CVE-2008-1118

Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, does not perform input validation before logging information fields taken from packets from a remote peer, which allows remote attackers to generate crafted log entries, and possibly avoid detection of attacks, via modified 1 computer...

CVE-2008-1118

Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, does not perform input validation before logging information fields taken from packets from a remote peer, which allows remote attackers to generate crafted log entries, and possibly avoid detection of attacks, via modified 1 computer...

CVE-2008-1118

CVE-2008-1118 affects Timbuktu Pro 8.6.5 for Windows (and possibly 8.7 for Mac OS X). The root cause is a lack of input validation when logging information fields sourced from remote packets (computer name, user name, IP address). This allows a remote attacker to craft log entries or manipulate l...

CVE-2008-0978

Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storage Mirroring name and other names, allows remote attackers to obtain sensitive information via a packet of type 1 0x2728, which provides operating system and path information; 2 0x274e, which lists Ethernet adapters; 3...

Design/Logic Flaw

Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storage Mirroring name and other names, allows remote attackers to obtain sensitive information via a packet of type 1 0x2728, which provides operating system and path information; 2 0x274e, which lists Ethernet adapters; 3...

CVE-2008-0978

Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storage Mirroring name and other names, allows remote attackers to obtain sensitive information via a packet of type 1 0x2728, which provides operating system and path information; 2 0x274e, which lists Ethernet adapters; 3...

Fedora 8 : kernel-2.6.23.14-115.fc8 (2008-0984)

Update to Linux kernel 2.6.23.14: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.23.10 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.23.11 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.23.12 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.23.13...

Logs visualization in WS_FTP Server Manager 6.1.0.0

Luigi Auriemma Application: WSFTP Server Manager http://www.wsftp.com Versions: WSFTP Server = 6.1.0.0 Platforms: Windows Bugs: A authorization bypassing in log visualization B ASP source visualization Exploitation: remote Date: 06 Feb 2008 Author: Luigi Auriemma e-mail: [email protected] web:...

Information disclosure

The replaceinlineimg function in elogd in Electronic Logbook ELOG before 2.7.1 allows remote attackers to cause a denial of service infinite loop via crafted logbook entries. NOTE: some of these details are obtained from third party information...

CVE-2008-0445

The replaceinlineimg function in elogd in Electronic Logbook ELOG before 2.7.1 allows remote attackers to cause a denial of service infinite loop via crafted logbook entries. NOTE: some of these details are obtained from third party information...

CVE-2008-0445: Undefined Security Weakness

The replaceinlineimg function in elogd in Electronic Logbook ELOG before 2.7.1 allows remote attackers to cause a denial of service infinite loop via crafted logbook entries. NOTE: some of these details are obtained from third party information...

Design/Logic Flaw

blocks/shoutboxblock.php in BtiTracker 1.4.4 does not verify user accounts, which allows remote attackers to post shoutbox entries as arbitrary users via a modified nick field...

Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 9.1 / current : xpdf/poppler/koffice/kdegraphics (SSA:2007-316-01)

New xpdf packages are available for Slackware 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, and -current. New poppler packages are available for Slackware 12.0 and -current. New koffice packages are available for Slackware 11.0, 12.0, and -current. New kdegraphics packages are available for Slackware 10.2,...

Cross site scripting

Cross-site scripting XSS vulnerability in the CAD service in IBM Tivoli Storage Manager TSM Client 5.3.5.3 and 5.4.1.2 for Windows allows remote attackers to inject arbitrary web script or HTML via HTTP requests to port 1581, which generate log entries in a dsmerror.log file that is accessible...

CVE-2007-5513

The XML DB XMLDB component in Oracle Database 9.2.0.8, 9.2.0.8DV, and 10.1.0.5 generates incorrect audit entries in the USERID column in which 1 long usernames are trimmed to 5 characters, or 2 short entries contain any extra characters from usernames in previous entries, aka DB23...

Design/Logic Flaw

The XML DB XMLDB component in Oracle Database 9.2.0.8, 9.2.0.8DV, and 10.1.0.5 generates incorrect audit entries in the USERID column in which 1 long usernames are trimmed to 5 characters, or 2 short entries contain any extra characters from usernames in previous entries, aka DB23...

CVE-2007-5513

The CVE-2007-5513 entry concerns Oracle Database XML DB (XMLDB) component in versions 9.2.0.8, 9.2.0.8DV, and 10.1.0.5. The issue is in audit trail entries for USERID: long usernames get trimmed to five characters, and shorter entries may contain extra characters from previous usernames (DB23). T...

CVE-2007-5513

The XML DB XMLDB component in Oracle Database 9.2.0.8, 9.2.0.8DV, and 10.1.0.5 generates incorrect audit entries in the USERID column in which 1 long usernames are trimmed to 5 characters, or 2 short entries contain any extra characters from usernames in previous entries, aka DB23...

CVE-2007-5513: Undefined Security Weakness

The XML DB XMLDB component in Oracle Database 9.2.0.8, 9.2.0.8DV, and 10.1.0.5 generates incorrect audit entries in the USERID column in which 1 long usernames are trimmed to 5 characters, or 2 short entries contain any extra characters from usernames in previous entries, aka DB23...

simpnews24103-xss.txt

netVigilance Security Advisory 70 SimpNews version 2.41.03 Multiple XSS Attack Vulnerabilities Description: SimpNews is a news system written in PHP. Features: Data stored in MySQL, admin interface, support for multiple languages, support for multiple instances in one database, own header, multip...