GLSA-200805-06 : Firebird: Data disclosure

The remote host is affected by the vulnerability described in GLSA-200805-06 Firebird: Data disclosure Viesturs reported that the default configuration for Gentoo's init script '/etc/conf.d/firebird' sets the 'ISCPASSWORD' environment variable when starting Firebird. It will be used when no...

Linux Terminal Server Project: Multiple vulnerabilities

Background The Linux Terminal Server Project adds thin-client support to Linux servers. Description LTSP version 4.2, ships prebuilt copies of programs such as the Linux Kernel, the X.org X11 server GLSA 200705-06, GLSA 200710-16, GLSA 200801-09, libpng GLSA 200705-24, GLSA 200711-08, Freetype GL...

Firebird: Data disclosure

Background Firebird is a multi-platform, open source relational database. Description Viesturs reported that the default configuration for Gentoo's init script "/etc/conf.d/firebird" sets the "ISCPASSWORD" environment variable when starting Firebird. It will be used when no password is supplied b...

[ GLSA 200804-24 ] DBmail: Data disclosure

Gentoo Linux Security Advisory GLSA 200804-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

GLSA-200804-19 : PHP Toolkit: Data disclosure and Denial of Service

The remote host is affected by the vulnerability described in GLSA-200804-19 PHP Toolkit: Data disclosure and Denial of Service Toni Arnold, David Sveningsson, Michal Bartoszkiewicz, and Joseph reported that php-select does not quote parameters passed to the 'tr' command, which could convert the...

Tomcat: Multiple vulnerabilities

Background Tomcat is the Apache Jakarta Project's official implementation of Java Servlets and Java Server Pages. Description The following vulnerabilities were reported: Delian Krustev discovered that the JULI logging component does not properly enforce access restrictions, allowing web...

OpenSSH: Privilege escalation

Background OpenSSH is a complete SSH protocol implementation that includes an SFTP client and server support. Description Two issues have been discovered in OpenSSH: Timo Juhani Lindfors discovered that OpenSSH sets the DISPLAY variable in SSH sessions using X11 forwarding even when it cannot bin...

CVE-2008-1528

Affected: ZyXEL Prestige routers P-660, P-661, P-662 with firmware 3.40(AGD.2)–3.40(AHQ.3). Issue: remote authenticated users can read HTML sources via direct HTTP requests to disclose credentials, e.g., RemMagSNMP.html reveals SNMP communities and WLAN.html reveals WEP keys. Root cause: inadequa...

Joomla! Component ProductShowcase 1.5 - SQL Injection

Joomla Component comproductshowcase SQL Injection AUTHOR : S@BUN HOME : http://www.milw0rm.com/author/1334 HOME : http://securityreason.com/search/101/c0BidW4=/1/0 MAÄ°L : [email protected] DORKS 1 : allinurl :"comproductshowcase" EXPLOIT :...

phpip-sql.txt

There exist numerous SQL injection vulnerabilities in phpIP 4.3.2, and probably previous versions. Most of the data obtained from the request variables $GET, $POST, $COOKIE, etc is not sanitized before it is passed to MySQL. This may result in un-authorized administrative access to phpIp and...

Debian: Security Advisory (DSA-889-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Code injection

The script program in FreeBSD 5.0 through 7.0-PRERELEASE invokes openpty, which creates a pseudo-terminal with world-readable and world-writable permissions when it is not run as root, which allows local users to read data from the terminal of the user running script...

eurologon-sql.txt

--------------------------------------------------------------- / | |\ \ / | / |/ | | |/ \ | | | |||| /| / / --------------------------------------------------------------- Http://www.inj3ct-it.org Staffatinj3ct-itdotorg --------------------------------------------------------------- Eurologon...

DSA-1380-1 elinks - information disclosure

Bulletin has no description...

simpnews24103-fdisclose.txt

netVigilance Security Advisory 69 SimpNews version 2.41.03 File Content Disclosure Vulnerability Description: SimpNews is a news system written in PHP. Features: Data stored in MySQL, admin interface, support for multiple languages, support for multiple instances in one database, own header,...

AuraCMS 2.1 - Remote File Attachment Local File Inclusion

AuraCMS 2.1 - Remote File Attachment Local File Inclusion AuraCMS 2.1 - Remote File Attachment - Local File Inclusion Vendor : http://www.auracms.org/ Download : http://www.auracms.org/dljump.php?id=42 Ditemukan oleh : k1tk4t - k1tk4t4tnewhack.org Lokasi : Indonesia -- newhackdotorg @ irc.dal.net...

Bradford CampusManager v3.1(6) Sensitive Data Disclosure

Bradford CampusManager v3.16 Sensitive Data Disclosure The following directories should be protected from world readability. Child folders include backup, log, and configuration files. http://cmnms.target.com:8080/runTime/ http://cmnms.target.com:8080/remediationReports/ Vulnerable: CampusManager...

CVE-2007-1585

The CVE-2007-1585 entry concerns Linksys devices (WAG200G; WRT54GC v1/v2) with specific firmware versions (WAG200G 1.01.01, WRT54GC 1.x/2 with 1.03.0 or earlier) that allow remote attackers to obtain sensitive information (passwords and configuration data). The underlying issue enables data discl...

EasyNews PRO News Publishing 4.0 - Password Disclosure

= EasyNews PRO News Publishing 4.0 Remote Password Disclosure Vulnerability Affected Software: Easy News 4.0 PRO = Risk: Critical = Download: http://www.stphp.com/scripts/EasyNewsPRO40.zip = Bugfounder: bd0rk = Contact: bd0rkathackermail.com = Greets: str0ke, crashovernight, TheJT, Kacper Usage:...

CVE-2006-5019

CVE-2006-5019 affects Google Mini up to version 4.4.102.M.36. The issue is an information-disclosure vulnerability: an attacker can issue a direct request to /search with an invalid client parameter and the error message reveals the path, exposing partial confidentiality risk. The NVD entry lists...