phpPgAds dest Parameter HTTP Response Splitting

There is a flaw in the remote phpPgAds/phpAdsNew, a banner management and tracking system written in PHP. This version of phpPgAds/phpAdsNew is affected by an HTTP response splitting vulnerability. An attacker, exploiting this flaw, would be able to redirect users to another site to perform anoth...

ngIRCd < 0.8.2 Lists_MakeMask() Remote Overflow DoS

According to its banner, the version of the ngIRCd chat service on the remote host contains a buffer overflow in 'ListsMakeMask' in 'src/ngircd/lists.c' that can be exploited by a remote attacker to crash the affected service or possibly even execute arbitrary code on the remote host subject to t...

CoolForum Multiple SQL Injections

The version of CoolForum, a bulletin-board application written in PHP, installed on the remote host fails to sanitize input to several parameters to scripts in the 'admin' directory before using it in database queries. An attacker could leverage these issues to manipulate SQL queries or attack th...

WarFTPd CWD Command Remote DoS

The remote host is running War FTP Daemon, an FTP server for Windows. The remote version of this software is prone to a remote denial of service vulnerability. An attacker may exploit this flaw to crash the remote service. C Tenable Network Security, Inc. include 'compat.inc' ; ifdescription...

Konversation: Various vulnerabilities

Background Konversation is a user-friendly IRC client for KDE. Description Wouter Coekaerts has discovered three vulnerabilities within Konversation: The Server::parseWildcards function, which is used by the "Quick Buttons", does not properly handle variable expansion CAN-2005-0129. Perl scripts...

TikiWiki File Upload temp Directory Arbitrary Script Execution

The remote host is running TikiWiki, a content management system written in PHP. The remote version of this software is vulnerable to a flaw in the way TikiWiki handles uploaded files. If an attacker is able to upload a file, they can then call the script remotely via a request to the...

MySQL: Insecure temporary file creation

Background MySQL is a fast, multi-threaded, multi-user SQL database server. Description Javier Fernandez-Sanguino Pena from the Debian Security Audit Project discovered that the 'mysqlaccess' script creates temporary files in world-writeable directories with predictable names. Impact A local...

CUPS: Stack overflow in included Xpdf code

Background The Common UNIX Printing System CUPS is a cross-platform print spooler. It makes use of Xpdf code to handle PDF files. Description The Decrypt::makeFileKey2 function in Xpdf's Decrypt.cc insufficiently checks boundaries when processing /Encrypt /Length tags in PDF files GLSA 200501-28...

ImageMagick: PSD decoding heap overflow

Background ImageMagick is a collection of tools to read, write and manipulate images in many formats. Description Andrei Nigmatulin discovered that a Photoshop Document PSD file with more than 24 layers could trigger a heap overflow. Impact An attacker could potentially design a mailicous PSD ima...

Winamp < 5.0.5 Skin File (.WSZ) Local Zone Arbitrary Code Execution

The remote host is using Winamp, a popular media player which handles many files format mp3, wavs and more... The remote version of this software is vulnerable to a code execution flaw when processing a malformed .WSZ Winamp Skin file. An attacker may exploit this flaw by sending a malformed .wsz...

Bugzilla Internal Error Response XSS

The remote host runs Bugzilla, a web-based bug tracking system. The remote Bugzilla installation, according to its version number, is vulnerable to a cross-site scripting attack when rendering internal errors containing user-supplied input. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

tnftp: Arbitrary file overwriting

Background tnftp is a NetBSD FTP client with several advanced features. Description The 'mget' function in cmds.c lacks validation of the filenames that are supplied by the server. Impact An attacker running an FTP server could supply clients with malicious filenames, potentially allowing the...

Winamp < 5.0.8c Multiple Unspecified Vulnerabilities

The version of Winamp installed on the remote host has various unspecified vulnerabilities that may allow an attacker to execute arbitrary code on the remote host. An attacker may exploit these flaws by sending malformed files to a victim on the remote host. %NASLMINLEVEL 70300 C Tenable Network...

Horde < 3.0.1 Multiple Script XSS

The remote host is running at least one instance of Horde version 3.0, which suffers from two cross-site scripting vulnerabilities. Through specially crafted GET requests to the remote host, an attacker can cause a third-party user to unknowingly run arbitrary JavaScript code. %NASLMINLEVEL 70300...

Exim: Two buffer overflows

Background Exim is an highly configurable message transfer agent MTA developed at the University of Cambridge. Description Buffer overflows have been found in the hostaton function CAN-2005-0021 as well as in the spabase64tobits function CAN-2005-0022, which is part of the SPA authentication code...

GNU Mailman Multiple Unspecified Remote Vulnerabilities

The remote host is running GNU Mailman, a web-based application for managing mailing lists. The version running on the remote host has multiple flaws, such as information disclosure and cross-site scripting. These vulnerabilities could allow a remote attacker to gain unauthorized access...

KDE FTP KIOslave: Command injection

Background KDE is a feature-rich graphical desktop environment for Linux and Unix-like Operating Systems. KDE provided KIOslaves for many protocols in the kdelibs package, one of them being FTP. These are used by KDE applications such as Konqueror. Description The FTP KIOslave fails to properly...

UnRTF: Buffer overflow

Background UnRTF is a utility to convert files in the Rich Text Format into other formats. Description An unchecked strcat in unrtf may overflow the bounds of a static buffer. Impact Using a specially crafted file, possibly delivered by e-mail or over the web, an attacker may execute arbitrary co...

mpg123: Buffer overflow

Background mpg123 is a real-time MPEG audio player. Description mpg123 improperly parses frame headers in input streams. Impact By inducing a user to play a malicious file, an attacker may be able to exploit a buffer overflow to execute arbitrary code with the permissions of the user running...

Exim < 4.44 Multiple Overflows

The remote host is running Exim, a message transfer agent SMTP. It is reported that Exim is prone to an IPv6 Address and an SPA authentication buffer overflow. An attacker, exploiting this issue, may be able to execute arbitrary code on the remote host. Exim must be configured with SPA...