Debian Security Advisory DSA 1459-1 (gforge)

The remote host is missing an update to gforge announced via advisory DSA 1459-1. OpenVAS Vulnerability Test $Id: deb14591.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1459-1 gforge Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Debian DSA-1477-1 : yarssr - missing input sanitising

Duncan Gilmore discovered that yarssr, an RSS aggregator and reader, performs insufficient input sanitising, which could result in the execution of arbitrary shell commands if a malformed feed is read. Due to a technical limitation of the archive management scripts, the fix for the old stable...

[SECURITY] [DSA 1477-1] New yarssr packages fix arbitrary shell command execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1477-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 27, 2008 http://www.debian.org/security/faq -...

yarssr RSS reader shell characters vulnerability

No description provided...

[SECURITY] [DSA 1477-1] New yarssr packages fix arbitrary shell command execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1477-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 27, 2008 http://www.debian.org/security/faq -...

lxblog rss.php爆路径

$cid=int$GET'cid'; $uid=int$GET'uid'; $Rssnewnum=20; $Rsslistnum=20; $Rssupdatetime=10; $cachepath=DP.'data/cache/rss.php'.$cid.'cache.php'; lxblog 暂无 www.lxblog.net/ http://www.XXXX.com/blog/rss.php?cid=12345 http://www.XXXX.com/blog/data/cache/rss.php12345cache.php...

Debian: Security Advisory (DSA-944-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2008-0173

SQL injection vulnerability in Gforge 4.6.99 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified parameters, related to RSS exports...

Sql injection

SQL injection vulnerability in Gforge 4.6.99 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified parameters, related to RSS exports...

CVE-2008-0173

SQL injection vulnerability in Gforge 4.6.99 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified parameters, related to RSS exports...

CVE-2008-0173

CVE-2008-0173 affects Gforge, with SQL injection in scripts related to RSS exports due to insufficient input validation in CGI parameters. Affected versions include 4.6.99 and earlier. Remote attackers could potentially execute arbitrary SQL commands via those parameters. Debian (DSA-1459-1) and ...

CVE-2008-0173

SQL injection vulnerability in Gforge 4.6.99 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified parameters, related to RSS exports...

DSA-1459-1 gforge - SQL injection

Bulletin has no description...

DEBIAN-CVE-2008-0191

WordPress 2.2.x and 2.3.x allows remote attackers to obtain sensitive information via an invalid p parameter in an rss2 action to the default URI, which reveals the full path and the SQL database structure...

SA-2008-005 - Drupal core - Cross site request forgery

The aggregator module fetches items from RSS feeds and makes them available on the site. The module provides an option to remove items from a particular feed. This has been implemented as a simple GET request and is therefore vulnerable to cross site request forgeries. For example: Should a...

CVE-2008-0191

WordPress 2.2.x and 2.3.x allows remote attackers to obtain sensitive information via an invalid p parameter in an rss2 action to the default URI, which reveals the full path and the SQL database structure...

drupal -- cross site request forgery

The Drupal Project reports: The aggregator module fetches items from RSS feeds and makes them available on the site. The module provides an option to remove items from a particular feed. This has been implemented as a simple GET request and is therefore vulnerable to cross site request forgeries...

Apple Mac OS X v10.5.1 2007-009 Multiple Security Vulnerabilities

CVE-2007-4708 CVE-2007-4709 CVE-2007-4710 CVE-2007-5847 CVE-2007-5848 CVE-2007-5849 CVE-2007-5850 CVE-2007-5851 CVE-2007-5853 CVE-2007-5854 CVE-2007-5855 CVE-2007-5856 CVE-2007-5857 CVE-2007-5859 CVE-2007-5876 CVE-2007-5860 CVE-2007-5861 These issues affect Mac OS X and various applications,...

Zenphoto 'rss.php' SQL注入漏洞

Zenphoto是一款基于PHP的WEB应用程序。 Zenphoto不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于'rss.php'脚本对用户提交的'albumnr'参数处理缺少充分过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Zenphoto zenphoto 1.1.3 Zenphoto zenphoto 1.1.2 Zenphoto zenphoto 1.1.1 Zenphoto zenphoto 1.1 目前没有解决方案提供：...

ZenPhoto 1.1.3 - rss.php?albumnr SQL Injection

ZenPhoto 1.1.3 - rss.php?albumnr SQL Injection !/usr/bin/perl -w Zenphoto 1.1.3 SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code rss.php: $albumnr = $GETalbumnr; if $albumnr != "" $sql = "SELECT FROM "...