Midnight Commander: Multiple vulnerabilities

Background Midnight Commander is a visual console file manager. Description Midnight Commander contains several format string vulnerabilities CAN-2004-1004, buffer overflows CAN-2004-1005, a memory deallocation error CAN-2004-1092 and a buffer underflow CAN-2004-1176. Impact An attacker could...

[SePro Bugtraq] SQL-Injection in PerlDesk 1.x

SQL-Injection in PerlDesk Discovered by deluxe89 and Astovidatu www.security-project.org Vendor: LogicNow Homepage: http://www.perldesk.com/ Vulnerable versions: 1.x Login required: no Description: "PerlDesk is a feature packed web based help desk and email management application designed to...

phpEventCalendar.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Title: phpEventCalendar HTML injection Vulnerability discovery: Madelman Date: 25/01/2005 Severity: Medium. Registered users can obtain other users cookies Summary: - -------- phpEventCalendar is a MySQL backed application that allows users to post an...

[EXPL] Multiple Vulnerabilities in Konversation (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

[SECURITY] [DSA 633-1] New bmv package fixes insecure temporary file creation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 633-1 [email protected] http://www.debian.org/security/ Martin Schulze January 11th, 2005 http://www.debian.org/security/faq -...

DSA-613-1 ethereal - infinite loop

Bulletin has no description...

CVSTrac < 1.1.5 Multiple XSS

The remote host seems to be running CVSTrac, a web-based bug and patch-set tracking system for CVS. According to its version number, the remote installation of CVSTrac has multiple cross-site scripting flaws. A remote attacker could exploit this by tricking a user into requesting a malicious URL,...

Remote Execute vulnerable to denial-of-service

Overview Remote Execute cannot handle more than seven connections simultaneously. If more than seven connections are attempted, Remote Execute will crash, resulting in a denial-of-service condition. Description Remote Execute is a network administration tool for the Windows platform that allows...

phpMyAdmin < 2.6.0-pl3 Multiple XSS

The version of phpMyAdmin installed on the remote host is vulnerable to cross-site scripting attacks through various parameters and scripts. With a specially crafted URL, an attacker can cause arbitrary code execution resulting in a loss of integrity. %NASLMINLEVEL 70300 C Tenable Network Securit...

Moodle < 1.4.3 Multiple Vulnerabilities

The remote host is running a version of the Moodle suite that is prior to version 1.4.3. It is, therefore, affected by a SQL injection vulnerability in the 'glossary' module due to a lack of user input sanitization. In addition, Moodle has also been reported to be affected by a directory traversa...

DSA-584-1 dhcp - format string vulnerability

Bulletin has no description...

DSA-576-1 squid - multiple

Bulletin has no description...

MySQL < 4.0.21 Multiple Vulnerabilities

You are running a version of MySQL which is older than version 4.0.21. Such versions are potentially affected by two flaws : - There is an unauthorized database GRANT privilege vulnerability, which may allow an attacker to misuse the GRANT privilege it has been given and to use it against other...

DSA-566-1 cupsys - unsanitised input

Bulletin has no description...

[SECURITY] [DSA 555-1] New frenet6 packages fix potential information leak

-------------------------------------------------------------------------- Debian Security Advisory DSA 555-1 [email protected] http://www.debian.org/security/ Martin Schulze September 30th, 2004 http://www.debian.org/security/faq -...

Debian DSA-165-1 : postgresql - buffer overflows

Mordred Labs and others found several vulnerabilities in PostgreSQL, an object-relational SQL database. They are inherited from several buffer overflows and integer overflows. Specially crafted long date and time input, currency, repeat data and long timezone names could cause the PostgreSQL serv...

Debian DSA-281-1 : moxftp - buffer overflow

Knud Erik Hojgaard discovered a vulnerability in moxftp and xftp respectively, an Athena X interface to FTP. Insufficient bounds checking could lead to execution of arbitrary code, provided by a malicious FTP server. Erik Tews fixed this. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-300-1 : balsa - buffer overflow

Byrial Jensen discovered a couple of off-by-one buffer overflow in the IMAP code of Mutt, a text-oriented mail reader supporting IMAP, MIME, GPG, PGP and threading. This code is imported in the Balsa package. This problem could potentially allow a remote malicious IMAP server to cause a denial of...

Debian DSA-432-1 : crawl - buffer overflow

Steve Kemp from the Debian Security Audit Project discovered a problem in crawl, another console based dungeon exploration game, in the vein of nethack and rogue. The program uses several environment variables as inputs but doesn't apply a size check before copying one of them into a fixed size...

GLSA-200408-22 : Mozilla, Firefox, Thunderbird, Galeon, Epiphany: New releases fix vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200408-22 Mozilla, Firefox, Thunderbird, Galeon, Epiphany: New releases fix vulnerabilities Mozilla, Galeon, Epiphany, Mozilla Firefox and Mozilla Thunderbird contain the following vulnerabilities: All Mozilla tools use libpng for...