Some of the blast path tips-vulnerability warning-the black bar safety net

Webmasters network dedecms proof method directory http://chinaz.com/include/htmledit/index.php?modetype=basic&height=airpig Fatal error: Unsupported operand types in E:\2008.chinaz\include\htmledit\index.php on line 7 These are the use of a cms vulnerability Then say under Phpmyadmin This more...

Design/Logic Flaw

A certain ActiveX control in iisext.dll in Microsoft Internet Information Services IIS allows remote attackers to set a password via a string argument to the SetPassword method. NOTE: this issue could not be reproduced by a reliable third party. In addition, the original researcher is unreliable...

CVE-2008-4301

CVE-2008-4301 concerns a vulnerability in the ActiveX control in iisext.dll used by Microsoft Internet Information Services (IIS). The affected component is an ActiveX control; the reported issue allows remote attackers to set a password via a string argument to the SetPassword method. The core p...

CVE-2008-4297

Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files from a repository via an "hg pull" request...

DSA-1627-2 opensc - smart card vulnerability

Bulletin has no description...

CVE-2008-3329

Unspecified vulnerability in Links before 2.1, when "only proxies" is enabled, has unknown impact and attack vectors related to providing "URLs to external programs."...

CentOS 3 / 4 / 5 : pidgin (CESA-2008:0584)

Updated Pidgin packages that fix a security issue and address a bug are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Pidgin is a multi-protocol Internet Messaging client. An integer...

nBill component for Joomla! 'cid' Parameter SQLi

The version of the nBill also known as netinvoice component for Joomla! and Mambo running on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the 'cid' parameter before using it to construct database queries. Regardless of the PHP...

Design/Logic Flaw

Untrusted search path vulnerability in a certain Red Hat build script for Standards Based Linux Instrumentation for Manageability sblim libraries before 1-13a.el46.1 in Red Hat Enterprise Linux RHEL 4, and before 1-31.el52.1 in RHEL 5, allows local users to gain privileges via a malicious library...

CVE-2008-2306

Apple Safari before 3.1.2 on Windows does not properly interpret the URLACTIONSHELLEXECUTEHIGHRISK Internet Explorer zone setting, which allows remote attackers to bypass intended access restrictions, and force a client system to download and execute arbitrary files...

TYPO3 Security Bulletin

Several vulnerabilities have been found in TYPO3 third party extensions. Please read first: This Collective Security Bulletin CSB is a listing of vulnerable extensions with neither significant download numbers nor other special importance amongst the TYPO3 Community. The intention of CSBs is to...

PHP 5.2.6 - 'sleep()' Local Memory Exhaust

There is some kind of issue in PHP we can run out memory even on SAFEMODE script simply allocate maximum of memory and go to sleep for, let's say 9999999 seconds. sleep pass 'maxexecutiontime' setting. Ram eater sploit ? if ! $purl = @parseurl$url die'sorry, parseurl function disabled Oo'; if !...

Information disclosure

Microsoft Internet Explorer 7 can save encrypted pages in the cache even when the DisableCachingOfSSLPages registry setting is enabled, which might allow local users to obtain sensitive information...

[SECURITY] Fedora 8 Update: kdebase-runtime-4.0.3-10.fc8.1

Core runtime for the K Desktop Environment 4. This package does not include the KDE 4 versions of applications which are provided by KDE 3 because of file and configuration setting conflicts...

[SECURITY] Fedora 7 Update: kdebase4-4.0.3-9.fc7

Core runtime requirements and applications for the K Desktop Environment 4. This package does not include the KDE 4 versions of applications which are provided by KDE 3 because of file and configuration setting conflicts...

Memory corruption

Foxit Reader 2.2 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a PDF file with 1 a malformed ExtGState resource containing a /Font resource, or 2 an XObject resource with a Rotate setting, which triggers memory corruption. NOTE: this is probabl...

[NEWS] Websphere MQ MCAUSER Setting Bypass Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

lighttpd: Multiple vulnerabilities

Background lighttpd is a lightweight high-performance web server. Description Julien Cayzax discovered that an insecure default setting exists in moduserdir in lighttpd. When userdir.path is not set the default value used is $HOME. It should be noted that the "nobody" user's $HOME is "/"...

Privacy issue with SSL Client Authentication — Mozilla

Peter Brodersen and Alexander Klink independently reported that the default setting for SSL Client Authentication, automatically selecting a client certificate on behalf of the user, creates a potential privacy issue for users by allowing tracking through client certificates. For users who alread...

PHPAuction Multiple Script include_path Parameter File Inclusion

The remote host is running PHPAuction, a PHP script for building auction websites. The version of PHPAuction installed on the remote host fails to sanitize input to the 'includepath' parameter of several scripts before using it to include PHP code. An unauthenticated, remote attacker can exploit...