Novell ZENworks Configuration Management UploadServlet Remote Code Execution

Added: 05/10/2010 BID: 39114 OSVDB: 63412 Background Novell ZENworks Configuration Management is an IT desktop computer management suite that provides the ability to install, configure and administer desktop computers from a centralized location. The product is based on a client/server...

Debian DSA-1916-1 : kdelibs - insufficient input validation

Dan Kaminsky and Moxie Marlinspike discovered that kdelibs, core libraries from the official KDE release, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL serve...

Debian DSA-1825-1 : nagios2, nagios3 - insufficient input validation

It was discovered that the statuswml.cgi script of nagios, a monitoring and management system for hosts, services and networks, is prone to a command injection vulnerability. Input to the ping and traceroute parameters of the script is not properly validated which allows an attacker to execute...

Debian DSA-1938-1 : php-mail - programming error

It was discovered that php-mail, a PHP PEAR module for sending email, has insufficient input sanitising, which might be used to obtain sensitive data from the system that uses php-mail. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin wer...

Debian DSA-1949-1 : php-net-ping - programming error

It was discovered that php-net-ping, a PHP PEAR module to execute ping independently of the Operating System, performs insufficient input sanitising, which might be used to inject arguments no CVE yet or execute arbitrary commands CVE-2009-4024 on a system that uses php-net-ping. %NASLMINLEVEL...

Debian DSA-1870-1 : pidgin - insufficient input validation

Federico Muttis discovered that libpurple, the shared library that adds support for various instant messaging networks to the pidgin IM client, is vulnerable to a heap-based buffer overflow. This issue exists because of an incomplete fix for CVE-2008-2927 and CVE-2009-1376. An attacker can exploi...

Debian DSA-1829-1 : sork-passwd-h3 - insufficient input sanitising

It was discovered that sork-passwd-h3, a Horde3 module for users to change their password, is prone to a cross-site scripting attack via the backend parameter. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian DSA-1904-1 : wget - insufficient input validation

Daniel Stenberg discovered that wget, a network utility to retrieve files from the Web using HTTPS and FTP, is vulnerable to the 'Null Prefix Attacks Against SSL/TLS Certificates' published at the Blackhat conference some time ago. This allows an attacker to perform undetected man-in-the-middle...

Debian DSA-1954-1 : cacti - insufficient input sanitising

Several vulnerabilities have been found in cacti, a frontend to rrdtool for monitoring systems and services. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-3112, CVE-2007-3113 It was discovered that cacti is prone to a denial of service via the...

Quicksilver Forums Local File Include and Arbitrary File Upload Vulnerabilities

Quicksilver Forums is prone to a local file-include vulnerability and an arbitrary-file-upload vulnerability because the application fails to sufficiently sanitize user-supplied input. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, a...

PHP < 5.2.12 Multiple Vulnerabilities

According to its banner, the version of PHP installed on the remote host is older than 5.2.12. Such versions may be affected by several security issues : - It is possible to bypass the 'safemode' configuration setting using 'tempnam'. CVE-2009-3557 - It is possible to bypass the 'openbasedir'...

New cacti packages fix insufficient input sanitising

No description provided by source. - ------------------------------------------------------------------------ Debian Security Advisory DSA-1954-1 [email protected] http://www.debian.org/security/ Steffen Joeris December 16, 2009 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1951-1] New firefox-sage packages fix insufficient input sanitizing

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1951-1 [email protected] http://www.debian.org/security/ Steffen Joeris December 15, 2009 http://www.debian.org/security/faq -...

dotDefender 3.8-5 - Remote Command Execution

dotDefender 3.8-5 - Remote Command Execution Problem Description =================== A remote command execution vulnerability exists in the dotDefender 3.8-5 Site Management. dotDefender 1 is a web appliaction firewall WAF which 'prevents hackers from attacking your website.' Technical Details...

[SECURITY] [DSA 1905-1] New python-django packages fix denial of service

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA-1905-1 [email protected] http://www.debian.org/security/ Nico Golde October 10th, 2009 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1905-1] New python-django packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA-1905-1 [email protected] http://www.debian.org/security/ Nico Golde October 10th, 2009 http://www.debian.org/security/faq -...

RedHat Security Advisory RHSA-2009:1219

The remote host is missing updates announced in advisory RHSA-2009:1219. The libvorbis packages contain runtime libraries for use in programs that support Ogg Vorbis. Ogg Vorbis is a fully open, non-proprietary, patent-and royalty-free, general-purpose compressed audio format. An insufficient inp...

DSA-1870-1 pidgin - insufficient input sanitization

Bulletin has no description...

[SECURITY] [DSA 1829-1] New sork-passwd-h3 packages fix cross-site scripting

------------------------------------------------------------------------ Debian Security Advisory DSA-1829-1 [email protected] http://www.debian.org/security/ Steffen Joeris July 11, 2009 http://www.debian.org/security/faq -...

RedHat Security Advisory RHSA-2009:1138

The remote host is missing updates announced in advisory RHSA-2009:1138. Openswan is a free implementation of Internet Protocol Security IPsec and Internet Key Exchange IKE. IPsec uses strong cryptography to provide both authentication and encryption services. These services allow you to build...