Sympa New List Creation Description Field XSS

According to its version number, the installation of Sympa on the remote host contains an HTML injection vulnerability that may allow a user who has the privileges to create a new list to inject HTML tags in the list description field. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. based on...

Cfengine cfservd ReceiveTransaction Function Remote Overflow (version check)

Cfengine is running on this remote host. This version has a stack-based buffer overrun vulnerability. An attacker, exploiting this flaw, would need network access to the server as well as the ability to send a crafted transaction packet to the cfservd process. Successful exploitation of this flaw...

CVSTrac Ticket Title Arbitrary Command Execution

The remote host seems to be running cvstrac, a web-based bug and patch-set tracking system for CVS. This version contains a flaw related to ticket titles containing a semi-colon ';' that may allow an attacker to execute arbitrary commands on the system. Nessus has determined the vulnerability...

phpGroupWare Multiple Module SQL Injection

The remote host seems to be running PhpGroupWare, a multi-user groupware suite written in PHP. It has been reported that this version may be prone to multiple SQL injection vulnerabilities in the 'calendar' and 'infolog' modules. The problems exist due to insufficient sanitization of user-supplie...

CVSTrac Database Plaintext Password Storage

The remote host seems to be running cvstrac, a web-based bug and patch-set tracking system for CVS. This version contains a flaw related to .db files that may allow an attacker to gain access to plaintext passwords. Nessus has determined the vulnerability exists on the target simply by looking at...

CVSTrac timeline.c timeline_page Function Overflow

The remote host seems to be running cvstrac, a web-based bug and patch-set tracking system for CVS. This version contains a flaw related to the timelinepage function in timeline.c that may allow an attacker to cause a buffer overflow. An attacker, exploiting this flaw, would be potentially able t...

Sympa wwsympa.fcgi Unauthorised List Creation

According to its version number, the installation of Sympa on the remote host has an authentication flaw within the web interface. An attacker, exploiting this flaw, would be able to bypass security mechanisms and perform listmaster functions. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Opera < 7.50 onUnload Address Bar Spoofing

The remote host is using Opera - an alternative web browser. This version of Opera is vulnerable to a security weakness that may permit malicious web pages to spoof address bar information. This is reportedly possible through malicious use of the JavaScript 'unOnload' event handler when the brows...

Mandrake Linux Security Advisory : libsafe (MDKSA-2002:026)

Wojciech Purczynski discovered that format string protection in libsafe can be easily bypassed by using flag characters that are implemented in glibc but are not implemented in libsafe. It was also discovered that printf function wrappers incorrectly parse argument indexing in format strings,...

Mandrake Linux Security Advisory : mtools (MDKSA-2004:016)

Sebastian Krahmer found that the mformat program, when installed suid root, can create any file with 0666 permissions as root, and that it also does not drop privileges when reading local configuration files. The updated packages remove the suid bit from mformat. %NASLMINLEVEL 70300 C Tenable...

Mandrake Linux Security Advisory : expect (MDKSA-2001:087)

A packaging problem that can lead to a root compromise existed in the expect package as provided in Mandrake Linux 8.1. expect would look for libraries in the directory /home/snailtalk/tmp/tcltk-root/usr/lib before any other and if such a user existed on the system, with rogue libraries, if root...

Mandrake Linux Security Advisory : postfix (MDKSA-2001:089)

Wietse Venema, the author of postfix, reported a vulnerability in the SMTP server where a remote attacker could execute a Denial of Service attack on it. The SMTP session log could grow to an unreasonable size and could possibly exhause the server's memory if no other limits were enforced...

Mandrake Linux Security Advisory : irssi (MDKSA-2003:117)

A vulnerability in versions of irssi prior to 0.8.9 would allow a remote user to crash another user's irssi client provided that the client was on a non-x86 architecture or if the 'gui print text' signal is being used by some script or plugin. The updated packages provide 0.8.9 which corrects the...

Mandrake Linux Security Advisory : openssl (MDKSA-2001:065)

The pseudo-random number generator in OpenSSL versions up to 0.9.6a has a design flaw. By knowing the output of specific PRNG requests, an attacker would be able to determine the PRNG's internal state and thus predict future PRNG output. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandrake Linux Security Advisory : jmcce (MDKSA-2002:008)

A problem exists in the jmcce program that is used for Chinese text on the console. jmcce is installed setuid root and places log files in /tmp; because jmcce does not perform suitable checking on the files it writes to and because it uses a predictable logfile name, an attacker could exploit thi...

Mandrake Linux Security Advisory : gftp (MDKSA-2001:044)

A format string vulnerability exists in all versions of gftp prior to version 2.0.8. This vulnerability has been fixed upstream in version 2.0.8. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security...

Mandrake Linux Security Advisory : rsync (MDKSA-2003:111)

A vulnerability was discovered in all versions of rsync prior to 2.5.7 that was recently used in conjunction with the Linux kernel dobrk vulnerability to compromise a public rsync server. This heap overflow vulnerability, by itself, cannot yield root access, however it does allow arbitrary code...

Mandrake Linux Security Advisory : groff (MDKSA-2002:012)

zen-parse discovered an exploitable buffer overflow in groff's preprocessor. If groff is invoked using the LPRng printing system, an attacker can gain rights as the 'lp' user. Likewise, this may be remotely exploitable if lpd is running and remotely accessible and the attacker knows the name of t...

Mandrake Linux Security Advisory : sharutils (MDKSA-2002:052)

The uudecode utility creates output files without checking to see if it is about to write to a symlink or pipe. This could be exploited by a local attacker to overwrite files or lead to privilege escalation if users decode data into share directories, such as /tmp. This update fixes this...

Mandrake Linux Security Advisory : gv (MDKSA-2002:069)

A buffer overflow was discovered in gv versions 3.5.8 and earlier by Zen Parse. The problem is triggered by scanning a file and can be exploited by an attacker sending a malformed PostScript or PDF file. This would result in arbitrary code being executed with the privilege of the user viewing the...