Gentoo Security Advisory GLSA 200405-05 (utempter)

The remote host is missing updates announced in advisory GLSA 200405-05. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Authentication flaw

The SAML Single Sign-On SSO Service for Google Apps allows remote service providers to impersonate users at arbitrary service providers via vectors related to authentication responses that lack a request identifier and recipient field...

CVE-2008-3891

The SAML Single Sign-On SSO Service for Google Apps allows remote service providers to impersonate users at arbitrary service providers via vectors related to authentication responses that lack a request identifier and recipient field...

CVE-2008-3891

The SAML Single Sign-On SSO Service for Google Apps allows remote service providers to impersonate users at arbitrary service providers via vectors related to authentication responses that lack a request identifier and recipient field...

CVE-2008-3891

SAID: CVE-2008-3891 concerns the SAML Single Sign-On (SSO) service for Google Apps. The vulnerability arises when authentication responses lack a request identifier and recipient field, enabling remote service providers to impersonate users at arbitrary service providers. The core affected compon...

Java Web Start Buffer overflow vulnerabilities (6557220)

Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.218 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by a an application that grants itself...

Java Web Start arbitrary file creation/deletion file with user permissions (6704077)

Unspecified vulnerability in Sun Java Web Start in JDK and JRE 5.0 before Update 16 and SDK and JRE 1.4.x before 1.4.218 allows remote attackers to create or delete arbitrary files via an untrusted application, aka CR 6704077...

Firefox arbitrary JavaScript code execution

Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 allow remote attackers to execute arbitrary code via an XUL document that includes a script from a chrome: URI that points to a fastload file, related to this file's "privilege level."...

Java Web Start arbitrary file creation/deletion file with user permissions (6704077)

Unspecified vulnerability in Sun Java Web Start in JDK and JRE 5.0 before Update 16 and SDK and JRE 1.4.x before 1.4.218 allows remote attackers to create or delete arbitrary files via an untrusted application, aka CR 6704077...

CVE-2008-3111

Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.218 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by a an application that grants itself...

Firefox block reflow flaw

The block reflow implementation in Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 allows remote attackers to execute arbitrary code or cause a denial of service application crash via an image whose display requires more pixels than nscoordMAX, relat...

tomcat manager example DoS

Multiple cross-site scripting XSS vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 el/functions.jsp, 2 el/implicit-objects.jsp, and 3 jspx/textRotate.jspx in examples/jsp2/, as demonstrated via...

[SECURITY] Fedora 8 Update: fedora-ds-admin-1.1.4-1.fc8

Fedora Administration Server is an HTTP agent that provides management feat ures for Fedora Directory Server. It provides some management web apps that can be used through a web browser. It provides the authentication, access cont rol, and CGI utilities used by the console...

Attack Technique: File Download Injection

File Download Injection ======================= Affects most web application platforms, including Java, .NET, PHP, Cold Fusion. This attack involves the use of header injection, particularly the Content-Disposition header, to subvert HTTP responses from trusted domains. Attackers can use this...

AIX 520009 : U807850

The remote host is missing AIX PTF U807850 which is related to the security of the package X11.apps.clients You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc';...

AIX 530005 : U807684

The remote host is missing AIX PTF U807684 which is related to the security of the package X11.samples.apps.aixclients You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0;...

jetAudio 7.0.5 COWON Media Center MP4 Stack Overflow Exploit

Exploit for unknown platform in category local exploits ============================================================ jetAudio 7.0.5 COWON Media Center MP4 Stack Overflow Exploit ============================================================ !/bin/perl jetAudio 7.0.5 COWON Media Center MP4 Stack...

jetAudio 7.0.5 COWON Media Center MP4 - Local Stack Overflow

!/bin/perl jetAudio 7.0.5 COWON Media Center MP4 Stack Overflow 0-day discovered and exploited by SYS 49152 Tested on win XP SP2 ENG Shell on port 49152 usage: - download the latest 3ivx codec from here: hxxp://www.3ivx.com/codec/3ivxMPEG-4501trialwin.exe - play the AVI file with COWON Media Cent...

SuSE 10 Security Update : krb5-apps-servers (ZYPP Patch Number 3022)

When using the krb5 telnet daemon it was possible for remote attackers to override authentication mechanisms and gain root access to the machine by supplying a special username. This is tracked by the Mitre CVE ID CVE-2007-0956. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE 10 Security Update : krb5-apps-servers and krb5-apps-clients (ZYPP Patch Number 1938)

Various return checks of setuid and seteuid calls have been fixed in kerberos client and server applications. If these applications are setuid, it might have been possible for local attackers to gain root access. CVE-2006-3083 We are not affected by the seteuid problems, tracked by CVE-2006-3084...