|
|
Colapse all |
Post message
[ISecAuditors Advisories] IMAP/SMTP Injection in SquirrelMail 2006-02-27 ISecAuditors Security Advisories (advisories isecauditors com) ============================================= INTERNET SECURITY AUDITORS ALERT 2006-002 - Original release date: February 27, 2006 - Last revised: February 27, 2006 - Discovered by: Vicente Aguilera Diaz - Severity: 3/5 ============================================= I. VULNERABILITY ----------------- [ more ] [ reply ] Secunia Research: ArGoSoft Mail Server Pro viewheaders ScriptInsertion 2006-02-27 Secunia Research (remove-vuln secunia com) Re: [eVuln] Vanilla Guestbook Multiple XSS & SQL Injection Vulnerabilities 2006-02-27 tachyon tachyondecay net I don't really recall receiving any sort of notification about this. . . . But anyway, I am indeed aware of XSS vulnerabilities in the software. My time has been devoted to overhauling my blog software, however. I hope to seriously rewrite the guestbook script as soon as possible. It _is_ a beta [ more ] [ reply ] CGI Calendar XSS Vulnerability 2006-02-26 revnic gmail com CGI Calendar XSS Vulnerability Software: CGI Calendar Version: 2.7 http://cgicalendar.sourceforge.net/ Description: an online calendar implemented using CGI technology Vulnerability: Cross-Site Scripting Exploit: /cgi-bin/calendar2/index.cgi?lang=en-us&mode=all&month=2&date=1&year=<sc ript>alert [ more ] [ reply ] 2 SQL Injection in d3jeeb 2006-02-26 S3ude Hotmail com Software: D3Jeeb Web Site: http://www.tl4s.com Versions: tested on D3Jeeb Pro 3 Type: SQL Injection Class: Remote Vulnerable script: fastlinks.php catogary.php Exploit : 1- http://www.target.com/fastlinks.php?catid=[SQL] 2- http://www.target.com/catogary.php?catid=[SQL] Discovered by: SAUDI [ more ] [ reply ] 2 SQL Injection in Fantastic News 2006-02-26 S3ude Hotmail com Software: Fantastic News Web Site: http://www.fscripts.com Versions: 2.1.1 Type: 2 SQL Injection Class: Remote Exploit : 1- http://www.target.com/news.php?action=news&category=|sql 2- http://www.target.com/news.php?page=|sql Discovered by: SAUDI L-G-H Team http://www.lezr.com Regards /// [ more ] [ reply ] phpRPC Library Remote Code Execution 2006-02-26 GulfTech Security Research (security gulftech org) ########################################################## # GulfTech Security Research February 26, 2006 ########################################################## # Vendor : Robert Hoffman # URL : http://sourceforge.net/projects/phprpc/ # Version : phpRPC <= 0.7 # Risk : Remote Code Exe [ more ] [ reply ] [SECURITY] [DSA 982-1] New gpdf packages fix several vulnerabilities 2006-02-27 joey infodrom org (Martin Schulze) [eVuln] Quirex Arbitrary File Disclosure Vulnerability 2006-02-26 alex evuln com New eVuln Advisory: Quirex Arbitrary File Disclosure Vulnerability http://evuln.com/vulns/78/summary.html --------------------Summary---------------- eVuln ID: EV0078 CVE: CVE-2006-0795 Software: Quirex Sowtware's Web Site: http://www.teca-scripts.com/ Versions: 2.0.2 2.0 and earlier Critical Level [ more ] [ reply ] NETGEAR WGT624 ? Wireless DSL router default user name/password vulnerability 2006-02-26 info teamintell com Thomson SpeedTouch 500 modems vulnerable to XSS 2006-02-26 preben watchcom no TITLE: Thomson SpeedTouch 500 series vulnerable to XSS CRITICAL: Less critical IMPACT: Cross Site Scripting SOFTWARE: SpeedTouch 5.3.2.6.0 DESCRIPTION: There consists a vulnerability in the SpeedTouch modems, which can be exploited by malicious people to conduct cross-site scripting attacks, an [ more ] [ reply ] NETGEAR WGT624 ? Wireless DSL Firewall/Router vulnerability 2006-02-26 info teamintel com When configured to backup configuration settings, the device will store various information in cleartext. Accessing this file could allow an attacker to obtain sensitive information which could aid the attacker in compromising the web administration interface of the device, DSL/cable account passwor [ more ] [ reply ] Archangel Weblog 0.90.02 Admin Authentication Bypass & Remote File Inclusion 2006-02-26 kingofska gmail com Norton Monitoring Systems funny problems 2006-02-26 Alexander Hristov (joffer gmail com) Norton Internet monitoring tools issues Versions Affected : * Fix : No What im writing about is how to stop the internet of some user that is using the norton tools and IRC / any other chat at the same time. By default norton monitor checks for words like "keylogger" , "start keylogger" , "key log [ more ] [ reply ] Mail Transport System Professional--Open Relay Hole 2006-02-25 Craig Morrison (craig fishpalace org) What: Mail Transport System Professional is a RFC compliant mail server for Windows. Who: http://www.mtsprofessional.com/ Problem: Open relay hole when forwarding all outgoing mail through an ISP. When configured to forward all outgoing mail through an ISP MTS Pro will accept and forward all m [ more ] [ reply ] [USN-258-1] PostgreSQL vulnerability 2006-02-27 Martin Pitt (martin pitt canonical com) =========================================================== Ubuntu Security Notice USN-258-1 February 27, 2006 postgresql-7.4, postgresql-8.0, postgresql vulnerability CVE-2006-0678 =========================================================== A security issue affects the following Ubuntu releases: [ more ] [ reply ] [ GLSA 200602-14 ] noweb: Insecure temporary file creation 2006-02-26 Thierry Carrez (koon gentoo org) [ GLSA 200602-13 ] GraphicsMagick: Format string vulnerability 2006-02-26 Thierry Carrez (koon gentoo org) Archive_Zip (Zip file management class) Directory traversal 2006-02-25 h e (het_ebadi yahoo com) Archive_Zipr (Zip file management class) Directory traversal This class provides handling of tar files in PHP. It supports creating, listing, extracting and adding to tar files. Gzip support is available if PHP has the zlib extension built-in or loaded. Bz2 compression is also supported with t [ more ] [ reply ] Research paper on covert channels 2006-02-23 matthijs koot biz As part of our MSc study on System and Network Engineering at the University of Amsterdam, NL, Marc Smeets and I have done research on covert channels. Abstract: "Covert channels have been topic of discussion within both academic and non-academic communities for more than two decades. Traditional [ more ] [ reply ] RE: Vulnerabilites in new laws on computer hacking 2006-02-25 Craig Wright (cwright bdosyd com au) In response to "But if there really *was* a hole that allowed an actual break-in they would have to do that anyway, because they wouldn't know if anyone had broken in before and just wiped his tracks, would they?" There is a world of difference to knowing that you have a vulnerability and kn [ more ] [ reply ] |
|
Privacy Statement |
Application: DirectContact
http://reyero.info/dc/
Version: 0.3b
Bug: directory traversal
Date: 27-Feb-2006
Author: Donato Ferrante
e-mail: fdonato (at) autistici (dot) org [email concealed]
web: www.autisti
[ more ] [ reply ]