========================================================================
The Secunia Weekly Advisory Summary
2007-06-28 - 2007-07-05
This week: 55 advisories
========================================================================
Table of Contents:
1.....................................................Word From Secunia
2....................................................This Week In Brief
3...............................This Weeks Top Ten Most Read Advisories
4.......................................Vulnerabilities Summary Listing
5.......................................Vulnerabilities Content Listing
========================================================================
1) Word From Secunia:
Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.
The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.
========================================================================
2) This Week in Brief:
HP Instant Support Driver Check was found to contain a vulnerability,
which can be exploited by malicious people to compromise a vulnerable
system.
A boundary error can occur when processing the "queryHub()" function
in sdd.dll, which can be exploited to cause a buffer overflow via an
overly long string passed to the affected function when a user visits
a malicious web page.
Successful exploitation allows an attacker to execute arbitrary code.
Users are advised to upgrade to version 1.5.0.3, which fixes this
vulnerability.
For more information:
http://secunia.com/advisories/25918/
--
Secunia Research has discovered a vulnerability in Gimp, which can be
exploited by malicious people to compromise a user's system.
An integer overflow within the "seek_to_and_unpack_pixeldata()"
function in plug-ins/common/psd.c can be exploited to cause
heap-based buffer overflow by tricking a user into opening a specially
crafted PSD file with large width or height values.
Successful exploitation allows an attacker to execute arbitrary code.
The vulnerability is confirmed in version 2.2.15n and other versions
may also be affected. The vendor has fixed this vulnerability in the
SVN repository.
For more information:
http://secunia.com/advisories/25677/
--
Sun Java Web Start contains a vulnerability, which can be exploited
by malicious people to bypass certain security restrictions.
The vulnerability is caused due to an unspecified error in Java Web
Start. This can be exploited by an untrusted application to grant
itself permissions to overwrite any file that is writable by the user
running the application. This can further be exploited to overwrite
the user's ".java.policy" file, allowing the application to invoke
applets or Java Web Start applications.
The vendor has released updates for both Java Web Start in JDK and
JRE 5.0, and Java Web Start in SDK and JRE for the Windows platform.
Users are advised to update their systems immediately.
For more information:
http://secunia.com/advisories/25823/
--
VIRUS ALERTS:
During the past week Secunia collected 227 virus descriptions from the
Antivirus vendors. However, none were deemed MEDIUM risk or higher
according to the Secunia assessment scale.
========================================================================
3) This Weeks Top Ten Most Read Advisories:
1. [SA25823] Sun Java Web Start Untrusted Application Arbitrary File
Overwrite
2. [SA25891] AMX VNC ActiveX Control Buffer Overflow Vulnerabilities
3. [SA25845] EVA-Web index.php3 Two File Inclusion Vulnerabilities
4. [SA25889] Xerox ESS/ Network Controller OpenSSL Vulnerabilities
5. [SA25846] Coppermine Photo Gallery Two SQL Injection
Vulnerabilities
6. [SA25869] HP PSC All-in-One Series XMLData ActiveX Control Two
Insecure Methods
7. [SA25875] Sun Solaris/SEAM kadmind Buffer Overflow Vulnerability
8. [SA25866] SAP Products Cross-Site Scripting Vulnerabilities
9. [SA25883] 3Com IntelliJack Switch NJ220 Loopback Packet Processing
Denial of Service
10. [SA25885] IBM OS/400 TCP Packet Processing Security Bypass Issue
========================================================================
4) Vulnerabilities Summary Listing
Windows:
[SA25918] HP Instant Support Driver Check sdd.dll Buffer Overflow
[SA25891] AMX VNC ActiveX Control Buffer Overflow Vulnerabilities
[SA25908] Gorki Online Santrac Sitesi Script Insertion Vulnerabilities
[SA25930] Oliver Library Management System Cross-Site Scripting
Vulnerabilities
[SA25917] Efendy Blog "ara" Cross-Site Scripting
UNIX/Linux:
[SA25911] SUSE update for krb5
[SA25905] Gentoo update for openoffice and openoffice-bin
[SA25903] Wheatblog File Inclusion and SQL Injection Vulnerabilities
[SA25894] SGI Advanced Linux Environment Multiple Updates
[SA25890] Debian update for krb5
[SA25888] Trustix update for kerberos5
[SA25949] Ubuntu update for gimp
[SA25933] Mandriva update for kdebase
[SA25932] SUSE update for libexif
[SA25925] Girlserv Ads "idnew" SQL Injection Vulnerability
[SA25923] Knowledgeroot Knowledgebase FCKeditor ADS File Upload
Vulnerability
[SA25944] ServerView DBAsciiAccess Command Execution Vulnerability
[SA25946] Mandriva update for mysql
[SA25935] Avaya Products util-linux Security Issue
[SA25934] Avaya Products GDB "DWARF" Buffer Overflow Vulnerabilities
[SA25931] SUSE update for file
[SA25906] Gentoo update for evolution-data-server
[SA25914] Debian update for gsambad
[SA25913] Debian update for fireflier-server
[SA25912] Debian update for unicon-imc2
[SA25910] UNICON "HOME" Environment Variable Buffer Overflow
Vulnerability
[SA25909] GSAMBAD "populate_conns()" Insecure Temporary Files
[SA25900] FireFlier Insecure Use of Temporary Files
[SA25896] Avaya Products Shadow "useradd.c" Insecure Mailbox File
Permissions
[SA25920] Mandriva update for apache
[SA25936] Avaya CMS / IR Solaris scp Command Line Shell Command
Injection
[SA25895] Linux Kernel USBLCD Driver Out of Memory Denial of Service
Other:
[SA25902] Yoggie Pico Pro Shell Command Injection Vulnerability
[SA25889] Xerox ESS/ Network Controller OpenSSL Vulnerabilities
[SA25943] Fujitsu PRIMERGY BX300 Web Interface Authentication Bypass
Cross Platform:
[SA25898] Ripe Website Manager File Inclusion and Information Exposure
[SA25928] PHP Director "id" SQL Injection Vulnerability
[SA25927] AV Arcade "id" SQL Injection Vulnerability
[SA25926] Elite Bulletin Board Two Vulnerabilities
[SA25924] bbs100 Multiple Denial of Service Vulnerabilities
[SA25922] Youtube Script "id" SQL Injection Vulnerability
[SA25921] SuperCali PHP Event Calendar "o" SQL Injection
[SA25916] ArcadeBuilder Game Portal Manager SQL Injection
[SA25915] phpEventCalendar "id" SQL Injection Vulnerability
[SA25901] 1-2-3 Music Store "CategoryID" SQL Injection
[SA25899] TotalCalendar "id" SQL Injection Vulnerability
[SA25893] GL-SH Deaf Forum Two Local File Inclusion Vulnerabilities
[SA25892] WebChat "rid" SQL Injection Vulnerability
[SA25947] ManageEngine NetFlow Analyzer Multiple Cross-Site Scripting
Vulnerabilities
[SA25942] Zen Cart Session Fixation Vulnerability
[SA25929] Moodle "search" Cross-Site Scripting Vulnerability
[SA25919] Oracle Rapid Install Cross-Site Scripting Vulnerability
[SA25907] PHP-Fusion "FUSION_QUERY" Cross-Site Scripting Vulnerability
[SA25887] Claroline "$_SERVER['PHP_SELF']" Cross-Site Scripting
Vulnerability
[SA25904] Firefox "OnKeyDown" Event Focus Weakness
========================================================================
5) Vulnerabilities Content Listing
Windows:--
[SA25918] HP Instant Support Driver Check sdd.dll Buffer Overflow
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-07-03
A vulnerability has been reported in HP Instant Support Driver Check,
which can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/25918/
--
[SA25891] AMX VNC ActiveX Control Buffer Overflow Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-06-29
rgod has discovered some vulnerabilities in AMX VNC ActiveX Control,
which can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/25891/
--
[SA25908] Gorki Online Santrac Sitesi Script Insertion Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-07-02
GeFORC3 has reported some vulnerabilities in Gorki Online Santrac
Sitesi, which can be exploited by malicious people to conduct script
insertion attacks.
Full Advisory:
http://secunia.com/advisories/25908/
--
[SA25930] Oliver Library Management System Cross-Site Scripting
Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-07-04
A. R. has reported some vulnerabilities in Oliver Library Management
System, which can be exploited by malicious people to conduct
cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/25930/
--
[SA25917] Efendy Blog "ara" Cross-Site Scripting
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-07-02
GeFORC3 has reported a vulnerability in Efendy Blog, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/25917/
UNIX/Linux:--
[SA25911] SUSE update for krb5
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2007-07-04
SUSE has issued an update for krb5. This fixes some vulnerabilities,
which can be exploited by malicious users and malicious people to
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/25911/
--
[SA25905] Gentoo update for openoffice and openoffice-bin
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-07-03
Gentoo has issued an update for openoffice and openoffice-bin. This
fixes some vulnerabilities, which can be exploited by malicious people
to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/25905/
--
[SA25903] Wheatblog File Inclusion and SQL Injection Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Manipulation of data, Exposure of system information,
Exposure of sensitive information, System access
Released: 2007-07-02
E.Minaev has discovered two vulnerabilities in Wheatblog, which can be
exploited by malicious people to conduct SQL injection attacks,
disclose sensitive information, or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/25903/
--
[SA25894] SGI Advanced Linux Environment Multiple Updates
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Exposure of sensitive information,
Privilege escalation, DoS, System access
Released: 2007-06-29
SGI has issued multiple updates for SGI Advanced Linux Environment.
These fix some vulnerabilities, which can be exploited by malicious,
local users to bypass certain security restrictions or to perform
certain actions with escalated privileges, by malicious users to bypass
certain security restrictions or to compromise a vulnerable system, and
by malicious people to disclose potentially sensitive information, to
cause a DoS (Denial of Service), or to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/25894/
--
[SA25890] Debian update for krb5
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2007-06-29
Debian has issued an update for krb5. This fixes some vulnerabilities,
which can be exploited by malicious users and malicious people to
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/25890/
--
[SA25888] Trustix update for kerberos5
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2007-06-29
Trustix has issued an update for kerberos5. This fixes some
vulnerabilities, which can be exploited by malicious users and
malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/25888/
--
[SA25949] Ubuntu update for gimp
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2007-07-05
Ubuntu has issued an update for gimp. This fixes a vulnerability, which
can be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/25949/
--
[SA25933] Mandriva update for kdebase
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2007-07-04
Mandriva has issued an update for kdebase. This fixes a vulnerability,
which can be exploited by malicious people to disclose potentially
sensitive information.
Full Advisory:
http://secunia.com/advisories/25933/
--
[SA25932] SUSE update for libexif
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2007-07-04
SUSE has issued an update for libexif. This fixes some vulnerabilities,
which can be exploited by malicious people to cause a DoS (Denial of
Service) or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/25932/
--
[SA25925] Girlserv Ads "idnew" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information
Released: 2007-07-04
Cold z3ro has discovered a vulnerability in Girlserv Ads, which can be
exploited by malicious people to conduct SQL Injection attacks.
Full Advisory:
http://secunia.com/advisories/25925/
--
[SA25923] Knowledgeroot Knowledgebase FCKeditor ADS File Upload
Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Security Bypass
Released: 2007-07-02
A vulnerability has been acknowledged in Knowledgeroot Knowledgebase,
which can be exploited by malicious people to bypass certain security
restrictions.
Full Advisory:
http://secunia.com/advisories/25923/
--
[SA25944] ServerView DBAsciiAccess Command Execution Vulnerability
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2007-07-05
RedTeam Pentesting has reported a vulnerability in ServerView, which
can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/25944/
--
[SA25946] Mandriva update for mysql
Critical: Less critical
Where: From remote
Impact: Privilege escalation, DoS
Released: 2007-07-05
Mandriva has issued an update for mysql. This fixes some
vulnerabilities and a security issue, which can be exploited by
malicious users to cause a DoS (Denial of Service) or gain escalated
privileges.
Full Advisory:
http://secunia.com/advisories/25946/
--
[SA25935] Avaya Products util-linux Security Issue
Critical: Less critical
Where: From remote
Impact: Security Bypass
Released: 2007-07-04
Avaya has acknowledged a security issue in various Avaya products,
which can be exploited by malicious users to bypass certain security
restrictions.
Full Advisory:
http://secunia.com/advisories/25935/
--
[SA25934] Avaya Products GDB "DWARF" Buffer Overflow Vulnerabilities
Critical: Less critical
Where: From remote
Impact: DoS, System access
Released: 2007-07-04
Avaya has acknowledged some vulnerabilities in various Avaya products,
which potentially can be exploited by malicious, local users to gain
escalated privileges or malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/25934/
--
[SA25931] SUSE update for file
Critical: Less critical
Where: From remote
Impact: DoS, System access
Released: 2007-07-04
SUSE has issued an update for file. This fixes a vulnerability, which
potentially can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/25931/
--
[SA25906] Gentoo update for evolution-data-server
Critical: Less critical
Where: From remote
Impact: System access, DoS
Released: 2007-07-03
Gentoo has issued an update for evolution-data-server. This fixes a
vulnerability, which can be exploited by malicious people to compromise
a user's system.
Full Advisory:
http://secunia.com/advisories/25906/
--
[SA25914] Debian update for gsambad
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-07-02
Debian has issued an update for gsambad. This fixes a security issue,
which can be exploited by malicious, local users to perform certain
actions with escalated privileges.
Full Advisory:
http://secunia.com/advisories/25914/
--
[SA25913] Debian update for fireflier-server
Critical: Less critical
Where: Local system
Impact: Manipulation of data
Released: 2007-07-02
Debian has issued an update for fireflier-server. This fixes a security
issue, which can be exploited by malicious, local users to delete
arbitrary files.
Full Advisory:
http://secunia.com/advisories/25913/
--
[SA25912] Debian update for unicon-imc2
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-07-02
Debian has issued an update for unicon-imc2. This fixes a
vulnerability, which potentially can be exploited by malicious, local
users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/25912/
--
[SA25910] UNICON "HOME" Environment Variable Buffer Overflow
Vulnerability
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-07-02
Steve Kemp has reported a vulnerability in UNICON, which potentially
can be exploited by malicious, local users to gain escalated
privileges.
Full Advisory:
http://secunia.com/advisories/25910/
--
[SA25909] GSAMBAD "populate_conns()" Insecure Temporary Files
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-07-02
Steve Kemp has reported a security issue in GSAMBAD, which can be
exploited by malicious, local users to perform certain actions with
escalated privileges.
Full Advisory:
http://secunia.com/advisories/25909/
--
[SA25900] FireFlier Insecure Use of Temporary Files
Critical: Less critical
Where: Local system
Impact: Manipulation of data
Released: 2007-07-02
Steve Kemp has reported a security issue in FireFlier, which can be
exploited by malicious, local users to delete arbitrary files.
Full Advisory:
http://secunia.com/advisories/25900/
--
[SA25896] Avaya Products Shadow "useradd.c" Insecure Mailbox File
Permissions
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-06-29
Avaya has acknowledged a security issue in various Avaya products,
which potentially can be exploited by malicious, local users to perform
certain actions with escalated privileges.
Full Advisory:
http://secunia.com/advisories/25896/
--
[SA25920] Mandriva update for apache
Critical: Not critical
Where: From remote
Impact: Cross Site Scripting, DoS
Released: 2007-07-05
Mandriva has issued an update for apache. This fixes some
vulnerabilities, which can be exploited by malicious, local users to
cause a DoS (Denial of Service) and malicious people to conduct
cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/25920/
--
[SA25936] Avaya CMS / IR Solaris scp Command Line Shell Command
Injection
Critical: Not critical
Where: Local system
Impact: Privilege escalation
Released: 2007-07-04
Avaya has acknowledged a weakness in Avaya CMS and IR, which can be
exploited by malicious, local users to perform certain actions with
escalated privileges.
Full Advisory:
http://secunia.com/advisories/25936/
--
[SA25895] Linux Kernel USBLCD Driver Out of Memory Denial of Service
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2007-07-02
A security issue has been reported in the Linux Kernel, which can be
exploited by malicious, local users to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/25895/
Other:--
[SA25902] Yoggie Pico Pro Shell Command Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2007-07-03
Cody Brocious has reported a vulnerability in Yoggie Pico Pro, which
can be exploited by malicious people to compromise a vulnerable
device.
Full Advisory:
http://secunia.com/advisories/25902/
--
[SA25889] Xerox ESS/ Network Controller OpenSSL Vulnerabilities
Critical: Moderately critical
Where: From local network
Impact: DoS, System access
Released: 2007-06-29
Some vulnerabilities have been reported in Xerox ESS/ Network
Controller, which can be exploited by malicious people to cause a DoS
(Denial of Service) and compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/25889/
--
[SA25943] Fujitsu PRIMERGY BX300 Web Interface Authentication Bypass
Critical: Less critical
Where: From local network
Impact: Security Bypass
Released: 2007-07-05
RedTeam Pentesting has reported a security issue in PRIMERGY BX300,
which can be exploited by malicious people to bypass certain security
restrictions.
Full Advisory:
http://secunia.com/advisories/25943/
Cross Platform:--
[SA25898] Ripe Website Manager File Inclusion and Information Exposure
Critical: Highly critical
Where: From remote
Impact: Exposure of system information, Exposure of sensitive
information, System access
Released: 2007-07-02
Some vulnerabilities have been reported in Ripe Website Manager, which
can be exploited by malicious people to disclose sensitive information
or to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/25898/
--
[SA25928] PHP Director "id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-07-03
Kw3rLn has discovered a vulnerability in PHP Director, which can be
exploited by malicious people to conduct SQL Injection attacks.
Full Advisory:
http://secunia.com/advisories/25928/
--
[SA25927] AV Arcade "id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information, Manipulation of data
Released: 2007-07-03
Kw3rLn has discovered a vulnerability in AV Arcade, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/25927/
--
[SA25926] Elite Bulletin Board Two Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-07-04
Two vulnerabilities have been reported in Elite Bulletin Board, which
can be exploited by malicious users and malicious people to manipulate
certain data.
Full Advisory:
http://secunia.com/advisories/25926/
--
[SA25924] bbs100 Multiple Denial of Service Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2007-07-03
Some vulnerabilities have been reported in bbs100, which potentially
can be exploited by malicious users or malicious people to cause a DoS
(Denial of Service).
Full Advisory:
http://secunia.com/advisories/25924/
--
[SA25922] Youtube Script "id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-07-02
t0pP8uZz & xprog has reported a vulnerability in Youtube Script, which
can be exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/25922/
--
[SA25921] SuperCali PHP Event Calendar "o" SQL Injection
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information
Released: 2007-07-04
A vulnerability has been discovered in SuperCali PHP Event Calendar,
which can be exploited by malicious people to conduct SQL Injection
attacks.
Full Advisory:
http://secunia.com/advisories/25921/
--
[SA25916] ArcadeBuilder Game Portal Manager SQL Injection
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Manipulation of data
Released: 2007-07-04
A vulnerability has been reported in ArcadeBuilder Game Portal Manager,
which can be exploited by malicious people to conduct SQL Injection
attacks.
Full Advisory:
http://secunia.com/advisories/25916/
--
[SA25915] phpEventCalendar "id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information
Released: 2007-07-02
Iron has discovered a vulnerability in phpEventCalendar, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/25915/
--
[SA25901] 1-2-3 Music Store "CategoryID" SQL Injection
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information
Released: 2007-07-03
A vulnerability has been reported in 1-2-3 Music Store, which can be
exploited by malicious people to conduct SQL Injection attacks.
Full Advisory:
http://secunia.com/advisories/25901/
--
[SA25899] TotalCalendar "id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information
Released: 2007-07-02
t0pP8uZz & xprog have reported a vulnerability in TotalCalendar, which
can be exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/25899/
--
[SA25893] GL-SH Deaf Forum Two Local File Inclusion Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Exposure of system information, Exposure of sensitive
information
Released: 2007-06-29
Katatafish has discovered two vulnerabilities in GL-SH Deaf Forum,
which can be exploited by malicious people to disclose sensitive
information.
Full Advisory:
http://secunia.com/advisories/25893/
--
[SA25892] WebChat "rid" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information
Released: 2007-06-29
R00T[ATI] has discovered a vulnerability in WebChat, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/25892/
--
[SA25947] ManageEngine NetFlow Analyzer Multiple Cross-Site Scripting
Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-07-05
Lostmon has discovered some vulnerabilities in ManageEngine NetFlow
Analyzer, which can be exploited by malicious people to conduct
cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/25947/
--
[SA25942] Zen Cart Session Fixation Vulnerability
Critical: Less critical
Where: From remote
Impact: Hijacking
Released: 2007-07-05
Tomaz Bratusa has discovered a vulnerability in Zen Cart, which can be
exploited by malicious people to conduct session fixation attacks.
Full Advisory:
http://secunia.com/advisories/25942/
--
[SA25929] Moodle "search" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-07-05
MustLive has discovered a vulnerability in Moodle, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/25929/
--
[SA25919] Oracle Rapid Install Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-07-05
A vulnerability has been reported in Oracle Rapid Install, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/25919/
--
[SA25907] PHP-Fusion "FUSION_QUERY" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-07-02
nights_shadow has discovered a vulnerability in PHP-Fusion, which can
be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/25907/
--
[SA25887] Claroline "$_SERVER['PHP_SELF']" Cross-Site Scripting
Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-07-02
munozferna has reported a vulnerability in Claroline, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/25887/
--
[SA25904] Firefox "OnKeyDown" Event Focus Weakness
Critical: Not critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2007-07-02
Carl Hardwick has discovered a weakness in Firefox, which potentially
can be exploited by malicious people to disclose sensitive
information.
Full Advisory:
http://secunia.com/advisories/25904/
========================================================================
Secunia recommends that you verify all advisories you receive,
by clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only use
those supplied by the vendor.
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Subscribe:
http://secunia.com/secunia_weekly_summary/
Contact details:
Web : http://secunia.com/
E-mail : support@private
Tel : +45 70 20 51 44
Fax : +45 70 20 51 45
_____________________________________________________
Attend Black Hat USA, July 28-August 2 in Las Vegas,
the world's premier technical event for ICT security
experts. Featuring 30 hands-on training courses and
90 Briefings presentations with lots of new content
and new tools. Network with 4,000 delegates from
70 nations. Visit product displays by 30 top
sponsors in a relaxed setting. Rates increase on
June 1 so register today. http://www.blackhat.com
This archive was generated by hypermail 2.1.3 : Thu Jul 05 2007 - 23:38:37 PDT