Advanced Poll does not adequately authenticate users

Overview Advanced Poll is a polling system written in PHP for use on web sites. When a flat file database is used, Advanced Poll does not adequately authenticate users, thereby allowing any user to gain Advanced Poll administrative privileges. Description On versions of Advanced Poll older than...

[SECURITY] [DSA-094-1] mailman cross-site scripting problem

Package : mailman Problem type : cross-site scripting hole Debian-specific: no Barry A. Warsaw reported several cross-site scripting security holes in Mailman, due to non-existent escaping of CGI variables. These have been fixed upstream in version 2.0.8, and the relevant patches have been...

Interactive Story story.pl next Parameter Traversal Arbitrary File Access

By requesting : GET /cgi-bin/story.pl?next=../../../filetoread%00 An attacker may use this flaw to read arbitrary files on this server. %NASLMINLEVEL 70300 This script was written by Georges Dagousset See the Nessus Scripts License for details Changes by Tenable: - Revised plugin title 1/13/2009 ...

[SECURITY] [DSA 084-1] New gftp packages won't display the password

-------------------------------------------------------------------------- Debian Security Advisory DSA 084-1 [email protected] http://www.debian.org/security/ Martin Schulze October 18th, 2001 - -------------------------------------------------------------------------- Package : gftp...

[SECURITY] [DSA-061-1] multiple gnupg problems

Package : gnupg Problem type : printf format attack web of trust pollution Debian-specific: no The version of GnuPG GNU Privacy Guard, an OpenPGP implementation as distributed in Debian GNU/Linux 2.2 suffers from two problems: fish stiqz reported on bugtraq that there was a printf format problem ...

More Icecast remote vulnerabilities

Following the announcement yesterday about buffer overflow vulnerabilities in Icecast, Andreas Hasenack [email protected] identified several more likely buffer overflow vulnerabilities. Matt Messier [email protected] took a look, and determined that at least some of them are definitely...

Sudo version 1.6.3p6 now available

Sudo version 1.6.3p6 is now available ftp sites listed at the end. This fixes a buffer overflow in sudo which is a potential security problem. I don't know of any exploits that currently exist but I suggest that you upgrade none the less. Sudo has a good track record wrt secure coding, but this o...

Vulnerability in Soft Lite ServerWorx

----- Begin Hush Signed Message from [email protected] ----- Vulnerability in Soft Lite ServerWorx Overview Soft Lite ServerWorx v3.00 is a web server available from http://www.zdnet.com and http://www.softlite.net. A vulnerability exists which allows a remote user to break out of the web roo...

Security Advisory: Subscribe Me Lite 1.0 - 2.0 Unix or 1.0 - 2.0 NT and below.

note : This is not apparent in the commercial versions, tested on three different versions the author was notified and appropriate changes have since been made. product page - http://www.cgiscriptcenter.com/subscribe/index2.html vendor notice - Security Advisory: Users of Subscribe Me Lite 1.0 -...

[SECURITY] [DSA-002-1] fsh symlink attack

-----BEGIN PGP SIGNED MESSAGE----- - ------------------------------------------------------------------------ Debian Security Advisory DSA-002-1 [email protected] http://www.debian.org/security/ Wichert Akkerman November 30, 2000 -...

[SECURITY] New version of ghostscript released

------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman November 23, 2000 - ------------------------------------------------------------------------ Package : gs Problem type : symlink...

[SECURITY] New version of joe released

------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman November 22, 2000 - ------------------------------------------------------------------------ Package : joe Problem type : symlink...

[SECURITY] New version of curl fixes buffer overflow

------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman October 13, 2000 - ------------------------------------------------------------------------ Package : curl and curl-ssl Problem...

Linux news 19.09.00

Linux 2.2.18pre9 Alan Cox выпустил новую pre-версию следующего стабильного ядра Linux: 2.2.18pre9. В этой версии была поправлена поддержка NFS и была добавлена поддержка NFSv3, перенесены некоторые USB драйвера из Linux 2.4 и др. Подробнее:...

[SECURITY] New version of userv released

-----BEGIN PGP SIGNED MESSAGE----- - ------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman July 27, 2000 - ------------------------------------------------------------------------...

BluePanda Vulnerability Announcement: WFTPD/WFTPD Pro 2.41 RC11

================================================================ BluePanda Vulnerability Announcement: WFTPD/WFTPD Pro 2.41 RC11 21/07/2000 dd/mm/yyyy [email protected] http://bluepanda.box.sk/ ================================================================ Problem: STAT command devulges...

Linux news 23.05.00

Linux 2.2.16pre4 Alan Cox выпустил новую pre-версию следующего стабильного ядра Linux: 2.2.16pre4. Подробнее: http://www.lwn.net/daily/2.2.16pre4.html Kernel Traffic 68 Вышел очередной Kernel Traffic за номером 68. Подробнее: http://linuxtoday.com/newsstory.php3?ltsn=2000-05-22-003-04-OS-KN GNU...

Linux news 16.05.00

Open Source Motif Open Group открыла исходники Motif. Motif - это набор для создания и обслуживания кнопочек, полос прокрутки и так далее. В общем, как Qt, только Motif. Netscape для Linux использует именно его. Подробнее: http://www.opengroup.org/openmotif/ Bluefish 0.4 Появилось сообщение о том...

Linux news 11.05.00

nmap 2.53 Вышла новая версия утилиты, предназначенной для сканирования сетей и отдельных хостов - nmap. Подробнее: http://www.appwatch.com/Linux/Library/81/view.html Red Hat создала инвестиционное подразделение для финансирования молодых компаний Компания Red Hat объявила о создании нового...

FreeBSD-SA-00:08.lynx

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:08 Security Advisory FreeBSD, Inc. Topic: Lynx ports contain numerous buffer overflows Category: ports Module: lynx/lynx-current/lynx-ssl/ja-lynx/ja-lynx-current...