jetboxcms21-xss.txt

netVigilance Security Advisory 29 Jetbox CMS version 2.1 XSS Attack Vulnerability Description: Jetbox CMS is seriously tested on usability & has a professional intuitive interface. The system is role based, with workflow and module orientated. All content is fully separated from layout. It uses p...

jetbox-sql.txt

netVigilance Security Advisory 28 Jetbox CMS version 2.1 Multiple SQL Injection Vulnerabilities Description: Jetbox CMS is seriously tested on usability & has a professional intuitive interface. The system is role based, with workflow and module orientated. All content is fully separated from...

[Full-disclosure] Jetbox CMS version 2.1 Multiple Path Disclosure Vulnerabilities

netVigilance Security Advisory 27 Jetbox CMS version 2.1 Multiple Path Disclosure Vulnerabilities Description: Jetbox CMS is seriously tested on usability & has a professional intuitive interface. The system is role based, with workflow and module orientated. All content is fully separated from...

[Full-disclosure] Jetbox CMS version 2.1 Multiple SQL Injection Vulnerabilities

netVigilance Security Advisory 28 Jetbox CMS version 2.1 Multiple SQL Injection Vulnerabilities Description: Jetbox CMS is seriously tested on usability & has a professional intuitive interface. The system is role based, with workflow and module orientated. All content is fully separated from...

CVE-2007-1742

suexec in Apache HTTP Server httpd 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root, which might allow local users to perform unauthorized operations on incorrect directories, as demonstrated using "htmlbackup" and "htmleditor" under an "html...

CVE-2007-1742

suexec in Apache HTTP Server httpd 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root, which might allow local users to perform unauthorized operations on incorrect directories, as demonstrated using "htmlbackup" and "htmleditor" under an "html...

wagora-disclose.txt

netVigilance Security Advisory 15 w-agora version 4.2.1 Information Disclosure Vulnerability Description: w-agora is a set of scripts written in PHP. This package is intended to allow users to share, exchange and publish information, files and discussions over the web. It is possible to disclose...

[Full-disclosure] CVSTrac 2.0.0 Denial of Service (DoS) vulnerability

SECURITY ADVISORY ================= Application: CVSTrac Version: 2.0.0 Vulnerability: Denial of Service DoS Identification: CVE-2007-0347 Date: 2007-01-29 12:00 UTC DESCRIPTION ----------- A Denial of Service DoS vulnerability exists in CVSTrac http://www.cvstrac.org/ version 2.0.0, a web-based...

freetype: integer overflow vulnerability due to incomplete fix for CVE-2006-1861

Integer overflow in FreeType before 2.2 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted PCF file, as demonstrated by the Red Hat bad1.pcf test file, due to a partial fix of CVE-2006-1861...

Information disclosure

Partial Links 1.2.2 allows remote attackers to obtain sensitive information via a direct request to 1 pagefooter.php and 2 pageheader.php, which displays the path in an error message...

Sql injection

SQL injection vulnerability in index.php in Partial Links 1.2.2 allows remote attackers to execute arbitrary SQL commands via the topic parameter...

CVE-2006-2905

Partial Links 1.2.2 allows remote attackers to obtain sensitive information via a direct request to 1 pagefooter.php and 2 pageheader.php, which displays the path in an error message...

CVE-2006-2904

SQL injection vulnerability in index.php in Partial Links 1.2.2 allows remote attackers to execute arbitrary SQL commands via the topic parameter...

CVE-2006-2905

Partial Links 1.2.2 allows remote attackers to obtain sensitive information via a direct request to 1 pagefooter.php and 2 pageheader.php, which displays the path in an error message...

CVE-2006-2905

Partial Links 1.2.2 is affected. Remote attackers can disclose sensitive information by requesting page_footer.php or page_header.php, which reveals the path in an error message. The provided documents do not specify a fix or workaround.

CVE-2006-2904

The CVE-2006-2904 entry describes an SQL injection vulnerability in Partial Links 1.2.2, specifically in index.php and exploitable via the topic parameter. The underlying issue is improper input handling that allows an attacker to inject and execute arbitrary SQL commands on the backend database....

The Bat! mail agent headers spoofing

message/partial format alows to spoof message headers completely, making it impossible to track sender by Received or Message-ID headers...

CVE-2006-0133

Multiple directory traversal vulnerabilities in AIX 5.3 ML03 allow local users to determine the existence of files and read partial contents of certain files via a .. dot dot in the argument to 1 getCommand.new aka getCommand and 2 getShell, a different vulnerability than CVE-2005-4273...

Low: Red Hat Security Advisory: gdb security update

An updated gdb package that fixes several bugs and minor security issues is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. GDB, the GNU debugger, allows debugging of programs written in C, C++, and other languages by executing them i...

DEBIAN-CVE-2004-1012

The argument parser of the PARTIAL command in Cyrus IMAP Server 2.2.6 and earlier allows remote authenticated users to execute arbitrary code via a certain command "bodyp" that is treated as a different command "body.peek" and causes an index increment error that leads to an out-of-bounds memory...