CVE-2007-6221

TuMusika Evolution 1.7R5 allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-6221

The vulnerability CVE-2007-6221 affects TuMusika Evolution 1.7R5. A direct request to phpinfo.php calls phpinfo, enabling remote attackers to disclose configuration information. No remediation details are provided in the connected documents. The exact root cause is exposure of PHP configuration d...

CVE-2007-6221: Exposure of Sensitive Information to an Unauthorized Actor

TuMusika Evolution 1.7R5 allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Directory traversal

Multiple directory traversal vulnerabilities in TuMusika Evolution 1.7R5 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter to 1 languagesn.php, 2 languagesf.php, or 3 languages.php in inc/; and 4 allow remote attackers to read arbitrary...

CVE-2007-6188

Multiple directory traversal vulnerabilities in TuMusika Evolution 1.7R5 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter to 1 languagesn.php, 2 languagesf.php, or 3 languages.php in inc/; and 4 allow remote attackers to read arbitrary...

CVE-2007-6188

Multiple directory traversal vulnerabilities in TuMusika Evolution 1.7R5 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter to 1 languagesn.php, 2 languagesf.php, or 3 languages.php in inc/; and 4 allow remote attackers to read arbitrary...

CVE-2007-6188

TuMusika Evolution 1.7R5 is affected by multiple directory traversal flaws enabling remote attackers to include/execute arbitrary local files via ".." in language parameters (languages_n.php, languages_f.php, languages.php in inc/) and to read local files via ".." in the uri parameter to frames/n...

CVE-2007-6188: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in TuMusika Evolution 1.7R5 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter to 1 languagesn.php, 2 languagesf.php, or 3 languages.php in inc/; and 4 allow remote attackers to read arbitrary...

TuMusika Evolution 1.7R5 Remote File Disclosure Vulnerability

No description provided by source. TuMusika Evolution 1.7R5 Remote File Disclosure Vulnerability Script : http://sourceforge.net/project/platformdownload.php?groupid=186000 /frames/nogui/scdownload.php ? $file = $GET'uri' ;---xxx $title = $GET'title' ; header'HTTP/1.1 200 OK';...

TuMusika Evolution 1.7R5 - Remote File Disclosure

TuMusika Evolution 1.7R5 - Remote File Disclosure TuMusika Evolution 1.7R5 Remote File Disclosure Vulnerability Script : http://sourceforge.net/project/platformdownload.php?groupid=186000 /frames/nogui/scdownload.php Exploit:...

TuMusika Evolution 1.7R5 Remote File Disclosure Vulnerability

Exploit for unknown platform in category web applications ============================================================= TuMusika Evolution 1.7R5 Remote File Disclosure Vulnerability ============================================================= TuMusika Evolution 1.7R5 Remote File Disclosure...

TuMusika Evolution 1.7R5 - Remote File Disclosure

TuMusika Evolution 1.7R5 Remote File Disclosure Vulnerability Script : http://sourceforge.net/project/platformdownload.php?groupid=186000 /frames/nogui/scdownload.php Exploit: /Evolution1.7/frames/nogui/scdownload.php?uri=../../../../../../etc/passwd TuMusika Evolution 1.7R5 Local File Inclusion...

Ubuntu 6.06 LTS / 6.10 : evolution vulnerability (USN-442-1)

Ulf Harnhammar of Secunia Research discovered that Evolution did not correctly handle format strings when displaying shared memos. If a remote attacker tricked a user into viewing a specially crafted shared memo, they could execute arbitrary code with user privileges. Note that Tenable Network...

Ubuntu 6.06 LTS / 6.10 / 7.04 : evolution-data-server vulnerability (USN-475-1)

Philip Van Hoof discovered that the IMAP client in Evolution did not correctly verify the SEQUENCE value. A malicious or spoofed server could exploit this to execute arbitrary code with user privileges. Note that Tenable Network Security has extracted the preceding description block directly from...

GLSA-200711-04 : Evolution: User-assisted remote execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200711-04 Evolution: User-assisted remote execution of arbitrary code The imaprescan function of the file camel-imap-folder.c does not properly sanitize the 'SEQUENCE' response sent by an IMAP server before being used to index...

Fedora 7 : evolution-data-server-1.10.2-3.fc7 (2007-0464)

This update fixes a security flaw in Evolution's IMAP module. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Evolution: User-assisted remote execution of arbitrary code

Background Evolution is the mail client of the GNOME desktop environment. Camel is the Evolution Data Server module that handles mail functions. Description The imaprescan function of the file camel-imap-folder.c does not properly sanitize the "SEQUENCE" response sent by an IMAP server before bei...

openSUSE 10 Security Update : evolution-data-server (evolution-data-server-3825)

A malicious IMAP server could execute code within evolution by sending a malformed response to a SEQUENCE command. CVE-2007-3257 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

openSUSE 10 Security Update : evolution (evolution-3960)

Format string problems in the Memo Viewer of evolution could be used to potentially execute code when viewing shared memos. CVE-2007-1002 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

openSUSE 10 Security Update : gtk2 (gtk2-2499)

A bug in gdk-pixbuf could crash applications such as Evolution when trying to display certain images CVE-2007-0010 Additionally a bug in the printer dialog prevent the correct display of all connected printers. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...