FreeBSD : php -- _ecalloc Integer Overflow Vulnerability (e329550b-54f7-11db-a5ae-00508d6a62df)

Stefan Esser reports : The PHP 5 branch of the PHP source code lacks the protection against possible integer overflows inside ecalloc that is present in the PHP 4 branch and also for several years part of our Hardening-Patch and our new Suhosin-Patch. It was discovered that such an integer overfl...

FreeBSD : php -- open_basedir Race Condition Vulnerability (edabe438-542f-11db-a5ae-00508d6a62df)

Stefan Esser reports : PHP's openbasedir feature is meant to disallow scripts to access files outside a set of configured base directories. The checks for this are placed within PHP functions dealing with files before the actual open call is performed. Obviously there is a little span of time...

php -- _ecalloc Integer Overflow Vulnerability

Stefan Esser reports: The PHP 5 branch of the PHP source code lacks the protection against possible integer overflows inside ecalloc that is present in the PHP 4 branch and also for several years part of our Hardening-Patch and our new Suhosin-Patch. It was discovered that such an integer overflo...

phpmyadmin -- XSRF vulnerabilities

phpMyAdmin team reports: We received a security advisory from Stefan Esser [email protected] and we wish to thank him for his work. It was possible to inject arbitrary SQL commands by forcing an authenticated user to follow a crafted link...

CVE-2006-4767

Multiple directory traversal vulnerabilities in Stefan Ernst Newsscript aka WM-News 0.5beta allow remote attackers to 1 read arbitrary local files via a .. dot dot sequence in the ide parameter in modify.php and 2 write to arbitrary local files via a .. sequence in the var parameter in addgo.php...

CVE-2006-4767

The CVE-2006-4767 entry concerns Stefan Ernst Newsscript (aka WM-News) 0.5beta. The described vulnerabilities are directory traversal flaws caused by improper handling of a .. sequence: (1) in modify.php with the ide parameter could allow reading arbitrary local files, and (2) in add_go.php with ...

CVE-2006-4768

The CVE-2006-4768 entry concerns Stefan Ernst Newsscript (aka WM-News) 0.5 beta, where the add_go.php script is vulnerable to multiple direct static code injection via the parameters (description, issue, title, var, name, keywords, note) stored in an article file. This allows remote attackers to ...

CVE-2006-4766

Directory traversal vulnerability in print.php in Stefan Ernst Newsscript aka WM-News 0.5 beta allows remote attackers to read arbitrary files via a .. dot dot in the ide parameter...

CVE-2006-4766

CVE-2006-4766 concerns a directory traversal vulnerability in the print.php script of Stefan Ernst Newsscript (aka WM-News) 0.5 beta. The issue allows remote attackers to read arbitrary files by supplying a .. path segment in the ide parameter, exposing partial confidentiality. The available refe...

[SA21826] Stefan E. Newsscript Multiple Vulnerabilities

TITLE: Stefan E. Newsscript Multiple Vulnerabilities SECUNIA ADVISORY ID: SA21826 VERIFY ADVISORY: http://secunia.com/advisories/21826/ CRITICAL: Highly critical IMPACT: Manipulation of data, Exposure of system information, Exposure of sensitive information, System access WHERE: From remote...

CVE-2006-4666

Multiple PHP remote file inclusion vulnerabilities in Stefan Ernst Newsscript aka WM-News 0.5 beta allow remote attackers to execute arbitrary PHP code via a URL in the 1 ide parameter in a article.php; or the 2 pwfile parameter in b delete.php, c modify.php, d admin.php, or e modifygo.php...

CVE-2006-4666

Multiple PHP remote file inclusion vulnerabilities in Stefan Ernst Newsscript aka WM-News 0.5 beta allow remote attackers to execute arbitrary PHP code via a URL in the 1 ide parameter in a article.php; or the 2 pwfile parameter in b delete.php, c modify.php, d admin.php, or e modifygo.php...

CVE-2006-4666

Multiple PHP remote file inclusion vulnerabilities affect Stefan Ernst Newsscript (aka WM-News) 0.5 beta. An attacker can cause arbitrary PHP code execution by supplying a URL in the vulnerable parameter: (1) ide in article.php, or (2) pwfile in delete.php, modify.php, admin.php, or modify_go.php...

[Full-disclosure] Content Management Framework "G3" - XSS Vulnerability in Search Function

Content Management Framework "G3" - XSS Vulnerability in Search Function INTRO According to the manufacturer, "G3" is a classic content-management-system, allowing customers to manage their own websites without knowing much about webpublishing. Information about the product is available at:...

CentOS 4 : curl (CESA-2005:875)

Updated curl packages that fix a security issue are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and Dict servers, using any of th...

Neon Responder (Dos,Exploit)

Author: Stefan Lochbihler Date: 17.04.2006 Affected Software: Neon Responder for Windows Software 5.4 Software http://www.neon.com/NRwin.shtml Attack: Dos Overview: Neon Responders greatly enhance the functionality of LANsurveyor by providing LANsurveyor with direct access to computers with the...

Neon Responder 5.4 (Clock Synchronization) Denial of Service Exploit

Exploit for unknown platform in category dos / poc ==================================================================== Neon Responder 5.4 Clock Synchronization Denial of Service Exploit ==================================================================== / Stefan Lochbihler/ include include...

Neon Responders 5.4 - Remote Clock Synchronization Denial of Service

Neon Responders 5.4 - Remote Clock Synchronization Denial of Service // source: https://www.securityfocus.com/bid/17569/info Neon Responders is susceptible to a remote denial-of-service vulnerability. This issue is due to the application's failure to properly handle malformed network packets. Thi...

[SA19392] Mambo AkoComment Module SQL Injection Vulnerabilities

TITLE: Mambo AkoComment Module SQL Injection Vulnerabilities SECUNIA ADVISORY ID: SA19392 VERIFY ADVISORY: http://secunia.com/advisories/19392/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: AkoComment 2.x module for Mambo http://secunia.com/product/8985/...

[SECURITY] [DSA 997-1] New bomberclone packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 997-1 [email protected] http://www.debian.org/security/ Martin Schulze March 13th, 2006 http://www.debian.org/security/faq -...