CVE-2008-0217

The script program in FreeBSD 5.0 through 7.0-PRERELEASE invokes openpty, which creates a pseudo-terminal with world-readable and world-writable permissions when it is not run as root, which allows local users to read data from the terminal of the user running script...

CVE-2008-0217

The script program in FreeBSD 5.0 through 7.0-PRERELEASE invokes openpty, which creates a pseudo-terminal with world-readable and world-writable permissions when it is not run as root, which allows local users to read data from the terminal of the user running script...

CVE-2008-0217

FreeBSD CVE-2008-0217 describes two pty handling flaws in openpty/ptsname that allow a non‑root user to snoop or hijack a tty: when openpty is called by openpty, the new pty is world‑readable/writable; ptsname returns potentially invalid device names used by pt_chown to transfer ownership. Affect...

FreeBSD Security Advisory FreeBSD-SA-08:01.pty

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-08:01.pty Security Advisory The FreeBSD Project Topic: pty snooping Category: core Module: libcstdlib / libutil Announced: 2008-01-14 Credits: John Baldwin Affect...

CVE-2008-0216: Undefined Security Weakness

The ptsname function in FreeBSD 6.0 through 7.0-PRERELEASE does not properly verify that a certain portion of a device name is associated with a pty of a user who is calling the ptchown function, which might allow local users to read data from the pty from another user...

FreeBSD-SA-08:01.pty

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-08:01.pty Security Advisory The FreeBSD Project Topic: pty snooping Category: core Module: libcstdlib / libutil Announced: 2008-01-14 Credits: John Baldwin...

Tribisur 'forum.php'/'cat_main.php' SQL注入漏洞

BUGTRAQ ID: 27149 CNCAN ID:CNCAN-2008010812 Tribisur是一款基于PHP的WEB应用程序。 Tribisur不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于'forum.php'和'catmain.php'脚本对用户提交的WEB参数处理缺少充分过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Thomas PEREZ Tribisur 2.0 厂商解决方案 --------- 目前没有解决方案提供：...

FreeBSD Security Advisory FreeBSD-SA-07:09.random

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-07:09.random Security Advisory The FreeBSD Project Topic: Random value disclosure Category: core Module: sysdevrandom Announced: 2007-11-29 Credits: Robert Woolle...

FreeBSD-SA-07:09.random

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-07:09.random Security Advisory The FreeBSD Project Topic: Random value disclosure Category: core Module: sysdevrandom Announced: 2007-11-29 Credits: Robert Woolle...

Low: Red Hat Security Advisory: xterm security update

An updated xterm package that corrects a security issue is now available for Red Hat Enterprise Linux 4. This update has been rated as having low security impact by the Red Hat Security Response Team. The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and...

CVE-2003-1384: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in PY-Livredor 1.0 allows remote attackers to insert arbitrary web script or HTML via the 1 titre, 2 Votre pseudo, 3 Votre e-mail, or 4 Votre message fields...

CVE-2007-4956

Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via 1 the pseudo parameter to login.php, 2 the id parameter to index.php in a carnet editer action in the MemberSpace espacemembre module, or 3 the typenav parameter to index.php in a...

UltraVNC w/ DSM Plugin Detection (2)

UltraVNC seems to be running on the remote port. Upon connection, the remote service on this port sends pseudo-random bytes. It is probably UltraVNC with the new DSM encryption plugin. This plugin tunnels the RFB protocol into a RC4 or AES encrypted stream. %NASLMINLEVEL 70300 C Tenable Network...

CVE-2007-2000: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in admin/admin.php in Crea-Book 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 pseudo or 2 passe parameter...

CVE-2006-7152: Undefined Security Weakness

default.asp in ASP-Nuke Community 1.5 and earlier allows remote attackers to gain privileges by setting certain pseudo cookie values...

Mozilla Foundation Security Advisory 2007-05

Mozilla Foundation Security Advisory 2007-05 Title: XSS and local file access by opening blocked popups Impact: Moderate Announced: February 23, 2007 Reporter: shutdown, Michal Zalewski Products: Firefox, SeaMonkey Fixed in: Firefox 2.0.0.2 Firefox 1.5.0.10 SeaMonkey 1.0.8 Description shutdown...

Linux SCSI devices unauthorized access

pam module problem allows console users to access generic SCSI and pseudo-SCSI devices directly...

CVE-2007-0814: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Adrenalin's ASP Chat allow remote attackers to inject arbitrary web script or HTML 1 via the psuedo pseudo field or 2 during chat...

CVE-2007-0398

Multiple cross-site scripting XSS vulnerabilities in forum.php3 in Arnaud Guyonne aka Arnotic a-forum allow remote attackers to inject arbitrary web script or HTML via the 1 Sujet or 2 Pseudo field...

CVE-2007-0398

CVE-2007-0398 describes multiple cross-site scripting (XSS) vulnerabilities in the forum.php3 component of Arnaud Guyonne’s a-forum. The flaws allow remote attackers to inject arbitrary web script or HTML through the (1) Sujet and (2) Pseudo input fields. The issue affects the affected forum’s in...