4062 matches found
[Full-disclosure] H4CREW-000005 EasyNews Pro 4.0 XSS & CSRF
I luv u Ms. Phisher u d4 d1am0nds 1n My Ski h4xorCrew Advirosy 5: Easynews PRO 4.0 XSS and CRSF =================================================== "the game of secuirity is like a sord fight you must think furst b4 you m0ve" H-4 h3r3 2 stay cuz we in da h0uz h4xorcewz n da house and r4w we g0nna...
CVE-2007-3209
Mail Notification 4.0, when WITHSSL is set to 0 at compile time, uses unencrypted connections for accounts configured with SSL/TLS, which allows remote attackers to obtain sensitive information by sniffing the network...
CVE-2007-3209
Mail Notification 4.0 is affected: if built with WITH_SSL=0, it uses unencrypted connections for SSL/TLS accounts, enabling remote attackers to sniff network traffic and obtain sensitive information. No remediation details are provided in the supplied documents.
CVE-2007-3209
Mail Notification 4.0, when WITHSSL is set to 0 at compile time, uses unencrypted connections for accounts configured with SSL/TLS, which allows remote attackers to obtain sensitive information by sniffing the network...
Remote file inclusion
PHP remote file inclusion vulnerability in sample/xls2mysql in ABC Excel Parser Pro 4.0 allows remote attackers to execute arbitrary PHP code via a URL in the parserpath parameter...
CVE-2007-2857
CVE-2007-2857 is a PHP remote file inclusion vulnerability affecting ABC Excel Parser Pro 4.0 (sample/xls2mysql). The underlying issue allows an attacker to execute arbitrary PHP code by providing a URL in the parser_path parameter. Public references confirm the RFI nature, with impact described ...
[SECURITY] [DSA 1297-1] New gforge-plugin-scmcvs packages fix arbitrary shell command execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 1297-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 24th, 2007 http://www.debian.org/security/faq -...
[SECURITY] [DSA 1281-2] New clamav packages fix denial of service vulnerability
------------------------------------------------------------------------ Debian Security Advisory DSA-1281-2 [email protected] http://www.debian.org/security/ Noah Meyerhans May 21, 2007 - ------------------------------------------------------------------------ Package : clamav Vulnerability :...
[SECURITY] Fedora Core 6 Update: squirrelmail-1.4.10a-1.fc6
SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no Javascript for maximum compatibility across browsers. It has very few requirements and is very easy to configure and instal...
[SECURITY] [DSA 1289-1] New Linux 2.6.18 packages fix several vulnerabilities
-------------------------------------------------------------------------- Debian Security Advisory DSA 1289-1 [email protected] http://www.debian.org/security/ Dann Frazier May 13th, 2007 http://www.debian.org/security/faq -...
DSA-1289-1 linux-2.6
Bulletin has no description...
CVE-2006-7196
Cross-site scripting XSS vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly...
Debian DSA-1288-1 : pptpd - programming error
It was discovered that the PoPToP Point to Point Tunneling Server contains a programming error, which allows the tear-down of a PPTP connection through a malformed GRE packet, resulting in denial of service. The oldstable distribution sarge is not affected by this problem. %NASLMINLEVEL 70300 C...
CVE-2007-2577
Multiple SQL injection vulnerabilities in ACP3 4.0 beta 3 allow remote attackers to execute arbitrary SQL commands via 1 the mode parameter to feeds.php, the 2 formcat parameter to a news/list/index.php or b certain news/details/id/actioncreate/index.php files, or 3 the formmods parameter to...
Code injection
Unspecified vulnerability in search/list/actionsearch/index.php in ACP3 4.0 beta 3 allows remote attackers to have unknown impact, relating to "Cookie Manipulation", via the formsearchterm parameter...
CVE-2007-2579
Multiple cross-site scripting XSS vulnerabilities in ACP3 4.0 beta 3 allow remote attackers to inject arbitrary web script or HTML via 1 the formmail parameter to contact/contact/index.php; the 2 formmods or 3 formsearchterm parameter to search/list/actionsearch/index.php; 4 the id parameter to...
CVE-2007-2578
Unspecified vulnerability in search/list/actionsearch/index.php in ACP3 4.0 beta 3 allows remote attackers to have unknown impact, relating to "Cookie Manipulation", via the formsearchterm parameter...
CVE-2007-2579
CVE-2007-2579 concerns ACP3 4.0 beta 3, where multiple cross-site scripting (XSS) vectors exist. The vulnerabilities allow remote attackers to inject arbitrary web script or HTML through various parameters across the application: form[mail] to contact/contact/index.php; form[mods][], form[search_...
CVE-2007-2577
Multiple SQL injection vulnerabilities in ACP3 4.0 beta 3 allow remote attackers to execute arbitrary SQL commands via 1 the mode parameter to feeds.php, the 2 formcat parameter to a news/list/index.php or b certain news/details/id/actioncreate/index.php files, or 3 the formmods parameter to...