PT-2006-1129 · Linux +2 · Netfilter +3

Name of the Vulnerable Software and Affected Versions: Linux versions prior to 2.6.16-rc3 Description: The issue is related to an integer overflow in the do replace function in netfilter for Linux. This can be exploited by local users with CAP NET ADMIN rights to cause a buffer overflow in the co...

CVE-2005-4709

The CVE concerns JBoss EJB 3.0 RC3. The popSubjectContext method in SecurityAssociation preserves threadPrincipal and threadCredential from a prior client after the session ends, enabling a remote attacker to assume the roles of that previous client on the same server thread. This is described as...

CVE-2005-4256

Cross-site scripting XSS vulnerability in forum.asp in ASP-DEV XM Forum RC3 allows remote attackers to inject arbitrary web script or HTML via the forumtitle parameter. NOTE: the provenance of this issue is unknown; the details are obtained solely from the BID. In addition, its accuracy is in...

CVE-2005-4256

CVE-2005-4256 describes a cross-site scripting (XSS) vulnerability in ASP-DEV XM Forum RC3, specifically in forum.asp where the forum_title parameter can inject arbitrary script/HTML. Affected item is XM Forum RC3 (forum.asp handling). The core issue is an XSS in the forum_title parameter, enabli...

CVE-2005-4256

Cross-site scripting XSS vulnerability in forum.asp in ASP-DEV XM Forum RC3 allows remote attackers to inject arbitrary web script or HTML via the forumtitle parameter. NOTE: the provenance of this issue is unknown; the details are obtained solely from the BID. In addition, its accuracy is in...

[SA17859] SAPID CMS Security Bypass Vulnerability

TITLE: SAPID CMS Security Bypass Vulnerability SECUNIA ADVISORY ID: SA17859 VERIFY ADVISORY: http://secunia.com/advisories/17859/ CRITICAL: Moderately critical IMPACT: Security Bypass WHERE: From remote SOFTWARE: SAPID CMS 1.x http://secunia.com/product/6323/ DESCRIPTION: A vulnerability has been...

PhpGroupWare index.php HTML Injection Vulnerabilities

PhpGroupWare is prone to HTML injection vulnerabilities through SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

postnukeSQL0760rc3.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PostNuke Non Critical SQL Injection and Include 0.760-RC3=x cXIb8O3.10 Author: cXIb8O3Maksymilian Arciemowicz Date: 2.4.2005 from securityreason.com TEAM - --- 0.Description --- PostNuke: The Phoenix Release 0.760-RC3=X PostNuke is an open source, ope...

CVE-2002-1829

OpenBB (Open Bulletin Board) 1.0.0 RC3 has a cross-site scripting vulnerability in codeparse.php that allows remote attackers to inject arbitrary script via (1) myhome.php, (2) an onerror attribute in an IMG tag (variant of CVE-2002-0330), or (3) a glow tag. The issue stems from insufficient inpu...

CVE-2002-1802

XSS vulnerability CVE-2002-1802 affects XOOPS 1.0 RC3. The flaw allows remote attackers to inject arbitrary script/HTML via Javascript in an IMG tag when submitting news, due to insufficient input sanitization in the news submission workflow. Impact is Cross‑Site Scripting; no exploit vectors or ...

CVE-2005-1700

CVE-2005-1700 affects PostNuke 0.760-RC3 via the Xanthia module. The vulnerability is an SQL injection in pnadmin.php exploitable by the riga[0] parameter, allowing remote administrators to execute arbitrary SQL commands. Connected sources corroborate SQL injection in Xanthia/Messages areas and P...

CVE-2005-1699

CVE-2005-1699 : A directory traversal vulnerability exists in the Xanthia module’s pnadminapi.php (PostNuke 0.760-RC3). Remote administrators can read arbitrary files by supplying a .. (dot dot) in the skin parameter, enabling partial confidentiality impact. The provided documents do not specify ...

CVE-2005-1049

Multiple cross-site scripting vulnerabilities in PostNuke 0.760-RC3 allow remote attackers to inject arbitrary web script or HTML via the 1 module parameter to admin.php or 2 op parameter to user.php. NOTE: the vendor reports that certain issues could not be reproduced for 760 RC3, or for .750...

CVE-2005-1049

Multiple cross-site scripting vulnerabilities in PostNuke 0.760-RC3 allow remote attackers to inject arbitrary web script or HTML via the 1 module parameter to admin.php or 2 op parameter to user.php. NOTE: the vendor reports that certain issues could not be reproduced for 760 RC3, or for .750...

CVE-2005-1008

CVE-2005-1008 is an XSS vulnerability in ASP-DEv XM Forum RC3, affecting posts.asp where a javascript: URL in an IMG tag can inject arbitrary script/HTML. The OpenVAS/Nessus entries corroborate a cross-site scripting issue in this XM Forum component. The connected documents do not provide specifi...

CVE-2005-0776

adm-photo.php in PhotoPost PHP 5.0 RC3 does not properly verify administrative privileges before manipulating photos, which could allow remote attackers to manipulate other users' photos...

CVE-2005-0777

PhotoPost PHP 5.0 RC3 is affected by multiple XSS vulnerabilities. Specifically, remote attackers can inject arbitrary script or HTML via (1) the check_tags function and (2) the editbio field in the user profile. The issues arise from unsanitized input in these areas, enabling reflected or stored...

Fedora Core 2 : kernel-2.6.6-1.427 (2004-137)

An updated kernel is available that brings the kernel to the 2.6.7-rc3 base level. This new kernel provides a significant number of bug fixes and improvements for USB, the keyboard/mouse subsystem and the VM. This kernel also fixes the high profile bugs about not working on VIA C3 processors 1206...

[SCSA-024] BES-CMS including file vulnerability

====================================================================== Security Corporation Security Advisory SCSA-024 BES-CMS including file vulnerability ====================================================================== PROGRAM: BES-CMS HOMEPAGE: http://bes.h6p.org VULNERABLE VERSIONS: 0.4...

WebChat for XOOPS RC3 SQL INJECTION

Text available at http://www.phpsecure.org/tutos/webchat.1-5.xoops.rc3.sql.injection.txt Patch available on phpsecure.org XOOPS RC3 WebChat Module SQL Injection Tested with : Xoops RC3 WebChat 1-5 Author : val2 - phpsecure.org for more info and patchs Lines 291-299 from modules/WebChat/index.php ...