Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : postgresql vulnerabilities (USN-568-1)

Nico Leidecker discovered that PostgreSQL did not properly restrict dblink functions. An authenticated user could exploit this flaw to access arbitrary accounts and execute arbitrary SQL queries. CVE-2007-3278, CVE-2007-6601 It was discovered that the TCL regular expression parser used by...

CVE-2007-6383: Undefined Security Weakness

The DAV component in Chandler Server Cosmo before 0.10.1 does not check resource creation permissions, which allows remote authenticated users to create arbitrary resources in another user's home collection...

CVE-2007-5970: Undefined Security Weakness

MySQL 5.1.x before 5.1.23 and 6.0.x before 6.0.4 allows remote authenticated users to gain privileges on arbitrary tables via unspecified vectors involving use of table-level DATA DIRECTORY and INDEX DIRECTORY options when creating a partitioned table with the same name as a table on which the us...

CVE-2007-4669: Exposure of Sensitive Information to an Unauthorized Actor

The Services API in Firebird before 2.0.2 allows remote authenticated users without SYSDBA privileges to read the server log firebird.log, aka CORE-1148...

CVE-2007-3841

Unspecified vulnerability in Pidgin formerly Gaim 2.0.2 for Linux allows remote authenticated users, who are listed in a users list, to execute certain commands via unspecified vectors, aka ZD-00000035. NOTE: this information is based upon a vague advisory by a vulnerability information sales...

CVE-2007-2450: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the 1 Manager and 2 Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script o...

CVE-2007-2595

The CVE-2007-2595 issue in RSAuction 2.73.1.3 allows remote authenticated users to re-activate their own suspended accounts by issuing a direct request to the activation URL generated at registration. The vulnerability is described across multiple sources (NVD/NVDC and CVE listings) but no concre...

PT-2007-3271

Name of the Vulnerable Software and Affected Versions DirectAdmin versions prior to 1.293 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via http or ftp requests logged in various log files, including /var/log/directadmin/security.log. It also enabl...

CVE-2007-1183: Undefined Security Weakness

WebAPP before 0.9.9.5 allows remote authenticated users to spoof another user's Real Name via whitespace, which has unknown impact and attack vectors...

CVE-2007-0433: Undefined Security Weakness

Unspecified vulnerability in BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2, when using Active Directory LDAP for authentication, allows remote authenticated users to access the server even after the account has been disabled...

CVE-2007-0313

Unspecified vulnerability in GONICUS System Administration GOsa before 2.5.8 allows remote authenticated users to modify certain settings, including the admin password, via crafted POST requests...

CVE-2006-5950: Undefined Security Weakness

Unspecified vulnerability in ALTools ALFTP FTP Server 4.1 beta 1, and possibly earlier, allows remote authenticated users to obtain the installation path via unknown vectors related to the REN command, probably due to response messages. NOTE: the provenance of this information is unknown; details...

CVE-2006-4600: Undefined Security Weakness

slapd in OpenLDAP before 2.3.25 allows remote authenticated users with selfwrite Access Control List ACL privileges to modify arbitrary Distinguished Names DN...

CentOS 4 : kernel (CESA-2006:0617)

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 4 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating syste...

CVE-2005-4738: Undefined Security Weakness

IBM DB2 Universal Database UDB 810 before ESE AIX 5765F4100 does not ensure that a user has execute privileges before permitting object creation based on routines, which allows remote authenticated users to gain privileges...

CVE-2005-0173: Undefined Security Weakness

squidldapauth in Squid 2.5 and earlier allows remote authenticated users to bypass username-based Access Control Lists ACLs via a username with a space at the beginning or end, which is ignored by the LDAP server...

CVE-2004-0325

TYPSoft FTP Server 1.10 allows remote authenticated users to cause a denial of service CPU consumption via "//../" arguments to 1 mkd, 2 xmkd, 3 dele, 4 size, 5 retr, 6 stor, 7 appe, 8 rnfr, 9 rnto, 10 rmd, or 11 xrmd, as demonstrated using "//../qwerty"...

SquirrelMail 1.2.11 Administrator Plugin - 'options.php' Arbitrary Admin Account Creation

source: https://www.securityfocus.com/bid/7952/info Multiple vulnerabilities have been reported for Squirrelmail which could allow for information disclosure, data corruption, and privilege escalation. The problems appear to occur due to insufficient sanitization of URI parameters submitted withi...

CVE-2002-0558

Directory traversal vulnerability in TYPSoft FTP server 0.97.1 and earlier allows a remote authenticated user possibly anonymous to list arbitrary directories via a .. in a LIST ls command ending in wildcard . characters...

CVE-2002-0558: Undefined Security Weakness

Directory traversal vulnerability in TYPSoft FTP server 0.97.1 and earlier allows a remote authenticated user possibly anonymous to list arbitrary directories via a .. in a LIST ls command ending in wildcard . characters...