|
|
Colapse all |
Post message
[Kurdish Security # 13] Savant2 Remote File Include Vulnerability [For Mambo, Joomla] 2006-07-21 botan linuxmail org [SECURITY] [DSA 1116-1] New gimp packages fix arbitrary code execution 2006-07-21 Moritz Muehlenhoff (jmm debian org) SolpotCrew Advisory #2 - Advanced Poll ver 2.02 (base_path) Remote File Inclusion 2006-07-21 chris_hasibuan yahoo com #############################SolpotCrew Community################################ # # Advanced Poll ver 2.02 (base_path) Remote File Inclusion # # Vendor site : http://www.proxy2.de/scripts.php # ######################################################################## ######### # # [ more ] [ reply ] [SECURITY] [DSA 1114-1] New hashcash packages fix arbitrary code execution 2006-07-21 joey infodrom org (Martin Schulze) [ MDKSA-2006:130 ] - Updated kdelibs packages fix konqueror crash vulnerability. 2006-07-21 security mandriva com Samba Internal Data Structures DOS Vulnerability Exploit 2006-07-20 Alexander Hristov (joffer gmail com) (1 replies) Name : Samba Internal Data Structures DOS Vulnerability Exploit Link : http://securitydot.net/xpl/exploits/vulnerabilities/articles/1175/exploi t.html Date : 2006-07-21 Vulnerability : http://securitydot.net/vuln/exploits/vulnerabilities/articles/18014/vuln .html PATCH : http://us4.samba.org/samba/ft [ more ] [ reply ] Re: Samba Internal Data Structures DOS Vulnerability Exploit 2006-07-21 Gerald (Jerry) Carter (jerry samba org) Unidomedia Chameleon LE/Pro Directory Traversal 2006-07-20 kicktd hotmail com Date of Advisory: ----------------- July 20th 2006 Product: -------- Chameleon LE <= 1.203 Chameleon Pro is suspected to be vulnerable but since I am cheap and not about to pay $99 for the pro version to check if a bug exists I CAN NOT confirm that the Pro version is vulnerable but can a [ more ] [ reply ] LoudBlog <=0.5 Sql injection 2006-07-20 rgod autistici org #!/usr/bin/php -q -d short_open_tag=on <? echo "LoudBlog <= 0.5 'id' SQL injection / admin credentials disclosure\r\n"; echo "by rgod rgod (at) autistici (dot) org [email concealed]\r\n"; echo "site: http://retrogod.altervista.org\r\n"; echo "a dork: \"Powered by LoudBlog\"\r\n\r\n"; /* works regardless of magic_quotes_g [ more ] [ reply ] [security bulletin] HPSBMA02133 SSRT061201 rev.1 - HP Oracle for OpenView (OfO) Critical Patch Update July 2006 2006-07-20 security-alert hp com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c00727143 Version: 1 HPSBMA02133 SSRT061201 rev.1 - HP Oracle for OpenView (OfO) Critical Patch Update July 2006 NOTICE: The information in this Security Bulletin should be acted upon as soon a [ more ] [ reply ] SECURITY UPDATE::Farsinews release FarsiNewsPro3.0Stable1SecurityPath1 2006-07-21 armin390 gmail com ###SECURITY UPDATE### According to http://www.securityfocus.com/bid/18925 about a security bug(local file inclusion) in FarsiNewsPro3.0 BETA1 and Stable1 versions,now farsinews team release new version of FarsiNewsPro3.0 means 'Stable1SecurityPath1'. For more information see: http://forum.farsi [ more ] [ reply ] [SECURITY] [DSA 1117-1] New libgd2 packages fix denial of service 2006-07-21 Moritz Muehlenhoff (jmm debian org) [USN-321-1] mysql-dfsg-4.1 vulnerability 2006-07-21 Martin Pitt (martin pitt canonical com) =========================================================== Ubuntu Security Notice USN-321-1 July 21, 2006 mysql-dfsg-4.1 vulnerability CVE-2006-3469 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 5.10 This [ more ] [ reply ] rPSA-2006-0134-1 sendmail sendmail-cf 2006-07-21 Justin M. Forbes (jmforbes rpath com) rPath Security Advisory: 2006-0134-1 Published: 2006-07-21 Products: rPath Linux 1 Rating: Major Exposure Level Classification: Remote Deterministic Denial of Service Updated Versions: sendmail=/conary.rpath.com@rpl:devel//1/8.13.7-0.1-1 sendmail-cf=/conary.rpath.com@rpl:devel//1/8.13.7- [ more ] [ reply ] [SECURITY] [DSA 1115-1] New GnuPG2 packages fix denial of service 2006-07-21 joey infodrom org (Martin Schulze) [security bulletin] HPSBUX02108 SSRT061133 rev.12 - HP-UX Running Sendmail, Remote Execution of Arbitrary Code 2006-07-20 security-alert hp com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c00629555 Version: 12 HPSBUX02108 SSRT061133 rev.12 - HP-UX Running Sendmail, Remote Execution of Arbitrary Code NOTICE: The information in this Security Bulletin should be acted upon as soon as [ more ] [ reply ] [ MDKSA-2006:129 ] - Updated freetype2 packages fixes overflow vulnerability. 2006-07-20 security mandriva com [MajorSecurity #21] phpFaber TopSites <=2.0.9 - SQL Injection Vulnerability 2006-07-20 admin majorsecurity de [MajorSecurity #20]SiteDepth CMS <= 3.01 - Remote File Include Vulnerability 2006-07-20 admin majorsecurity de Advisory: Remote command execution in planetGallery 2006-07-20 RedTeam Pentesting (release redteam-pentesting de) Advisory: Remote command execution in planetGallery An admin of planetGallery is allowed to create new galleries and upload images. Because of a vulnerable regular expression, he may also upload PHP scripts and thereby execute arbitrary commands with the privileges of PHP. Details ======= Produc [ more ] [ reply ] [ECHO_ADV_40$2006] iManage CMS <= 4.0.12 (absolute_path) Remote File Inclusion 2006-07-20 matdhule gmail com ECHO.OR.ID ECHO_ADV_40$2006 ------------------------------------------------------------------------ --------------------------- [ECHO_ADV_40$2006] iManage CMS <= 4.0.12 (absolute_path) Remote File Inclusion ------------------------------------------------------------------------ ----------------- [ more ] [ reply ] Cisco MARS < 4.2.1 remote compromise 2006-07-20 Jon Hart (jhart spoofed org) Cisco MARS (Monitoring, Analysis and Response System, sometimes referred to as CS-MARS) prior to version 4.2.1 ships with an unprotected JBoss installation which ultimately leads to a complete compromise of the device. The caveat here is that, despite much work on Cisco's part, they were not able t [ more ] [ reply ] rPSA-2006-0133-1 libpng 2006-07-19 Justin M. Forbes (jmforbes rpath com) rPath Security Advisory: 2006-0133-1 Published: 2006-07-19 Products: rPath Linux 1 Rating: Major Exposure Level Classification: User Non-deterministic Unauthorized Access Updated Versions: libpng=/conary.rpath.com@rpl:devel//1/1.2.12-2-0.1 References: http://www.cve.mitre.org/cgi-bin/cv [ more ] [ reply ] Security point-of-contact for Ameritrade? 2006-07-19 James M. Blackburn (BlackburnJ brcc edu) Good day. Does anyone happen to know of a security-specific contact point-of-contact for Ameritrade? I have an infosec concern I'd like to raise with someone there, but I'd like to try to avoid the front-end call center gauntlet. Unfortunately, whois, abuse.net, this list's archives, and a Google [ more ] [ reply ] |
|
Privacy Statement |
>The mentioned SQL injection vulnerability is not possible. Please
>remove it.
Could you explain this further?
In 1.5.3, edit_forum() in forums.inc.php has the following:
$sql = "UPDATE ".TABLE_PREFIX."forums SET title='$_POST[title]', description='$_POST[body]' WHERE forum_id=$_POST[fid]";
$r
[ more ] [ reply ]