phpGroupWare: XSS vulnerability in wiki module

Background phpGroupWare is a web-based suite of group applications including calendar, todo-list, addressbook, email, wiki, news headlines, and a file manager. Description Due to an input validation error, the wiki module in the phpGroupWare suite is vulnerable to cross site scripting attacks...

Mozilla < 1.7.3 / Thunderbird < 0.8 Multiple Vulnerabilities

The remote host is using Mozilla and/or Thunderbird, an alternative mail user agent. The remote version of this software is vulnerable to several flaws that could allow an attacker to execute arbitrary code on the remote host. To exploit these flaws, an attacker would need to send a rogue email t...

SUS: Local root vulnerability

Background SUS is a utility that allows regular users to be able to execute certain commands as root. Description Leon Juranic found a bug in the logging functionality of SUS that can lead to local privilege escalation. A format string vulnerability exists in the log function due to an incorrect...

Samba: Denial of Service vulnerabilities

Background Samba is a freely available SMB/CIFS implementation which allows seamless interoperability of file and print services to other SMB/CIFS clients. smbd and nmbd are two daemons used by the Samba server. Description There is a defect in smbd's ASN.1 parsing. A bad packet received during t...

Trillian MSN Overflow

Trillian is a Peer2Peer client that allows users to chat and share files with other users across the world. A bug has been reported in the MSN portion of Trillian. A remote attacker, exploiting this flaw, would be potentially able to execute code on the client system running Trillian. C Tenable...

[Full-Disclosure] [ GLSA 200409-11 ] star: Suid root vulnerability

Gentoo Linux Security Advisory GLSA 200409-11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

MIT krb5: Multiple vulnerabilities

Background MIT krb5 is the free implementation of the Kerberos network authentication protocol by the Massachusetts Institute of Technology. Description The implementation of the Key Distribution Center KDC and the MIT krb5 library contain double-free vulnerabilities, making client programs as we...

multi-gnome-terminal: Information leak

Background multi-gnome-terminal is an enhanced terminal emulator that is derived from gnome-terminal. Description multi-gnome-terminal contains debugging code that has been known to output active keystrokes to a potentially unsafe location. Output has been seen to show up in the '.xsession-errors...

GLSA-200409-01 : vpopmail: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200409-01 vpopmail: Multiple vulnerabilities vpopmail is vulnerable to several unspecified SQL injection exploits. Furthermore when using Sybase as the backend database vpopmail is vulnerable to a buffer overflow and format string...

IlohaMail Unspecified Database Password Disclosure Weakness

The target is running at least one instance of IlohaMail version 0.6 or earlier. Such versions suffer from a potential password disclosure problem when databasae information is not saved in the session table. Nessus has determined the vulnerability exists on the target simply by looking at the...

MySQL: Insecure temporary file creation in mysqlhotcopy

Background MySQL is a popular open-source multi-threaded, multi-user SQL database server. Description Jeroen van Wolffelaar discovered that the MySQL database hot copy utility mysqlhotcopy.sh, when using the scp method, uses temporary files with predictable names. A malicious local user with writ...

TorrentTrader download.php id Parameter SQL Injection

The remote host is running TorrentTrader, a web-based BitTorrent tracker. The remote version of this software is vulnerable to a SQL injection attack that may allow an attacker to inject arbitrary SQL statements in the remote database. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

WS_FTP Server CWD Command Remote DoS

According to its banner, the version of WSFTP running on the remote host has a denial of service vulnerability. Sending a 'CWD' command followed by a long argument causes the service to crash. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid14586; scriptversion"1.16";...

GLSA-200402-01 : PHP setting leaks from .htaccess files on virtual hosts

The remote host is affected by the vulnerability described in GLSA-200402-01 PHP setting leaks from .htaccess files on virtual hosts If the server configuration 'php.ini' file has 'registerglobals = on' and a request is made to one virtual host which has 'phpadminflag registerglobals off' and the...

GLSA-200403-05 : UUDeview MIME Buffer Overflow

The remote host is affected by the vulnerability described in GLSA-200403-05 UUDeview MIME Buffer Overflow By decoding a MIME archive with excessively long strings for various parameters, it is possible to crash UUDeview, or cause it to execute arbitrary code. This vulnerability was originally...

GLSA-200406-22 : Pavuk: Remote buffer overflow

The remote host is affected by the vulnerability described in GLSA-200406-22 Pavuk: Remote buffer overflow When Pavuk connects to a web server and the server sends back the HTTP status code 305 Use Proxy, Pavuk copies data from the HTTP Location header in an unsafe manner. Impact : An attacker...

GLSA-200408-11 : Nessus: 'adduser' race condition vulnerability

The remote host is affected by the vulnerability described in GLSA-200408-11 Nessus: 'adduser' race condition vulnerability A race condition can occur in 'nessus-adduser' if the user has not configured their TMPDIR variable. Impact : A malicious user could exploit this bug to escalate privileges ...

GLSA-200404-02 : KDE Personal Information Management Suite Remote Buffer Overflow Vulnerability

The remote host is affected by the vulnerability described in GLSA-200404-02 KDE Personal Information Management Suite Remote Buffer Overflow Vulnerability A buffer overflow may occur in KDE-PIM's VCF file reader when a maliciously crafted VCF file is opened by a user on a vulnerable system. Impa...

GLSA-200408-26 : zlib: Denial of service vulnerability

The remote host is affected by the vulnerability described in GLSA-200408-26 zlib: Denial of service vulnerability zlib contains a bug in the handling of errors in the 'inflate' and 'inflateBack' functions. Impact : An attacker could exploit this vulnerability to launch a Denial of Service attack...

GLSA-200404-14 : Multiple format string vulnerabilities in cadaver

The remote host is affected by the vulnerability described in GLSA-200404-14 Multiple format string vulnerabilities in cadaver Cadaver code includes the neon library, which in versions 0.24.4 and previous is vulnerable to multiple format string attacks. The latest version of cadaver uses version...