Moderate: Red Hat Security Advisory: evolution-data-server security update

Updated evolution-data-server and evolution28-evolution-data-server packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Evolution Data Server provide...

RedHat Security Advisory RHSA-2009:0297

The remote host is missing updates announced in advisory RHSA-2009:0297. In accordance with the Red Hat Enterprise Linux Errata Support Policy, the 7 years life-cycle of Red Hat Enterprise Linux 2.1 will end on May 31 2009. After that date, Red Hat will discontinue the technical support services,...

RedHat Security Advisory RHSA-2009:0297

The remote host is missing updates announced in advisory RHSA-2009:0297. In accordance with the Red Hat Enterprise Linux Errata Support Policy, the 7 years life-cycle of Red Hat Enterprise Linux 2.1 will end on May 31 2009. After that date, Red Hat will discontinue the technical support services,...

ZABBIX PHP前端多个输入验证漏洞

BUGTRAQ ID: 33965 zabbix是一个CS结构的分布式网络监控系统。 ZABBIX的PHP前端存在多个输入验证错误，远程攻击者可以通过提交恶意请求执行跨站请求伪造攻击、读取敏感信息或完全入侵有漏洞的系统。 1 include/validate.inc.php中没有正确的过滤对calcexp2函数所提交的extlang参数，这可能导致注入并执行任意PHP代码。 2 由于没有检查用户提交请求的有效性，远程攻击者可以通过提交HTTP执行非授权操作。 3...

RHEL 2.1 : redhat-release (EOL Notice) (RHSA-2009:0297)

This is the 3-month notification of the End Of Life plans for Red Hat Enterprise Linux 2.1. In accordance with the Red Hat Enterprise Linux Errata Support Policy, the 7 years life cycle of Red Hat Enterprise Linux 2.1 will end on May 31 2009. After that date, Red Hat will discontinue the technica...

(RHSA-2009:0297) Low: Red Hat Enterprise Linux 2.1 - 3 Month End Of Life Notice

In accordance with the Red Hat Enterprise Linux Errata Support Policy, the 7 years life-cycle of Red Hat Enterprise Linux 2.1 will end on May 31 2009. After that date, Red Hat will discontinue the technical support services, bugfix, enhancement and security errata updates for the following...

Java Runtime Environment JAR manifest Main Class buffer overflow

Added: 02/26/2009 CVE: CVE-2008-5354 BID: 32608 OSVDB: 50499 Background Java Runtime Environment JRE allows end users to run Java applications. Problem A buffer overflow vulnerability in JRE allows command execution when a user opens a JAR archive containing a manifest file with a specially craft...

Java Runtime Environment JAR manifest Main Class buffer overflow

Added: 02/26/2009 CVE: CVE-2008-5354 BID: 32608 OSVDB: 50499 Background Java Runtime Environment JRE allows end users to run Java applications. Problem A buffer overflow vulnerability in JRE allows command execution when a user opens a JAR archive containing a manifest file with a specially craft...

Adobe under fire for poor security response

In the wake of the zero-day attacks against Adobe’s Acrobat and Reader product lines, the company is taking a lot of flack for its poor response to handling the issue — specifically around communicating the risks and providing migitation guidance for end users. Over on the ZDNet Zero Day blog, I...

Code injection

Tor 0.2.0.28, and probably 0.2.0.34 and earlier, allows remote attackers, with control of an entry router and an exit router, to confirm that a sender and receiver are communicating via vectors involving 1 replaying, 2 modifying, 3 inserting, or 4 deleting a single cell, and then observing cell...

SuSE Update for clamav SUSE-SA:2007:033

Check for the Version of clamav OpenVAS Vulnerability Test $Id: gbsuse2007033.nasl 8050 2017-12-08 09:34:29Z santu $ SuSE Update for clamav SUSE-SA:2007:033 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software;...

CVE-2008-5936: Exposure of Sensitive Information to an Unauthorized Actor

front-end/edit.php in mini-pub 0.3 and earlier allows remote attackers to read files and obtain PHP source code via a filename in the sFileName parameter...

No routing password permissions when the Dove on-line method-vulnerability warning-the black bar safety net

No routing password permissions when the pigeons on the line method: The first step:tools--FTP--FTP home directory, just in the desktop build one, put the following ports into 2 1. The user name can not fill. The following two options are marked with a tick. Then turn on the service. Completed th...

CVE-2008-5883: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in front-end/dir.php in mini-pub 0.3 and earlier allows remote attackers to list arbitrary directories via a full pathname in the sDir parameter...

CVE-2008-5579: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to read arbitrary files via a full pathname in the sFileName parameter...

CVE-2008-5580: Improper Input Validation

mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the sFileName argument...

MYBBS系统存在漏洞

1.用户注册功能页面没有针对无用户名注册的过滤用户注册功能页面没有针对用户名的长度的过滤用户注册功能页面没有针对无密码用户的过滤用户注册功能页面没有针对用户签名以及个人介绍的字数限制用户注册功能页面没有针对用户头像大小以及规格的限制 2.论坛版面最新回复所调用字数的限制论坛版面发表新文章的主题字数限制论坛版面发表新文章内容部分的字数限制论坛版面发表新文章针对JS的过滤 3.论坛短信功能页面没有针对发表人以及回复人的限制论坛短信功能页面对于JS恶意代码的过滤（JS代码嵌入漏洞论坛短信功能页面没有针对发表后页面的时间限制（可以导致无限制短信DOS...

CVE-2008-3511

Multiple cross-site scripting XSS vulnerabilities in Softbiz Image Gallery Photo Gallery allow remote attackers to inject arbitrary web script or HTML via the 1 latest parameter to a index.php, b images.php, c suggestimage.php, and d imagedesc.php; and the 2 msg parameter to index.php, images.php...

security update

CentOS Errata and Security Advisory CESA-2008:0521-03 In accordance with the Red Hat Enterprise Linux Errata Support Policy, the 7 year life-cycle of Red Hat Enterprise Linux 2.1 will end on May 31, 2009. After this date, Red Hat will discontinue the technical support services, bug fix,...

Wordtrans-web exec_wordtrans Function Arbitrary Command Execution

The remote host is running wordtrans-web, a web-based front-end for wordtrans, for translating words. The version of wordtrans-web installed on the remote host fails to sanitize input to the 'advanced' parameter of the 'wordtrans.php' script before using it in an 'passthru' statement to execute P...