========================================================================
The Secunia Weekly Advisory Summary
2006-10-19 - 2006-10-26
This week: 69 advisories
========================================================================
Table of Contents:
1.....................................................Word From Secunia
2....................................................This Week In Brief
3...............................This Weeks Top Ten Most Read Advisories
4.......................................Vulnerabilities Summary Listing
5.......................................Vulnerabilities Content Listing
========================================================================
1) Word From Secunia:
To improve our services to our customers, we have made a number of
additions to the Secunia Advisories and have started translating the
advisories to German.
The improvements will help our customers to get a better understanding
of how we reached our conclusions, how it was rated, our thoughts on
exploitation, attack vectors, and scenarios.
This includes:
* Reason for rating
* Extended description
* Extended solution
* Exploit code or links to exploit code
* Deep links
Read the full description:
http://corporate.secunia.com/products/48/?r=s
========================================================================
2) This Week in Brief:
Yesterday, another issue was reported in Internet Explorer 7, which can
be exploited by a malicious website to spoof the address bar of
popup-windows.
Secunia has constructed a demonstration, which is available at:
http://secunia.com/internet_explorer_7_popup_address_bar_spoofing_test/
For additional information please see the referenced Secunia advisory.
Reference:
http://secunia.com/SA22542
--
Two vulnerabilities have been reported in Winamp, which can be
exploited by malicious people to compromise a user's system.
The vendor has issued an updated version.
Reference:
http://secunia.com/SA22580
--
VIRUS ALERTS:
During the past week Secunia collected 200 virus descriptions from the
Antivirus vendors. However, none were deemed MEDIUM risk or higher
according to the Secunia assessment scale.
========================================================================
3) This Weeks Top Ten Most Read Advisories:
1. [SA22477] Internet Explorer 7 "mhtml:" Redirection Information
Disclosure
2. [SA19738] Internet Explorer "mhtml:" Redirection Disclosure of
Sensitive Information
3. [SA22542] Internet Explorer 7 Popup Address Bar Spoofing Weakness
4. [SA21906] Mozilla Firefox Multiple Vulnerabilities
5. [SA22218] Opera Web Browser URL Handling Buffer Overflow
Vulnerability
6. [SA20153] Microsoft Word Malformed Object Pointer Vulnerability
7. [SA22396] Oracle Products Multiple Vulnerabilities
8. [SA12580] Mozilla / Mozilla Firefox Cross-Domain Cookie Injection
Vulnerability
9. [SA20442] Firefox File Upload Form Keystroke Event Cancel
Vulnerability
10. [SA12403] Mozilla / Mozilla Firefox Apple Java Plugin Tab
Spoofing Vulnerability
========================================================================
4) Vulnerabilities Summary Listing
Windows:
[SA22580] Winamp Lyrics3 and Ultravox Processing Buffer Overflows
[SA22567] AOL YGPPDownload ActiveX Control Buffer Overflows
[SA22563] QK SMTP Server "RCPT TO:" Buffer Overflow Vulnerability
[SA22559] RevilloC MailServer "RCPT TO:" Buffer Overflow Vulnerability
[SA22571] Zwahlen Online Shop Cross-Site Scripting Vulnerabilities
[SA22542] Internet Explorer 7 Popup Address Bar Spoofing Weakness
[SA22540] FtpXQ Server "MKD" Denial of Service Vulnerability
[SA22536] Symantec Products SAVRT.SYS Device Driver Privilege
Escalation
[SA22510] Yahoo! Messenger Conference Invite Denial of Service
UNIX/Linux:
[SA22556] Debian update for webmin
[SA22551] Gentoo update for clamav
[SA22549] Gentoo update for mod_tcl
[SA22544] Gentoo update for openssl
[SA22538] Avaya Products PHP Multiple Vulnerabilites
[SA22537] Debian update for clamav
[SA22517] Gentoo update for libmusicbrainz
[SA22509] SUSE update for opera
[SA22589] Slackware update for Qt
[SA22581] Avaya CMS Sun Solaris IPv6 Denial of Service
[SA22579] Mandriva update for Qt
[SA22575] Sun Java System Messaging Server Webmail Script Insertion
[SA22574] Cisco Security Agent for Linux Port Scan Denial of Service
[SA22572] ImageMagick PALM and DCM Buffer Overflows
[SA22569] GraphicsMagick PALM and DCM Buffer Overflows
[SA22545] Blue Coat Products RSA Signature Vulnerability
[SA22533] Avaya Products PHP "_ecalloc" Integer Overflow Vulnerability
[SA22531] Debian update for python2.3
[SA22520] Ubuntu update for Qt
[SA22512] Debian update for python2.4
[SA22518] Debian update for maxdb-7.5.00
[SA22583] GNU Screen UTF-8 Character Handling Vulnerabilities
[SA22515] Gentoo update for cscope
[SA22560] Avaya Products XFree86 Integer Overflow Vulnerabilities
[SA22528] HP Tru64 Unix dtmail Privilege Escalation Vulnerability
[SA22584] Ubuntu update for postgresql
[SA22562] PostgreSQL Denial of Service Vulnerabilities
[SA22587] Avaya CMS / IR Sun Solaris "syslog" Denial of Service
[SA22543] FreeBSD "/dev/crypto" Local Denial of Service Vulnerability
Other:
[SA22523] IBM HMC Apache2 / OpenSSL Vulnerabilities
[SA22524] D-Link DSL-G624T Directory Traversal and Cross-Site
Scripting
Cross Platform:
[SA22577] OTSCMS "OTCMS.php" File Inclusion Vulnerability
[SA22565] UeberProject Management System "cfg[homepath]" File Inclusion
Vulnerability
[SA22554] Ascended Guestbook "CONFIG[path]" File Inclusion
Vulnerability
[SA22552] Imageview "user_settings" File Inclusion Vulnerability
[SA22548] OTSCMS "OTCMS.php" File Inclusion Vulnerability
[SA22547] Wiclear "path" File Inclusion Vulnerabilities
[SA22546] Der Dirigent "cfg_dedi[dedi_path]" File Inclusion
Vulnerabilities
[SA22527] castor "rootpath" File Inclusion Vulnerabilities
[SA22525] Trawler Web CMS Multiple File Inclusion Vulnerabilities
[SA22522] Net_DNS "phpdns_basedir" File Inclusion Vulnerability
[SA22521] Mambo MambWeather Module "mosConfig_absolute_path" File
Inclusion
[SA22516] Virtual Law Office "phpc_root_path" File Inclusion
Vulnerabilities
[SA22508] EPNadmin "language" File Inclusion Vulnerability
[SA22505] pandaBB displayCategory.php File Inclusion Vulnerabilities
[SA22503] Open Meetings Filing Application "PROJECT_ROOT" File
Inclusion
[SA22530] 2BGal "path" Local File Inclusion Vulnerabilities
[SA22529] phpPgAds "lib-history.php.inc" Cross-Site Scripting and
Script Insertion
[SA22526] phpAdsNew "lib-history.inc.php" Cross-Site Scripting and
Script Insertion
[SA22514] Segue CMS SQL Injection Vulnerabilities
[SA22511] PHP-Nuke "eid" SQL Injection Vulnerability
[SA22504] PH Pexplorer "Language" File Inclusion Vulnerability
[SA22502] GeoNetwork opensource SQL Injection Vulnerability
[SA22519] Novell eDirectory iMonitor HTTP Protocol Stack Buffer
Overflow
[SA22506] Novell eDirectory Multiple Vulnerabilities
[SA22564] MAXdev MD-Pro Cross-Site Scripting and HTTP Response
Splitting
[SA22558] WikiNi "name" and "email" Cross-Site Scripting
Vulnerabilities
[SA22555] cPanel Multiple Cross-Site Scripting Vulnerabilities
[SA22535] Simpnews Cross-Site Scripting Vulnerabilities
[SA22532] ProgSys URL Cross-Site Scripting Vulnerability
========================================================================
5) Vulnerabilities Content Listing
Windows:--
[SA22580] Winamp Lyrics3 and Ultravox Processing Buffer Overflows
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-25
Two vulnerabilities have been reported in Winamp, which can be
exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/22580/
--
[SA22567] AOL YGPPDownload ActiveX Control Buffer Overflows
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-26
Two vulnerabilities have been reported in AOL, which can be exploited
by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/22567/
--
[SA22563] QK SMTP Server "RCPT TO:" Buffer Overflow Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-24
Greg Linares has discovered a vulnerability in QK SMTP Server, which
potentially can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/22563/
--
[SA22559] RevilloC MailServer "RCPT TO:" Buffer Overflow Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-25
Greg Linares has discovered a vulnerability in RevilloC MailServer,
which potentially can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/22559/
--
[SA22571] Zwahlen Online Shop Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-10-24
MC Iglo has reported some vulnerabilities in Zwahlen Online Shop, which
can be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/22571/
--
[SA22542] Internet Explorer 7 Popup Address Bar Spoofing Weakness
Critical: Less critical
Where: From remote
Impact: Spoofing
Released: 2006-10-25
A weakness has been discovered in Internet Explorer, which can be
exploited by malicious people to conduct phishing attacks.
Full Advisory:
http://secunia.com/advisories/22542/
--
[SA22540] FtpXQ Server "MKD" Denial of Service Vulnerability
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2006-10-25
Greg Linares has discovered a vulnerability in FTPXQ Server, which can
be exploited by malicious users to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/22540/
--
[SA22536] Symantec Products SAVRT.SYS Device Driver Privilege
Escalation
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2006-10-24
A vulnerability has been reported in various Symantec products, which
can be exploited by malicious, local users to gain escalated
privileges.
Full Advisory:
http://secunia.com/advisories/22536/
--
[SA22510] Yahoo! Messenger Conference Invite Denial of Service
Critical: Not critical
Where: From remote
Impact: DoS
Released: 2006-10-25
Gianni Amato has discovered a weakness in Yahoo! Messenger, which can
be exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/22510/
UNIX/Linux:--
[SA22556] Debian update for webmin
Critical: Highly critical
Where: From remote
Impact: Cross Site Scripting, Exposure of system information,
Exposure of sensitive information, DoS, System access
Released: 2006-10-24
Debian has issued an update for webmin. This fixes some
vulnerabilities, which can be exploited by malicious people to disclose
potentially sensitive information, conduct cross-site scripting attacks,
cause a DoS (Denial of Service), and potentially compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/22556/
--
[SA22551] Gentoo update for clamav
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-24
Gentoo has issued an update for clamav. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) and potentially compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/22551/
--
[SA22549] Gentoo update for mod_tcl
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-24
Gentoo has issued an update for mod_tcl. This fixes some
vulnerabilities, which can be exploited by malicious people to
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22549/
--
[SA22544] Gentoo update for openssl
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-24
Gentoo has issued an update for openssl. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) and compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22544/
--
[SA22538] Avaya Products PHP Multiple Vulnerabilites
Critical: Highly critical
Where: From remote
Impact: Unknown, Security Bypass, DoS, System access
Released: 2006-10-23
Avaya has acknowledged some vulnerabilities in PHP included in various
Avaya products, where some have unknown impacts, and others can be
exploited by malicious, local users to bypass certain security
restrictions and by malicious people to cause a DoS (Denial of Service)
or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22538/
--
[SA22537] Debian update for clamav
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-23
Debian has issued an update for clamav. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) and potentially compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/22537/
--
[SA22517] Gentoo update for libmusicbrainz
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-23
Gentoo has issued an update for libmusicbrainz. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) and potentially compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/22517/
--
[SA22509] SUSE update for opera
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Spoofing, System access
Released: 2006-10-20
SUSE has issued an update for opera. This fixes some vulnerabilities,
which can be exploited by malicious people to bypass certain security
restrictions and compromise a user's system.
Full Advisory:
http://secunia.com/advisories/22509/
--
[SA22589] Slackware update for Qt
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-26
Slackware has issued an update for Qt. This fixes some vulnerabilities,
which can be exploited by malicious people to cause a DoS (Denial of
Service) or potentially compromise an application using the library.
Full Advisory:
http://secunia.com/advisories/22589/
--
[SA22581] Avaya CMS Sun Solaris IPv6 Denial of Service
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2006-10-26
Avaya has acknowledged a vulnerability in CMS, which can be exploited
by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/22581/
--
[SA22579] Mandriva update for Qt
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-25
Mandriva has issued an update for Qt. This fixes a vulnerability, which
can be exploited by malicious people to cause a DoS (Denial of Service)
and potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22579/
--
[SA22575] Sun Java System Messaging Server Webmail Script Insertion
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-10-25
A vulnerability has been reported in Sun Java System Messaging Server,
which can be exploited by malicious people to conduct script insertion
attacks.
Full Advisory:
http://secunia.com/advisories/22575/
--
[SA22574] Cisco Security Agent for Linux Port Scan Denial of Service
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2006-10-26
A vulnerability has been reported in Cisco Security Agent for Linux,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/22574/
--
[SA22572] ImageMagick PALM and DCM Buffer Overflows
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-24
Some vulnerabilities have been reported in ImageMagick, which can be
exploited by malicious people to cause a DoS (Denial of Service) and
potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22572/
--
[SA22569] GraphicsMagick PALM and DCM Buffer Overflows
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-24
Some vulnerabilities have been reported in GraphicsMagick, which can be
exploited by malicious people to cause a DoS (Denial of Service) and
potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22569/
--
[SA22545] Blue Coat Products RSA Signature Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Security Bypass
Released: 2006-10-26
Blue Coat has acknowledged a vulnerability in some products, which can
be exploited by malicious people to bypass certain security
restrictions.
Full Advisory:
http://secunia.com/advisories/22545/
--
[SA22533] Avaya Products PHP "_ecalloc" Integer Overflow Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-23
Avaya has acknowledged a vulnerability in PHP included in various Avaya
products, which can be exploited by malicious people to cause a DoS
(Denial of Service) and potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22533/
--
[SA22531] Debian update for python2.3
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-24
Debian has issued an update for python 2.3. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service) and potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22531/
--
[SA22520] Ubuntu update for Qt
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-24
Ubuntu has issued an update for Qt. This fixes a vulnerability, which
can be exploited by malicious people to cause a DoS (Denial of Service)
and potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22520/
--
[SA22512] Debian update for python2.4
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-23
Debian has issued an update for python2.4. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service) and potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22512/
--
[SA22518] Debian update for maxdb-7.5.00
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2006-10-23
Debian has issued an update for maxdb-7.5.00. This fixes a
vulnerability, which can be exploited by malicious people to compromise
a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22518/
--
[SA22583] GNU Screen UTF-8 Character Handling Vulnerabilities
Critical: Less critical
Where: From remote
Impact: DoS, System access
Released: 2006-10-25
Some vulnerabilities have been reported in GNU Screen, which can be
exploited by malicious people to cause a DoS (Denial of Service) or
potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22583/
--
[SA22515] Gentoo update for cscope
Critical: Less critical
Where: From remote
Impact: System access, DoS
Released: 2006-10-20
Gentoo has issued an update for cscope. This fixes some
vulnerabilities, which can be exploited by malicious people to
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22515/
--
[SA22560] Avaya Products XFree86 Integer Overflow Vulnerabilities
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2006-10-24
Avaya has acknowledged some vulnerabilities in XFree86 included in
various Avaya products, which can be exploited by malicious, local
users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/22560/
--
[SA22528] HP Tru64 Unix dtmail Privilege Escalation Vulnerability
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2006-10-23
Netragard has reported a vulnerability in HP Tru64 Unix, which can be
exploited by malicious, local users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/22528/
--
[SA22584] Ubuntu update for postgresql
Critical: Not critical
Where: From local network
Impact: DoS
Released: 2006-10-25
Ubuntu has issued an update for postgresql. This fixes some
vulnerabilities, which can be exploited by malicious users to cause a
DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/22584/
--
[SA22562] PostgreSQL Denial of Service Vulnerabilities
Critical: Not critical
Where: From local network
Impact: DoS
Released: 2006-10-25
Some vulnerabilities have been reported in PostgreSQL, which can be
exploited by malicious users to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/22562/
--
[SA22587] Avaya CMS / IR Sun Solaris "syslog" Denial of Service
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2006-10-26
Avaya has acknowledged a vulnerability in CMS / IR, which can be
exploited by malicious, local users to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/22587/
--
[SA22543] FreeBSD "/dev/crypto" Local Denial of Service Vulnerability
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2006-10-25
Evgeny Legerov has reported a vulnerability in FreeBSD, which can be
exploited by malicious, local users to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/22543/
Other:--
[SA22523] IBM HMC Apache2 / OpenSSL Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, DoS, System access
Released: 2006-10-26
IBM has acknowledged some vulnerabilities in HMC, which can be
exploited by malicious people to conduct cross-site scripting attacks
and to cause a DoS (Denial of Service), and potentially to bypass
certain security restrictions or to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22523/
--
[SA22524] D-Link DSL-G624T Directory Traversal and Cross-Site
Scripting
Critical: Less critical
Where: From local network
Impact: Cross Site Scripting, Exposure of sensitive information
Released: 2006-10-25
Jose Ramon Palanco has reported some vulnerabilities in D-Link
DSL-G624T, which can be exploited by malicious people to conduct
cross-site scripting attacks or to disclose certain sensitive
information.
Full Advisory:
http://secunia.com/advisories/22524/
Cross Platform:--
[SA22577] OTSCMS "OTCMS.php" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-25
GregStar has reported a vulnerability in OTSCMS, which can be exploited
by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22577/
--
[SA22565] UeberProject Management System "cfg[homepath]" File Inclusion
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-25
xoron has reported a vulnerability in UeberProject Management System,
which can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/22565/
--
[SA22554] Ascended Guestbook "CONFIG[path]" File Inclusion
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-25
Kacper has discovered a vulnerability in Ascended Guestbook, which can
be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22554/
--
[SA22552] Imageview "user_settings" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: Exposure of sensitive information, System access
Released: 2006-10-25
Kacper has discovered a vulnerability in Imageview, which can be
exploited by malicious people to disclose sensitive information or
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22552/
--
[SA22548] OTSCMS "OTCMS.php" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-25
GregStar has reported a vulnerability in OTSCMS, which can be exploited
by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22548/
--
[SA22547] Wiclear "path" File Inclusion Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-24
the master has discovered some vulnerabilities in Wiclear, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22547/
--
[SA22546] Der Dirigent "cfg_dedi[dedi_path]" File Inclusion
Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-24
Drago84 has discovered some vulnerabilities in Der Dirigent, which can
be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22546/
--
[SA22527] castor "rootpath" File Inclusion Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-23
Some vulnerabilities have been reported in castor, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22527/
--
[SA22525] Trawler Web CMS Multiple File Inclusion Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-23
k1tk4t has reported some vulnerabilities in Trawler Web CMS, which can
be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22525/
--
[SA22522] Net_DNS "phpdns_basedir" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-25
Drago84 has discovered a vulnerability in Net_DNS, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22522/
--
[SA22521] Mambo MambWeather Module "mosConfig_absolute_path" File
Inclusion
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-23
h4ntu has discovered a vulnerability in the MambWeather module for
Mambo, which can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/22521/
--
[SA22516] Virtual Law Office "phpc_root_path" File Inclusion
Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-23
xoron has reported some vulnerabilities in Virtual Law Office, which
can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/22516/
--
[SA22508] EPNadmin "language" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-24
Kw3[R]Ln has reported a vulnerability in EPNadmin, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22508/
--
[SA22505] pandaBB displayCategory.php File Inclusion Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-20
nukedclx has discovered some vulnerabilities in pandaBB, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22505/
--
[SA22503] Open Meetings Filing Application "PROJECT_ROOT" File
Inclusion
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-10-23
xoron has reported some vulnerabilities in Open Meetings Filing
Application, which can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/22503/
--
[SA22530] 2BGal "path" Local File Inclusion Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2006-10-24
Kw3[R]Ln has discovered some vulnerabilities in 2BGal, which can be
exploited by malicious people to disclose potentially sensitive
information.
Full Advisory:
http://secunia.com/advisories/22530/
--
[SA22529] phpPgAds "lib-history.php.inc" Cross-Site Scripting and
Script Insertion
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-10-23
A vulnerability has been reported in phpPgAds, which can be exploited
by malicious people to conduct script insertion and cross-site
scripting attacks.
Full Advisory:
http://secunia.com/advisories/22529/
--
[SA22526] phpAdsNew "lib-history.inc.php" Cross-Site Scripting and
Script Insertion
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-10-23
A vulnerability has been reported in phpAdsNew, which can be exploited
by malicious people to conduct script insertion and cross-site
scripting attacks.
Full Advisory:
http://secunia.com/advisories/22526/
--
[SA22514] Segue CMS SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-10-20
Some vulnerabilities have been reported in Segue CMS, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/22514/
--
[SA22511] PHP-Nuke "eid" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-10-23
Paisterist has discovered a vulnerability in PHP-Nuke, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/22511/
--
[SA22504] PH Pexplorer "Language" File Inclusion Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information, System access
Released: 2006-10-20
Kacper has discovered a vulnerability in PH Pexplorer, which can be
exploited by malicious users to disclose sensitive information or
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22504/
--
[SA22502] GeoNetwork opensource SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-10-23
A vulnerability has been reported in GeoNetwork opensource, which can
be exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/22502/
--
[SA22519] Novell eDirectory iMonitor HTTP Protocol Stack Buffer
Overflow
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2006-10-23
Michael Ligh and Ryan Smith have reported a vulnerability in Novell
eDirectory, which can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/22519/
--
[SA22506] Novell eDirectory Multiple Vulnerabilities
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2006-10-23
Multiple vulnerabilities have been reported in Novell eDirectory, which
can be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/22506/
--
[SA22564] MAXdev MD-Pro Cross-Site Scripting and HTTP Response
Splitting
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-10-25
R00T[ATI] has reported some vulnerabilities in MAXdev MD-Pro, which can
be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/22564/
--
[SA22558] WikiNi "name" and "email" Cross-Site Scripting
Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-10-24
Raphael HUCK has reported some vulnerabilities in WikiNi, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/22558/
--
[SA22555] cPanel Multiple Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-10-25
Crackers_Child has reported some vulnerabilities in cPanel, which can
be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/22555/
--
[SA22535] Simpnews Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-10-24
Moran Zavdi has reported a vulnerability in Simpnews, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/22535/
--
[SA22532] ProgSys URL Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-10-25
Moran Zavdi has discovered a vulnerability in ProgSys, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/22532/
========================================================================
Secunia recommends that you verify all advisories you receive,
by clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only use
those supplied by the vendor.
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Subscribe:
http://secunia.com/secunia_weekly_summary/
Contact details:
Web : http://secunia.com/
E-mail : support@private
Tel : +45 70 20 51 44
Fax : +45 70 20 51 45
_________________________________
Visit the InfoSec News store!
http://www.shopinfosecnews.org
This archive was generated by hypermail 2.1.3 : Fri Oct 27 2006 - 00:12:47 PDT