CVE-2009-4954

CVE-2009-4954 describes an SQL injection in the TYPO3 VCE plug-in Versatile Calendar Extension (sk_calendar) before version 0.3.4. Affected software: TYPO3 environment using sk_calendar prior to 0.3.4. Root cause: improper handling of input in the extension, enabling an attacker to inject arbitra...

CVE-2009-4937

CVE-2009-4937 describes an XSS in Small Pirate (SPirate) 2.1. An attacker can inject arbitrary script/HTML via an onmouseover in an img BBCode tag inside a url BBCode tag. The records consistently cite Cross-site scripting without details on exploit status or affected versions beyond 2.1. The con...

CVE-2009-4939

AdPeeps 8.5d1 is affected by multiple cross-site scripting (XSS) vulnerabilities in index.php. The issues allow remote attackers to inject arbitrary web script or HTML via a large set of parameters (e.g., uid, campaignid, type, period, accname, loginpass, e9, from, message, idno, plus several for...

CVE-2009-4942

Technical details (affected versions, root cause, exploit conditions) are not provided in the connected documents. Monitor for updates for additional, verifiable information.

CVE-2009-4943

CVE-2009-4943 affects AdPeeps 8.5d1, where index.php exposes sensitive information: (1) view_adrates with an invalid uid leaks the installation path via an error message, and (2) adminlogin with a crafted uid reveals the version. Documents show CVSS2 base 5.0 (medium) and reference multiple advis...

CVE-2009-4936

CVE-2009-4936 affects Small Pirate (SPirate) 2.1 with multiple SQL injection vulnerabilities. Remote attackers can inject through the id parameter in: (1) the default URI in an RSS .xml action, (2) pag1.php, (3) pag1-guest.php, (4) rss-comment_post.php (aka rss-coment_post.php), or (5) rss-pic-co...

CVE-2009-4945

CVE-2009-4945 affects AdPeeps 8.5d1, where a default admin password enables remote access via index.php. The vulnerability has CVSSv2 base score 7.5 (NETWORK vector, low attack complexity, no authentication). Impact described as partial confidentiality, integrity, and availability. Documents conf...

CVE-2009-4941

CVE-2009-4941 is a documented cross-site scripting (XSS) vulnerability in ATRC ACollab 1.2, specifically in the script. The issue arises when an attacker can inject arbitrary web script or HTML via the f parameter . The public records (NVD, CVE List, CVE Record) confirm the vulnerable component ...

CVE-2009-4940

ZeusCart is reported to be vulnerable to an SQL injection in index.php for version 2.3 and earlier, exploitable via the maincatid parameter in the showmaincatlanding action. The vulnerability affects ZeusCart’s input handling in the affected page, potentially allowing remote attackers to execute ...

CVE-2009-4942

Cross-site request forgery CSRF vulnerability in ACollab 1.2 allows remote attackers to hijack the authentication of arbitrary users for requests that add personal agenda items...

CVE-2009-4897

Buffer overflow in gs/psi/iscan.c in Ghostscript 8.64 and earlier allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted PDF document containing a long name...

CVE-2009-4897

Ghostscript (GPL Ghostscript) contains CVE-2009-4897: a buffer overflow in gs/psi/iscan.c can be triggered by a crafted PDF with a long name, enabling remote code execution or memory corruption. Affected: Ghostscript 8.64 and earlier. Exploitation via crafted PDFs; memory corruption could lead to...

CentOS 4 : openldap (CESA-2010:0543)

Updated openldap packages that fix two security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Debian Security Advisory DSA 2071-1 (libmikmod)

The remote host is missing an update to libmikmod announced via advisory DSA 2071-1. OpenVAS Vulnerability Test $Id: deb20711.nasl 6614 2017-07-07 12:09:12Z cfischer $ Description: Auto-generated from advisory DSA 2071-1 libmikmod Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

[Backports-security-announce] Security Update for nsrp

Alexander Reichle-Schmehl uploaded new packages for nspr which fixed the following security problems: CVE-2009-0689 Array index error in the 1 dtoa implementation in dtoa.c aka pdtoa.c and the 2 gdtoa aka new dtoa implementation in gdtoa/misc.c in libc, as used in multiple operating systems and...

openSUSE Security Update : kernel (openSUSE-SU-2010:0397-1)

The SUSE Linux Enterprise 11 Kernel was updated to 2.6.27.48 fixing various bugs and security issues. CVE-2010-1641: The dogfs2setflags function in fs/gfs2/file.c in the Linux kernel does not verify the ownership of a file, which allows local users to bypass intended access restrictions via a...

[SECURITY] [DSA 2073-1] New mlmmj packages fix directory traversal

------------------------------------------------------------------------ Debian Security Advisory DSA-2073-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst July 20, 2010 http://www.debian.org/security/faq -...

OpenLDAP: Doesn't properly handle NULL character in subject Common Name

libraries/libldap/tlso.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers vi...

VMware vCenter Update Manager fix for Jetty Web server addresses important security vulnerabilities

a. VMware vCenter Update Manager Jetty Web server vulnerabilities VMware vCenter Update Manager is an automated patch management solution for VMware ESX hosts and Microsoft virtual machines. Update Manager embeds the Jetty Web server which is a third party component. The default version of the...

[security bulletin] HPSBTU02453 SSRT091037 rev.1 - HP Tru64 UNIX BIND Server, Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01837667 Version: 1 HPSBTU02453 SSRT091037 rev.1 - HP Tru64 UNIX BIND Server, Denial of Service DoS NOTICE: The information in this Security Bulletin should be acted upon as soon as possible...