[SECURITY] [DSA 1725-1] New websvn packages fix information leak

------------------------------------------------------------------------ Debian Security Advisory DSA-1725-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst February 15, 2009 http://www.debian.org/security/faq -...

DSA-1725-1 websvn - information leak

Bulletin has no description...

CVE-2008-6137: Undefined Security Weakness

EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to bypass access restrictions via unknown vectors...

Design/Logic Flaw

Mozilla Firefox before 3.0.6 and SeaMonkey before 1.1.15 do not properly restrict access from web pages to the 1 Set-Cookie and 2 Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly...

CVE-2009-0411

CVE-2009-0411 affects Google Chrome prior to 1.0.154.46, where web pages could access the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers via XMLHttpRequest and other web scripts, leading to potential disclosure of cookie data. Root cause: insufficient restriction of cross-origin access ...

CVE-2009-0411

Google Chrome before 1.0.154.46 does not properly restrict access from web pages to the 1 Set-Cookie and 2 Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls and other web script...

CVE-2009-0383

delete.php in Max.Blog 1.0.6 does not properly restrict access, which allows remote attackers to delete arbitrary blog posts via a direct request...

CVE-2009-0383

CVE-2009-0383 affects Max.Blog 1.0.6; the delete.php endpoint does not properly restrict access, enabling remote attackers to delete arbitrary blog posts via a direct request. The issue is caused by improper access control on the delete operation. Impact is partial integrity/partial availability ...

CVE-2009-0383

delete.php in Max.Blog 1.0.6 does not properly restrict access, which allows remote attackers to delete arbitrary blog posts via a direct request...

CVE-2009-0382: Undefined Security Weakness

Unspecified vulnerability in Internationalization i18n Translation 5.x before 5.x-2.5, a module for Drupal, allows remote attackers with "translate node" permissions to bypass intended access restrictions and read unpublished nodes via unspecified vectors...

CVE-2009-0342

Niels Provos Systrace before 1.6f on the x8664 Linux platform allows local users to bypass intended access restrictions by making a 64-bit syscall with a syscall number that corresponds to a policy-compliant 32-bit syscall...

CVE-2009-0343: Undefined Security Weakness

Niels Provos Systrace 1.6f and earlier on the x8664 Linux platform allows local users to bypass intended access restrictions by making a 32-bit syscall with a syscall number that corresponds to a policy-compliant 64-bit syscall, related to race conditions that occur in monitoring 64-bit processes...

CVE-2009-0342: Undefined Security Weakness

Niels Provos Systrace before 1.6f on the x8664 Linux platform allows local users to bypass intended access restrictions by making a 64-bit syscall with a syscall number that corresponds to a policy-compliant 32-bit syscall...

NewsCMSlite Insecure Cookie Handling

www.BugReport.ir AmnPardaz Security Research Team Title: NewsCMSlite Vendor: http://www.katywhitton.com Bug: Insecure Cookie Handling Exploitation: Remote with browser Fix: N/A Original Advisory: http://www.bugreport.ir/index62.htm - Description: NewsCMSlite is an easy way to get regularly update...

CVE-2009-0180: Undefined Security Weakness

Certain Fedora build scripts for nfs-utils before 1.1.2-9.fc9 on Fedora 9, and before 1.1.4-6.fc10 on Fedora 10, omit TCP Wrapper support, which might allow remote attackers to bypass intended access restrictions, possibly a related issue to CVE-2008-1376...

DEBIAN-CVE-2008-5905

The web interface plugin in KTorrent before 3.1.4 allows remote attackers to bypass intended access restrictions and upload arbitrary torrent files, and trigger the start of downloads and seeding, via a crafted HTTP POST request...

CVE-2008-5905: Undefined Security Weakness

The web interface plugin in KTorrent before 3.1.4 allows remote attackers to bypass intended access restrictions and upload arbitrary torrent files, and trigger the start of downloads and seeding, via a crafted HTTP POST request...

HP OpenView Network Node Manager Toolbar.exe CGI buffer overflow

Added: 01/09/2009 CVE: CVE-2008-0067 BID: 33147 Background HP OpenView Network Node Manager is network availability and performance management software. Problem A buffer overflow vulnerability allows remote attackers to execute arbitrary commands by requesting the Toolbar.exe CGI program with a...

Design/Logic Flaw

The smmsnmpd service in CA Service Metric Analysis r11.0 through r11.1 SP1 and Service Level Management 3.5 does not properly restrict access, which allows remote attackers to execute arbitrary commands via unspecified vectors...

CVE-2009-0043

CVE-2009-0043 relates to CA Service Metric Analysis (SMA) r11.0–r11.1 SP1 and CA Service Level Management (SLM) 3.5, where the smmsnmpd service has insufficient access control allowing a remote attacker to execute arbitrary commands. The vulnerability stems from access restrictions not properly l...