|
|
Prev week |
Colapse all |
Post message
[USN-246-1] imagemagick vulnerabilities 2006-01-24 Martin Pitt (martin pitt canonical com) =========================================================== Ubuntu Security Notice USN-246-1 January 24, 2006 imagemagick vulnerabilities CVE-2005-4601, CVE-2006-0082, http://bugs.debian.org/345595 =========================================================== A security issue affects the following [ more ] [ reply ] LibAST 0.7 Release Fixes Security Vulnerability 2006-01-23 Michael Jennings (mej eterm org) I am pleased to announce the release of LibAST 0.7. The release summary is below. Please note that this release contains an important security fix; all users of LibAST are STRONGLY encouraged to update to this latest version immediately. The latest version can be obtained in source, RPM, and SRPM [ more ] [ reply ] Multiple vulnerabilities in CommuniGate Pro Server 2006-01-28 Evgeny Legerov (research gleg net) I. DESCRIPTION CommuniGate Pro Core Server from CommuniGate Systems provides robust cross-platform groupware applications, enabling a cost effective, easy to manage communications platform. For more info visit http://www.stalker.com II. DETAILS During testing of CommuniGate Pro Server 5.0.6 us [ more ] [ reply ] [CORRECTIONS AND ADDITIONS ]Azbb v1.1.00 Cross-Site Scripting 2006-01-28 roozbeh_afrasiabi yahoo com The WorldsEnd.NET - Free Ping Script, written in PHP (2 vulns) 2006-01-23 cvh kapda ir [KAPDA::#23] - The WorldsEnd.NET - Free Ping Script, written in PHP (2 vulns) KAPDA New advisory Vulnerable products : The WorldsEnd.NET - Free Ping Script Vendor: http://www.theworldsend.net/ Risk: Low Vulnerabilities: Restriction Bypass Date : -------------------- Found : Aug 2005 Vendor Conta [ more ] [ reply ] Azbb v1.1.00 Cross-Site Scripting 2006-01-23 roozbeh_afrasiabi yahoo com [KAPDA::#22] - Azbb v1.1.00 Cross Site Scripting KAPDA New advisory Vulnerable products : Azbb <= 1.1.00 Vendor: www.azbb.org Risk: Low Vulnerabilities: Cross Site Scripting Date : -------------------- Found : Jan 20 2006 Vendor Contacted : Jan 21 2006 Release Date : Jan 21 2006 About : ------- [ more ] [ reply ] Re: [security] What A Click! [Internet Explorer] 2006-01-27 Lance James (lancej securescience net) yossarian wrote: > There is an easy trick to avoid a .HTA related 'thingie' such as this > one: tell your windows to open .HTA files in notepad. It broke the > beautifull PoC I guess, had it in place as long as this particular > machine (2 years or so), it never broke anything before. Is there [ more ] [ reply ] Shareaza P2P Remote Vulnerability 2006-01-27 Ryan Smith (whatstheaddress gmail com) Abstract: There is a vulnerability present in the latest version of the Shareaza P2P file trading software. At a minimum, this vulnerability would easily allow parties (RIAA) to disrupt P2P services. Remote code execution is also possible. Products affected: Shareaza eTomi Vulnerability Impact: [ more ] [ reply ] [ MDKSA-2006:024 ] - Updated ImageMagick packages fix vulnerabilities 2006-01-26 security mandriva com Re: [security] What A Click! [Internet Explorer] 2006-01-27 yossarian (yossarian planet nl) There is an easy trick to avoid a .HTA related 'thingie' such as this one: tell your windows to open .HTA files in notepad. It broke the beautifull PoC I guess, had it in place as long as this particular machine (2 years or so), it never broke anything before. Second hint for people protecting [ more ] [ reply ] [SECURITY] [DSA 958-1] New drupal packages fix several vulnerabilities 2006-01-27 joey infodrom org (Martin Schulze) CAID 33778 - CA iGateway Content-Length Buffer Overflow Vulnerability [v1.1] 2006-01-27 Williams, James K (James Williams ca com) Please see below for important changes to CAID 33778. Changelog is near end of advisory. Regards, Ken Williams Title: CAID 33778 - CA iGateway Content-Length Buffer Overflow Vulnerability [v1.1] CA Vulnerability ID: 33778 CA Advisory Date: 2006-01-23 Updated Advisory [v1.1]: 2006-01-26 Disco [ more ] [ reply ] hello 2006-01-27 code shell yahoo com ASPThai Forums Version 8.0 & Lower Sql Injection Vulnerability ASPThai is Prudoct of www.ASPThai.net and Made in Thailand author : code.shell , <code.shell (at) yahoo (dot) com [email concealed]> ######################################################## Target: http://www.example.com/[Forum target]/login.asp username: admi [ more ] [ reply ] [ MDKSA-2006:023 ] - Updated perl-Net_SSLeay packages fix vulnerability 2006-01-26 security mandriva com [Argeniss] Oracle Database Buffer overflows vulnerabilities in public procedures of XDB.DBMS_XMLSCHEMA{_INT} 2006-01-26 Cesar (cesarc56 yahoo com) Argeniss Security Advisory Name: Oracle Database Buffer overflows vulnerabilities in public procedures of XDB.DBMS_XMLSCHEMA{_INT} Affected Software: Oracle Database Server versions 9iR2 and 10gR1 Severity: High Remote exploitable: Yes (Authentication to Database Server is needed) Credits: Es [ more ] [ reply ] [SECURITY] [DSA 952-1] New libapache-auth-ldap packages fix arbitrary code execution 2006-01-23 joey infodrom org (Martin Schulze) RE: MySQL 5.0 information leak? 2006-01-23 Burton Strauss (Security SmallNetSolutions com) It's not semantics at all. Every password is a piece of undisclosed information and NOBODY views that as security by obscurity. It's the corner stone of AAA ... Something you know, something you have, something about you. -----Burton -----Original Message----- From: Lance James [mailto:bugtraq@ [ more ] [ reply ] BitComet URI Proof of Concept 2006-01-23 nick58 gmail com #include <windows.h> #include <stdio.h> /* * .::[ BitComet URI Buffer Overflow ]::. * * A vulnerability in BitComet, allows remote attackers construct a special .torrent file and put * it on any BitTorrent publishing web site. When a user downloads the .torrent file and clicks * on publishers nam [ more ] [ reply ] Re: [Full-disclosure] Urgent Alert: Possible BlackWorm DDay February 3rd (Snort signatures included) 2006-01-24 Dude VanWinkle (dudevanwinkle gmail com) On 1/24/06, Gadi Evron <ge (at) linuxbox (dot) org [email concealed]> wrote: > now known as the TISF BlackWorm task force. Why do you call a .scr you have to manually install a "worm"? Why not "BlackVirus" the worm moniker is very misleading (actually got me worried for a sec). The "email worm" is also misleading, because it [ more ] [ reply ] Re: MySQL 5.0 information leak? 2006-01-24 Johan De Meersman (jdm operamail com) Burton Strauss wrote: >Traditionally the schema for a database is NOT secure information. >Applications download this information to build queries on the fly. > >The essential problem is relying on security by obscurity, "I have user >accounts (nss) that have publicly available credentials but noon [ more ] [ reply ] [ MDKSA-2006:022 ] - Updated perl-Convert-UUlib packages fix vulnerability 2006-01-26 security mandriva com [SECURITY] [DSA 950-1] New CUPS packages fix arbitrary code execution 2006-01-23 joey infodrom org (Martin Schulze) iDefense Security Advisory 01.23.06: Computer Associates iTechnology iGateway Service Content-Length Buffer Overflow Vulnerability 2006-01-23 labs-no-reply (at) idefense (dot) com [email concealed] (labs-no-reply idefense com) Computer Associates iTechnology iGateway Service Content-Length Buffer Overflow Vulnerability iDefense Security Advisory 01.23.06 http://www.idefense.com/intelligence/vulnerabilities/display.php?id=376 January 23, 2006 I. BACKGROUND iTechnology is an integration technology which provides standard [ more ] [ reply ] Buffer Overflow /Font on mIRC 2006-01-24 Crowdat Kurobudetsu (crowdat gmail com) - 1 - Introduction Written by Khaled Mardam-Bey, mIRC is a friendly IRC client that is well equipped with options and tools. - 2 - Vulnerability description This bug was discovered by a friend (Racy) , with the command exposed by Racy only hung mIRC, but after debugging and testing, I discover t [ more ] [ reply ] Re: MySQL 5.0 information leak? 2006-01-22 Lance James (bugtraq securescience net) Burton Strauss wrote: >I'd get a refund on your coinage... root's password is not security by >obscurity, it is an undisclosed piece of information. There is a big >difference. > > Now we're arguing symantics, undislosed information would also by the MySQL information leak problem then too, as [ more ] [ reply ] |
|
Privacy Statement |
Pixelpost Photoblog XSS Vulnerability
http://evuln.com/vulns/45/summary.html
--------------------Summary----------------
Software: Pixelpost Photoblog
Sowtware's Web Site: http://www.pixelpost.org/
Versions: 1.4.3
Critical Level: Moderate
Type: Cross-Site Scripting
Class: Remot
[ more ] [ reply ]