couchdb -- DOM based Cross-Site Scripting via Futon UI

Jan Lehnardt reports: Query parameters passed into the browser-based test suite are not sanitised, and can be used to load external resources. An attacker may execute JavaScript code in the browser, using the context of the remote user...

[SECURITY] Fedora 16 Update: perl-FCGI-0.74-1.fc16

Test suite for package perl-FCGI...

Fedora 14 : libxml-1.8.17-27.fc14 (2011-7856)

This update addresses CVE-2011-1944 heap-based buffer overflow by adding a new namespace node to an existing nodeset or merging nodesets. It is described in detail at http://scarybeastsecurity.blogspot.com/2011/05/libxml-vulnerability-an d-interesting.html It also fixes the broken xpath...

Fedora 15 : libxml-1.8.17-27.fc15 (2011-7820)

This update addresses CVE-2011-1944 heap-based buffer overflow by adding a new namespace node to an existing nodeset or merging nodesets. It is described in detail at http://scarybeastsecurity.blogspot.com/2011/05/libxml-vulnerability-an d-interesting.html It also fixes the broken xpath...

CVE-2010-0212

OpenLDAP 2.4.22 allows remote attackers to cause a denial of service crash via a modrdn call with a zero-length RDN destination string, which is not properly handled by the smrnormalize function and triggers a NULL pointer dereference in the IA5StringNormalize function in schemainit.c, as...

CVE-2010-0212

OpenLDAP 2.4.22 allows remote attackers to cause a denial of service crash via a modrdn call with a zero-length RDN destination string, which is not properly handled by the smrnormalize function and triggers a NULL pointer dereference in the IA5StringNormalize function in schemainit.c, as...

CVE-2010-0212

OpenLDAP 2.4.22 allows remote attackers to cause a denial of service crash via a modrdn call with a zero-length RDN destination string, which is not properly handled by the smrnormalize function and triggers a NULL pointer dereference in the IA5StringNormalize function in schemainit.c, as...

CVE-2010-0211

The slapmodrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smrnormalize function, which allows remote attackers to cause a denial of service segmentation fault and possibly execute arbitrary code via a modrdn call with an RDN string containing...

CVE-2010-0211

The slapmodrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smrnormalize function, which allows remote attackers to cause a denial of service segmentation fault and possibly execute arbitrary code via a modrdn call with an RDN string containing...

Mandriva Update for glibc MDKA-2007:012 (glibc)

Check for the Version of glibc OpenVAS Vulnerability Test Mandriva Update for glibc MDKA-2007:012 glibc Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Mandriva Update for openssl MDVSA-2008:107 (openssl)

Check for the Version of openssl OpenVAS Vulnerability Test Mandriva Update for openssl MDVSA-2008:107 openssl Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

CVE-2008-6536: Undefined Security Weakness

Unspecified vulnerability in 7-zip before 4.5.7 has unknown impact and remote attack vectors, as demonstrated by the PROTOS GENOME test suite for Archive Formats c10...

Default credentials

The UFS implementation in the kernel in Sun OpenSolaris snv29 through snv90 allows local users to cause a denial of service panic via the single posixfallocate test in the SUSv3 POSIX test suite, related to an FALLOCSP fcntl call...

FreeBSD Ports: pwlib

The remote host is missing an update to the system as announced in the referenced advisory. VID 27c331d5-64c7-11d8-80e3-0020ed76ef5a OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Code injection

libclamunrar in ClamAV before 0.93 allows remote attackers to cause a denial of service crash via crafted RAR files that trigger "memory problems," as demonstrated by the PROTOS GENOME test suite for Archive Formats...

CVE-2008-1387

ClamAV before 0.93 allows remote attackers to cause a denial of service CPU consumption via a crafted ARJ archive, as demonstrated by the PROTOS GENOME test suite for Archive Formats...

Design/Logic Flaw

Unspecified vulnerability in multiple F-Secure anti-virus products, including Internet Security 2006 through 2008, Anti-Virus 2006 through 2008, and others, allows remote attackers to execute arbitrary code or cause a denial of service hang or crash via a malformed archive that triggers an...

PHP import_request_variables() arbitrary variable overwrite

PHP importrequestvariables arbitrary variable overwrite Name Using importrequestvariables you can overwrite $ and $ any php variable. Systems Affected PHP =4.0.7 =5.2.1 Severity High Vendor http://www.php.net/ Advisory http://www.wisec.it/vulns.php?id=10 http://www.wisec.it/vuln10.txt Authors...

Debian DSA-1195-1 : openssl096 - denial of service (multiple)

Multiple vulnerabilities have been discovered in the OpenSSL cryptographic software package that could allow an attacker to launch a denial of service attack by exhausting system resources or crashing processes on a victim's computer. - CVE-2006-3738 Tavis Ormandy and Will Drewry of the Google...

CVE-2006-4760

Multiple cross-site scripting XSS vulnerabilities in Benjamin Pasero and Tobias Eichert RSSOwl allow remote attackers to inject arbitrary web script or HTML via a web feed, as demonstrated by certain test cases of the Robert Auger and Caleb Sima RSS and Atom feed reader test suite...