WebcamXP Chat Name XSS

The remote host is running a version of webcamXP, a webcam software package and integrated web server for Windows, that suffers from an HTML injection flaw in its chat feature. An attacker can exploit this flaw by injecting malicious HTML and script code through the nickname field to redirect cha...

Multiple ModernBill 4.3.0 And Earlier Vulnerabilities

GulfTech Security Research April 10th, 2005 Vendor : ModernGigabyte, LLC URL : http://www.modernbill.com/ Version : ModernBill 4.3.0 && Earlier Risk : Multiple Vulnerabilities Description: ModernBill is a widely used billing and management software used by webhosts to manage billing and financial...

DSA-691-1 abuse - several

Bulletin has no description...

phpWebSite: Arbitrary PHP execution and path disclosure

Background phpWebSite provides a complete web site content management system. Description NST discovered that, when submitting an announcement, uploaded files aren't correctly checked for malicious code. They also found out that phpWebSite is vulnerable to a path disclosure. Impact A remote...

Debian DSA-664-1 : cpio - broken file permissions

It has been discovered, that cpio, a program to manage archives of files, creates output files with -O and -F with broken permissions due to a reset zero umask which allows local users to read or overwrite those files. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

[ GLSA 200501-46 ] ClamAV: Multiple issues

Gentoo Linux Security Advisory GLSA 200501-46 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

[SECURITY] [DSA 649-1] New xtrlock packages fix authentication bypass

-------------------------------------------------------------------------- Debian Security Advisory DSA 649-1 [email protected] http://www.debian.org/security/ Martin Schulze January 20th, 2005 http://www.debian.org/security/faq -...

phpCMS parser.php file Parameter XSS

The remote host runs phpCMS, a content management system written in PHP. This version is vulnerable to cross-site scripting due to a lack of sanitization of user-supplied data in parser.php script. Successful exploitation of this issue may allow an attacker to execute malicious script code on a...

CubeCart index.php cat_id Parameter SQL Injection

There is a SQL injection issue in the remote version of CubeCart that could allow an attacker to execute arbitrary SQL statements on the remote host and to potentially overwrite arbitrary files on the remote system, by sending a malformed value to the 'catid' argument of the file 'index.php'...

Debian DSA-145-1 : tinyproxy - doubly freed memory

The authors of tinyproxy, a lightweight HTTP proxy, discovered a bug in the handling of some invalid proxy requests. Under some circumstances, an invalid request may result in allocated memory being freed twice. This can potentially result in the execution of arbitrary code. %NASLMINLEVEL 70300 C...

Debian DSA-382-3 : ssh - possible remote vulnerability

A bug has been found in OpenSSH's buffer handling where a buffer could be marked as grown when the actual reallocation failed. DSA-382-2: This advisory is an addition to the earlier DSA-382-1 advisory: two more buffer handling problems have been found in addition to the one described in DSA-382-1...

Debian DSA-043-1 : zope

This advisory covers several vulnerabilities in Zope that have been addressed.Hotfix 08092000 'Zope security alert and hotfix product' The issue involves the fact that the getRoles method of user objects contained in the default UserFolder implementation returns a mutable Python type. Because the...

Squid: Denial of service when using NTLM authentication

Background Squid is a full-featured Web Proxy Cache designed to run on Unix systems. It supports proxying and caching of HTTP, FTP, and other URLs, as well as SSL support, cache hierarchies, transparent caching, access control lists and many other features. Description Squid 2.5.x versions contai...

[SECURITY] [DSA 543-1] New krb5 packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 543-1 [email protected] http://www.debian.org/security/ Martin Schulze August 31st, 2004 http://www.debian.org/security/faq -...

GLSA-200404-08 : GNU Automake symbolic link vulnerability

The remote host is affected by the vulnerability described in GLSA-200404-08 GNU Automake symbolic link vulnerability Automake may be vulnerable to a symbolic link attack which may allow an attacker to modify data or escalate their privileges. This is due to the insecure way Automake creates...

GLSA-200402-01 : PHP setting leaks from .htaccess files on virtual hosts

The remote host is affected by the vulnerability described in GLSA-200402-01 PHP setting leaks from .htaccess files on virtual hosts If the server configuration 'php.ini' file has 'registerglobals = on' and a request is made to one virtual host which has 'phpadminflag registerglobals off' and the...

GLSA-200407-12 : Linux Kernel: Remote DoS vulnerability with IPTables TCP Handling

The remote host is affected by the vulnerability described in GLSA-200407-12 Linux Kernel: Remote DoS vulnerability with IPTables TCP Handling An attacker can utilize an erroneous data type in the IPTables TCP option handling code, which lies in an iterator. By making a TCP packet with a header...

GLSA-200402-03 : Monkeyd Denial of Service vulnerability

The remote host is affected by the vulnerability described in GLSA-200402-03 Monkeyd Denial of Service vulnerability A bug in the URI processing of incoming requests allows for a Denial of Service to be launched against the webserver, which may cause the server to crash or behave sporadically...

Merak Webmail / IceWarp Web Mail < 5.2.8 Multiple Vulnerabilities

The target is running at least one instance of Merak Webmail / IceWarp Web Mail 5.2.7 or less or Merak Mail Server 7.5.2 or less. Such versions are potentially affected by multiple cross-site scripting, HTML and SQL injection, and PHP source code disclosure vulnerabilities. %NASLMINLEVEL 70300 Th...

TikiWiki Unauthorized Page Access

The remote host is running TikiWiki, a content management system written in PHP. The remote version of this software is vulnerable to a flaw that could allow an attacker to bypass the permissions of individual Wiki pages. An attacker could exploit this flaw to deface the remote web server or gain...