797 matches found
PYSEC-2011-27
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587...
Linux Kernel 2.6.10 - File Lock Local Denial of Service
/ source: https://www.securityfocus.com/bid/12949/info A local denial of service vulnerability reportedly affects the Linux kernel. This issue arises due to a failure of the kernel to properly handle malicious, excessive file locks. An attacker may leverage this issue to crash or hang the affecte...
PHP-Fusion 4.0 - 'Viewthread.php' Information Disclosure
source: https://www.securityfocus.com/bid/12482/info PHP-Fusion is reportedly affected by an information disclosure vulnerability. This issue is due to the application failing to properly sanitize user-supplied input. It is reported that an attacker could leverage this vulnerability to view any...
KPdf, KOffice: Stack overflow in included Xpdf code
Background KPdf is a KDE-based PDF viewer included in the kdegraphics package. KOffice is an integrated office suite for KDE. Description KPdf and KOffice both include Xpdf code to handle PDF files. Xpdf is vulnerable to a new stack overflow, as described in GLSA 200501-28. Impact An attacker cou...
Xpdf, GPdf: Stack overflow in Decrypt::makeFileKey2
Background Xpdf is an open source viewer for Portable Document Format PDF files. GPdf is a Gnome-based PDF viewer that includes some Xpdf code. Description iDEFENSE reports that the Decrypt::makeFileKey2 function in Xpdf's Decrypt.cc insufficiently checks boundaries when processing /Encrypt /Leng...
000102advisory.txt
Hat-Squad Advisory: Remote buffer overflow in MailEnable IMAP service Product: MailEnable Mail Server Vendor Url: http://www.mailenable.com Version: MailEnable Professional Edition v1.52, MailEnable Enterprise Edition v1.01 Vulnerability: Remote buffer overflow in IMAP service Release Date: 26...
InShop and InMail - Cross-Site Scripting
InShop and InMail - Cross-Site Scripting source: https://www.securityfocus.com/bid/11758/info InMail and InShop are both reported susceptible to cross-site scripting vulnerabilities. These issues are due to a failure of the applications to properly sanitize user-supplied input prior to including ...
Fastream DoS
HEAD command socket leak...
AppServ 2.5.x and Prior Exploit
what AppServ ========== AppServ is the Apache/PHP/MySQL open source software installer packages. Objective : - Easy to buid Webserver and Database Server - For those who just beginning client/server programming. - For web programmers/developers using PHP & MySQL. - For programming techniques that...
GLSA-200411-23 : Ruby: Denial of Service issue
The remote host is affected by the vulnerability described in GLSA-200411-23 Ruby: Denial of Service issue Ruby's developers found and fixed an issue in the CGI module that can be triggered remotely and cause an infinite loop. Impact : A remote attacker could trigger the vulnerability through an...
[SA12853] phpCodeGenie "Simple Application Generation" Code Execution Vulnerability
TITLE: phpCodeGenie "Simple Application Generation" Code Execution Vulnerability SECUNIA ADVISORY ID: SA12853 VERIFY ADVISORY: http://secunia.com/advisories/12853/ CRITICAL: Less critical IMPACT: System access WHERE: From remote SOFTWARE: phpCodeGenie 3.x http://secunia.com/product/4141/...
MDaemon IMAP Server Multiple Command Local DoS
The remote host is running the MDaemon IMAP server. It is possible to crash the remote version of this software by sending a too long argument to the 'SELECT' or 'EXAMINE' commands. This problem allows an attacker to make the remote service crash, thus preventing legitimate users from receiving...
GLSA-200407-17 : l2tpd: Buffer overflow
The remote host is affected by the vulnerability described in GLSA-200407-17 l2tpd: Buffer overflow Thomas Walpuski discovered a buffer overflow that may be exploitable by sending a specially crafted packet. In order to exploit the vulnerable code, an attacker would need to fake the establishment...
OpenSSL contains null-pointer assignment in do_change_cipher_spec() function
Overview OpenSSL contains a null-pointer assignment in the dochangecipherspec function which could allow a remote, unauthenticated attacker to cause OpenSSL to crash. Description OpenSSL implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols and includes a general...
Important: Red Hat Security Advisory: : Updated mutt packages fix remotely-triggerable crash
New mutt packages that fix a remotely-triggerable crash in the menu drawing code are now available. Mutt is a text-mode mail user agent. A bug was found in the index menu code in versions of mutt. A remote attacker could send a carefully crafted mail message that can cause mutt to segfault and...
NullLogic Null HTTPd 0.5.1 - Error Page Long HTTP Request Cross-Site Scripting
source: https://www.securityfocus.com/bid/8695/info It has been reported that Null HTTPd is prone to a cross-site scripting vulnerability when displaying error pages that may allow an attacker to execute HTML or script code in a user's browser. The issue was previously reported and fixed BID 5603...
CVE-2003-0756
SiteBuilder 1.4 contains a directory traversal flaw in sitebuilder.cgi, exploitable via .. sequences in the selectedpage parameter that allows reading arbitrary files. Evidence from CVE-2003-0756 across NVD/Red Hat records confirms the same vector; no exploit status or active exploitation is prov...
Directory traversal in NucaWeb Server
Product: Nuca WebServer Version: 0.01 OffSite: http://www.geocities.com/nucainterface Problem: Directory traversal ------------------------------------------------ NucaWebServer - server, written in Delphi. This server have a large problem - Atacker may view all files on hard disk. The server doe...
Monkey Http Daemon
After reading the PHP XSS "exploit" I dont know if it qualifies as one in phpinfo, I found out that on the default page of the Monkey Http Daemon, there is a Test of Supports section. Two links are included: http://whateverhost/php/index.php and http://whateverhost/cgi-bin/test.pl index.php just...
