Important: gnupg security update

1.2.6-9 - incorporate backport of patch from Werner to work around clients which can't tell that multiple plain messages have been processed 230456...

CVE-2006-7037

Mathcad 12 through 13.1 allows local users to bypass the security features by directly accessing or editing the XML representation of the worksheet with a text editor or other program, which allows attackers to 1 bypass password protection by replacing the password field with a hash of a known...

CVE-2007-1068

The CVE-2007-1068 entry describes a credential leakage issue where authentication credentials used by Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x/2.x, Cisco Security Agent (CSA) 5.0/5.1 (with vulnerable Trust Agent), and Meetinghouse AEGIS SecureConnect Client are stored in plaintext...

Directory traversal

Directory traversal vulnerability in the Plain Old Webserver POW add-on before 0.0.9 for Mozilla Firefox allows remote attackers to read arbitrary files via a .. dot dot in the URI...

EUVD-2007-0868

Directory traversal vulnerability in the Plain Old Webserver POW add-on before 0.0.9 for Mozilla Firefox allows remote attackers to read arbitrary files via a .. dot dot in the URI...

RHEL 2.1 / 3 / 4 : fetchmail (RHSA-2007:0018)

Updated fetchmail packages that fix two security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding utility. A denial of service flaw was found when Fetchmail was run in...

Information disclosure

The wwwpurgeList method in Plain Black WebGUI before 7.3.8 does not properly check user permissions, which allows attackers to delete unauthorized assets. NOTE: some of these details are obtained from third party information...

CVE-2007-0629

The wwwpurgeList method in Plain Black WebGUI before 7.3.8 does not properly check user permissions, which allows attackers to delete unauthorized assets. NOTE: some of these details are obtained from third party information...

CVE-2007-0629

CVE-2007-0629 affects Plain Black WebGUI prior to version 7.3.8, where the www_purgeList method fails to properly enforce user permissions, enabling an attacker to delete assets they should not be able to access. The vulnerability is documented in multiple sources (NVD/NVD-derived entries) and is...

GLSA-200701-13 : Fetchmail: Denial of Service and password disclosure

The remote host is affected by the vulnerability described in GLSA-200701-13 Fetchmail: Denial of Service and password disclosure Neil Hoggarth has discovered that when delivering messages to a message delivery agent by means of the 'mda' option, Fetchmail passes a NULL pointer to the ferror and...

Cross site scripting

Cross-site scripting XSS vulnerability in Plain Black WebGUI before 7.3.4 beta allows remote attackers to inject arbitrary web script or HTML via Wiki Page titles...

CVE-2007-0308

Cross-site scripting XSS vulnerability in Plain Black WebGUI before 7.3.4 beta allows remote attackers to inject arbitrary web script or HTML via Wiki Page titles...

CVE-2007-0308

Cross-site scripting XSS vulnerability in Plain Black WebGUI before 7.3.4 beta allows remote attackers to inject arbitrary web script or HTML via Wiki Page titles...

CVE-2007-0308

Plain Black WebGUI is affected by CVE-2007-0308: an XSS in Wiki Page titles allows remote injection of script/HTML. Affected product/version: Plain Black WebGUI before 7.3.4 (beta). Root cause: improper handling of Wiki Page titles leads to script injection. Impact per sources: client-side script...

CVE-2007-0119

Multiple cross-site scripting XSS vulnerabilities in EditTag 1.2 allow remote attackers to inject arbitrary web script or HTML via the plain parameter to 1 mkpwmp.cgi, 2 mkpw.pl, or 3 mkpw.cgi...

Microsoft Internet Explorer VML buffer overflow

Overview Microsoft Internet Explorer IE fails to properly handle Vector Markup Language tags. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft IE version 5.0 and higher supports the Vector Markup Language VML,...

FreeBSD : fetchmail -- TLS enforcement problem/MITM attack/password exposure (5238ac45-9d8c-11db-858b-0060084a00e5)

Matthias Andree reports : Fetchmail has had several longstanding password disclosure vulnerabilities. - sslcertck/sslfingerprint options should have implied 'sslproto tls1' in order to enforce TLS negotiation, but did not. - Even with 'sslproto tls1' in the config, fetches would go ahead in plain...

fetchmail -- TLS enforcement problem/MITM attack/password exposure

Matthias Andree reports: Fetchmail has had several longstanding password disclosure vulnerabilities. sslcertck/sslfingerprint options should have implied "sslproto tls1" in order to enforce TLS negotiation, but did not. Even with "sslproto tls1" in the config, fetches would go ahead in plain text...

hlstats-sql.txt

Hlstats is more than 5 years old. HLstats has been downloaded more than 270,000 from http://sf.net. Nothing more than absolutely benign XSS has been reported for this application, until NOW. Merry Christmass, --Michael Brooks Homepage: http://sourceforge.net/projects/hlstats/ -----BEGIN PGP SIGNE...

HLStats 1.34 - 'hlstats.php' SQL Injection

= 1.20 works with magicquotesgpc=On by Michael Brooks / print "HLStats SQL Injection Exploit -------------------------------------------------------------------------------------------------------------------------------------------- Welcome To HLstats Exploit code. SQL Inection + Path Disclosure...