[SECURITY] [DSA 1366-1] New clamav packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1366-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff September 1st, 2007 http://www.debian.org/security/faq -...

sql-ledger -- multiple vulnerabilities

The Debian security Team reports: Several remote vulnerabilities have been discovered in SQL Ledger, a web based double-entry accounting program, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems: Chris Travers...

Debian DSA-999-1 : lurker - several vulnerabilities

Several security related problems have been discovered in lurker, an archive tool for mailing lists with integrated search engine. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2006-1062 Lurker's mechanism for specifying configuration files was...

DSA-1168-1 imagemagick

Bulletin has no description...

Ottoman CMS <= 1.1.3 (default_path) Remote File Inclusion Exploit

No description provided by source. !/usr/bin/perl use IO::Socket; Jacek Wlodarczyk j4ck - jacekwloatgmaildotcom Title: Ottoman CMS = 1.1.3 Remote File Inclusion Exploit Application: Ottoman Content Management System Version: 1.1.3 and prior Url: http://www.lowter.com/p/ottoman Affected software...

Horde Web Application Framework: XSS vulnerability

Background The Horde Web Application Framework is a general-purpose web application framework written in PHP, providing classes for handling preferences, compression, browser detection, connection tracking, MIME, and more. Description Michael Marek discovered that the Horde Web Application...

Chatty improper input sanitizing

Chatty improper input sanitizing Discovered by: Nomenumbra Date: 21/5/2006 impact:moderate possible defacement Chatty is a PHP-based chatscript allowing users to chat over the web. Subscribing with a username like this: scriptalert22xss22/script would cause major xss in the chatroom. Nomenumbra...

ChipmunkBlogger improper input sanitizing

ChipmunkBlogger improper input sanitizing Discovered by: Nomenumbra Date: 6/4/2006 impact:moderate privilege escalation,possible defacement Posts potentially made by lower-privilege members and profile names aren't properly sanitized, thus resulting in being vulnerable to the following kind of XS...

FlexCustomer <= 0.0.4 sql injection

FlexCustomer = 0.0.4 sql injection Discovered by: Nomenumbra Date: 6/4/2006 impact:high privilege escalation,defacement FlexCustomer versions 0.0.4 and below are vulnerable to and SQL injection in the common user and admin-panel login as follows it really is SQL-injection 101 you know....: a' or...

[SNS Advisory No.85] XOOPS Multiple Cross-site Scripting Vulnerabilities

---------------------------------------------------------------------- SNS Advisory No.85 XOOPS Multiple Cross-site Scripting Vulnerabilities Problem first discovered on: Sun, 25 Sep 2005 Published on: Tue, 25 Oct 2005 ---------------------------------------------------------------------- Severit...

Mandrake Linux Security Advisory : bluez-utils (MDKSA-2005:150)

A vulnerability in bluez-utils was discovered by Henryk Plotz. Due to missing input sanitizing, it was possible for an attacker to execute arbitrary commands supplied as a device name from the remote bluetooth device. The updated packages have been patched to correct this problem. %NASLMINLEVEL...

SysCP < 1.2.11 Multiple Script Command Execution Vulnerabilities

The remote host is running SysCP, an open source control panel written in PHP. The version of SysCP installed on the remote host uses user-supplied input to several variables in various scripts without sanitizing it. Provided PHP's 'registerglobals' setting is enabled, an attacker can exploit the...

CVE-2005-1854

Unknown vulnerability in apt-cacher in Debian 3.1, related to "missing input sanitising," allows remote attackers to execute arbitrary commands on the caching server...

[SECURITY] [DSA 762-1] New affix packages fix arbitrary command and code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 762-1 [email protected] http://www.debian.org/security/ Martin Schulze July 19th, 2005 http://www.debian.org/security/faq -...

FreeBSD : rsync -- path sanitizing vulnerability (2689f4cb-ec4c-11d8-9440-000347a4fa7d)

An rsync security advisory reports : There is a path-sanitizing bug that affects daemon mode in all recent rsync versions including 2.6.2 but only if chroot is disabled. The bug may allow a remote user to access files outside of an rsync module's configured path with the privileges configured for...

CVE-2005-0388

CVE-2005-0388 applies to remstats' remoteping service in versions up to 1.0.13. The vulnerability arises from missing input sanitising, enabling remote command execution. Debian DSA-704-1 fixes the issue in remstats (uptstream: version 1.0.13a-5 for sid; 1.00a4-8woody1 for woody). Red Hat advisor...

[SECURITY] [DSA 695-1] New xli packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 695-1 [email protected] http://www.debian.org/security/ Martin Schulze March 21st, 2005 http://www.debian.org/security/faq -...

DSA-695-1 xli - buffer overflow, input sanitising, integer overflow

Bulletin has no description...

[SECURITY] [DSA 690-1] New bsmtpd packages fix arbitrary command execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 690-1 [email protected] http://www.debian.org/security/ Martin Schulze February 25th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 690-1] New bsmtpd packages fix arbitrary command execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 690-1 [email protected] http://www.debian.org/security/ Martin Schulze February 25th, 2005 http://www.debian.org/security/faq -...