-2007-6116

CVE-2007-6116 : The Firebird/Interbase dissector in Wireshark (formerly Ethereal) 0.99.6 is susceptible to remote denial of service (infinite loop or crash) via unknown vectors. The provided documents do not specify the exact exploit vectors or a remediation version. Monitor for official fixes an...

CVE-2007-6100

CVE-2007-6100 is a cross-site scripting (XSS) vulnerability in phpMyAdmin prior to 2.11.2.2. The flaw occurs in libraries/auth/cookie.auth.lib.php where, when logins use cookie auth_type, an attacker can inject script via the convcharset parameter to index.php. The issue affects phpMyAdmin versio...

CVE-2007-6106

SQL injection vulnerability in index.php in AlstraSoft E-Friends 4.98 and earlier allows remote attackers to execute arbitrary SQL commands via the seid parameter in a viewevent action...