Debian DSA-1403-1 : phpmyadmin - missing input sanitising

Omer Singer of the DigiTrust Group discovered several vulnerabilities in phpMyAdmin, an application to administrate MySQL over the WWW. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-5589 phpMyAdmin allows a remote attacker to inject arbitrary web...

Debian DSA-1389-2 : zoph - missing input sanitising

It was discovered that zoph, a web-based photo management system, performs insufficient input sanitising, which allows SQL injection. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-1389...

DSA-1389-2 zoph - SQL injection

Bulletin has no description...

[SECURITY] [DSA 1389-1] New zoph packages fix SQL injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1389-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst October 18th, 2007 http://www.debian.org/security/faq -...

DSA-1389-1 zoph - SQL injection

Bulletin has no description...

[SECURITY] [DSA 1369-1] New gforge packages fix SQL injection

-------------------------------------------------------------------------- Debian Security Advisory DSA 1369-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff September 6th, 2007 http://www.debian.org/security/faq -...

DSA-1369-1 gforge - SQL injection

Bulletin has no description...

Debian DSA-1366-1 : clamav - several vulnerabilities

Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-4510 It was discovered that the RTF and RFC2397 parsers can be tricked into dereferencing a NULL pointer, resulting i...

Debian DSA-1298-1 : otrs2 - missing input sanitising

It was discovered that the Open Ticket Request System performs insufficient input sanitising for the Subaction parameter, which allows the injection of arbitrary web script code. The oldstable distribution sarge doesn't include otrs2. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

[SECURITY] [DSA 1298-1] New otrs2 packages fix cross-site scripting

-------------------------------------------------------------------------- Debian Security Advisory DSA 1298-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 28th, 2007 http://www.debian.org/security/faq -...

[Full-disclosure] [SECURITY] [DSA 1298-1] New otrs2 packages fix cross-site scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1298-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 28th, 2007 http://www.debian.org/security/faq -...

DSA-1298-1 otrs2

Bulletin has no description...

Debian DSA-1297-1 : gforge-plugin-scmcvs - missing input sanitising

Bernhard R. Link discovered that the CVS browsing interface of Gforge, a collaborative development tool, performs insufficient escaping of URLs, which allows the execution of arbitrary shell commands with the privileges of the www-data user. The oldstable distribution sarge is not affected by thi...

Debian DSA-1296-1 : php4 - missing input sanitising

It was discovered that the ftp extension of PHP, a server-side, HTML-embedded scripting language performs insufficient input sanitising, which permits an attacker to execute arbitrary FTP commands. This requires the attacker to already have access to the FTP server. %NASLMINLEVEL 70300 C Tenable...

[SECURITY] [DSA 1297-1] New gforge-plugin-scmcvs packages fix arbitrary shell command execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1297-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 24th, 2007 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1297-1] New gforge-plugin-scmcvs packages fix arbitrary shell command execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1297-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 24th, 2007 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1296-1] New php4 packages fix privilege escalation

-------------------------------------------------------------------------- Debian Security Advisory DSA 1296-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 21st, 2007 http://www.debian.org/security/faq -...

Debian DSA-1290-1 : squirrelmail - missing input sanitising

It was discovered that the webmail package Squirrelmail performs insufficient sanitising inside the HTML filter, which allows the injection of arbitrary web script code during the display of HTML email messages. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Debian DSA-1279-1 : webcalendar - missing input sanitising

It was discovered that WebCalendar, a PHP-based calendar application, performs insufficient sanitising in the exports handler, which allows injection of web script. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debi...

[SECURITY] [DSA 1279-1] New webcalendar packages fix cross-site scripting

-------------------------------------------------------------------------- Debian Security Advisory DSA 1279-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff April 22nd, 2007 http://www.debian.org/security/faq -...