CVE-2007-6080: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in modules/banners/click.php in the banners module for bcoos 1.0.10 allows remote attackers to execute arbitrary SQL commands via the bid parameter. NOTE: it was later reported that 1.0.13 is also affected...

Alstrasoft e-Friends 4.98 - seid Multiple SQL Injections

Alstrasoft e-Friends 4.98 - seid Multiple SQL Injections \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV85$2007 ----------------------------------------------------------------------------------------- ECHOADV85$2007 alstrasoft E-Friends = 4.98 seid...

pam security update

CentOS Errata and Security Advisory CESA-2007:0737 Updated pam packages that fix two security flaws, resolve two bugs, and add an enhancement are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team...

Security fix for the ALT Linux 5 package samba version 3.0.27-alt1

Nov. 15, 2007 Alexander Bokovoy 3.0.27-alt1 - Security release 3.0.27: + CVS-2007-4572 Stack buffer overflow in nmbd's logon request processing. + CVE-2007-5398 Remote code execution in Samba's WINS server daemon nmbd when processing name registration followed name query requests. - Updated set o...

irb, ruby security update

CentOS Errata and Security Advisory CESA-2007:0961 Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an interpreted scripting languag...

Moderate: Red Hat Security Advisory: ruby security update

Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an interpreted scripting language for object-oriented programming. A flaw was...

Moderate: Red Hat Security Advisory: ruby security update

Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an interpreted scripting language for object-oriented programming. An SSL certifica...

openSUSE 10 Security Update : yast2-core (yast2-core-4634)

This update fixes a security bug in yast2-core that allowed local attackers to provide malicious yast2 modules to yast2 that are executed with root privileges. To trigger this vulnerability root has to execute yast2 in an untrusted directory i.e. /tmp. Thanks to Stefan Nordhausen for reporting th...

CVE-2007-5913: Improper Authentication

dirsys/modules/auth.php in JBC Explorer 7.20 RC1 and earlier does not require authentication, which allows remote attackers to 1 delete auth.inc.php via the suppr parameter, and 2 re-create the auth.inc.php file with contents that specify a new account name and password for JBC Explorer via the...

CVE-2007-5914: Improper Control of Generation of Code

Direct static code injection vulnerability in dirsys/modules/config/post.php in JBC Explorer 7.20 RC1 and earlier allows remote authenticated administrators to inject arbitrary PHP code via the DEBUG parameter, which can be executed by accessing config.inc.php. NOTE: this can be exploited by...

CVE-2007-5922: Exposure of Sensitive Information to an Unauthorized Actor

The modules/mdop.m in the Cypress 1.0k script for BitchX, as downloaded from a distribution site in November 2007, contains an externally introduced backdoor that e-mails sensitive information hostnames, usernames, and shell history to a fixed address...

Ubuntu 6.10 : linux-restricted-modules-2.6.17 vulnerability (USN-404-1)

Laurent Butti, Jerome Razniewski, and Julien Tinnes discovered that the MadWifi wireless driver did not correctly check packet contents when receiving scan replies. A remote attacker could send a specially crafted packet and execute arbitrary code with root privileges. Note that Tenable Network...

CVE-2007-5812: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in modules/Builder/DownloadModule.php in ModuleBuilder 1.0 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

Gallery: Multiple vulnerabilities

Background Gallery is a PHP based photo album manager. Description Merrick Manalastas and Nicklous Roberts have discovered multiple vulnerabilities in the WebDAV and Reupload modules. Impact A remote attacker could exploit these vulnerabilities to bypass security restrictions and rename, replace...

CVE-2007-5676: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in modules/Forums/favorites.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execute arbitrary PHP code via a URL in the nukebbrootpath parameter...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the fullpath parameter to 1 certinfo/index.php, 2 emails/index.php, 3 events/index.php, 4 fax/index.php, 5 files/index.php, 6...

CVE-2007-5642: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to include and execute arbitrary local files via a .. dot dot in 1 the deflang parameter to modules/files/list.php; the mpath parameter to 2 modules/projects/summary.inc.php or 3...

PHP Project Management 0.8.10 - Multiple LocalRemote File Inclusions

PHP Project Management 0.8.10 - Multiple LocalRemote File Inclusions PHP Project Management = 0.8.10 Multiple RFI / LFI Vulnerabilities http://surfnet.dl.sourceforge.net/sourceforge/php-pm/release-0.8.tar.gz DORK : "PHP Project Management 0.8.10" POC : RFI...

PHP Project Management <= 0.8.10 Multiple RFI / LFI Vulnerabilities

Exploit for unknown platform in category web applications =================================================================== PHP Project Management = 0.8.10 Multiple RFI / LFI Vulnerabilities =================================================================== PHP Project Management = 0.8.10...

PeopleAggregator <= 1.2pre6-release-53 Multiple RFI Vulnerabilities

Exploit for unknown platform in category web applications =================================================================== PeopleAggregator = 1.2pre6-release-53 Multiple RFI Vulnerabilities =================================================================== PeopleAggregator 1.2pre6 Multiple...