482 matches found
DEBIAN-CVE-2008-5367
ip-up in ppp-udeb 2.4.4rel on Debian GNU/Linux allows local users to overwrite arbitrary files via a symlink attack on the /tmp/resolv.conf.tmp temporary file...
DEBIAN-CVE-2008-4870
dovecot 1.0.7 in Red Hat Enterprise Linux RHEL 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain the sslkeypassword parameter value...
Fedora 9 : libHX-1.23-1.fc9 / pam_mount-0.47-1.fc9 (2008-7976)
A security flaw in the pammount's handling of user defined volumes using the 'luserconf' option has been fixed in this update. The vulnerability allowed users to arbitrarily mount filesystems at arbitrary locations. More details about this vulnerability can be found in the announcement message se...
CVE-2008-3294
src/configure.in in Vim 5.0 through 7.1, when used for a build with Python support, does not ensure that the Makefile-conf temporary file has the intended ownership and permissions, which allows local users to execute arbitrary code by modifying this file during a time window, or by creating it...
Code injection
src/configure.in in Vim 5.0 through 7.1, when used for a build with Python support, does not ensure that the Makefile-conf temporary file has the intended ownership and permissions, which allows local users to execute arbitrary code by modifying this file during a time window, or by creating it...
CVE-2008-2533
Multiple cross-site scripting (XSS) vulnerabilities exist in Phoenix View CMS Pre Alpha2 and earlier. The issue stems from unsanitized user input passed via the ltarget parameter to admin/admin_frame.php and via the conf parameter to the following pages in admin/module/: gbuch.admin.php, links.ad...
Remote file inclusion
Multiple PHP remote file inclusion vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the CONFapproot parameter to 1 tcuser.class.php, 2 absencecount.inc.php, 3 avatar.inc.php, 4 csvhandler.class.php, 5 functions.tcpro.php, 6...
CVE-2007-6560
Multiple cross-site scripting XSS vulnerabilities in Logaholic before 2.0 RC8 allow remote attackers to inject arbitrary web script or HTML via 1 the newconfname parameter to profiles.php or 2 the conf parameter to index.php...
Oreon/Centreon - Multiple Remote File Inclusion
By Michael Brooks Vulnerability Type: Multiple Remote File Inclusion. Software: Oreon and Centreon Homepage:http://www.oreon-project.org/ or http://www.centreon.com/ Versions: 1.4Oreon and 1.4.1Centreon The vulnerable file is: ./oreon-1.4/www/include/monitoring/engine/MakeXML.php Another,virtuall...
Max label limit can be passed by adding labels via ajax
For CONF-8978, limits were implemented on how many labels can be added in one submit by various "add label" screens, and how many labels can be set on an edit page/edit news screen. However, there is nothing to prevent extra labels being added by the "add label" screens beyond the number allowed ...
cwmVote 1.0 - 'archive.php' Remote File Inclusion
cwmVote 1.0 File Include Vulnerability F0und3R: bd0rk || SOH-Crew Website: www.soh-crew.it.tt Download: http://explorer.cwm-design.de/dirs/41/cwmVote.rar Vulnerable Code in archive.php Code: include$abs."inc/functions.inc.php"; include$abs."inc/conf.mysql.inc.php";...
DEBIAN-CVE-2006-6174
Cross-site scripting XSS vulnerability in tDiary before 2.0.3 and 2.1.x before 2.1.4.20061126 allows remote attackers to inject arbitrary web script or HTML via the conf parameter in 1 tdiary.rb and 2 skel/conf.rhtml...
CVE-2006-6174
Cross-site scripting XSS vulnerability in tDiary before 2.0.3 and 2.1.x before 2.1.4.20061126 allows remote attackers to inject arbitrary web script or HTML via the conf parameter in 1 tdiary.rb and 2 skel/conf.rhtml...
FreeBSD : dokuwiki -- multiple vulnerabilities (450b76ee-5068-11db-a5ae-00508d6a62df)
Secunia reports : Some vulnerabilities have been reported in DokuWiki, which can be exploited by malicious people to cause a DoS Denial of Service or potentially compromise a vulnerable system. Input passed to the 'w' and 'h' parameters in lib/exec/fetch.php is not properly sanitised before being...
SQLiteWebAdmin 0.1 (tpl.inc.php) Remote Include Vulnerability
Exploit for unknown platform in category web applications ============================================================= SQLiteWebAdmin 0.1 tpl.inc.php Remote Include Vulnerability ============================================================= SQLiteWebAdmin...
PT-2006-4708 · Vanilla · Vanilla Cms
Name of the Vulnerable Software and Affected Versions: Vanilla CMS versions 1.0.1 and earlier Description: The issue concerns a remote file inclusion vulnerability in the upgrader.php file of Vanilla CMS. This vulnerability can be exploited when the /conf/old settings.php file exists, allowing...
Remote file inclusion
PHP remote file inclusion vulnerability in common-menu.php in Cameron McKay Informium 0.12.0 allows remote attackers to execute arbitrary PHP code via a URL in the CONFlocalpath parameter...
security flaw
The sysctl functionality sysctl.c in Linux kernel before 2.6.14.1 allows local users to cause a denial of service kernel oops and possibly execute code by opening an interface file in /proc/sys/net/ipv4/conf/, waiting until the interface is unregistered, then obtaining and modifying function...
security flaw
KPPP 2.1.2 in KDE 3.1.5 and earlier, when setuid root without certain wrappers, does not properly close a privileged file descriptor for a domain socket, which allows local users to read and write to /etc/hosts and /etc/resolv.conf and gain control over DNS name resolution by opening a number of...
