Security advisory: SQL Injection in LedgerSMB 1.2.24 and lower

Hi all; The LedgerSMB development team has found an SQL injection issue in LedgerSMB 1.2.24. Because this issue stems from our common SQL-Ledger heritage, it affects all versions of LedgerSMB and has been confirmed in SQL-Ledger 2.8.33. We contacted Dieter when we initially discovered this and no...

CGI Generic Tests Load Estimation (quick tests, HTML injection)

This script computes the maximum number of requests that would be done by the generic web tests, depending on miscellaneous options. It does not perform any test by itself. It adjusts the mode of each script if it is unable to run in the given time. The results can be used to estimate the duratio...

roundcube -- XSS vulnerability

RoundCube development Team reports: We just published a new release which fixes a recently reported XSS vulnerability as an update to the stable 0.5 branch. Please update your installations with this new version or patch them with the fix which is also published in the downloads section or our...

BackBox - Linux distribution based website Hacked

BackBox - Linux distribution based website Hacked BackBox is a Linux distribution based on Ubuntu Lucid 10.04 LTS developed to perform penetration tests and security assessments. Designed to be fast, easy to use and to provide a minimal yet complete desktop environment thanks to its own software...

BackBox - Linux distribution based website Hacked

BackBox - Linux distribution based website Hacked BackBox is a Linux distribution based on Ubuntu Lucid 10.04 LTS developed to perform penetration tests and security assessments. Designed to be fast, easy to use and to provide a minimal yet complete desktop environment thanks to its own software...

CVE-2011-1526

ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications aka krb5-appl 1.0.1 and earlier does not check the krb5setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP...

CVE-2009-5079

The 1 gendef.sh, 2 doc/fixinfo.sh, and 3 contrib/gdiffmk/tests/runtests.in scripts in GNU troff aka groff 1.21 and earlier allow local users to overwrite arbitrary files via a symlink attack on a gro.tmp or /tmp/ temporary file...

CVE-2009-5079

The 1 gendef.sh, 2 doc/fixinfo.sh, and 3 contrib/gdiffmk/tests/runtests.in scripts in GNU troff aka groff 1.21 and earlier allow local users to overwrite arbitrary files via a symlink attack on a gro.tmp or /tmp/ temporary file...

PT-2011-1198

Name of the Vulnerable Software and Affected Versions groff versions prior to 1.22.2 Description The issue concerns multiple vulnerabilities in the groff package that can be exploited to compromise the integrity and availability of protected information. Exploitation can be performed remotely...

kernel: unlimited socket backlog DoS

The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service memory consumption by sending a large amount of network traffic, as demonstrated by netperf UDP tests...

Nmap NSE net: smtp-open-relay

Attempts to relay mail by issuing a predefined combination of SMTP commands. The goal of this script is to tell if a SMTP server is vulnerable to mail relaying. An SMTP server that works as an open relay, is a email server that does not verify if the user is authorised to send email from the...

python security, bug fix, and enhancement update

python: 2.6.6-20 Resolves: CVE-2010-3493 2.6.6-19 Resolves: CVE-2011-1015 2.6.6-18 Resolves: CVE-2011-1521 2.6.6-17 - recompile against systemtap 1.4 Related: rhbz569695 2.6.6-16 - recompile against systemtap 1.4 Related: rhbz569695 2.6.6-15 - fix race condition that sometimes breaks the build wi...

Code injection

The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service memory consumption by sending a large amount of network traffic, as demonstrated by netperf UDP tests...

kernel: unlimited socket backlog DoS

The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service memory consumption by sending a large amount of network traffic, as demonstrated by netperf UDP tests...

CVE-2010-4776

SQL injection vulnerability in takefreestart.php in PreProjects Pre Online Tests Generator Pro allows remote attackers to execute arbitrary SQL commands via the tid2 parameter...

Sql injection

SQL injection vulnerability in takefreestart.php in PreProjects Pre Online Tests Generator Pro allows remote attackers to execute arbitrary SQL commands via the tid2 parameter...

CVE-2010-4776

SQL injection vulnerability in takefreestart.php in PreProjects Pre Online Tests Generator Pro allows remote attackers to execute arbitrary SQL commands via the tid2 parameter...

CVE-2010-4776

CVE-2010-4776 describes an SQL injection in takefreestart.php of PreProjects Pre Online Tests Generator Pro, exploitable via the tid2 parameter to execute arbitrary SQL. Reported in NVD with CVSSv2 base score 7.5 (HIGH); affected component is the PHP script takefreestart.php, URL-controlled input...

CVE-2010-4776: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in takefreestart.php in PreProjects Pre Online Tests Generator Pro allows remote attackers to execute arbitrary SQL commands via the tid2 parameter...

PT-2011-1725

Name of the Vulnerable Software and Affected Versions Pre Online Tests Generator Pro affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands via the tid2 parameter in the takefreestart.php file. This can lead to unauthorized access and...