[Backports-security-announce] Security Update for postgresql-8.4

Gerfried Fuchs uploaded new packages for postgresql-8.4 which fixed the following security problems: CVE-2010-1169 PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2 does not properly restrict...

CVE-2010-2011

Microsoft Dynamics GP uses a substitution cipher to encrypt the system password field and unspecified other fields, which makes it easier for remote authenticated users to obtain sensitive information by decrypting a field's contents...

CVE-2010-2011

Microsoft Dynamics GP is affected by CVE-2010-2011, where a substitution cipher used to encrypt the system password field (and unspecified other fields) can allow remote authenticated users to decrypt content and obtain sensitive information. The vulnerability stems from weak/encryption method us...

Code injection

PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not properly check privileges during certain RESET ALL operations, which allows remote authenticated users to remove arbitrary parameter settings via a 1 ALTER USER ...

CVE-2010-1624

The CVE-2010-1624 issue affects Pidgin (libpurple) MSN protocol plugin, specifically the msn_emoticon_msg function in slp.c. It allows remote authenticated users to trigger a denial of service via a specially crafted SLP message containing a malformed emoticon, causing a NULL pointer dereference ...

OCS Inventory NG Server <= 1.3.1 (login) Remote Authentication Bypass

Exploit for php platform in category web applications ===================================================================== OCS Inventory NG Server OCS Inventory NG function $id return document.getElementByIdid; function $$id return $id.options$id.options.selectedIndex.value; function bypass...

OCS Inventory NG Server 1.3.1 - 'LOGIN' Remote Authentication Bypass

OCS Inventory NG = 1.3.1 login Remote Authentication Bypass function $id return document.getElementByIdid; function $$id return $id.options$id.options.selectedIndex.value; function bypass $'log'.action = $'ocsreports'.value + $$'meth' + '?lang=' + $$'lang'; if $$'type' == 0 $'login'.value = "'...

OCS Inventory NG Server 1.3.1 - LOGIN Remote Authentication Bypass

OCS Inventory NG Server 1.3.1 - LOGIN Remote Authentication Bypass OCS Inventory NG = 1.3.1 login Remote Authentication Bypass function $id return document.getElementByIdid; function $$id return $id.options$id.options.selectedIndex.value; function bypass $'log'.action = $'ocsreports'.value +...

DEBIAN-CVE-2010-0402

OpenTTD before 1.0.1 does not properly validate index values of certain items, which allows remote authenticated users to cause a denial of service daemon crash or possibly execute arbitrary code via a crafted in-game command...

CVE-2010-0401

OpenTTD before 1.0.1 accepts a company password for authentication in response to a request for the server password, which allows remote authenticated users to bypass intended access restrictions or cause a denial of service daemon crash by sending a company password packet...

Command injection

OpenTTD before 1.0.1 does not properly validate index values of certain items, which allows remote authenticated users to cause a denial of service daemon crash or possibly execute arbitrary code via a crafted in-game command...

CVE-2010-1617

user/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not properly check a role, which allows remote authenticated users to obtain the full names of other users via the course profile page...

Code injection

Unspecified vulnerability in HP System Insight Manager before 6.0 allows remote authenticated users to gain privileges via unknown vectors...

CVE-2009-4815

Directory traversal vulnerability in Serv-U before 9.2.0.1 allows remote authenticated users to read arbitrary files via unspecified vectors...

CVE-2010-1035

Multiple unspecified vulnerabilities in HP Virtual Machine Manager VMM before 6.0 allow remote authenticated users to execute arbitrary code via unknown vectors...

CVE-2009-4810

The Secure Remote Password SRP implementation in Samhain before 2.5.4 does not check for a certain zero value where required by the protocol, which allows remote attackers to bypass authentication via crafted input...

CVE-2010-1034

Unspecified vulnerability in HP System Management Homepage SMH 6.0 before 6.0.0-95 on Linux, and 6.0 before 6.0.0.96 on Windows, allows remote authenticated users to obtain sensitive information, modify data, and cause a denial of service via unknown vectors...

CVE-2009-4790

CVE-2009-4790 concerns Sysax Multi Server 4.5, where multiple directory traversal vulnerabilities allow remote authenticated users to read or modify arbitrary files via crafted FTP commands. The description notes that provenance is unknown and details come from third‑party information. All connec...

CVE-2009-4800

Directory traversal vulnerability in Sysax Multi Server 4.3 and 4.5 allows remote authenticated users to delete arbitrary files via a ..// dot dot slash slash in a DELE command...

CVE-2009-4800

The CVE-2009-4800 entry describes a directory traversal vulnerability in Sysax Multi Server versions 4.3 and 4.5 . It allows remote authenticated users to delete arbitrary files via a “..//” sequence in a DELE command, indicating a flaw in path handling during FTP-like file operations. The availa...