[NEWS] GNU oSIP URI Parsing Heap Overflows

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

ModernBill < 4.3.3 Multiple Vulnerabilities

Binary data 2812.prm...

SiteEnable - SQL Injection

SiteEnable - SQL Injection source: https://www.securityfocus.com/bid/12985/info SiteEnable is reported prone to an SQL injection vulnerability. This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks...

CVE-2005-0386

Cross-site scripting XSS vulnerability in network.cgi in mailreader before 2.3.29 earlier allows remote attackers to inject arbitrary web script or HTML via MIME text/enriched or text/richtext messages...

CVE-2005-0477

Cross-site scripting XSS vulnerability in the SML code for Invision Power Board 1.3.1 FINAL allows remote attackers to inject arbitrary web script via 1 a signature file or 2 a message post containing an IMG tag within a COLOR tag whose style is set to background:url...

CVE-2001-1433

The CVE-2001-1433 entry concerns Cherokee web server before 0.2.7. The core issue is twofold: (1) after binding to port 80 it does not properly drop root privileges, creating a risk that a remote attacker could gain privileges, and (2) the remote version is vulnerable to remote command execution ...

phorumSplit.txt

Positive Technologies SA-20050322 Phorum "location" HTTP Response Splitting Vulnerability. Release Date: 03/22/2005 Date Reported: 03/10/2005 Severity: Medium Application: Phorum Platform: PHP Vendor: http://www.phorum.org Affects versions: 5.0.14a Other versions may also be affected. I. BACKGROU...

CVE-2001-1425

The CVE-2001-1425 entry concerns the Alcatel Speed Touch (firmware KHDSAA.108 through KHDSAA.134) where the EXPERT user’s challenge-response authentication can be bypassed by an attacker who directly computes the login response from information provided during login. This constitutes remote privi...

CVE-2001-1426

Affected product: Alcatel Speed Touch with firmware KHDSAA.108 and KHDSAA.132–KHDSAA.134. Vulnerability: TFTP server runs without a password, enabling remote modification of firmware versions or device configurations. Root cause: insecure TFTP service exposed on the device. Impact: allows uninten...

CoolForum SQL and XSS Vulnerabilities

Binary data 2725.prm...

Icecast Multiple Vulnerabilities

Binary data 2724.prm...

photopost50rc3.txt

PhotoPost 5.0RC3, All Enthusiast, Inc, multiple vulnerabilities March 05 2005 For your consideration. 1. BACKGROUND PhotoPost is a popular commercial image publishing software. Everyone loves showing off their photos! Add PhotoPost to your site, or let us install it for you, and your visitors wil...

Oracle MySQL Multiple Vulnerabilities

Binary data 2696.prm...

CVE-2004-1760

The CVE-2004-1760 entry covers unauthenticated remote admin access on Cisco voice products running the IBM Director Agent on IBM servers before OS 2000.2.6. The vulnerability allows an attacker to gain administrator privileges by connecting to TCP port 14247. The description specifies the affecte...

CVE-2003-1096

The CVE describes a vulnerability in the Cisco LEAP challenge/response authentication mechanism where passwords are used in a way that permits dictionary attacks, enabling remote attackers to gain privileges via brute force password guessing. The provided documents do not include a specific remed...

CVE-2005-0693

Buffer overflow in JoWood Chaser 1.50 and earlier allows remote attackers to cause a denial of service client or server crash and execute arbitrary code via a long nickname...

CVE-2005-0692

Cross-site scripting XSS vulnerability in fusioncore.php for PHP-Fusion 5.x allows remote attackers to inject arbitrary web script or HTML via a message with IMG bbcode containing character-encoded Javascript...

CVE-2005-0693

Buffer overflow in JoWood Chaser 1.50 and earlier allows remote attackers to cause a denial of service client or server crash and execute arbitrary code via a long nickname...

Mandrake Linux Security Advisory : gaim (MDKSA-2005:049)

Gaim versions prior to version 1.1.4 suffer from a few security issues such as the HTML parses not sufficiently validating its input. This allowed a remote attacker to crash the Gaim client be sending certain malformed HTML messages CVE-2005-0208 and CVE-2005-0473. As well, insufficient input...

ca3de - Multiple Vulnerabilities

ca3de - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/12727/info Ca3DE is reported prone to multiple remote vulnerabilities. An attacker can exploit these issues to carry out format string and denial of service attacks. The following specific issues were identified: It is...