wagora-disclose.txt

netVigilance Security Advisory 15 w-agora version 4.2.1 Information Disclosure Vulnerability Description: w-agora is a set of scripts written in PHP. This package is intended to allow users to share, exchange and publish information, files and discussions over the web. It is possible to disclose...

[Full-disclosure] CVSTrac 2.0.0 Denial of Service (DoS) vulnerability

SECURITY ADVISORY ================= Application: CVSTrac Version: 2.0.0 Vulnerability: Denial of Service DoS Identification: CVE-2007-0347 Date: 2007-01-29 12:00 UTC DESCRIPTION ----------- A Denial of Service DoS vulnerability exists in CVSTrac http://www.cvstrac.org/ version 2.0.0, a web-based...

freetype: integer overflow vulnerability due to incomplete fix for CVE-2006-1861

Integer overflow in FreeType before 2.2 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted PCF file, as demonstrated by the Red Hat bad1.pcf test file, due to a partial fix of CVE-2006-1861...

Sql injection

SQL injection vulnerability in index.php in Partial Links 1.2.2 allows remote attackers to execute arbitrary SQL commands via the topic parameter...

Information disclosure

Partial Links 1.2.2 allows remote attackers to obtain sensitive information via a direct request to 1 pagefooter.php and 2 pageheader.php, which displays the path in an error message...

CVE-2006-2905

Partial Links 1.2.2 allows remote attackers to obtain sensitive information via a direct request to 1 pagefooter.php and 2 pageheader.php, which displays the path in an error message...

CVE-2006-2905

Partial Links 1.2.2 allows remote attackers to obtain sensitive information via a direct request to 1 pagefooter.php and 2 pageheader.php, which displays the path in an error message...

CVE-2006-2904

SQL injection vulnerability in index.php in Partial Links 1.2.2 allows remote attackers to execute arbitrary SQL commands via the topic parameter...

CVE-2006-2904

The CVE-2006-2904 entry describes an SQL injection vulnerability in Partial Links 1.2.2, specifically in index.php and exploitable via the topic parameter. The underlying issue is improper input handling that allows an attacker to inject and execute arbitrary SQL commands on the backend database....

CVE-2006-2905

Partial Links 1.2.2 is affected. Remote attackers can disclose sensitive information by requesting page_footer.php or page_header.php, which reveals the path in an error message. The provided documents do not specify a fix or workaround.

CVE-2006-2905: Undefined Security Weakness

Partial Links 1.2.2 allows remote attackers to obtain sensitive information via a direct request to 1 pagefooter.php and 2 pageheader.php, which displays the path in an error message...

CVE-2006-2904: Undefined Security Weakness

SQL injection vulnerability in index.php in Partial Links 1.2.2 allows remote attackers to execute arbitrary SQL commands via the topic parameter...

CVE-2006-0916: Undefined Security Weakness

Bugzilla 2.19.3 through 2.20 does not properly handle "//" sequences in URLs when redirecting a user from the login form, which could cause it to generate a partial URL in a form action that causes the user's browser to send the form data to another domain...

The Bat! mail agent headers spoofing

message/partial format alows to spoof message headers completely, making it impossible to track sender by Received or Message-ID headers...

CVE-2006-0133

Multiple directory traversal vulnerabilities in AIX 5.3 ML03 allow local users to determine the existence of files and read partial contents of certain files via a .. dot dot in the argument to 1 getCommand.new aka getCommand and 2 getShell, a different vulnerability than CVE-2005-4273...

Low: Red Hat Security Advisory: gdb security update

An updated gdb package that fixes several bugs and minor security issues is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. GDB, the GNU debugger, allows debugging of programs written in C, C++, and other languages by executing them i...

CVE-2005-1703: Undefined Security Weakness

Warrior Kings: Battles 1.23 and earlier allows remote attackers to cause a denial of service server crash via a partial join packet that triggers a NULL pointer dereference...

CVE-2005-0621: Undefined Security Weakness

Scrapland 1.0 and earlier allows remote attackers to cause a denial of service server termination by triggering an error, which is treated as a fatal error by the server, as demonstrated using 1 signed integers for size values, 2 an invalid model, 3 a "newpos" value that is less than or equal to ...

DEBIAN-CVE-2004-1012

The argument parser of the PARTIAL command in Cyrus IMAP Server 2.2.6 and earlier allows remote authenticated users to execute arbitrary code via a certain command "bodyp" that is treated as a different command "body.peek" and causes an index increment error that leads to an out-of-bounds memory...

CVE-2004-1012: Undefined Security Weakness

The argument parser of the PARTIAL command in Cyrus IMAP Server 2.2.6 and earlier allows remote authenticated users to execute arbitrary code via a certain command "bodyp" that is treated as a different command "body.peek" and causes an index increment error that leads to an out-of-bounds memory...