farsinews.txt

if magicquotesgpc is Off in php.ini then local file inclusion in /jscripts/tinymce/tinymcegzip.php is available to use;!! why? codejscripts/tinymce/tinymcegzip.php ... $theme = isset$REQUEST'theme' ? $REQUEST'theme' : ""; $language = isset$REQUEST'language' ? $REQUEST'language' : ""; $plugins =...

CentOS 3 : mozilla (CESA-2005:384)

Updated Mozilla packages that fix various security bugs are now available. This update has been rated as having Important security impact by the Red Hat Security Response Team. Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several bu...

DEBIAN-CVE-2006-2196

Unspecified vulnerability in pinball 0.3.1 allows local users to gain privileges via unknown attack vectors that cause pinball to load plugins from an attacker-controlled directory while operating at raised privileges...

CVE-2006-2196

Unspecified vulnerability in pinball 0.3.1 allows local users to gain privileges via unknown attack vectors that cause pinball to load plugins from an attacker-controlled directory while operating at raised privileges...

DSA-1102 pinball - design error

Bulletin has no description...

CVE-2006-3172

Multiple PHP remote file inclusion vulnerabilities in ContentBuilder 0.7.5 allow remote attackers to execute arbitrary PHP code via a URL with a trailing slash / character in the 1 langpath parameter to a cms/plugins/colman/column.inc.php, b cms/plugins/poll/poll.inc.php, c...

PT-2006-3760 · Squirrelmail +1 · Squirrelmail +1

Name of the Vulnerable Software and Affected Versions: SquirrelMail versions 1.4.6 and earlier Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter, under specific conditions where register globals is enabled and magic quotes gpc is...

Squirrelmail local file inclusion

Squirrelmail local file inclusion bug in functions/plugin.php . Tested on the latest 1.4.x version. No authentication needed. if isset$plugins && isarray$plugins foreach $plugins as $name useplugin$name; ... function useplugin $name if fileexistsSMPATH . "plugins/$name/setup.php" includeonceSMPAT...

Multiple Adobe Macromedia Flash products vulnerabilities

Multiple vulnerabilities, including standard browser's plugins. Can be used for silent malware installation...

Security fix for the ALT Linux 9 package openvpn version 2.0.6-alt1

April 6, 2006 Nikolay A. Fetisov 2.0.6-alt1 - New version 2.0.6 -- Security fixes for CVE-2005-3393, CVE-2005-3409, CVE-2006-1629 -- several minor bug fixes and improvements, see ChangeLog for details - Adding README.ALT - Updating init.d script - Building and packaging plugins...

Several GET locks web server

The remote web server shuts down temporarily or blacklists us when it receives several GET HTTP/1.0 requests in a row. This might trigger false positive in generic destructive or DoS plugins. The scanner enabled some countermeasures, however they might be insufficient. SPDX-FileCopyrightText: 200...

FTP Service Allows Any Username

The FTP service can be accessed using any username and password. Many other FTP plugins may trigger falsely because of this, so the scanner enable some countermeasures. SPDX-FileCopyrightText: 2005 Digital Defense Inc. Some text descriptions might be excerpted from a referenced sources, and are...

[SECURITY] [DSA 815-1] New kdebase packages fix local root vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 815-1 [email protected] http://www.debian.org/security/ Martin Schulze September 16th, 2005 http://www.debian.org/security/faq -...

FreeBSD : mozilla -- arbitrary code execution vulnerability (cbfde1cd-87eb-11d9-aa18-0001020eed82)

A Mozilla Foundation Security Advisory reports : Plugins such as flash can be used to load privileged content into a frame. Once loaded various spoofs can be applied to get the user to interact with the privileged content. Michael Krax's 'Fireflashing' example demonstrates that an attacker can op...

CVE-2005-2039

Unknown vulnerability in "various plugins" for NanoBlogger 3.2.1 and earlier allows remote attackers to execute arbitrary commands...

CVE-2005-1713

Serendipity 0.8 is affected by multiple XSS vulnerabilities described in CVE-2005-1713, exploitable via the templatedropdown and shoutbox plugins. The Red Hat and NVD entries corroborate that remote attackers could inject arbitrary web script or HTML through these plugins, enabling client-side sc...

CVE-2005-1713

Multiple cross-site scripting XSS vulnerabilities in Serendipity 0.8 allow remote attackers to inject arbitrary web script or HTML via the 1 templatedropdown and 2 shoutbox plugins...

CVE-2005-1452

Serendipity before 0.8 allows Chief users to "hide plugins installed by other users."...

CVE-2005-0527

Firefox 1.0 allows remote attackers to execute arbitrary code via plugins that load "privileged content" into frames, as demonstrated using certain XUL events when a user drags a scrollbar two times, aka "Firescrolling."...

CVE-2005-0527

Firefox 1.0 allows remote attackers to execute arbitrary code via plugins that load "privileged content" into frames, as demonstrated using certain XUL events when a user drags a scrollbar two times, aka "Firescrolling."...