Microsoft XMLHTTP ActiveX control setRequestHeader vulnerability

Added: 11/17/2006 CVE: CVE-2006-5745 BID: 20915 OSVDB: 30208 Background Microsoft XML Core Services includes the XMLHTTP ActiveX control, which allows web pages to send and receive XML data. Problem A memory corruption vulnerability in the XMLHTTP ActiveX control allows command execution when a...

devhelp, seamonkey security update

CentOS Errata and Security Advisory CESA-2006:0734 Updated seamonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open sour...

Critical: Red Hat Security Advisory: firefox security update

Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. Several flaws were found in the way Firefox...

CVE-2006-4256

index.php in Horde Application Framework before 3.1.2 allows remote attackers to include web pages from other sites, which could be useful for phishing attacks, via a URL in the url parameter, aka "cross-site referencing." NOTE: some sources have referred to this issue as XSS, but it is different...

CVE-2006-4256

The CVE-2006-4256 issue affects the Horde Application Framework prior to 3.1.2, where index.php can include web pages from other sites via the url parameter, enabling cross-site referencing that could aid phishing. Affected platforms and advisories corroborate remote inclusion risks, with related...

CVE-2006-3639

Microsoft Internet Explorer 5.01 and 6 does not properly identify the originating domain zone when handling redirects, which allows remote attackers to read cross-domain web pages and possibly execute code via unspecified vectors involving a crafted web page, aka "Source Element Cross-Domain...

CVE-2006-3640

CVE-2006-3640 is an Information Disclosure vulnerability in Microsoft Internet Explorer (IE 5.01 and 6) where a script can persist across navigations to reveal the window location in another domain/IE zone. The NVD description matches a Window Location Information Disclosure Vector, and the conne...

CVE-2006-3639

Microsoft Internet Explorer 5.01 and 6 does not properly identify the originating domain zone when handling redirects, which allows remote attackers to read cross-domain web pages and possibly execute code via unspecified vectors involving a crafted web page, aka "Source Element Cross-Domain...

CVE-2006-3640

Microsoft Internet Explorer 5.01 and 6 allows certain script to persist across navigations between pages, which allows remote attackers to obtain the window location of visited web pages in other domains or zones, aka "Window Location Information Disclosure Vulnerability."...

error_log() Safe Mode Bypass PHP 5.1.4 and 4.4.2

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 errorlog Safe Mode Bypass PHP 5.1.4 and 4.4.2 Author: Maksymilian Arciemowicz cXIb8O3 Date: - -Written: 10.6.2006 - -Public: 26.06.2006 from SECURITYREASON.COM CVE-2006-3011 - --- 0.Description --- PHP is an HTML-embedded scripting language. Much of i...

CMS Faethon 1.3.2 - mainpath Remote File Inclusion

CMS Faethon 1.3.2 - mainpath Remote File Inclusion \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV33$2006 --------------------------------------------------------------------------- ECHOADV33$2006 CMS Faethon 1.3.2 mainpath Remote File Inclusion...

UBUNTU-CVE-2006-2692

Multiple unspecified vulnerabilities in aMuleWeb for AMule before 2.1.2 allow remote attackers to read arbitrary image, HTML, or PHP files via unknown vectors, probably related to directory traversal...

XSS in Omegasoft's Insel

Hi together, This also works on serveral web-pages of this product. http://host/OmegaMw7a.ASP?WCI=Logon&WCE=0;scriptalertunescapedocument.cookie;/script There might be some ways for SQL-Injection, too, but i am not willing to try this at the real system : Vendor notified as CC regards MC.Iglo...

GLSA-200604-18 : Mozilla Suite: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200604-18 Mozilla Suite: Multiple vulnerabilities Several vulnerabilities were found in Mozilla Suite. Version 1.7.13 was released to fix them. Impact : A remote attacker could craft malicious web pages or emails that would levera...

[ECHO_ADV_31$2006] Sws Web Server 0.1.7 Strcpy() & Syslog() Format String Vulnerability

--------------------------------------------------------------------------------------- ECHOADV31$2006 Sws Web Server 0.1.7 Strcpy & Syslog Format String Vulnerability --------------------------------------------------------------------------------------- Author : Dedi Dwianto Date : April, 28th...

Mozilla Suite: Multiple vulnerabilities

Background The Mozilla Suite is a popular all-in-one web browser that includes a mail and news reader. Description Several vulnerabilities were found in Mozilla Suite. Version 1.7.13 was released to fix them. Impact A remote attacker could craft malicious web pages or emails that would leverage...

GLSA-200604-12 : Mozilla Firefox: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200604-12 Mozilla Firefox: Multiple vulnerabilities Several vulnerabilities were found in Mozilla Firefox. Versions 1.0.8 and 1.5.0.2 were released to fix them. Impact : A remote attacker could craft malicious web pages that would...

Mozilla Firefox: Multiple vulnerabilities

Background Mozilla Firefox is the next-generation web browser from the Mozilla project. Description Several vulnerabilities were found in Mozilla Firefox. Versions 1.0.8 and 1.5.0.2 were released to fix them. Impact A remote attacker could craft malicious web pages that would leverage these issue...

CVE-2006-1903

Multiple cross-site scripting XSS vulnerabilities in UserLand Manila allow remote attackers to inject arbitrary web script or HTML 1 via the referer parameter in sendMail, and via attributes of 2 the A element and certain other HTML elements in web pages edited with the editInBrowser module. NOTE...

Microsoft Internet Explorer DBCS Remote Memory Corruption Vulnerability

Microsoft Internet Explorer DBCS Remote Memory Corruption Vulnerability By Sowhat of Nevis Labs Date: 2006.04.11 http://www.nevisnetworks.com http://secway.org/advisory/AD20060411.txt http://www.microsoft.com/technet/security/bulletin/MS06-013.mspx CVE: CVE-2006-1189 Vendor Microsoft Inc. Product...