Important: Red Hat Security Advisory: kernel security update

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating syste...

CVE-2006-5433: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/guestbook/index.php in ALiCE-CMS 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the CONFIGlocalroot parameter...

ALiCE-CMS 0.1 - 'CONFIG[local_root]' Remote File Inclusion

+------------------------------------------------------------------------------------------- + ALiCE-CMS 0.1 CONFIGlocalroot Remote File Include Vulnerability +------------------------------------------------------------------------------------------- + Affected Software .: ALiCE-CMS 0.1 + Vendor...

Debian DSA-1148-1 : gallery - several vulnerabilities

Several remote vulnerabilities have been discovered in gallery, a web-based photo album. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-2734 A cross-site scripting vulnerability allows injection of web script code through HTML or EXIF information. ...

Debian DSA-1018-2 : kernel-source-2.4.27 - several vulnerabilities

The original update lacked recompiled ALSA modules against the new kernel ABI. Furthermore, kernel-latest-2.4-sparc now correctly depends on the updated packages. For completeness we're providing the original problem description : Several local and remote vulnerabilities have been discovered in t...

CVE-2006-5257: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/forum/include/config.php in Ciamos Content Management System CMS 0.9.6b and earlier allows remote attackers to execute arbitrary PHP code via a URL in the modulecachepath parameter...

CVE-2006-5121: Undefined Security Weakness

SQL injection vulnerability in modules/Downloads/admin.php in the Admin section of PostNuke 0.762 allows remote attackers to execute arbitrary SQL commands via the hits parameter...

CVE-2006-5090: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Phoenix Evolution CMS PECMS allow remote attackers to inject arbitrary web script or HTML via the 1 mod or 2 action parameters in index.php, or the 3 pageid parameter in modules/pageedit/index.php. NOTE: the provenance of this information is...

CVE-2006-5030: Undefined Security Weakness

SQL injection vulnerability in modules/messages/index.php in exV2 2.0.4.3 and earlier allows remote authenticated users to execute arbitrary SQL commands via the sort parameter...

CVE-2006-4921: Undefined Security Weakness

PHP remote file inclusion vulnerability in Site@School S@S 2.4.03 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cmsdir parameter to starnet/modules/include/include.php. NOTE: some of these details are obtained from third party information...

CVE-2006-4906: Undefined Security Weakness

SQL injection vulnerability in modules/calendar/week.php in More.groupware 0.74 allows remote attackers to execute arbitrary SQL commands via the newcalendarid parameter...

CVE-2006-4876

Multiple SQL injection vulnerabilities in Jupiter CMS allow remote attackers to execute arbitrary SQL commands via 1 the user name during login, or the 2 key or 3 fpwusername parameters in modules/register...

CVE-2006-4873: Undefined Security Weakness

Jupiter CMS allows remote attackers to obtain sensitive information via a direct request for 1 includes/functions.php, 2 modules/register.php, 3 modules/poll.php, 4 modules/panel.php, 5 modules/pm.php, 6 modules/news.php, 7 modules/templateschange.php, 8 modules/users.php, 9 modules/misc.php, 10...

CVE-2006-4874: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Jupiter CMS allow remote attackers to inject arbitrary web script or HTML via the 1 languageAdmin name and 2 languageAdmin back parameters in a modules/blocks.php; the 3 languageRegister title and 4 languageRegister title2 parameters in b...

CVE-2006-4875: Undefined Security Weakness

Unrestricted file upload vulnerability in modules/galleryuploadfunction.php in Jupiter CMS allows remote attackers to upload picture files, and possibly files with arbitrary extensions, to gallery/albums/public...

CVE-2006-4644: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/home.module.php in phpFullAnnu 5.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the repmod parameter...

CVE-2006-4588

vtiger CRM 4.2.4 (and possibly earlier) contains an authentication-bypass vulnerability that lets remote attackers access administrative modules by issuing a direct request to index.php with a modified module parameter, demonstrated via the Settings module. Root cause: improper validation of the ...

CVE-2006-4588

vtiger CRM 4.2.4, and possibly earlier, allows remote attackers to bypass authentication and access administrative modules via a direct request to index.php with a modified module parameter, as demonstrated using the Settings module...

CVE-2006-4544: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in ExBB 1.9.1, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the exbbhomepath parameter in files in the modules directory including 1 birstday/birst.php 2 birstday/select.php, 3...

CVE-2006-4544

Multiple PHP remote file inclusion vulnerabilities in ExBB 1.9.1, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the exbbhomepath parameter in files in the modules directory including 1 birstday/birst.php 2 birstday/select.php, 3...