[SECURITY] [DSA 1831-1] New djbdns packages fix privilege escalation

------------------------------------------------------------------------ Debian Security Advisory DSA-1831-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst July 13, 2009 http://www.debian.org/security/faq -...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in Rentventory 1.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 username aka Login and 2 password parameters in a login action...

Citrix XenCenterWeb (XSS/SQL/RCE) Multiple Remote Vulnerabilities

No description provided by source. Secure Network - Security Research Advisory Vuln name: Citrix XenCenterWeb Multiple Vulnerabilities Systems affected: Citrix XenCenterWeb Systems not affected: n/a Severity: High Local/Remote: Remote Vendor URL: http://www.citrix.com Authors: Alberto Trivero...

citrix xencenterweb - Cross-Site Scripting / SQL Injection / Remote Code Execution

Secure Network - Security Research Advisory Vuln name: Citrix XenCenterWeb Multiple Vulnerabilities Systems affected: Citrix XenCenterWeb Systems not affected: n/a Severity: High Local/Remote: Remote Vendor URL: http://www.citrix.com Authors: Alberto Trivero [email protected] - Claudio...

CVE-2009-2351

Opera 9.52 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to 1 injecting a Refresh header or 2 specifying the content of a Refresh header, a related issue to...

Pwning Nokia phones (and other Symbian based smartphones)

Hello, I'll just leave this here ; https://www.sec-consult.com/files/SECConsultVulnerabilityLabPwningSymbianV1.03PUBLIC.pdf Abstract: 1. Perform static analysis of XIP ROM images dumping, restoring import and export tables, searching for unsafe function calls 2. Enable run mode debugging of syste...

CVE-2009-2241

Cross-site scripting XSS vulnerability in search.asp in ASP Inline Corporate Calendar allows remote attackers to inject arbitrary web script or HTML via the keyword parameter...

Cross site scripting

WebVPN on the Cisco Adaptive Security Appliances ASA device with software 8.04, 8.1.2, and 8.2.1 allows remote attackers to bypass certain protection mechanisms involving URL rewriting and HTML rewriting, and conduct cross-site scripting XSS attacks, by modifying the first hex-encoded character i...

Ubuntu 8.10 / 9.04 : tomcat6 vulnerabilities (USN-788-1)

Iida Minehiko discovered that Tomcat did not properly normalise paths. A remote attacker could send specially crafted requests to the server and bypass security restrictions, gaining access to sensitive content. CVE-2008-5515 Yoshihito Fukuyama discovered that Tomcat did not properly handle error...

CVE-2009-0568

The RPC Marshalling Engine aka NDR in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly maintain its internal state, which allows remote attackers to overwrite arbitrary memory locations via a crafted RPC message that...

Mandrake Security Advisory MDVSA-2009:131-1 (apr-util)

The remote host is missing an update to apr-util announced via advisory MDVSA-2009:131-1. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Sql injection

SQL injection vulnerability in Skip 1.0.2 and earlier, and 1.1RC2 and earlier 1.1RC versions, allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2009-1769

The web interface in Open Computer and Software Inventory Next Generation OCS Inventory NG 1.01 generates different error messages depending on whether a username is valid, which allows remote attackers to enumerate valid usernames...

CVE-2009-1743

CVE-2009-1743 describes a directory traversal vulnerability in InstallHFZ.exe 6.5.201.0, part of Pinnacle Hollywood Effects 6 within Pinnacle Studio 12. An attacker can craft a Hollywood FX Compressed Archive (.hfz) filename containing a ..\ sequence to create or overwrite arbitrary files on the ...

CVE-2009-1379

Use-after-free vulnerability in the dtls1retrievebufferedfragment function in ssl/d1both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service openssl sclient crash and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server tha...

CVE-2009-0153

International Components for Unicode ICU 4.0, 3.6, and other 3.x versions, as used in Apple Mac OS X 10.5 before 10.5.7, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Fedora 9 and 10, and possibly other operating systems, does not properly handle invalid byte sequences...

Debian Security Advisory DSA 1789-1 (php5)

The remote host is missing an update to php5 announced via advisory DSA 1789-1. OpenVAS Vulnerability Test $Id: deb17891.nasl 6615 2017-07-07 12:09:52Z cfischer $ Description: Auto-generated from advisory DSA 1789-1 php5 Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

GLSA-200905-01 : Asterisk: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200905-01 Asterisk: Multiple vulnerabilities Multiple vulnerabilities have been discovered in the IAX2 channel driver when performing the 3-way handshake CVE-2008-1897, when handling a large number of POKE requests CVE-2008-3263,...

DSA-1789-1 php5 - several vulnerabilities

Bulletin has no description...

CVE-2009-1508

SQL injection vulnerability in the xforumvalidateUser function in Common.php in X-Forum 0.6.2 allows remote attackers to execute arbitrary SQL commands, as demonstrated via the cookieusername parameter to Configure.php...