libxml2 security update

CentOS Errata and Security Advisory CESA-2012:1512 Updated libxml2 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS...

CVE-2012-3886

AirDroid 1.0.4 beta uses the MD5 algorithm for values in the checklogin key parameter and 7bb cookie, which makes it easier for remote attackers to obtain cleartext data by sniffing the local wireless network and then conducting a 1 brute-force attack or 2 rainbow-table attack...

Samba 3.x < 3.6.4 / 3.5.14 / 3.4.16 RPC Multiple Buffer Overflows

Binary data 6443.prm...

CVE-2011-3727

DokuWiki 2009-12-25c allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/tpl/index.php and certain other files...

JDK unspecified vulnerability in Sound component

Unspecified vulnerability in the Java Runtime Environment JRE in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.229 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound and...

OpenJDK HttpURLConnection allows arbitrary request headers (6961084,6980004)

Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU...

CVE-2009-4374

Directory traversal vulnerability in repository/repositoryattachment.php in AlienVault Open Source Security Information Management OSSIM 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to upload files into arbitrary directories via a .. dot dot in the iddocument paramet...

[SECURITY] [DSA 1914-1] New mapserver packages fix serveral vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA-1914-1 [email protected] http://www.debian.org/security/ Nico Golde October 22nd, 2009 http://www.debian.org/security/faq -...

Design/Logic Flaw

stardict 3.0.1, when Enable Net Dict is configured, sends the contents of the clipboard to a dictionary server, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2009-1318

Directory traversal vulnerability in index.php in Jamroom 3.1.2, 3.2.3 through 3.2.6, 4.0.2, and possibly other versions before 3.4.0 allows remote attackers to include arbitrary files via directory traversal sequences in the t parameter...

rmsoft-xss.txt

RMSOFT Downloads Plus two scripts two variables XSS Vendor url:http://www.xoops-mexico.net/ Advisore:http://lostmon.blogspot.com/2008/08/ rmsoft-downloads-plus-two-scripts-two.html Vendor notify:no exploits availables:yes RMSOFT Downloads Plus is a download php/Mysql script module for multiple CM...

CVE-2007-4407

ircu 2.10.12.03 and 2.10.12.04 does not associate a timestamp with ops privilege on an unused channel zannel, which allows remote attackers to 1 set or remove certain channel modes via a "netriding" attack or 2 take over a channel by joining an unlinked server with the A/Upass and then setting a...

Memory corruption

RealNetworks RealPlayer 10 Gold allows remote attackers to cause a denial of service memory consumption via a certain .ra file. NOTE: this issue was referred to as a "memory leak," but it is not clear if this is correct...

CVE-2007-1264

Enigmail 0.94.2 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Enigmail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message...

CVE-2006-4096

BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service crash via a flood of recursive queries, which cause an INSIST failure when the response is received after the recursion queue is empty...

akfingerd

The remote finger service appears to vulnerable to a remote attack which can disrupt the service of the finger daemon. This denial of service does not effect other services that may be running on the remote computer, only the finger service can be disrupted. akfingerd version 0.5 or earlier is...

CVE-2005-0290

NETGEAR FVS318 running firmware 2.4, and possibly other versions, allows remote attackers to bypass the filters using hex encoded URLs, as demonstrated using a hex encoded file extension...

CVE-2004-1102

MailPost 5.1.1sv, and possibly earlier versions, displays a different error message depending on whether the requested file exists or not, which allows remote attackers to gain sensitive information...

CVE-2002-1336

TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users...

CVE-2004-2009

NukeJokes 1.7 and 2 Beta allows remote attackers to obtain the full path of the server via 1 a direct call to mainfunctions.php, 2 an invalid jokeid parameter in a JokeView function or 3 an invalid cat parameter in a CatView function, which reveals the path in a PHP error message...