[eVuln] FreeForum PHP Code Execution & Multiple XSS Vulnerabilities

New eVuln Advisory: FreeForum PHP Code Execution & Multiple XSS Vulnerabilities http://evuln.com/vulns/89/summary.html --------------------Summary---------------- eVuln ID: EV0089 CVE: CVE-2006-0957 CVE-2006-0958 Vendor: ZoneO-Soft Vendor's Web Site: http://soft.zoneo.net/ Software: FreeForum...

LISTSERV contains multiple buffer overflow vulnerabilities in the WA CGI script

Overview Several buffer overflow vulnerabilities have been discovered in LISTSERV. These vulnerabilities could allow a remote attacker to execute arbitrary code on an affected system. Description L-Soft's LISTSERV is an email list management software package. It includes a Web Archive and...

L-Soft Listserv list management system web interface code execution

No description provided...

Critical Risk Vulnerability in L-Soft Listserv

Peter Winter-Smith of NGSSoftware has discovered a number of vulnerabilities in L-Soft's LISTSERV list management system. The worst of these carries a critical risk rating. Affected versions include: - LISTSERV version 14.4, including LISTSERV Lite and HPO - LISTSERV version 14.3, including...

CVE-2006-0958

Cross-site scripting XSS vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the 1 name and 2 subject parameters...

Cross site scripting

Cross-site scripting XSS vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the 1 name and 2 subject parameters...

CVE-2006-0957

Direct static code injection vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to execute arbitrary PHP code via the 1 X-Forwarded-For and 2 Client-Ip HTTP headers, which are stored in Data/flood.db.php...

CVE-2006-0958

FreeForum by ZoneO-Soft (vendor: ZoneO-Soft) prior to version 1.2.1 is affected. CVE-2006-0958 stems from unsanitized inputs in func.inc.php, allowing cross-site scripting via the name and subject parameters. Related linked advisory EV0089 also describes a PHP code execution path through unvalida...

CVE-2006-0957

Direct static code injection vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to execute arbitrary PHP code via the 1 X-Forwarded-For and 2 Client-Ip HTTP headers, which are stored in Data/flood.db.php...

CVE-2006-0958

Cross-site scripting XSS vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the 1 name and 2 subject parameters...

CVE-2006-0957

CVE-2006-0957 affects ZoneO-Soft FreeForum (before 1.2.1). A direct static code injection vulnerability exists in func.inc.php where HTTP headers X-Forwarded-For and Client-Ip are written to Data/flood.db.php, enabling remote attackers to inject and execute arbitrary PHP code. The vulnerability a...

security flaw

Buffer overflow in the International Domain Name IDN support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a hostname with all "soft" hyphens character 0xAD, which is not...

Sun Solaris UFS file system driver DoS

It's possible to cause "soft hang" if UFS logging is enabled...

IDN heap overrun using soft-hyphens — Mozilla

Tom Ferris reported a Firefox crash when processing a domain name consisting solely of soft-hyphen characters. This is due to a heap overrun triggered when Internationalized Domain Name IDN processing results in an empty string after removing non-mapping characters such as soft-hyphens. This...

CVE-2005-2871

Buffer overflow in the International Domain Name IDN support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a hostname with all "soft" hyphens character 0xAD, which is not...

CVE-2005-1773

Multiple unknown vulnerabilities in L-Soft LISTSERV 14.3, 1.8e, and 1.8d allow remote attackers to execute arbitrary code or cause a denial of service. NOTE: this candidate may be SPLIT in the future when more precise technical details become available...

CVE-2005-1773

CVE-2005-1773 concerns multiple unknown vulnerabilities in L-Soft LISTSERV versions 14.3, 1.8e, and 1.8d. The remote vulnerability vector targets the Listserv web interface CGI, enabling remote attackers to execute arbitrary code or cause a denial of service. The provided connected documents conf...

CVE-2005-1773

Multiple unknown vulnerabilities in L-Soft LISTSERV 14.3, 1.8e, and 1.8d allow remote attackers to execute arbitrary code or cause a denial of service. NOTE: this candidate may be SPLIT in the future when more precise technical details become available...

L-Soft LISTSERV mailing lists server multiple vulnerabilities

Remote code execution, denial of service...

High Risk Vulnerability in L-Soft's LISTSERV Server

Peter Winter-Smith of NGSSoftware has discovered a number of vulnerabilities in L-Soft's LISTSERV list management system. The worst of these carries a high risk rating. Affected versions include: - LISTSERV version 14.3, including LISTSERV Lite and HPO - LISTSERV version 1.8e, including LISTSERV...