CVE-2007-5041

CVE-2007-5041 : G DATA InternetSecurity 2007 reportedly does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, enabling local users to trigger a crash (DoS) and potentially gain privileges via the (1) NtCreateKey and (2) NtOpenProcess kernel SSD...

Unfixed XSS vulnerability at www.h-o-m-e-p-a-g-e.info

Security researcher T-Ping, has submitted on 18/09/2007 a cross-site-scripting XSS vulnerability affecting www.h-o-m-e-p-a-g-e.info, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 22/09/2007. It is...

GLSA-200708-08 : SquirrelMail G/PGP plugin: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-200708-08 SquirrelMail G/PGP plugin: Arbitrary code execution The functions deletekey, gpgchecksignpgpmime and gpgrecvkey used in the SquirrelMail G/PGP encryption plugin do not properly escape user-supplied data. Impact : An...

SquirrelMail G/PGP plugin: Arbitrary code execution

Background SquirrelMail is a webmail package written in PHP. It supports IMAP and SMTP protocols. Description The functions deletekey, gpgchecksignpgpmime and gpgrecvkey used in the SquirrelMail G/PGP encryption plugin do not properly escape user-supplied data. Impact An authenticated user could...

Atheros无线驱动拒绝服务漏洞

BUGTRAQ ID: 25160 CVE ID:CVE-2007-2927 CNCVE ID:CNCVE-20072927 Atheros Wireless Drivers是一款无线网卡的驱动程序。 部分版本的Atheros 802.11 a/b/g无线适配器版本不正确处理畸形报文，远程攻击者可以利用漏洞对驱动进行拒绝服务攻击。 问题是由于驱动不正确处理管理帧，在频率范围的攻击者可以通过发送畸形802.11管理帧来触发溢出，导致设备驱动崩溃。 Atheros Communications Wireless Driver 802.11 a/b/g 0 可联系供应商获得最新的程序：...

Cross site scripting

Cross-site scripting XSS vulnerability in the Belkin G Plus Router F5D7231-4 with firmware 4.05.03 allows remote attackers to inject arbitrary web script or HTML via a hostname of a DHCP client...

CVE-2007-3784

CVE-2007-3784 : A cross-site scripting (XSS) vulnerability affects the Belkin G Plus Router F5D7231-4 with firmware 4.05.03. The issue allows remote attackers to inject arbitrary web script or HTML through the hostname field of a DHCP client. The connected records confirm the affected product and...

CVE-2007-3784

Cross-site scripting XSS vulnerability in the Belkin G Plus Router F5D7231-4 with firmware 4.05.03 allows remote attackers to inject arbitrary web script or HTML via a hostname of a DHCP client...

Design/Logic Flaw

PHP local file inclusion vulnerability in gpgpopinit.php in the G/PGP GPG Plugin before 20070707 for Squirrelmail allows remote attackers to include and execute arbitrary local files, related to the MOD parameter...

CVE-2007-3779

PHP local file inclusion vulnerability in gpgpopinit.php in the G/PGP GPG Plugin before 20070707 for Squirrelmail allows remote attackers to include and execute arbitrary local files, related to the MOD parameter...

CVE-2006-4169

Multiple directory traversal vulnerabilities in the G/PGP GPG Plugin 2.0, and 2.1dev before 20070614, for Squirrelmail allow remote authenticated users to include and execute arbitrary local files via a .. dot dot in the help parameter to 1 gpghelp.php or 2 gpghelpbase.php...

CVE-2007-3778

The G/PGP GPG Plugin 2.0, and 2.1dev before 20060912, for Squirrelmail allows remote attackers to execute arbitrary commands via shell metacharacters in the messageSignedText parameter to the gpgchecksignpgpmime function in gpghookfunctions.php. NOTE: a parameter value can be set in the contents ...

CVE-2005-1924

The CVE-2005-1924 issue affects the G/PGP plugin for SquirrelMail (2.1 and earlier). It allows an authenticated remote user to execute arbitrary commands by injecting shell metacharacters in the fpr parameter to deleteKey (via gpg_keyring.php called by import_key_file.php, import_key_text.php, an...

CVE-2006-4169

Based on the provided documents, CVE-2006-4169 affects the SquirrelMail G/PGP plugin (versions 2.0 and 2.1dev before 20070614). The vulnerability stems from multiple input handling weaknesses in the G/PGP plugin that enable directory traversal to include and execute local files via the help param...

CVE-2007-3778

The CVE describes a remote command execution vulnerability in the G/PGP (GPG) Plugin for SquirrelMail (versions 2.0 and 2.1dev before 20060912) where shell metacharacters placed in the messageSignedText were processed by gpg_check_sign_pgp_mime in gpg_hook_functions.php. The issue arises from uns...

iDefense Security Advisory 07.11.07: SquirrelMail G/PGP Plugin gpg_recv_key() Command Injection Vulnerability

SquirrelMail G/PGP Plugin gpgrecvkey Command Injection Vulnerability iDefense Security Advisory 07.11.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jul 11, 2007 I. BACKGROUND The SquirrelMail G/PGP Encrpytion Plugin is a general purpose encryption, decryption, and digital signature...

SquirrelMail G/PGP Encryption Plug-in 2.0 Command Execution Vuln

No description provided by source. SquirrelMail G/PGP Encryption Plug-in Remote Command Execution Vulnerability Bugtraq ID: 24782 ----------------------------- There are various vulnerabilities in this software! One is in keyringmain.php! $fpr is not escaped from shellcommands! testbox:/home/w00t...

squirrel-exec.txt

SquirrelMail G/PGP Encryption Plug-in Remote Command Execution Vulnerability Bugtraq ID: 24782 ----------------------------- There are various vulnerabilities in this software! One is in keyringmain.php! $fpr is not escaped from shellcommands! testbox:/home/w00t cat /tmp/w00t cat: /tmp/w00t: No...

iDefense Security Advisory 07.11.07: SquirrelMail G/PGP Plugin gpg_help.php Local File Inclusion Vulnerability

SquirrelMail G/PGP Plugin gpgchecksignpgpmime Command Injection Vulnerability iDefense Security Advisory 07.11.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jul 11, 2007 I. BACKGROUND The SquirrelMail G/PGP Encrpytion Plugin is a general purpose encryption, decryption, and digital...

iDefense Security Advisory 07.11.07: SquirrelMail G/PGP Plugin gpg_check_sign_pgp_mime() Command Injection Vulnerability

SquirrelMail G/PGP Plugin gpgchecksignpgpmime Command Injection Vulnerability iDefense Security Advisory 07.11.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jul 11, 2007 I. BACKGROUND The SquirrelMail G/PGP Encrpytion Plugin is a general purpose encryption, decryption, and digital...