CVE-2006-5121: Undefined Security Weakness

SQL injection vulnerability in modules/Downloads/admin.php in the Admin section of PostNuke 0.762 allows remote attackers to execute arbitrary SQL commands via the hits parameter...

CVE-2006-5090: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Phoenix Evolution CMS PECMS allow remote attackers to inject arbitrary web script or HTML via the 1 mod or 2 action parameters in index.php, or the 3 pageid parameter in modules/pageedit/index.php. NOTE: the provenance of this information is...

CVE-2006-5030: Undefined Security Weakness

SQL injection vulnerability in modules/messages/index.php in exV2 2.0.4.3 and earlier allows remote authenticated users to execute arbitrary SQL commands via the sort parameter...

CVE-2006-4921: Undefined Security Weakness

PHP remote file inclusion vulnerability in Site@School S@S 2.4.03 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cmsdir parameter to starnet/modules/include/include.php. NOTE: some of these details are obtained from third party information...

CVE-2006-4906: Undefined Security Weakness

SQL injection vulnerability in modules/calendar/week.php in More.groupware 0.74 allows remote attackers to execute arbitrary SQL commands via the newcalendarid parameter...

CVE-2006-4876

Multiple SQL injection vulnerabilities in Jupiter CMS allow remote attackers to execute arbitrary SQL commands via 1 the user name during login, or the 2 key or 3 fpwusername parameters in modules/register...

CVE-2006-4874: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Jupiter CMS allow remote attackers to inject arbitrary web script or HTML via the 1 languageAdmin name and 2 languageAdmin back parameters in a modules/blocks.php; the 3 languageRegister title and 4 languageRegister title2 parameters in b...

CVE-2006-4875: Undefined Security Weakness

Unrestricted file upload vulnerability in modules/galleryuploadfunction.php in Jupiter CMS allows remote attackers to upload picture files, and possibly files with arbitrary extensions, to gallery/albums/public...

CVE-2006-4873: Undefined Security Weakness

Jupiter CMS allows remote attackers to obtain sensitive information via a direct request for 1 includes/functions.php, 2 modules/register.php, 3 modules/poll.php, 4 modules/panel.php, 5 modules/pm.php, 6 modules/news.php, 7 modules/templateschange.php, 8 modules/users.php, 9 modules/misc.php, 10...

CVE-2006-4644: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/home.module.php in phpFullAnnu 5.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the repmod parameter...

CVE-2006-4588

vtiger CRM 4.2.4, and possibly earlier, allows remote attackers to bypass authentication and access administrative modules via a direct request to index.php with a modified module parameter, as demonstrated using the Settings module...

CVE-2006-4588

vtiger CRM 4.2.4 (and possibly earlier) contains an authentication-bypass vulnerability that lets remote attackers access administrative modules by issuing a direct request to index.php with a modified module parameter, demonstrated via the Settings module. Root cause: improper validation of the ...

CVE-2006-4544

Multiple PHP remote file inclusion vulnerabilities in ExBB 1.9.1, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the exbbhomepath parameter in files in the modules directory including 1 birstday/birst.php 2 birstday/select.php, 3...

CVE-2006-4588: Undefined Security Weakness

vtiger CRM 4.2.4, and possibly earlier, allows remote attackers to bypass authentication and access administrative modules via a direct request to index.php with a modified module parameter, as demonstrated using the Settings module...

CVE-2006-4544: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in ExBB 1.9.1, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the exbbhomepath parameter in files in the modules directory including 1 birstday/birst.php 2 birstday/select.php, 3...

[SA21728] vtiger CRM Script Insertion and Administrative Modules Access

TITLE: vtiger CRM Script Insertion and Administrative Modules Access SECUNIA ADVISORY ID: SA21728 VERIFY ADVISORY: http://secunia.com/advisories/21728/ CRITICAL: Moderately critical IMPACT: Security Bypass, Cross Site Scripting WHERE: From remote SOFTWARE: vtiger CRM 4.x...

CVE-2006-4488: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/userstop/userstop.php in ExBB Italia 0.2 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the exbbhomepath parameter...

EZContents 2.0.3 - event_list.php?GLOBALS[admin_home] Remote File Inclusion

EZContents 2.0.3 - eventlist.php?GLOBALSadminhome Remote File Inclusion source: https://www.securityfocus.com/bid/19776/info ezContents is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker can exploit these...

CVE-2006-4373: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/visitors2/include/config.inc.php in pSlash 0.70 allows remote attackers to execute arbitrary PHP code via a URL in the lvcincludedir parameter...

elfutils security update

CentOS Errata and Security Advisory CESA-2006:0354 Updated elfutils packages that address a minor security issue and various other issues are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The elfutils packages contain a number of...