TikiWiki File Upload temp Directory Arbitrary Script Execution

The remote host is running TikiWiki, a content management system written in PHP. The remote version of this software is vulnerable to a flaw in the way TikiWiki handles uploaded files. If an attacker is able to upload a file, they can then call the script remotely via a request to the...

Konversation: Various vulnerabilities

Background Konversation is a user-friendly IRC client for KDE. Description Wouter Coekaerts has discovered three vulnerabilities within Konversation: The Server::parseWildcards function, which is used by the "Quick Buttons", does not properly handle variable expansion CAN-2005-0129. Perl scripts...

MySQL: Insecure temporary file creation

Background MySQL is a fast, multi-threaded, multi-user SQL database server. Description Javier Fernandez-Sanguino Pena from the Debian Security Audit Project discovered that the 'mysqlaccess' script creates temporary files in world-writeable directories with predictable names. Impact A local...

CUPS: Stack overflow in included Xpdf code

Background The Common UNIX Printing System CUPS is a cross-platform print spooler. It makes use of Xpdf code to handle PDF files. Description The Decrypt::makeFileKey2 function in Xpdf's Decrypt.cc insufficiently checks boundaries when processing /Encrypt /Length tags in PDF files GLSA 200501-28...

ImageMagick: PSD decoding heap overflow

Background ImageMagick is a collection of tools to read, write and manipulate images in many formats. Description Andrei Nigmatulin discovered that a Photoshop Document PSD file with more than 24 layers could trigger a heap overflow. Impact An attacker could potentially design a mailicous PSD ima...

Winamp < 5.0.5 Skin File (.WSZ) Local Zone Arbitrary Code Execution

The remote host is using Winamp, a popular media player which handles many files format mp3, wavs and more... The remote version of this software is vulnerable to a code execution flaw when processing a malformed .WSZ Winamp Skin file. An attacker may exploit this flaw by sending a malformed .wsz...

Bugzilla Internal Error Response XSS

The remote host runs Bugzilla, a web-based bug tracking system. The remote Bugzilla installation, according to its version number, is vulnerable to a cross-site scripting attack when rendering internal errors containing user-supplied input. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

tnftp: Arbitrary file overwriting

Background tnftp is a NetBSD FTP client with several advanced features. Description The 'mget' function in cmds.c lacks validation of the filenames that are supplied by the server. Impact An attacker running an FTP server could supply clients with malicious filenames, potentially allowing the...

Horde < 3.0.1 Multiple Script XSS

The remote host is running at least one instance of Horde version 3.0, which suffers from two cross-site scripting vulnerabilities. Through specially crafted GET requests to the remote host, an attacker can cause a third-party user to unknowingly run arbitrary JavaScript code. %NASLMINLEVEL 70300...

Winamp < 5.0.8c Multiple Unspecified Vulnerabilities

The version of Winamp installed on the remote host has various unspecified vulnerabilities that may allow an attacker to execute arbitrary code on the remote host. An attacker may exploit these flaws by sending malformed files to a victim on the remote host. %NASLMINLEVEL 70300 C Tenable Network...

Exim: Two buffer overflows

Background Exim is an highly configurable message transfer agent MTA developed at the University of Cambridge. Description Buffer overflows have been found in the hostaton function CAN-2005-0021 as well as in the spabase64tobits function CAN-2005-0022, which is part of the SPA authentication code...

GNU Mailman Multiple Unspecified Remote Vulnerabilities

The remote host is running GNU Mailman, a web-based application for managing mailing lists. The version running on the remote host has multiple flaws, such as information disclosure and cross-site scripting. These vulnerabilities could allow a remote attacker to gain unauthorized access...

KDE FTP KIOslave: Command injection

Background KDE is a feature-rich graphical desktop environment for Linux and Unix-like Operating Systems. KDE provided KIOslaves for many protocols in the kdelibs package, one of them being FTP. These are used by KDE applications such as Konqueror. Description The FTP KIOslave fails to properly...

mpg123: Buffer overflow

Background mpg123 is a real-time MPEG audio player. Description mpg123 improperly parses frame headers in input streams. Impact By inducing a user to play a malicious file, an attacker may be able to exploit a buffer overflow to execute arbitrary code with the permissions of the user running...

UnRTF: Buffer overflow

Background UnRTF is a utility to convert files in the Rich Text Format into other formats. Description An unchecked strcat in unrtf may overflow the bounds of a static buffer. Impact Using a specially crafted file, possibly delivered by e-mail or over the web, an attacker may execute arbitrary co...

Exim < 4.44 Multiple Overflows

The remote host is running Exim, a message transfer agent SMTP. It is reported that Exim is prone to an IPv6 Address and an SPA authentication buffer overflow. An attacker, exploiting this issue, may be able to execute arbitrary code on the remote host. Exim must be configured with SPA...

Vilistextum: Buffer overflow vulnerability

Background Vilistextum is an HTML to text converter. Description Ariel Berkman discovered that Vilistextum unsafely reads data into an array without checking the length. This code vulnerability may lead to a buffer overflow. Impact A remote attacker could craft a malicious webpage which, when...

mit-krb5: Heap overflow in libkadm5srv

Background MIT krb5 is the free implementation of the Kerberos network authentication protocol by the Massachusetts Institute of Technology. Description The MIT Kerberos 5 administration library libkadm5srv contains a heap overflow in the code handling password changing. Impact Under specific...

Shoutcast Server: Remote code execution

Background Shoutcast Server is Nullsoft's streaming audio server. It runs on a variety of platforms, including Linux, and is extremely popular with Internet broadcasters. Description Part of the Shoutcast Server Linux binary has been found to improperly handle sprintf parsing. Impact A malicious...

WPkontakt.txt

Product: WPKontakt , Jaroslaw Sajko Advisory: http://www.man.poznan.pl/security/wpkontakt.html ISSUE WPkontakt is the another Polish instant messenger. The problem is similiar to the problems revealed in GG or Tlen.pl - parsing error leading to the remote script execution. DETAILS Parsing error...