DreamPoll 3.1 SQL Injection / XSS

During a recent security audit of the DreamPoll 3.1 software by Dreamlevels, I discovered a number of XSS and SQL Injection vulnerabilities in the application. These vulnerabilities could be exploited to make unauthorized changes to a web site or compromise a client accessing a site that utilizes...

DreamPoll 3.1 Vulnerabilities

No description provided by source. During a recent security audit of the DreamPoll 3.1 software by Dreamlevels, I discovered a number of XSS and SQL Injection vulnerabilities in the application. These vulnerabilities could be exploited to make unauthorized changes to a web site or compromise a...

Gentoo Security Advisory GLSA 200501-22 (poppassd_pam)

The remote host is missing updates announced in advisory GLSA 200501-22. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Design/Logic Flaw

The editprofile3 function in cgi-bin/cgi-lib/user.pl in web-app.org WebAPP before 0.9.9.7 does not properly check the 1 themes.dat, 2 languages.dat, 3 profession.dat, 4 gen.dat, 5 marstat.dat, 6 states.dat, and 7 ages.dat files before saving profile settings of members, which has unknown impact a...

CVE-2007-0697

index2.php in ACGVannu 1.3 and earlier allows remote attackers to change the password or profile of a user via a modified id parameter, related to templates/modif.html. NOTE: some of these details are obtained from third party information...

Code injection

JAMWiki before 0.5.0 does not properly check permissions during moves of "read-only or admin-only topics," which allows remote attackers to make unauthorized changes to the wiki...

CVE-2007-0131

JAMWiki is affected by CVE-2007-0131. The issue is that JAMWiki before 0.5.0 does not properly enforce permissions during moves of topics that are read-only or admin-only, allowing remote attackers to make unauthorized changes to the wiki. The vulnerability is rooted in insufficient permission ch...

CVE-2007-0131

JAMWiki before 0.5.0 does not properly check permissions during moves of "read-only or admin-only topics," which allows remote attackers to make unauthorized changes to the wiki...

CVE-2007-0131: Undefined Security Weakness

JAMWiki before 0.5.0 does not properly check permissions during moves of "read-only or admin-only topics," which allows remote attackers to make unauthorized changes to the wiki...

Fuji Xerox Printing Systems (FXPS) Print Engine Crafted Request HTTP Authentication Bypass

The remote host appears to be a Fuji Xerox Printing Systems FXPS printer. According to its firmware version, the web server component of the FXPS device reportedly fails to authenticate HTTP requests, which could allow a remote attacker to gain administrative control of the affected printer and...

InterScan VirusWall Remote Configuration Vulnerability

The management interface used with the Interscan VirusWall uses several cgi programs that may allow a malicious user to remotely change the configuration of the server without any authorization using maliciously constructed querystrings. OpenVAS Vulnerability Test $Id: interscanvwcgi.nasl 6063...

PHProjekt: setup.php vulnerability

Background PHProjekt is a modular groupware web application used to coordinate group activities and share files. Description Martin Muench, from it.sec, found a flaw in the setup.php file. Impact Successful exploitation of the flaw allows a remote attacker without admin rights to make unauthorize...

[BUGZILLA] Vulnerabilities in Bugzilla 2.16.6 and 2.18rc2

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bugzilla Security Advisory October 24, 2004 Summary ======= Bugzilla is a Web-based bug-tracking system, used by a large number of software projects. This advisory covers three security bugs that have recently been discovered and fixed in the Bugzilla...

Important: Red Hat Security Advisory: kernel security update

Updated Itanium kernel packages that fix a number of security issues are now available. The Linux kernel handles the basic functions of the operating system. This kernel updates several important drivers and fixes a number of bugs including potential security vulnerabilities. Paul Starzetz...

Fedora Core 1 : kernel-2.4.22-1.2197.nptl (2004-206)

During an audit of the Linux kernel, SUSE discovered a flaw that allowed a user to make unauthorized changes to the group ID of files in certain circumstances. In the 2.4 kernel, as shipped with Fedora Core 1, the only way this could happen is through the kernel nfs server. A user on a system tha...

RHEL 3 : kernel (RHSA-2004:360)

Updated kernel packages that fix a security vulnerability affecting the kernel nfs server for Red Hat Enterprise Linux 3 are now available. The Linux kernel handles the basic functions of the operating system. During an audit of the Linux kernel, SUSE discovered a flaw that allowed a user to make...

RHEL 2.1 : kernel (RHSA-2004:354)

Updated kernel packages that fix a security vulnerability affecting the kernel nfs server for Red Hat Enterprise Linux 2.1 are now available. The Linux kernel handles the basic functions of the operating system. During an audit of the Linux kernel, SUSE discovered a flaw that allowed a user to ma...

Moderate: Red Hat Security Advisory: kernel security update

Updated kernel packages that fix a security vulnerability affecting the kernel nfs server for Red Hat Enterprise Linux 2.1 are now available. The Linux kernel handles the basic functions of the operating system. During an audit of the Linux kernel, SUSE discovered a flaw that allowed a user to ma...

Moderate: Red Hat Security Advisory: kernel security update

Updated kernel packages that fix a security vulnerability affecting the kernel nfs server for Red Hat Enterprise Linux 3 are now available. The Linux kernel handles the basic functions of the operating system. During an audit of the Linux kernel, SUSE discovered a flaw that allowed a user to make...

adv_microsoft_word_protection.txt

Guardeonic Solutions AG Thorsten Delbrouck http://www.guardeonic.com/ Security Advisory 01-2004 Advisory Name: Microsoft Word Form Protection Bypass Release Date: 2004-01-02 Affected Product: Microsoft Word Platform: Microsoft Windows, probably Apple Mac OS Version: tested on 2000, 2002 XP, 2003,...