PT-2006-6340 · Ig · Ig Shop

Name of the Vulnerable Software and Affected Versions: iG Shop version 1.4 Description: A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the id parameter in the change pass.php file. Recommendations: For iG Shop version 1.4, avoid using...

plone -- unprotected MembershipTool methods

The Plone Team reports: Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the: changeMemberPortrait deletePersonalPortrait testCurrentPassword methods, which allows remote attackers to modify portraits...

Microsoft ASP.NET AutoPostBack Variable Cross-Site Scripting Vulnerability

Description Microsoft ASP.NET is prone to a cross-site scripting vulnerability because the software fails to properly sanitize user-supplied input before it is rendered in the browser of an unsuspecting user in the context of the affected site. An attacker may leverage this issue to have arbitrar...

[SA21997] Amazing Little Poll "lp_settings.inc" Password Disclosure

TITLE: Amazing Little Poll "lpsettings.inc" Password Disclosure SECUNIA ADVISORY ID: SA21997 VERIFY ADVISORY: http://secunia.com/advisories/21997/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: Amazing Little Poll 1.x...

PT-2006-5246 · Cutenews · Cutenews

Name of the Vulnerable Software and Affected Versions: CuteNews versions 1.3.x Description: The issue allows remote attackers to potentially execute arbitrary PHP code via a URL in the cutepath parameter to API endpoints such as "show news.php" or "search.php". However, analysis has not identifie...

CVE-2006-2112

Fuji Xerox Printing Systems FXPS print engine, as used in products including 1 Dell 3000cn through 5110cn and 2 Fuji Xerox DocuPrint firmware before 20060628 and Network Option Card firmware before 5.13, allows remote attackers to use the FTP printing interface as a proxy "FTP bounce" by using...

Hobbit Monitor Daemon Detection

The remote host is running the server component of Hobbit Monitor, an open source application and network monitoring tool. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid22180; scriptversion"1.11";...

PT-2006-4529 · Atutor · Atutor

Name of the Vulnerable Software and Affected Versions: ATutor version 1.5.3 Description: A SQL injection issue in index.php allows remote attackers to execute arbitrary SQL commands via the fid parameter. The vendor has disputed this issue, stating it is not possible, but the source code suggests...

CVE-2006-1300: Undefined Security Weakness

Microsoft .NET framework 2.0 ASP.NET in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1 allows remote attackers to bypass access restrictions via unspecified "URL paths" that can access Application Folder objects "explicitly by name."...

Cisco Access Point Web Browser Interface contains a vulnerability

Overview A vulnerability in the HTTP management interface for some configurations of Cisco wireless access points could allow a remote attacker to take complete control over the affected device. Description Cisco wireless access points allow administrators to create more than one set of...

CVE-2006-2655: Undefined Security Weakness

The build process for ypserv in FreeBSD 5.3 up to 6.1 accidentally disables access restrictions when using the /var/yp/securenets file, which allows remote attackers to bypass intended access restrictions...

CVE-2006-2560

The connected sources confirm a vulnerability in Sitecom WL-153 router firmware prior to 1.38. A UPnP request with a modified InternalClient parameter is not validated, allowing remote attackers to bypass access restrictions and perform unauthorized operations, demonstrated via AddPortMapping to ...

CVE-2006-2562: Undefined Security Weakness

ZyXEL P-335WT router allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic...

CVE-2006-2561: Undefined Security Weakness

Edimax BR-6104K router allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter possibly within NewInternalClient, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary...

CVE-2006-2559: Undefined Security Weakness

Linksys WRT54G Wireless-G Broadband Router allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic...

CVE-2006-1856: Undefined Security Weakness

Certain modifications to the Linux kernel 2.6.16 and earlier do not add the appropriate Linux Security Modules LSM filepermission hooks to the 1 readv and 2 writev functions, which might allow attackers to bypass intended access restrictions...

[SA19846] FreeSSHd Key Exchange Algorithm String Buffer Overflow

TITLE: FreeSSHd Key Exchange Algorithm String Buffer Overflow SECUNIA ADVISORY ID: SA19846 VERIFY ADVISORY: http://secunia.com/advisories/19846/ CRITICAL: Highly critical IMPACT: DoS, System access WHERE: From remote SOFTWARE: FreeSSHd 1.x http://secunia.com/product/9607/ DESCRIPTION: Gerry...

CVE-2006-0515

CVE-2006-0515 affects Cisco PIX/ASA and Websense integration. Affected: Cisco PIX/ASA versions 7.1.x before 7.1(2) and 7.0.x before 7.0(5); PIX 6.3.x before 6.3.5(112); and FWSM 2.3.x before 2.3(4) and 3.x before 3.1(7) . Root cause: handling of HTTP requests when the GET method is split across m...

[SA19727] @1 Event Publisher Multiple Vulnerabilities

TITLE: @1 Event Publisher Multiple Vulnerabilities SECUNIA ADVISORY ID: SA19727 VERIFY ADVISORY: http://secunia.com/advisories/19727/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting, Exposure of sensitive information WHERE: From remote SOFTWARE: @1 Event Publisher...

To shadowless go without a trace anonymous breakthrough network limit-vulnerability warning-the black bar safety net

Network management as the name suggests, is every pipe of the network, and tried various means to restrict our Internet access people. In the network established all sorts of rules, don't download, don't use IM, not allowed to access the restricted site, etc., so we can't enjoy the Internet bring...