4156 matches found
DSA-752-1 gzip - several
Bulletin has no description...
e107 search.php search_info Parameter Traversal Arbitrary File Inclusion
The version of e107 installed on the remote host is affected by a remote file inclusion vulnerability because it fails to properly sanitize user-supplied input to the 'searchinfo' parameter of the 'search.php' script. This vulnerability could allow a remote, unauthenticated attacker to view...
CVE-2005-1093
Buffer overflow in the PopUp Plus 2.0.3.8 plugin for Miranda IM, with "Use SmileyAdd Setting" enabled, allows remote attackers to execute arbitrary code...
CVE-2005-1093
Buffer overflow in the PopUp Plus 2.0.3.8 plugin for Miranda IM, with "Use SmileyAdd Setting" enabled, allows remote attackers to execute arbitrary code...
JunkBuster: Multiple vulnerabilities
Background JunkBuster is a filtering HTTP proxy, designed to enhance privacy and remove unwanted content. Description James Ranson reported a vulnerability when JunkBuster is configured to run in single-threaded mode, an attacker can modify the referrer setting by getting a victim to request a...
junkbuster -- heap corruption vulnerability and configuration modification vulnerability
A Debian advisory reports: James Ranson discovered that an attacker can modify the referrer setting with a carefully crafted URL by accidently overwriting a global variable. Tavis Ormandy from the Gentoo Security Team discovered several heap corruptions due to inconsistent use of an internal...
GLSA-200501-39 : SquirrelMail: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-200501-39 SquirrelMail: Multiple vulnerabilities SquirrelMail fails to properly sanitize certain strings when decoding specially crafted strings, which can lead to PHP file inclusion and XSS. Insufficient checking of incoming URLs...
USN-75-1: cpio vulnerability
Recently it was discovered that cpio created world-writeable files when used in -o/--create mode with giving an output file with -O. This allowed any user to modify the created cpio archives. Now cpio respects the current umask setting of the user. Note: This vulnerability has already been fixed ...
Advanced Guestbook 2.22.3 - User-Agent HTML Injection
Advanced Guestbook 2.22.3 - User-Agent HTML Injection source: https://www.securityfocus.com/bid/14391/info Advanced Guestbook is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically...
Advanced Guestbook 2.2/2.3 - User-Agent HTML Injection
source: https://www.securityfocus.com/bid/14391/info Advanced Guestbook is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code...
CVE-2004-2760
sshd in OpenSSH 3.5p1, when PermitRootLogin is disabled, immediately closes the TCP connection after a root login attempt with the correct password, but leaves the connection open after an attempt with an incorrect password, which makes it easier for remote attackers to guess the password by...
CVE-2004-2236
Unknown vulnerability in Moodle before 1.3.3 has unknown impact and attack vectors, related to language setting...
CVE-2004-2069
sshd.c in OpenSSH 3.6.1p2 and 3.7.1p2 and possibly other versions, when using privilege separation, does not properly signal the non-privileged process when a session has been terminated after exceeding the LoginGraceTime setting, which leaves the connection open and allows remote attackers to...
CVE-2004-0979
Internet Explorer on Windows XP fails to honor the security setting for “Drag and drop or copy and paste files” when the user selects Disable or Prompt. This weakness can allow drag-and-drop operations to occur contrary to user intent, potentially enabling security-sensitive actions (e.g., copyin...
Debian DSA-181-1 : libapache-mod-ssl - XSS
Joe Orton discovered a cross site scripting problem in modssl, an Apache module that adds Strong cryptography i.e. HTTPS support to the webserver. The module will return the server name unescaped in the response to an HTTP request on an SSL port. Like the other recent Apache XSS bugs, this only...
CVE-2002-1435
class.atkdateattribute.js.php in Achievo 0.7.0 through 0.9.1, except 0.8.2, allows remote attackers to execute arbitrary PHP code when the 'allowurlfopen' setting is enabled via a URL in the configatkroot parameter that points to the code...
August 2004 Security Advisory
August 2004 Security Advisory August 12th, 2004 Background There is a path-sanitizing bug that affects daemon mode in all recent rsync versions including 2.6.2 but only if chroot is disabled. It does NOT affect the normal send/receive filenames that specify what files should be transferred this i...
phpMyAdmin: Multiple vulnerabilities
Background phpMyAdmin is a popular, web-based MySQL administration tool written in PHP. It allows users to administer a MySQL database from a web-browser. Description Two serious vulnerabilities exist in phpMyAdmin. The first allows any user to alter the server configuration variables including...
Lexmark / Dell Printer Unauthenticated Access
The remote printer has no password set. This allows anyone to change its IP or potentially to intercept print jobs sent to it. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid12236; scriptversion "$Revision: 1.14 $"; scriptcvsdate"$Date: 2013/01/25 01:19:09 $";...