|
|
Colapse all |
Post message
[ GLSA 200607-02 ] FreeType: Multiple integer overflows 2006-07-09 Sune Kloppenborg Jeppesen (jaervosz gentoo org) RW::Download stats.php Remote File Inc. 2006-07-08 StorMBoY BsdMaiL Org Title : RW::Download stats.php Remote File Inc. - Site : http://www.Cyber-Warrior.org - Author : StorMBoY - Mail : StorMBoY (at) BsdMail (dot) Org [email concealed] - exploit : http://target/path/stats.php?root_path=code] - Inc. Code : include_once $ROOT_PATH."functions/global_functions. [ more ] [ reply ] ATutor 1.5.3 Cross Site Scripting 2006-07-08 securityconnection gmail com ATutor 1.5.3 http://www.atutor.ca -------------------------- Cross Site Scripting (XSS) -------------------------- http://target.xx/documentation/index_list.php?lang="><script>alert(/Elli psisSecurityTest/)</script> --- POST http://target.xx:80/registration.php?register=Register HTTP/1.0 Acce [ more ] [ reply ] [KAPDA::#46] - AjaxPortal Authentication Bypass 2006-07-08 alireza hassani (trueend5 yahoo com) KAPDA New advisory Vendor: http://myiosoft.com Vulnerable: AjaxPortal v. 3.0 Bug: Sql Injection (Authentication Bypass) Exploitation: Remote with browser Description: -------------------- AjaxPortal is based on Sajax technology - an open source tool to make programming websites using the Ajax fr [ more ] [ reply ] PAPOO <=3RC3 sql injection / admin credentials disclosure 2006-07-07 rgod autistici org #!/usr/bin/php -q -d short_open_tag=on <? echo "PAPOO <= 3_RC3 SQL injection / admin credentials disclosure\n"; echo "by rgod rgod (at) autistici (dot) org [email concealed]\n"; echo "site: http://retrogod.altervista.org\n"; echo "dork: \"Help * Contact * Imprint * Sitemap\" | \"powered by papoo\" | \"powered by cms papoo\ [ more ] [ reply ] [ MDKSA-2006:118 ] - Updated OpenOffice.org packages fix various vulnerabilities 2006-07-07 security mandriva com ZDI-06-021: WebEx Downloader Plug-in Code Execution Vulnerability 2006-07-07 zdi-disclosures 3com com ZDI-06-021: WebEx Downloader Plug-in Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-06-021.html July 6, 2006 -- CVE ID: CVE-2006-3423 -- Affected Vendor: WebEx Communications -- Affected Products: WebEx Downloader Plug-in (tested on v2.0.0.7) -- TippingPoint(TM) IP [ more ] [ reply ] Pivot <=1.30rc2 privilege escalation / remote commands execution 2006-07-07 rgod autistici org #!/usr/bin/php -q -d short_open_tag=on <? echo "Pivot <= 1.30 RC2 privileges escalation / remote commands execution exploit\n"; echo "by rgod rgod (at) autistici (dot) org [email concealed]\n"; echo "site: http://retrogod.altervista.org\n"; echo "dorks: \"Powered byPivot\"\n"; echo "version specific: \"Powered byPivot - 1 [ more ] [ reply ] lintah_|adv|_01@2006>=========<[Aura-CMS v1.62]<===>[XSS vulnerable]&[bug] 2006-07-06 k07iX (apem-zigzag telkom net) by : iFX a.k.a inversFX _______________________________ [ apem-zigzag (at) telkom (dot) net [email concealed] ] [ inversfx (at) yahoo (dot) com [email concealed] ] ------------------------------- locate : Indonesia, Jakarta -------------------------------- date : 29/06/2006 -------------------------------- title : XSS on `CMS Aura v1.62` ----------- [ more ] [ reply ] IBM AIX Security contact? 2006-07-06 Joxean Koret (joxeankoret yahoo es) Hi to all! Anyone knowns what is the f*ng security contact for IBM AIX? -- Zer gutxi balio duen langileen bizitza -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQBErYYsU6rFMEYDrlERAksfAJ9KWtwb8IhLfZqrfoDq6bikSw7SywCff1t+ 55qKXV//QgDtkukYWevx2LA= =cqqG -----END PGP SIGNATUR [ more ] [ reply ] PBL Guestbook <= 1.32 XSS & SQL Querys Vulnerabilities 2006-07-07 paisterist nst gmail com /* -------------------------------------------------------- [N]eo [S]ecurity [T]eam [NST]? - Advisory #23 - 07/07/06 -------------------------------------------------------- Program: PBL Guestbook Homepage: www.pixelatedbylev.com Vulnerable Versions: 1.32 and lower. Risk: High! Impact: Criti [ more ] [ reply ] [ MDKSA-2006:117 ] - Updated libmms packages fix buffer overflow vulnerability 2006-07-07 security mandriva com rPSA-2006-0122-1 kernel 2006-07-07 Justin M. Forbes (jmforbes rpath com) rPath Security Advisory: 2006-0122-1 Published: 2006-07-07 Products: rPath Linux 1 Rating: Major Exposure Level Classification: Local Deterministic Denial of Service Updated Versions: kernel=/conary.rpath.com@rpl:devel//1/2.6.16.24-0.1-1 References: http://www.cve.mitre.org/cgi-bin/cven [ more ] [ reply ] HostingController: An attacker can gain reseller privileges and after that can gain admin privileges 2006-07-07 Irsdl yahoo com Hi, I'm Soroush Dalili from GrayHatz Security Group (GSG). I publish the most important bugs of hosting controller program, after 3 weeks from reporting to the main company (for more security) Title: An attacker can gain reseller privileges and after that can gain admin privileges Version: 6.1 H [ more ] [ reply ] [ECHO_ADV_36$2006] ExtCalendar <== v2.0 Remote File Include Vulnerabilities 2006-07-07 matdhule gmail com ECHO.OR.ID ECHO_ADV_36$2006 ------------------------------------------------------------------------ --- [ECHO_ADV_36$2006] ExtCalendar <== v2.0 Remote File Include Vulnerabilities ------------------------------------------------------------------------ --- Author : Ahmad Maulana a.k [ more ] [ reply ] ATutor : Cross-Site Scripting Vulnerabilities 2006-07-07 bug (at) securitynews (dot) ir [email concealed] (bug securitynews ir) ----------------------------------------------------------------- [#] Security Advisory #4 [^] http://securitynews.ir/ [>] Advisory Title: ATutor : Cross-Site Scripting Vulnerabilities [@] Author : bug [@] securitynews.ir [$] Product Vendor : http://www.atutor.ca/ [.] Affected Versions : 1.5.3 RC2 [ more ] [ reply ] WebEx Downloader Plug-in Multiple Vulnerabilities + rant 2006-07-07 Mark Litchfield (mark ngssoftware com) All these vulnerabilities were reported to WebEx by NGS Software back on the 24th February 2005 along with some other issues. The current Director of the X-Force new about these issues as at the time of their discovery, he worked with NGS. Seeing as I'm the subject, here is another example where [ more ] [ reply ] PHP-Blogger Multiple Cross Site Scripting Vulnerabilities 2006-07-07 OS2A BTO (os2a bto gmail com) Multiple Cross Site Scripting Vulnerabilities exist in PHP-Blogger, a free photoblog script designed for posting news & slideshows. http://www.phpblogger.com Attached is the advisory which details the vulnerability. Thanks, OS2A PHP-Blogger Multiple Cross Site Scripting Vulnerabilities OS2A ID: [ more ] [ reply ] Mico crashes when contected with wrong IOR / DoS 2006-07-06 tuergeist (tuergeist googlemail com) == == == TOC == == == 1. Affected Vendor 2. Affected Product 3. Vulnerability 4. Safety Hazard 5. Disclosure Timeline 6. Vendor Response 7. Patch / Workaround 8. Vulnerability Details --------------------- == 1. Affected Vendor == Object Security == 2. Affected Products == MICO - Mico is [ more ] [ reply ] Various heap and stack overflow bugs in AdPlug library 2.0 (CVS 04 Jul 2006) 2006-07-06 Luigi Auriemma (aluigi autistici org) McAfee VirusScan Enterprise 8.0.0 Buffer Overflow 2006-07-07 johndoe1529 yahoo com A local Buffer Overflow was discovered in McAfee VirusScan Enterprise 8.0.0. The overflow can be triggered within the "Buffer OverFlow Protection Properties" by creating a buffer overflow exclusion. Then fill each field with data, and click ok, and apply Process name: AAAAAAAAAAAAAAAAA......etc [ more ] [ reply ] Major updates to Excel 0-day Vulnerability FAQ at SecuriTeam Blogs 2006-07-07 Juha-Matti Laurio (juha-matti laurio netti fi) Several updates to First Microsoft Excel 0-day Vulnerability FAQ document at http://blogs.securiteam.com/?p=451 has been done. * Several exploits for this vuln and other Excel issues has been released recently * PoC sample file Nanika.xls was posted to Bugtraq on Monday already http://www.security [ more ] [ reply ] Re: IBM AIX Security contact? 2006-07-06 Troy Bollinger (troy austin ibm com) Quoting Joxean Koret (joxeankoret (at) yahoo (dot) es [email concealed]): > Anyone knowns what is the security contact for IBM AIX? > security-alert (at) austin.ibm (dot) com [email concealed] You can use the following PGP key as well: pub 1024D/1B14F299 2006-04-24 [expires: 2007-04-24] Key fingerprint = ED29 18DB E87C 770D 49DC 07AF A1F3 7F2 [ more ] [ reply ] [SECURITY] [DSA 1105-1] New xine-lib packages fix denial of service 2006-07-07 joey infodrom org (Martin Schulze) Re: vBulletin 3.5.4 (install_path) Exploit 2006-07-06 scott vbulletin com The default vBulletin requires authentication prior to the usage of the upgrade system and the backup feature. I suspect you had a pirated copy with this feature removed, this isn't something we can control and you are already taking a risk by using a version from an untrusted source. [ more ] [ reply ] |
|
Privacy Statement |
Gentoo Linux Security Advisory GLSA 200607-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - -
[ more ] [ reply ]