[security bulletin] HPSBUX02480 SSRT090253 rev.1 - HP-UX Running VRTSweb, Remote Execution of Arbitrary Code, Increase of Privilege

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01943614 Version: 1 HPSBUX02480 SSRT090253 rev.1 - HP-UX Running VRTSweb, Remote Execution of Arbitrary Code, Increase of Privilege NOTICE: The information in this Security Bulletin should be act...

Multiple vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: Car car, TYPO3 Watchdog abawatchdog, File list drblob, ListMan nllistman, XDS Staff List xdsstaff, Document Directorys danpdocumentdirs, Random Prayer Version 2 steprayer2, Diocese of Portsmouth Resources...

Sql injection

Multiple SQL injection vulnerabilities in cource.php in AlefMentor 2.0 and 2.2 allow remote attackers to execute arbitrary SQL commands via the 1 contid and 2 courcid parameters in a pregled action. NOTE: some of these details are obtained from third party information...

Fedora 10 : nginx-0.7.64-1.fc10 (2009-12775)

Fri Dec 4 2009 Jeremy Hinegardner - 0.7.64-1 - update to 0.7.64 - Thu Oct 29 2009 Jeremy Hinegardner - 0.7.63-1 - update to 0.7.63 - Mon Sep 14 2009 Jeremy Hinegardner - 0.7.62-1 - update to 0.7.62 - fixes CVE-2009-2629 - Sun Aug 2 2009 Jeremy Hinegardner - 0.7.61-1 - update to new stable 0.7.61...

Directory traversal

Directory traversal vulnerability in dialog/filemanager.php in Interspire Knowledge Manager 5 allows remote attackers to read arbitrary files via a .. dot dot in the p parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Multiple vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: AN Search it! ansearchit, Simple download-system with counter and categories kkdownloader, Automatic Base Tags for RealUrl ltbasetag, Trips mchtrips, simple Glossar simpleglossar, TW Productfinder...

Blind SQL Injection vulnerability in extension Calendar Base (cal)

It has been discovered that the extension Calendar Base cal is vulnerable to Blind SQL Injection. Release Date: December 1, 2009 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.2.0 and all versions below...

Cross-Site Scripting vulnerability in extension Direct Mail (direct_mail)

It has been discovered that the extension Direct Mail directmail is vulnerable to XSS. Release Date: December 1, 2009 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 2.6.4 and all versions below Vulnerability Type:...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in PHD Help Desk 1.43 allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO to area.php; the 2 pagina, 3 sentido, 4 qregistros, and 5 orden parameters to area.php; 6 the qregistros parameter to solicdisplay.php; 7 the...

CVE-2009-4053

Multiple directory traversal vulnerabilities in Home FTP Server 1.10.1.139 allow remote authenticated users to 1 create arbitrary directories via directory traversal sequences in an MKD command or 2 create files with any contents in arbitrary directories via directory traversal sequences in a fil...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in NCH Software Axon Virtual PBX 2.10 and 2.11 allow remote attackers to inject arbitrary web script or HTML via the 1 onok or 2 oncancel parameter to the logon program. NOTE: the provenance of this information is unknown; the details are obtained...

MassMutual Employee DB Hacked

MassMutual officials this week confirmed that one of its employee databases was accessed by an unauthorized person or persons, exposing an unknown number of employees’ personal data for a yet-to-be-determined amount of time. The Springfield, Mass.-based insurer said the compromised database was...

VMSA-2009-0016:VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components

VMSA-2009-0016.6 VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components. VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2009-0016.6 VMware Security Advisory Synopsis: VMware vCenter and ESX update release and vMA...

Jumi Component for Joomla! <= 2.0.5 Backdoor Detection

The version of Joomla! running on the remote host is affected by a backdoor that is part of a trojan installation of Jumi, a third-party component used for including custom code into Joomla!. An unauthenticated, remote attacker can exploit this backdoor, by using specially crafted input to the...

Online Ad Site Hacked, Rigged to Serve Exploits

A high-profile online advertising Web site has been hacked and rigged to serve multiple exploits to Microsoft Windows users surfing the net with unpatched third party desktop software. According to a warning issued by Websense Security Labs, the malicious code was found on media-servers.net, whic...

CVE-2009-3903

Multiple cross-site scripting XSS vulnerabilities in jspui/index.jsp in ManageEngine Netflow Analyzer 7.5 build 7500 allow remote attackers to inject arbitrary web script or HTML via the 1 view and 2 section parameters. NOTE: the provenance of this information is unknown; the details are obtained...

CVE-2009-3905

Multiple cross-site scripting XSS vulnerabilities in e-Courier CMS allow remote attackers to inject arbitrary web script or HTML via the UserGUID parameter to 1 Wizardtracking.asp, 2 wizardoe2.asp, 3 your-register.asp, 4 main-whyregister.asp, and 5 your.asp in home/, and other unspecified vectors...

CVE-2009-3856

Cross-site scripting XSS vulnerability in the default URI in news/ in Twilight CMS before 4.1 allows remote attackers to inject arbitrary web script or HTML via the calendar parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-3463

Array index error in Adobe Shockwave Player before 11.5.2.602 allows remote attackers to execute arbitrary code via crafted Shockwave content on a web site. NOTE: some of these details are obtained from third party information...

Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : firefox-3.0, firefox-3.5, xulrunner-1.9, xulrunner-1.9.1 vulnerabilities (USN-853-1)

Alin Rad Pop discovered a heap-based buffer overflow in Firefox when it converted strings to floating point numbers. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoki...