DSA-1789-1 php5 - several vulnerabilities

Bulletin has no description...

CVE-2009-1508

SQL injection vulnerability in the xforumvalidateUser function in Common.php in X-Forum 0.6.2 allows remote attackers to execute arbitrary SQL commands, as demonstrated via the cookieusername parameter to Configure.php...

CVE-2008-6783

SQL injection vulnerability in directory.php in Sites for Scripts SFS EZ Home Business Directory allows remote attackers to execute arbitrary SQL commands via the catid parameter in a list action...

MULTIPLE REMOTE SQL INJECTION VULNERABILITIES---MIM:InfiniX v1.2.003--->

-------------------------------------------------------------------------- MULTIPLE REMOTE SQL INJECTION VULNERABILITIES --MIM:InfiniX v1.2.003-- -------------------------------------------------------------------------- CMS INFORMATION: --WEB: http://mim.infinix.it --DOWNLOAD:...

Cross site scripting

Cross-site scripting XSS vulnerability in player.php in Nuke Evolution Xtreme 2.x allows remote attackers to inject arbitrary web script or HTML via the defaultVisualExt parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2009-0164

The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks...

Design/Logic Flaw

moziloCMS 1.11 allows remote attackers to obtain sensitive information via the 1 gal parameter to gallery.php, 2 page and 3 cat parameter to index.php, or 4 file parameter to download.php, which reveals the installation path in an error message...

Cross site scripting

Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey do not properly implement the Same Origin Policy for 1 XMLHttpRequest, involving a mismatch for a document's principal, and 2 XPCNativeWrapper.toString, involving an incorrect proto scope, which allows remote attackers to conduct cross-site...

Apache Geronimo 2.1.x - Cross-Site Request Forgery (Multiple Admin Function)

source: https://www.securityfocus.com/bid/34562/info Apache Geronimo Application Server is prone to multiple remote vulnerabilities: - Multiple directory-traversal vulnerabilities - A cross-site scripting vulnerability - Multiple HTML-injection vulnerabilities - A cross-site request-forgery...

CVE-2009-0995

Technical details about CVE-2009-0995 are not publicly available in the provided documents. No affected product/version or exploit information is specified here; monitor for updates from official advisories to obtain concrete details and remediation guidance.

CVE-2008-6717

U&M Software Signup 1.0 and 1.1 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers to have an unspecified impact via a direct request to 1 adminstart.php, 2 admineventtype.php, 3 admineventdetails.php, 4 admineventlist.php, 5...

CVE-2008-5519

The JK Connector aka modjk 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving 1 a request from a different client that included a Content-Length header but no POST dat...

Mandriva Update for tetex MDKSA-2007:022 (tetex)

Check for the Version of tetex OpenVAS Vulnerability Test Mandriva Update for tetex MDKSA-2007:022 tetex Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

CVE-2008-6646

CVE-2008-6646 affects CoronaMatrix phpAddressBook 2.0, where index.php processes the username parameter. The vulnerability is a cross-site scripting (XSS) flaw caused by inadequate sanitization of user input, enabling remote attackers to inject arbitrary script/HTML in victims’ browsers. Exploita...

CVE-2008-6649

CVE-2008-6649 : SQL injection in Ktools PhotoStore component manager/image_details_editor.php affects versions 2.5, 2.9.8, 3.1.0, and up to 3.5.2. The vulnerability allows remote attackers to execute arbitrary SQL commands via the id parameter. Public references (e.g., Exploit-DB, Secunia, OSVDB,...

CVE-2009-1245

Multiple SQL injection vulnerabilities in the inserttopastebin function in php/cccp-admin/inc/functions.php in CCCP Community Clan Portal Pastebin before 2.80 allow remote attackers to execute arbitrary SQL commands via the 1 subject, 2 language, and 3 nickname parameters to...

CVE-2009-1208

SQL injection vulnerability in auth2db 0.2.5, and possibly other versions before 0.2.7, uses the addslashes function instead of the mysqlrealescapestring function, which allows remote attackers to conduct SQL injection attacks using multibyte character encodings...

CVE-2009-0840

Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to have an unknown impact via a negative value in the Content-Length HTTP header...

CVE-2009-1176

mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a '\0' character, which allows remote attackers to conduct buffer-overflow attacks or have unspecified other impact via a long id parameter in a query action...

CVE-2009-1177

Multiple stack-based buffer overflows in maptemplate.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 have unknown impact and remote attack vectors...