[Backports-security-announce] Security update for openoffice.org

Rene Engelhard uploaded new packages for openoffice.org which fixed the following security problems: Debian BTS 496361 left-over debugging echos writing into an insecure temp file can allow attackers to overwrite files on the system with the prvilieges of the user executing senddoc File - Send...

[Backports-security-announce] Security Update for proftpd-dfsg

Francesco Paolo Lovergine uploaded new packages for proftpd-dfsg which fixed the following security problem: CVE-2008-4242, Debian Bug 502674 ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery CSRF...

[Backports-security-announce] Security Update for proftpd-dfsg

Francesco Paolo Lovergine uploaded new packages for proftpd-dfsg which fixed the following security problem: CVE-2008-4242, Debian Bug 502674 ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery CSRF...

phpwebgallery-hijackexec.txt

$b'.$sort.';' 64. ; An attacker could be able to inject and execute PHP code through $GET'sort', that is passed to createfunction at line 63 see http://www.securityfocus.com/bid/31398. Only admin can access to the plugins management interface, but the attacker might be able to retrieve a valid...

[SECURITY] [DSA 1654-1] New libxml2 packages fix execution of arbitrary code

------------------------------------------------------------------------ Debian Security Advisory DSA-1654-1 [email protected] http://www.debian.org/security/ Steve Kemp October 14, 2008 http://www.debian.org/security/faq -...

PhpWebGallery <= 1.7.2 Session Hijacking / Code Execution Exploit

Exploit for unknown platform in category web applications ================================================================= PhpWebGallery $b'.$sort.';' 64. ; An attacker could be able to inject and execute PHP code through $GET'sort', that is passed to createfunction at line 63 see...

[SECURITY] [DSA 1647-1] New php5 packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1647-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst October 07, 2008 http://www.debian.org/security/faq -...

CVE-2008-4369

SQL injection vulnerability in pics.php in Availscript Photo Album allows remote attackers to execute arbitrary SQL commands via the sid parameter...

Sql injection

SQL injection vulnerability in pics.php in Availscript Photo Album allows remote attackers to execute arbitrary SQL commands via the sid parameter...

CVE-2008-4241

SQL injection vulnerability in CJ Ultra Plus 1.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via an SID cookie...

Sql injection

SQL injection vulnerability in CJ Ultra Plus 1.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via an SID cookie...

CVE-2008-4241

SQL injection vulnerability in CJ Ultra Plus 1.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via an SID cookie...

Debian: Security Advisory (DSA-1639-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

cjultra-sql.txt

!/usr/bin/perl CJ Ultra Plus GretzZz 2: pronoobz.org - Wesker, China Sun and all other memberZz "SID='UNION SELECT b12 from settings/"; $ua = LWP::UserAgent-new; $ua-timeout10; $ua-envproxy; $ua-agent"Mozilla/5.0 Windows; U; Windows NT 5.1; nl; rv:1.8.1.12 Gecko/20080201 Firefox/2.0.0.12";...

Cross site scripting

Cross-site scripting XSS vulnerability in print.php in myPHPNuke MPN before 1.8.88rc2 allows remote attackers to inject arbitrary web script or HTML via the sid parameter...

Sql injection

SQL injection vulnerability in print.php in myPHPNuke MPN before 1.8.88rc2 allows remote attackers to execute arbitrary SQL commands via the sid parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in surveyresults.asp in Smart Survey 1.0 allows remote attackers to inject arbitrary web script or HTML via the sid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-4051

Cross-site scripting XSS vulnerability in surveyresults.asp in Smart Survey 1.0 allows remote attackers to inject arbitrary web script or HTML via the sid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

FreeBSD Ports: ethereal, ethereal-lite, tethereal, tethereal-lite

The remote host is missing an update to the system as announced in the referenced advisory. VID 265c8b00-d2d0-11d8-b479-02e0185c0b53 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Simple PHP Blog (SPHPBlog) 0.5.1 - Code Execution

Simple PHP Blog SPHPBlog 0.5.1 - Code Execution 3 curlsetopt $ch, CURLOPTCOOKIE, "$cook"; $res = curlexec $ch;$err=curlerror $ch ;if $err print "$err"; curlclose$ch; return $res; function error$msg print "$msg\nNot Exploitable";exit; extract$POST;extract$GET; print "URL:"; if strlen$eval3...