IceWarp Web Mail Multiple Flaws (2)

The remote host is running IceWarp Web Mail - a webmail solution available for the Microsoft Windows platform. The remote version of this software is vulnerable to multiple input validation issues that could allow an attacker to compromise the integrity of the remote host. %NASLMINLEVEL 70300 C...

Gallery: Cross-site scripting vulnerability

Background Gallery is a web application written in PHP which is used to organize and publish photo albums. It allows multiple users to build and maintain their own albums. It also supports the mirroring of images on other servers. Description Jim Paris has discovered a cross-site scripting...

Caudium Web Server Malformed URI Remote DoS

The remote host is running the Caudium Web Server. The remote version of this software is vulnerable to an attack wherein a malformed URI causes the web server to stop responding to requests. A remote attacker could disable this service by issuing a specially crafted HTTP GET request. C Tenable...

ArGoSoft FTP Server .lnk Shortcut Upload Arbitrary File Manipulation

The remote host is running ArGoSoft FTP Server. It is reported that ArGoSoft FTP Server is prone to an attack that allows link upload. An attacker, exploiting this flaw, may be able to have read and write access to any files and directories on the FTP server. C Tenable Network Security, Inc...

Ability FTP Server Multiple Command Remote Buffer Overflows

The remote host is running Ability FTP Server. It is reported that the remote version of this software is prone to a remote buffer overflow attack via the 'STOR' and 'APPE' commands. An attacker, exploiting this flaw, would only need to be able to craft and send a query to the FTP server on its...

shadow: Unauthorized modification of account information

Background shadow provides a set of utilities to deal with user accounts. Description Martin Schulze reported a flaw in the passwdcheck function in "libmisc/pwdcheck.c" which is used by chfn and chsh. Impact A logged-in local user with an expired password may be able to use chfn and chsh to chang...

[ GLSA 200411-04 ] Speedtouch USB driver: Privilege escalation vulnerability

Gentoo Linux Security Advisory GLSA 200411-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

Horde IMP status.php3 script Parameter XSS

The remote host is running at least one instance of Horde IMP in which the 'status.php3' script is vulnerable to a cross-site scripting attack since information passed to it is not properly sanitized. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Apache 1.3: Buffer overflow vulnerability in mod_include

Background The Apache HTTP server is one of the most popular web servers on the internet. modinclude is an Apache module to handle Server Side Includes SSI. Description A possible buffer overflow exists in the gettag function of modinclude.c. Impact If Server Side Includes SSI are enabled, a loca...

MIME-tools: Virus detection evasion

Background MIME-tools is a Perl module containing functions to handle MIME attachments. Description MIME-tools doesn't correctly parse attachment boundaries with an empty name boundary="". Impact An attacker could send a carefully crafted email and evade detection on some email virus-scanning...

Speedtouch USB driver: Privilege escalation vulnerability

Background The speedtouch package contains a driver for the ADSL SpeedTouch USB modem. Description The Speedtouch USB driver contains multiple format string vulnerabilities in modemrun, pppoa2 and pppoa3. This flaw is due to an improperly made syslog system call. Impact A malicious local user cou...

rssh: Format string vulnerability

Background rssh is a restricted shell, allowing only a few commands like scp or sftp. It is often used as a complement to OpenSSH to provide limited access to users. Description Florian Schilhabel from the Gentoo Linux Security Audit Team found a format string vulnerability in rssh syslogging of...

PuTTY: Pre-authentication buffer overflow

Background PuTTY is a free implementation of Telnet and SSH for Win32 and Unix platforms, along with an xterm terminal emulator. Description PuTTY fails to do proper bounds checking on SSH2MSGDEBUG packets. The "stringlen" parameter value is incorrectly checked due to signedness issues. Note that...

Bugzilla < 2.16.7 / 2.18.0rc3 Multiple Information Disclosures

The remote Bugzilla bug tracking system, according to its version number, is vulnerable to various flaws that may let an attacker bypass authentication or get access to private bug reports. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc';...

Netatalk: Insecure tempfile handling in etc2ps.sh

Background Netatalk is a kernel level implementation of the AppleTalk Protocol Suite, which allows Unix hosts to act as file, print, and time servers for Apple computers. It includes several script utilities, including etc2ps.sh. Description The etc2ps.sh script creates temporary files in...

Coppermine Photo Gallery Voting Restriction Bypass

The remote host is running Coppermine Gallery - a set of PHP scripts designed to handle galleries of pictures. This product has a vulnerability which allows a remote attacker with cookies disabled to cast multiple votes for a picture. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Xpdf, CUPS: Multiple integer overflows

Background Xpdf is an open source viewer for Portable Document Format PDF files. The Common UNIX Printing System CUPS is a cross-platform print spooler that includes some Xpdf code. Description Chris Evans discovered multiple integer overflow issues in Xpdf. Impact An attacker could entice an use...

Apache 2, mod_ssl: Bypass of SSLCipherSuite directive

Background The Apache HTTP server is one of the most popular web servers on the internet. modssl provides SSL v2/v3 and TLS v1 support for Apache 1.3 and is also included in Apache 2. Description A flaw has been found in modssl where the "SSLCipherSuite" directive could be bypassed in certain...

Open WebMail userstat.pl Arbitrary Command Execution

The target is running at least one instance of Open WebMail in which the userstat.pl component fails to sufficiently validate user input. This failure enables remote attackers to execute arbitrary programs on the target using the privileges under which the web server operates. For further...

Important: Red Hat Security Advisory: ImageMagick security update

Updated ImageMagick packages that fix a BMP loader vulnerability are now available. ImageMagickTM is an image display and manipulation tool for the X Window System. A heap overflow flaw has been discovered in the ImageMagick image handler. An attacker could create a carefully crafted BMP file in...