PHPOutsourcing Zorum 3.5 - Prod.php Arbitrary Command Execution

PHPOutsourcing Zorum 3.5 - Prod.php Arbitrary Command Execution source: https://www.securityfocus.com/bid/14601/info Zorum is prone to an arbitrary command execution vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. This issue may facilitat...

CVE-2005-0393

The helper scripts for crip 3.5 do not properly use temporary files, which allows local users to have an unknown impact with unknown attack vectors...

CVE-2005-0393

The helper scripts for crip 3.5 do not properly use temporary files, which allows local users to have an unknown impact with unknown attack vectors...

CVE-2005-0393

The helper scripts for crip 3.5 do not properly use temporary files, which allows local users to have an unknown impact with unknown attack vectors...

CVE-2005-0393

The helper scripts for crip 3.5 do not properly use temporary files, which allows local users to have an unknown impact with unknown attack vectors...

CVE-2005-0393

The helper scripts for crip 3.5 do not properly use temporary files, which allows local users to have an unknown impact with unknown attack vectors...

CVE-2005-0393

CVE-2005-0393 affects crip, a terminal-based ripper/encoder/tagger tool. The advisory notes that crip 3.5 helper scripts do not securely use temporary files, allowing local users to exploit this in an insecure manner with unknown impact and attack vectors. The Debian DSA-733-1 and OpenVAS entry c...

Debian DSA-733-1 : crip - insecure temporary files

Justin Rye discovered that crip, a terminal-based ripper, encoder and tagger tool, utilises temporary files in an insecure fashion in its helper scripts. The old stable distribution woody does not provide the crip package. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

[SECURITY] [DSA 733-1] New crip packages fix insecure temporary files

-------------------------------------------------------------------------- Debian Security Advisory DSA 733-1 [email protected] http://www.debian.org/security/ Martin Schulze June 30th, 2005 http://www.debian.org/security/faq -...

CVE-2005-0676

index.php in Zorum 3.5 allows remote attackers to trigger an SQL error, and possibly inject arbitrary SQL commands, via the search capability...

CVE-2005-0677

index.php for Zorum 3.5 allows remote attackers to perform certain actions as other users by modifying the id parameter...

CVE-2005-0637

The copy functions in locore.s such as copyout in OpenBSD 3.5 and 3.6, and possibly other BSD based operating systems, may allow attackers to exceed certain address boundaries and modify kernel memory...

CVE-2005-0675

Cross-site scripting XSS vulnerability in index.php for Zorum 3.5 allows remote attackers to inject arbitrary web script or HTML via the 1 list or 2 frommethod parameters...

CVE-2005-0740

The TCP stack tcpinput.c in OpenBSD 3.5 and 3.6 allows remote attackers to cause a denial of service system panic via crafted values in the TCP timestamp option, which causes invalid arguments to be used when calculating the retransmit timeout...

CVE-2003-1102

Hummingbird CyberDOCS 3.5, 3.9, and 4.0, when running on IIS, uses insecure permissions for script source code files, which allows remote attackers to read the source code...

CVE-2005-0676

CVE-2005-0676 affects Zorum 3.5. The vulnerability is in index.php via the search capability, where remote attackers can trigger an SQL error and potentially inject arbitrary SQL commands. The provided documents confirm the affected software and the underlying issue is an SQL injection/error cond...

CVE-2005-0677

CVE-2005-0677 affects Zorum 3.5 where the file index.php allows remote attackers to perform certain actions as other users by modifying the id parameter. The underlying issue is parameter manipulation that enables privilege escalation within the application, leading to actions executed with anoth...

CVE-2005-0675

CVE-2005-0675 affects Zorum 3.5. A Cross-site scripting (XSS) vulnerability exists in index.php, exploitable via the list or frommethod parameters to inject arbitrary script/HTML. This is a remote, unauthenticated vector with impact limited to client-side script execution; no remediation details ...

CVE-2005-0676

index.php in Zorum 3.5 allows remote attackers to trigger an SQL error, and possibly inject arbitrary SQL commands, via the search capability...

[VulnWatch] OpenBSD radius authentication vulnerability

Title: OpenBSD radius authentication vulnerability Summary: Authentication can be bypassed when radius-authentication is used on OpenBSD. Impact: Unauthorized access to the system Software: OpenBSD 3.2 and OpenBSD 3.5 confirmed vulnerable. Workarounds: 1 Place the Radius server on an isolated lan...