[SECURITY] [DSA 2370-1] unbound security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2370-1 [email protected] http://www.debian.org/security/ Florian Weimer December 22, 2011 http://www.debian.org/security/faq -...

Important: Red Hat Security Advisory: rhev-hypervisor6 security and bug fix update

An updated rhev-hypervisor6 package that fixes one security issue and two bugs is now available. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...

Slideshow: Threatpost Top Security News Stories of 2011

VIEW SLIDESHOW Threatpost Top Security News Stories of 2011 We’ve compiled our list of the Top Security Stories of 2011, presented here in no particular order. These are the issues that shook the world’s markets and kept us awake at night. If there’s a lesson here, it’s that cybersecurity...

CVE-2011-4453

PmWiki 2.x (notably <= 2.2.34) is affected by a Remote PHP Code Injection in scripts/pagelist.php (Pagelist) where a crafted order parameter enables unintended use of PHP create_function, leading to remote code execution. Public references indicate exploits and Metasploit modules exist for PmW...

CVE-2011-4203

CRLF injection vulnerability in calendar/set.php in the Calendar component in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, 2.1.x before 2.1.3, and 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors involving the url variable...

CVE-2011-4037

CVE-2011-4037 affects Sielco Sistemi Winlog PRO before 2.07.09 and Winlog Lite before 2.07.09. The root cause is a buffer overflow caused by invalid data in certain fields of a project file (unspecified fields), as described across multiple sources. The vulnerability could allow code execution, w...

CVE-2011-4203

The CVE-2011-4203 issue affects Moodle’s Calendar component, specifically calendar/set.php. The root cause is a CRLF injection via the url parameter, allowing remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting. Affected versions are Moodle 1.9.x before 1.9.15, 2...

Unfixed Redirect vulnerability at www.stat.si

Security researcher p0pc0rn, has submitted on 22/12/2011 a Redirect vulnerability affecting www.stat.si, which at the time of submission ranked 355952 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 22/12/2011. It is currently unfixed. If you...

Unfixed Redirect vulnerability at wnsr.halfoffdeals.com

Security researcher p0pc0rn, has submitted on 22/12/2011 a Redirect vulnerability affecting wnsr.halfoffdeals.com, which at the time of submission ranked 136338 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 22/12/2011. It is currently unfixed...

Unfixed Redirect vulnerability at milwaukee.halfoffdeals.com

Security researcher p0pc0rn, has submitted on 22/12/2011 a Redirect vulnerability affecting milwaukee.halfoffdeals.com, which at the time of submission ranked 136338 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 22/12/2011. It is currently...

Unfixed Redirect vulnerability at www.webconstruct.co.za

Security researcher p0pc0rn, has submitted on 22/12/2011 a Redirect vulnerability affecting www.webconstruct.co.za, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 22/12/2011. It is currently unfixed. If...

Unfixed Redirect vulnerability at neworleans.halfoffdeals.com

Security researcher p0pc0rn, has submitted on 22/12/2011 a Redirect vulnerability affecting neworleans.halfoffdeals.com, which at the time of submission ranked 136338 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 22/12/2011. It is currently...

Mozilla Products jar Files Remote Code Execution Vulnerability - Mac OS X

Mozilla Firefox/Thunderbird is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

DSA-2370-1 unbound - several

Bulletin has no description...

Tiki Wiki CMS Groupware 8.2 - 'snarf_ajax.php' Remote PHP Code Injection

------------------------------------------------------------------------- Tiki Wiki CMS Groupware /tiki-8.2/snarfajax.php?url=1&regexres=phpinfo&regex=//e%00/ Tiki internal filters remove all null bytes from user input, but for some strange reason this doesn't happen within admin sessions. So,...

phpMyAdmin 3.4.8 Cross Site Scripting

Trustwave's SpiderLabs Security Advisory TWSL2011-019: Cross-Site Scripting Vulnerability in phpMyAdmin https://www.trustwave.com/spiderlabs/advisories/TWSL2011-019.txt Published: 12/22/11 Version: 1.0 Vendor: phpMyAdmin http://www.phpmyadmin.net/ Product: phpMyAdmin Version affected: 3.4.8 and...

Unfixed Redirect vulnerability at cleveland.halfoffdeals.com

Security researcher p0pc0rn, has submitted on 22/12/2011 a Redirect vulnerability affecting cleveland.halfoffdeals.com, which at the time of submission ranked 136338 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 22/12/2011. It is currently...

Unfixed Redirect vulnerability at covga.halfoffdeals.com

Security researcher p0pc0rn, has submitted on 22/12/2011 a Redirect vulnerability affecting covga.halfoffdeals.com, which at the time of submission ranked 136338 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 22/12/2011. It is currently unfixe...

Unfixed Redirect vulnerability at whohd.halfoffdeals.com

Security researcher p0pc0rn, has submitted on 22/12/2011 a Redirect vulnerability affecting whohd.halfoffdeals.com, which at the time of submission ranked 136338 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 22/12/2011. It is currently unfixe...

Tiki Wiki CMS Groupware 8.2 - snarf_ajax.php Remote PHP Code Injection

Tiki Wiki CMS Groupware 8.2 - snarfajax.php Remote PHP Code Injection ------------------------------------------------------------------------- Tiki Wiki CMS Groupware /tiki-8.2/snarfajax.php?url=1&regexres=phpinfo&regex=//e%00/ Tiki internal filters remove all null bytes from user input, but for...