========================================================================
The Secunia Weekly Advisory Summary
2006-10-12 - 2006-10-19
This week: 83 advisories
========================================================================
Table of Contents:
1.....................................................Word From Secunia
2....................................................This Week In Brief
3...............................This Weeks Top Ten Most Read Advisories
4.......................................Vulnerabilities Summary Listing
5.......................................Vulnerabilities Content Listing
========================================================================
1) Word From Secunia:
Secunia Corporate Website has been Released
Learn more about what Secunia can offer you and your company, see and
download detailed product descriptions, and view comprehensive flash
presentations of both our products and corporate profile.
Visit the Secunia Corporate Website:
http://corporate.secunia.com/
Secunia Vulnerability and Advisory Portal has been Updated
Our publicly available Vulnerability and Advisory Portal
secunia.com has been updated with improved accessibility and usability,
enhanced features, and improved search capabilities along with
availability of extensive product reports.
Over the years, the Secunia brand has become synonymous with credible,
accurate, and reliable vulnerability intelligence and our services
are used by more than 5 million unique users every year at secunia.com.
Visit the Secunia Vulnerability and Advisory Portal:
http://secunia.com/
========================================================================
2) This Week in Brief:
A few hours after Microsoft released Internet Explorer 7 the first
vulnerability affecting it has been reported.
The vulnerability can be exploited by malicious people to disclose
potentially sensitive information.
Secunia has a demonstration available here:
http://secunia.com/Internet_Explorer_Arbitrary_Content_Disclosure_Vulnerability_Test/
NOTE: This vulnerability was initially reported 6 months ago in
Internet Explorer 6.
References:
http://secunia.com/SA22477
http://secunia.com/SA19738
--
A vulnerability has been reported in Opera 9, which can be exploited
by malicious people to compromise a user's system.
Further information is available in the referenced Secunia advisory
below.
Reference:
http://secunia.com/SA22218
--
Two vulnerabilities have been reported in Clam AntiVirus, which can be
exploited by malicious people to cause a DoS (Denial of Service) or
potentially compromise a vulnerable system.
An updated version is available from the vendor.
Reference:
http://secunia.com/SA22370
--
VIRUS ALERTS:
During the past week Secunia collected 196 virus descriptions from the
Antivirus vendors. However, none were deemed MEDIUM risk or higher
according to the Secunia assessment scale.
========================================================================
3) This Weeks Top Ten Most Read Advisories:
1. [SA22394] Microsoft PowerPoint Unspecified Code Execution
Vulnerability
2. [SA22159] Microsoft Windows Shell Code Execution Vulnerability
3. [SA21910] Internet Explorer daxctle.ocx "KeyFrame()" Method
Vulnerability
4. [SA20153] Microsoft Word Malformed Object Pointer Vulnerability
5. [SA21735] Microsoft Word Code Execution Vulnerabilities
6. [SA22370] Clam AntiVirus CHM Unpacker and PE Rebuilding
Vulnerabilities
7. [SA22218] Opera Web Browser URL Handling Buffer Overflow
Vulnerability
8. [SA22419] NVIDIA Binary Graphics Driver for Linux Buffer Overflow
Vulnerability
9. [SA21865] Adobe Flash Player Multiple Vulnerabilities
10. [SA22396] Oracle Products Multiple Vulnerabilities
========================================================================
4) Vulnerabilities Summary Listing
Windows:
[SA22396] Oracle Products Multiple Vulnerabilities
[SA22394] Microsoft PowerPoint Unspecified Code Execution
Vulnerability
[SA22386] JustSystems Ichitaro Unspecified Buffer Overflow
Vulnerability
[SA22402] Toshiba Bluetooth Stack Memory Corruption Vulnerability
[SA22477] Internet Explorer 7 "mhtml:" Redirection Information
Disclosure
UNIX/Linux:
[SA22461] Lou Portail "g_admin_rep" File Inclusion Vulnerability
[SA22500] Debian update for openssl096
[SA22457] Trustix Updates for Multiple Packages
[SA22450] Gentoo update for capi4hylafax
[SA22440] Avaya Products PHP Multiple Vulnerabilities
[SA22422] Avaya Products Firefox Multiple Vulnerabilities
[SA22421] Mandriva update for clamav
[SA22419] NVIDIA Binary Graphics Driver for Linux Buffer Overflow
Vulnerability
[SA22393] Ubuntu update for libmusicbrainz
[SA22391] Gentoo update for seamonkey
[SA22385] Avaya Products OpenSSL Multiple Vulnerabilities
[SA22378] Avaya Products Wireshark Multiple Vulnerabilities
[SA22481] Ubuntu update for pike
[SA22473] Ubuntu update for libksba
[SA22448] Gentoo update for python
[SA22445] Mandriva update for libksba
[SA22435] Avaya Products gzip Multiple Vulnerabilities
[SA22417] Avaya Products Linux Kernel Multiple Vulnerabilities
[SA22388] Sun Solaris Apache "mod_rewrite" and "mod_imap"
Vulnerabilities
[SA22384] TorrentFlux Cross-Site Scripting and Script Insertion
[SA22379] Avaya Python "repr()" Unicode String Buffer Overflow
Vulnerability
[SA22446] Gentoo update for nss
[SA22441] rPath update for kernel
[SA22425] Avaya CMS / IR Sun Solaris ACK Storm Denial of Service
[SA22382] Mandriva update for kernel
[SA22474] Apple Xcode WebObjects Plugin Privilege Escalation
Vulnerability
[SA22424] Mandriva update for php
[SA22390] OpenBase SQL Privilege Escalation Vulnerability
[SA22453] Sun Solaris TCP Fusion Local Denial of Service
[SA22439] X.Org X11 X Display Manager "Xsession" Script Security Issue
[SA22413] FreeBSD "fruncate()" and Scheduler Local Denial of Service
Other:
[SA22406] IronMail IronWebMail Directory Traversal Vulnerability
[SA22444] FirePass 1000 SSL VPN "sid" Cross-Site Scripting
Vulnerability
[SA22463] Fuji Xerox DocuPrint Multiple Vulnerabilities
Cross Platform:
[SA22471] phpPowerCards "txt.inc.php" PHP Code Injection
[SA22470] Comdev Misc Tools "path[docroot]" File Inclusion
[SA22466] Easynews "en_login_id" Authentication Bypass Vulnerability
[SA22465] Brim "renderer" File Inclusion Vulnerabilities
[SA22458] Apache HTTP Server mod_tcl Format String Vulnerabilities
[SA22455] Php AMX "plug_path" File Inclusion Vulnerability
[SA22449] PMB Multiple Vulnerabilities
[SA22447] Specimen Image Database "dir" File Inclusion Vulnerability
[SA22443] phpBB Archive for Search Engines "phpbb_root_path" File
Inclusion
[SA22442] WoltLab Burning Book SQL Injection and "eval()" Injection
[SA22438] SpamOborona "phpbb_root_path" File Inclusion Vulnerability
[SA22437] SuperMod "sourcedir" File Inclusion Vulnerabilities
[SA22436] ACP User Registration "phpbb_root_path" File Inclusion
Vulnerability
[SA22434] phpBB News Defilante Horizontale "phpbb_root_path" File
Inclusion
[SA22432] phpBB lat2cyr "phpbb_root_path" File Inclusion Vulnerability
[SA22430] French Language Pack for phpBB Prillian "phpbb_root_path"
File Inclusion
[SA22429] Lodel "home" File Inclusion Vulnerability
[SA22427] PHPRecipeBook "g_rb_basedir" File Inclusion Vulnerability
[SA22420] IncCMS Core "inc_dir" File Inclusion Vulnerability
[SA22416] CDS Agenda "AGE" File Inclusion Vulnerability
[SA22414] phpBB PlusXL "phpbb_root_path" File Inclusion Vulnerability
[SA22412] Open Conference Systems "fullpath" File Inclusion
Vulnerability
[SA22411] phpMyConference "lvc_include_path" File Inclusion
Vulnerability
[SA22404] phpht Topsites "phpht_real_path" File Inclusion
Vulnerability
[SA22403] NuralStorm Webmail "DEFAULT_SKIN" File Inclusion
Vulnerability
[SA22401] miniBB Keyword Replacer "pathToFiles" File Inclusion
Vulnerability
[SA22387] Journals System "phpbb_root_path" File Inclusion
Vulnerability
[SA22383] Download-Engine "spaw_root" File Inclusion Vulnerability
[SA22381] Leicestershire Community Portals "cp_root_path" File
Inclusion
[SA22472] Asbru Website Manager Shell Command Injection
[SA22423] libksba X.509 Certificates Denial of Service Vulnerability
[SA22409] Bugzilla Multiple Vulnerabilities
[SA22400] Invision Gallery Information Disclosure and SQL Injection
[SA22389] Def-Blog "article" SQL Injection Vulnerability
[SA22460] Sun Grid Engine Multiple OpenSSL Vulnerabilities
[SA22454] Brim Unspecified Information Disclosure Vulnerability
[SA22431] phplist "p" Cross-Site Scripting Vulnerability
[SA22418] Cerberus Helpdesk "rpc.php" Security Bypass Vulnerability
[SA22407] dbc CMS Cross-Site Scripting Vulnerability
[SA22405] phplist "unsubscribeemail" Cross-Site Scripting
Vulnerability
[SA22395] ViewVC UTF-7 Cross-Site Scripting Vulnerability
[SA22392] MySQLDumper "db" Cross-Site Scripting Vulnerability
[SA22399] HP Version Control Agent Security Bypass Vulnerability
[SA22469] Ubuntu update for xinit
========================================================================
5) Vulnerabilities Content Listing
Windows:--
[SA22396] Oracle Products Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Unknown, Manipulation of data, DoS, System access
Released: 2006-10-18
Multiple vulnerabilities have been reported in various Oracle products.
Some of these vulnerabilities have unknown impacts while others can be
exploited to cause a DoS (Denial of Service), conduct SQL injection
attacks, and potentially compromise the system.
Full Advisory:
http://secunia.com/advisories/22396/
--
[SA22394] Microsoft PowerPoint Unspecified Code Execution
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-13
Nanika has reported a vulnerability in Microsoft PowerPoint, which
potentially can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/22394/
--
[SA22386] JustSystems Ichitaro Unspecified Buffer Overflow
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-18
A vulnerability has been reported in Ichitaro, which can be exploited
by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/22386/
--
[SA22402] Toshiba Bluetooth Stack Memory Corruption Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-17
A vulnerability has been reported in Toshiba Bluetooth Stack, which can
be exploited by malicious people to cause a DoS (Denial of Service) and
potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22402/
--
[SA22477] Internet Explorer 7 "mhtml:" Redirection Information
Disclosure
Critical: Less critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2006-10-19
A vulnerability has been discovered in Internet Explorer, which can be
exploited by malicious people to disclose potentially sensitive
information.
Full Advisory:
http://secunia.com/advisories/22477/
UNIX/Linux:--
[SA22461] Lou Portail "g_admin_rep" File Inclusion Vulnerability
Critical: Highly critical
Where:
Impact:
Released: 2006-10-18
MP has discovered a vulnerability in Lou Portail, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22461/
--
[SA22500] Debian update for openssl096
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-19
Debian has issued an update for openssl096. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) and potentially compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/22500/
--
[SA22457] Trustix Updates for Multiple Packages
Critical: Highly critical
Where: From remote
Impact: Security Bypass, DoS, System access
Released: 2006-10-18
Trustix has issued updates for multiple packages. These fix some
vulnerabilities, which can be exploited by malicious, local users to
bypass certain security restrictions, and malicious people to cause a
DoS (Denial of Service) or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22457/
--
[SA22450] Gentoo update for capi4hylafax
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-18
Gentoo has issued an update for capi4hylafax. This fixes a
vulnerability, which potentially can be exploited by malicious people
to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22450/
--
[SA22440] Avaya Products PHP Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, DoS, System access
Released: 2006-10-16
Avaya has acknowledged some vulnerabilities in PHP included in various
Avaya products, which can be exploited by malicious, local users to
bypass certain security restrictions, and by malicious people to
conduct cross-site scripting and HTTP response splitting attacks, cause
a DoS (Denial of Service), and potentially compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/22440/
--
[SA22422] Avaya Products Firefox Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, Spoofing, DoS,
System access
Released: 2006-10-17
Avaya has acknowledged some vulnerabilities in Firefox included in
various Avaya products, which can be exploited by malicious people to
conduct man-in-the-middle, spoofing, and cross-site scripting attacks,
and potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/22422/
--
[SA22421] Mandriva update for clamav
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-18
Mandriva has issued an update for clamav. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22421/
--
[SA22419] NVIDIA Binary Graphics Driver for Linux Buffer Overflow
Vulnerability
Critical: Highly critical
Where: From remote
Impact: Privilege escalation, DoS, System access
Released: 2006-10-17
Rapid7 has reported a vulnerability in NVIDIA Binary Graphics Driver
for Linux, which can be exploited by malicious, local users to gain
escalated privileges and potentially by malicious people to compromise
a user's system.
Full Advisory:
http://secunia.com/advisories/22419/
--
[SA22393] Ubuntu update for libmusicbrainz
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-12
Ubuntu has issued an update for libmusicbrainz. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) and potentially compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/22393/
--
[SA22391] Gentoo update for seamonkey
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Spoofing, DoS, System access
Released: 2006-10-16
Gentoo has issued an update for seamonkey. This fixes some
vulnerabilities, which can be exploited by malicious people to conduct
spoofing attacks, bypass certain security restrictions, and potentially
compromise a user's system.
Full Advisory:
http://secunia.com/advisories/22391/
--
[SA22385] Avaya Products OpenSSL Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-13
Avaya has acknowledged some vulnerabilities in OpenSSL included in
various Avaya products, which can be exploited by malicious people to
cause a DoS (Denial of Service) and compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22385/
--
[SA22378] Avaya Products Wireshark Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-13
Avaya has acknowledged some vulnerabilities in Wireshark included in
various Avaya products, which can be exploited by malicious people to
cause a DoS (Denial of Service) and potentially compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/22378/
--
[SA22481] Ubuntu update for pike
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-10-19
Ubuntu has issued an update for pike. This fixes a vulnerability, which
can be exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/22481/
--
[SA22473] Ubuntu update for libksba
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2006-10-17
Ubuntu has issued an update for libksba. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/22473/
--
[SA22448] Gentoo update for python
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-18
Gentoo has issued an update for python. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service) and potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22448/
--
[SA22445] Mandriva update for libksba
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2006-10-18
Mandriva has issued an update for libksba. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/22445/
--
[SA22435] Avaya Products gzip Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-16
Avaya has acknowledged some vulnerabilities in gzip included in various
Avaya products, which can be exploited by malicious people to cause a
DoS (Denial of Service) and potentially compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/22435/
--
[SA22417] Avaya Products Linux Kernel Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Exposure of sensitive information, DoS
Released: 2006-10-16
Avaya has acknowledged some vulnerabilities in the Linux Kernel
included in various Avaya products, which can be exploited by
malicious, local users to bypass certain security restrictions, gain
knowledge of potentially sensitive information, or cause a DoS (Denial
of Service), and by malicious people to bypass certain security
restrictions or cause a DoS.
Full Advisory:
http://secunia.com/advisories/22417/
--
[SA22388] Sun Solaris Apache "mod_rewrite" and "mod_imap"
Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, DoS, System access
Released: 2006-10-12
Sun has acknowledged some vulnerabilities in Solaris, which can be
exploited by malicious people to conduct cross-site scripting attacks
and potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22388/
--
[SA22384] TorrentFlux Cross-Site Scripting and Script Insertion
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-10-16
Steven Roddis has discovered some vulnerabilities in TorrentFlux, which
can be exploited by malicious people to conduct cross-site scripting and
script insertion attacks.
Full Advisory:
http://secunia.com/advisories/22384/
--
[SA22379] Avaya Python "repr()" Unicode String Buffer Overflow
Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-13
Avaya has acknowledged a vulnerability in Python included in various
Avaya products, which can be exploited by malicious people to cause a
DoS (Denial of Service) and potentially compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/22379/
--
[SA22446] Gentoo update for nss
Critical: Less critical
Where: From remote
Impact: Security Bypass
Released: 2006-10-18
Gentoo has issued an update for nss. This fixes a vulnerability, which
can be exploited by malicious people to bypass certain security
restrictions.
Full Advisory:
http://secunia.com/advisories/22446/
--
[SA22441] rPath update for kernel
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2006-10-18
rPath has issued an update for the kernel. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/22441/
--
[SA22425] Avaya CMS / IR Sun Solaris ACK Storm Denial of Service
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2006-10-16
Avaya has acknowledged a vulnerability in Avaya CMS/IR, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/22425/
--
[SA22382] Mandriva update for kernel
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2006-10-12
Mandriva has issued an update for the kernel. This fixes some
vulnerabilities, which can be exploited by malicious, local users and
by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/22382/
--
[SA22474] Apple Xcode WebObjects Plugin Privilege Escalation
Vulnerability
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2006-10-17
A vulnerability has been reported in Apple Xcode, which can be
exploited by malicious, local users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/22474/
--
[SA22424] Mandriva update for php
Critical: Less critical
Where: Local system
Impact: Security Bypass
Released: 2006-10-18
Mandriva has issued an update for php. This fixes some vulnerabilities,
which can be exploited by malicious, local users to bypass certain
security restrictions.
Full Advisory:
http://secunia.com/advisories/22424/
--
[SA22390] OpenBase SQL Privilege Escalation Vulnerability
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2006-10-17
Kevin Finisterre has reported a vulnerability in OpenBase, which can be
exploited by malicious, local users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/22390/
--
[SA22453] Sun Solaris TCP Fusion Local Denial of Service
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2006-10-18
A vulnerability has been reported in Sun Solaris, which can be
exploited by malicious, local users to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/22453/
--
[SA22439] X.Org X11 X Display Manager "Xsession" Script Security Issue
Critical: Not critical
Where: Local system
Impact: Exposure of system information
Released: 2006-10-17
A security issue has been reported in X.Org X11, which can be exploited
by malicious, local users to gain access to system information.
Full Advisory:
http://secunia.com/advisories/22439/
--
[SA22413] FreeBSD "fruncate()" and Scheduler Local Denial of Service
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2006-10-18
Some vulnerabilities have been reported in FreeBSD, which can be
exploited by malicious, local users to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/22413/
Other:--
[SA22406] IronMail IronWebMail Directory Traversal Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2006-10-17
Derek Callaway has reported a vulnerability in IronMail, which can be
exploited by malicious people to gain knowledge of sensitive
information.
Full Advisory:
http://secunia.com/advisories/22406/
--
[SA22444] FirePass 1000 SSL VPN "sid" Cross-Site Scripting
Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-10-18
Richard Brain has reported a vulnerability in FirePass 1000 SSL VPN,
which can be exploited by malicious people to conduct cross-site
scripting attacks.
Full Advisory:
http://secunia.com/advisories/22444/
--
[SA22463] Fuji Xerox DocuPrint Multiple Vulnerabilities
Critical: Less critical
Where: From local network
Impact: Security Bypass, DoS
Released: 2006-10-16
Some vulnerabilities have been reported in various Fuji Xerox DocuPrint
printers, which can be exploited by malicious people to bypass certain
security restrictions or to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/22463/
Cross Platform:--
[SA22471] phpPowerCards "txt.inc.php" PHP Code Injection
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-19
nuffsaid has reported some vulnerabilities in phpPowerCards, which can
be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22471/
--
[SA22470] Comdev Misc Tools "path[docroot]" File Inclusion
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-19
disfigure has reported a vulnerability in Comdev Misc Tools, which can
be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22470/
--
[SA22466] Easynews "en_login_id" Authentication Bypass Vulnerability
Critical: Highly critical
Where: From remote
Impact: Security Bypass
Released: 2006-10-18
nuffsaid has discovered a vulnerability in Easynews, which can be
exploited by malicious people to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/22466/
--
[SA22465] Brim "renderer" File Inclusion Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-18
mdx and The_Bat_Hacker have discovered some vulnerabilities in Brim,
which can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/22465/
--
[SA22458] Apache HTTP Server mod_tcl Format String Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-16
Some vulnerabilities have been reported in the mod_tcl module for
Apache HTTP server, which can be exploited by malicious people to
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22458/
--
[SA22455] Php AMX "plug_path" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-18
MP has reported a vulnerability in Php AMX, which can be exploited by
malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22455/
--
[SA22449] PMB Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Exposure of sensitive information, System access
Released: 2006-10-18
Some vulnerabilities have been reported in PMB (PhpMyBibli), which can
be exploited by malicious people to disclose potentially sensitive
information and compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22449/
--
[SA22447] Specimen Image Database "dir" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-17
Kw3[R]Ln has discovered a vulnerability in Specimen Image Database,
which can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/22447/
--
[SA22443] phpBB Archive for Search Engines "phpbb_root_path" File
Inclusion
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-16
Ashiyane Corporation has reported a vulnerability in the phpBB Archive
for Search Engines module, which can be exploited by malicious people
to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22443/
--
[SA22442] WoltLab Burning Book SQL Injection and "eval()" Injection
Critical: Highly critical
Where: From remote
Impact: Manipulation of data, System access
Released: 2006-10-17
ShAnKaR has discovered some vulnerabilities in WoltLab Burning Book,
which can be exploited by malicious people to conduct SQL injection
attacks and compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22442/
--
[SA22438] SpamOborona "phpbb_root_path" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-16
Ashiyane Corporation has reported a vulnerability in the SpamOborona
module for phpBB, which can be exploited by malicious people to
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22438/
--
[SA22437] SuperMod "sourcedir" File Inclusion Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-16
sZ has discovered some vulnerabilities in SuperMod, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22437/
--
[SA22436] ACP User Registration "phpbb_root_path" File Inclusion
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-16
bd0rk has reported a vulnerability in the ACP User Registration module
for phpBB, which can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/22436/
--
[SA22434] phpBB News Defilante Horizontale "phpbb_root_path" File
Inclusion
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-18
Ashiyane Corporation has reported a vulnerability in the News Defilante
Horizontale module for phpBB, which can be exploited by malicious people
to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22434/
--
[SA22432] phpBB lat2cyr "phpbb_root_path" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-16
Ashiyane Corporation has reported a vulnerability in the lat2cyr module
for phpBB, which can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/22432/
--
[SA22430] French Language Pack for phpBB Prillian "phpbb_root_path"
File Inclusion
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-16
Ashiyane Corporation has reported some vulnerabilities in the French
Language Pack for the phpBB Prillian module, which can be exploited by
malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22430/
--
[SA22429] Lodel "home" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-18
The_Bekir and ERNE have reported a vulnerability in Lodel, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22429/
--
[SA22427] PHPRecipeBook "g_rb_basedir" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-17
r0ut3r has reported a vulnerability in PHPRecipeBook, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22427/
--
[SA22420] IncCMS Core "inc_dir" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-16
Kacper has reported a vulnerability in IncCMS Core, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22420/
--
[SA22416] CDS Agenda "AGE" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-16
Drago84 has reported a vulnerability in CDS Agenda, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22416/
--
[SA22414] phpBB PlusXL "phpbb_root_path" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-16
Ashiyane Corporation has reported a vulnerability in phpBB PlusXL,
which can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/22414/
--
[SA22412] Open Conference Systems "fullpath" File Inclusion
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-16
k1tk4t has reported a vulnerability in Open Conference Systems, which
can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/22412/
--
[SA22411] phpMyConference "lvc_include_path" File Inclusion
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-16
k1tk4t has reported a vulnerability in phpMyConference, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22411/
--
[SA22404] phpht Topsites "phpht_real_path" File Inclusion
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-13
XORON has reported a vulnerability in phpht Topsites, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22404/
--
[SA22403] NuralStorm Webmail "DEFAULT_SKIN" File Inclusion
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-16
Kw3rLn has reported a vulnerability in NuralStorm Webmail, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22403/
--
[SA22401] miniBB Keyword Replacer "pathToFiles" File Inclusion
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-13
Kw3[R]Ln has discovered a vulnerability in the Keyword Replacer plugin
for miniBB, which can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/22401/
--
[SA22387] Journals System "phpbb_root_path" File Inclusion
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-13
Ashiyane Corporation has discovered some vulnerabilities in Journals
System for phpBB, which can be exploited by malicious people to
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22387/
--
[SA22383] Download-Engine "spaw_root" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-13
v1per-haCker has discovered a vulnerability in Download-Engine, which
can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/22383/
--
[SA22381] Leicestershire Community Portals "cp_root_path" File
Inclusion
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-12
Ashiyane Corporation has discovered a vulnerability in Leicestershire
Community Portals, which can be exploited by malicious people to
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22381/
--
[SA22472] Asbru Website Manager Shell Command Injection
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2006-10-17
A vulnerability has been reported in Asbru Website Manager, which can
be exploited by malicious users to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22472/
--
[SA22423] libksba X.509 Certificates Denial of Service Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2006-10-17
A vulnerability has been reported in libksba, which can be exploited by
malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/22423/
--
[SA22409] Bugzilla Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data, Exposure of
sensitive information
Released: 2006-10-16
Some vulnerabilities have been reported in Bugzilla, which can be
exploited by malicious people or malicious users to disclose
potentially sensitive information, conduct cross-site scripting, script
insertion, and request forgery attacks.
Full Advisory:
http://secunia.com/advisories/22409/
--
[SA22400] Invision Gallery Information Disclosure and SQL Injection
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information
Released: 2006-10-13
_1nf3ct0r_ has reported some vulnerabilities in Invision Gallery, which
can be exploited by malicious people to disclose potentially sensitive
information and conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/22400/
--
[SA22389] Def-Blog "article" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-10-16
SHiKaA has discovered a vulnerability in Def-Blog, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/22389/
--
[SA22460] Sun Grid Engine Multiple OpenSSL Vulnerabilities
Critical: Moderately critical
Where: From local network
Impact: DoS, System access
Released: 2006-10-16
Sun Microsystems has acknowledged some vulnerabilities in Sun Grid
Engine, which can be exploited by malicious people to cause a DoS
(Denial of Service) and compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22460/
--
[SA22454] Brim Unspecified Information Disclosure Vulnerability
Critical: Less critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2006-10-18
A vulnerability has been reported in Brim, which can be exploited by
malicious users to disclose certain sensitive information.
Full Advisory:
http://secunia.com/advisories/22454/
--
[SA22431] phplist "p" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-10-18
b0rizQ has discovered a vulnerability in phplist, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/22431/
--
[SA22418] Cerberus Helpdesk "rpc.php" Security Bypass Vulnerability
Critical: Less critical
Where: From remote
Impact: Security Bypass
Released: 2006-10-18
A vulnerability has been reported in Cerberus Helpdesk, which can be
exploited by malicious people to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/22418/
--
[SA22407] dbc CMS Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-10-19
landseer has reported a vulnerability in dbc CMS, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/22407/
--
[SA22405] phplist "unsubscribeemail" Cross-Site Scripting
Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-10-13
MustLive has reported a vulnerability in phplist, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/22405/
--
[SA22395] ViewVC UTF-7 Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-10-16
Stefan Esser has reported a vulnerability in ViewVC, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/22395/
--
[SA22392] MySQLDumper "db" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-10-12
Crackers_Child has discovered a vulnerability in MySQLDumper, which can
be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/22392/
--
[SA22399] HP Version Control Agent Security Bypass Vulnerability
Critical: Less critical
Where: From local network
Impact: Security Bypass
Released: 2006-10-13
A vulnerability has been reported in HP Version Control Agent, which
can be exploited by malicious users to bypass certain security
restrictions.
Full Advisory:
http://secunia.com/advisories/22399/
--
[SA22469] Ubuntu update for xinit
Critical: Not critical
Where: Local system
Impact: Exposure of system information
Released: 2006-10-17
Ubuntu has issued an update for xinit. This fixes a security issue,
which can be exploited by malicious, local users to gain access to
system information.
Full Advisory:
http://secunia.com/advisories/22469/
========================================================================
Secunia recommends that you verify all advisories you receive,
by clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only use
those supplied by the vendor.
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Subscribe:
http://secunia.com/secunia_weekly_summary/
Contact details:
Web : http://secunia.com/
E-mail : support@private
Tel : +45 70 20 51 44
Fax : +45 70 20 51 45
_________________________________
Visit the InfoSec News store!
http://www.shopinfosecnews.org
This archive was generated by hypermail 2.1.3 : Fri Oct 20 2006 - 03:10:21 PDT