========================================================================
The Secunia Weekly Advisory Summary
2008-05-15 - 2008-05-22
This week: 64 advisories
========================================================================
Table of Contents:
1.....................................................Word From Secunia
2....................................................This Week In Brief
3...............................This Weeks Top Ten Most Read Advisories
4.......................................Vulnerabilities Summary Listing
5.......................................Vulnerabilities Content Listing
========================================================================
1) Word From Secunia:
Secunia is pleased to announce that we are sponsoring the upcoming
Gartner IT Security Summit from June 2 to 4 in Washington, DC. The
event brings together Gartner analysts, leading executives, and
innovators to present research, case studies, and insight into the
business-critical aspect of IT.
If you would like to meet with Secunia representatives in the
conference, you can get a $400 discount off the regular registration
fee. Please contact pr@private to receive the priority code and
schedule the meeting.
========================================================================
2) This Week in Brief:
Secunia Research has discovered a vulnerability in Foxit Reader, which
can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to a boundary error when parsing format
strings containing a floating point specifier in the "util.printf()"
JavaScript function. This can be exploited to cause a stack-based
buffer overflow via a specially crafted PDF file.
Successful exploitation allows execution of arbitrary code.
Reference:
http://secunia.com/advisories/29941/
--
Some vulnerabilities have been reported in Trillian, which can be
exploited by malicious people to compromise a user's system.
Successful exploitation allows execution of arbitrary code but requires
that the user is tricked into opening a malicious image file.
Reference:
http://secunia.com/advisories/30336/
Secunia has constructed the Secunia Personal Software Inspector, which
you can use to check if your personal system is vulnerable:
https://psi.secunia.com/
Corporate users can request for a trial of the Secunia Network Software
Inspector, which you can use to check which systems in your network are
vulnerable:
http://secunia.com/network_software_inspector/
--
Some vulnerabilities have been reported in FileZilla, which can be
exploited by malicious people to cause a DoS (Denial of Service) or to
potentially compromise a user's system.
The vulnerabilities are caused due to the precompiled packages
including a vulnerable version of the GnuTLS library.
Reference:
http://secunia.com/advisories/30330/
--
VIRUS ALERTS:
During the past week Secunia collected 117 virus descriptions from the
Antivirus vendors. However, none were deemed MEDIUM risk or higher
according to the Secunia assessment scale.
========================================================================
3) This Weeks Top Ten Most Read Advisories:
1. [SA30220] Debian OpenSSL Predictable Random Number Generator and
Update
2. [SA30241] Linux Kernel Multiple Vulnerabilities
3. [SA29941] Foxit Reader "util.printf()" Buffer Overflow
4. [SA30261] Symantec Altiris Deployment Solution Multiple
Vulnerabilities
5. [SA30140] Oracle Application Server Portal Authentication Bypass
6. [SA30143] Microsoft Word Two Code Execution Vulnerabilities
7. [SA30196] Model Search "cat" SQL Injection Vulnerability
8. [SA30273] 68 Classifieds "cat" SQL Injection Vulnerability
9. [SA30201] Kostenloses Linkmanagementscript Multiple Vulnerabilities
10. [SA30254] Pet Grooming Management System "useradded.php"
Security Bypass
========================================================================
4) Vulnerabilities Summary Listing
Windows:
[SA30336] Trillian Multiple Vulnerabilities
[SA30309] IBM Lotus Sametime Community Services Multiplexer Buffer
Overflow
[SA30305] PhotoStockPlus Uploader Tool ActiveX Control Buffer
Overflows
[SA30295] how2ASP Webboard "qNo" SQL Injection Vulnerability
[SA30333] AppServ "appservlang" Cross-Site Scripting Vulnerability
[SA30289] Cisco Voice Portal Privilege Escalation Vulnerability
[SA30297] Stunnel Windows Privilege Escalation Vulnerability
UNIX/Linux:
[SA30338] Gentoo update for gnutls
[SA30331] Ubuntu update for gnutls
[SA30328] Gentoo update for clamav
[SA30327] Gentoo Update for Mozilla Products
[SA30325] Debian update for gnome-peercast
[SA30324] Debian update for gnutls13
[SA30320] Debian update for peercast
[SA30317] Red Hat update for gnutls
[SA30302] Fedora update for gnutls
[SA30287] GnuTLS Multiple Vulnerabilities
[SA30358] Debian update for speex
[SA30353] Debian update for libfishsound
[SA30346] Interchange Unspecified HTTP POST Request Denial of Service
[SA30341] Red Hat update for vsftpd
[SA30326] Gentoo update for perl and libperl
[SA30323] Red Hat update for libxslt
[SA30288] Debian update for php4
[SA30280] Debian update for netpbm-free
[SA30352] Red Hat update for nss_ldap
[SA30342] Red Hat update for dovecot
[SA30313] Red Hat update for bind
[SA30291] Fedora update for Django
[SA30283] Nagios CGI Unspecified Cross-Site Scripting Vulnerability
[SA30351] Red Hat update for mysql
[SA30312] Mtr "split_redraw()" Buffer Overflow Vulnerability
[SA30294] Red Hat update for kernel
[SA30361] IBM AIX update for OpenSSH
[SA30349] IBM AIX Multiple Vulnerabilities
[SA30339] Red Hat update for setroubleshoot
[SA30286] Debian update for gforge
[SA30360] IBM AIX ftpd "quote cwd" Full Path Disclosure Weakness
[SA30357] Sun Solaris STREAMS Administrative Driver Denial of Service
[SA30329] Red Hat update for compiz
[SA30308] HP-UX useradd Security Bypass
Other:
[SA30322] Cisco IOS SSH Server Denial of Service
[SA30316] Cisco Service Control Engine SSH Server Denial of Service
Vulnerabilities
Cross Platform:
[SA30332] IBM Lotus Domino 6 Web Server Cross-Site Scripting and Buffer
Overflow
[SA30330] FileZilla GnuTLS Multiple Vulnerabilities
[SA30310] IBM Lotus Domino Web Server Cross-Site Scripting and Buffer
Overflow
[SA30319] ComicShout "comic_id" SQL Injection Vulnerability
[SA30315] libxslt XSL File Processing Vulnerability
[SA30314] PHP-Jokesite "cat_id" SQL Injection Vulnerability
[SA30304] PHP-Fusion Forum Rank System Local File Inclusion
[SA30301] GNU/Gallery "show" Local File Inclusion Vulnerability
[SA30299] Borland Interbase 2007 Packet Processing Buffer Overflow
[SA30296] WR-Meeting "msnum" File Disclosure Vulnerability
[SA30293] CMS WebManager-Pro SQL Injection Vulnerabilities
[SA30284] FireFTP Extension for Firefox Directory Traversal
Vulnerability
[SA30282] SunShop Shopping Cart "id" SQL Injection Vulnerability
[SA30281] FicHive "letter" SQL Injection Vulnerability
[SA30279] Rantx "logininfo" Security Bypass Vulnerability
[SA30300] CA ARCserve Backup Multiple Vulnerabilities
[SA30356] IBM HTTP Server Multiple Cross-Site Scripting
Vulnerabilities
[SA30348] Snort Fragmented IP Packets TTL Security Bypass
[SA30335] Stunnel OCSP Revoked Certificate Security Issue
[SA30334] SAP Web Application Server Cross-Site Scripting
Vulnerability
[SA30307] dotCMS "search_query" Cross-Site Scripting Vulnerability
========================================================================
5) Vulnerabilities Content Listing
Windows:--
[SA30336] Trillian Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2008-05-22
Some vulnerabilities have been reported in Trillian, which can be
exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/30336/
--
[SA30309] IBM Lotus Sametime Community Services Multiplexer Buffer
Overflow
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2008-05-22
A vulnerability has been reported in IBM Lotus Sametime, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/30309/
--
[SA30305] PhotoStockPlus Uploader Tool ActiveX Control Buffer
Overflows
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2008-05-20
Will Dormann has reported some vulnerabilities in PhotoStockPlus
Uploader Tool ActiveX control, which can be exploited by malicious
people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/30305/
--
[SA30295] how2ASP Webboard "qNo" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2008-05-20
CWH Underground has discovered a vulnerability in how2ASP Webboard,
which can be exploited by malicious people to conduct SQL injection
attacks.
Full Advisory:
http://secunia.com/advisories/30295/
--
[SA30333] AppServ "appservlang" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2008-05-21
tan_prathan has reported a vulnerability in AppServ, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/30333/
--
[SA30289] Cisco Voice Portal Privilege Escalation Vulnerability
Critical: Less critical
Where: From local network
Impact: Privilege escalation
Released: 2008-05-22
A vulnerability has been reported in Cisco Voice Portal (CVP), which
can be exploited by malicious users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/30289/
--
[SA30297] Stunnel Windows Privilege Escalation Vulnerability
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2008-05-20
A vulnerability has been reported in Stunnel, which can be exploited by
malicious, local users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/30297/
UNIX/Linux:--
[SA30338] Gentoo update for gnutls
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2008-05-22
Gentoo has issued an update for gnutls. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) or to potentially compromise an application
using the library.
Full Advisory:
http://secunia.com/advisories/30338/
--
[SA30331] Ubuntu update for gnutls
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2008-05-22
Ubuntu has issued an update for gnutls. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) or to potentially compromise an application
using the library.
Full Advisory:
http://secunia.com/advisories/30331/
--
[SA30328] Gentoo update for clamav
Critical: Highly critical
Where: From remote
Impact: Security Bypass, DoS, System access
Released: 2008-05-21
Gentoo has issued an update for clamav. This fixes some
vulnerabilities, which can be exploited by malicious people to bypass
certain security restrictions, to cause a DoS (Denial of Service), or
to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/30328/
--
[SA30327] Gentoo Update for Mozilla Products
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, Spoofing, Exposure
of sensitive information, DoS, System access
Released: 2008-05-21
Gentoo has issued updates for mozilla-firefox, mozilla-firefox-bin,
seamonkey, seamonkey-bin, mozilla-thunderbird, mozilla-thunderbird-bin,
and xulrunner. These fix some weaknesses and vulnerabilities, which can
be exploited by malicious people to disclose sensitive information,
conduct cross-site scripting attacks, bypass certain security
restrictions, conduct spoofing attacks, or to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/30327/
--
[SA30325] Debian update for gnome-peercast
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2008-05-21
Debian has issued an update for gnome-peercast. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) and potentially compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/30325/
--
[SA30324] Debian update for gnutls13
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2008-05-21
Debian has issued an update for gnutls13. This fixes some
vulnerabilities, which can be exploited to cause a DoS (Denial of
Service) or to potentially compromise an application using the
library.
Full Advisory:
http://secunia.com/advisories/30324/
--
[SA30320] Debian update for peercast
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2008-05-21
Debian has issued an update for peercast. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service) or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/30320/
--
[SA30317] Red Hat update for gnutls
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2008-05-21
Red Hat has issued an update for gnutls. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) or to potentially compromise an application
using the library.
Full Advisory:
http://secunia.com/advisories/30317/
--
[SA30302] Fedora update for gnutls
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2008-05-21
Fedora has issued an update for gnutls. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) or to potentially compromise an application
using the library.
Full Advisory:
http://secunia.com/advisories/30302/
--
[SA30287] GnuTLS Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2008-05-21
Some vulnerabilities have been reported in GnuTLS, which can be
exploited by malicious people to cause a DoS (Denial of Service) or to
potentially compromise an application using the library.
Full Advisory:
http://secunia.com/advisories/30287/
--
[SA30358] Debian update for speex
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2008-05-22
Debian has issued an update for speex. This fixes a vulnerability,
which can be exploited by malicious people to compromise an application
using the library.
Full Advisory:
http://secunia.com/advisories/30358/
--
[SA30353] Debian update for libfishsound
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2008-05-22
Debian has issued an update for libfishsound. This fixes a
vulnerability, which can be exploited by malicious people to compromise
an application using the library.
Full Advisory:
http://secunia.com/advisories/30353/
--
[SA30346] Interchange Unspecified HTTP POST Request Denial of Service
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2008-05-22
A vulnerability has been reported in Interchange, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/30346/
--
[SA30341] Red Hat update for vsftpd
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2008-05-22
Red Hat has issued an update for vsftpd. This fixes a vulnerability,
which can be exploited by malicious users to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/30341/
--
[SA30326] Gentoo update for perl and libperl
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2008-05-21
Gentoo has issued an update for perl and libperl. This fixes a
vulnerability, which potentially can be exploited by malicious people
to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/30326/
--
[SA30323] Red Hat update for libxslt
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2008-05-21
Red Hat has issued an update for libxslt. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service) and potentially to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/30323/
--
[SA30288] Debian update for php4
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Exposure of sensitive information, DoS,
System access
Released: 2008-05-19
Debian has issued an update for php4. This fixes some vulnerabilities,
which can be exploited by malicious, local users to bypass certain
security restrictions, and malicious people to disclose potentially
sensitive information, bypass certain security restrictions, cause a
DoS (Denial of Service), and potentially compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/30288/
--
[SA30280] Debian update for netpbm-free
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2008-05-19
Debian has issued an update for netpbm-free. This fixes a
vulnerability, which can potentially be exploited by malicious people
to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/30280/
--
[SA30352] Red Hat update for nss_ldap
Critical: Less critical
Where: From remote
Impact: Manipulation of data
Released: 2008-05-22
Red Hat has issued an update for nss_ldap. This fixes a security issue,
which can be exploited by malicious people to manipulate certain data.
Full Advisory:
http://secunia.com/advisories/30352/
--
[SA30342] Red Hat update for dovecot
Critical: Less critical
Where: From remote
Impact: Security Bypass
Released: 2008-05-22
Red Hat has issued an update for dovecot. This fixes a weakness and a
security issue, which can be exploited by malicious users to bypass
certain security restrictions.
Full Advisory:
http://secunia.com/advisories/30342/
--
[SA30313] Red Hat update for bind
Critical: Less critical
Where: From remote
Impact: Security Bypass, DoS, System access
Released: 2008-05-22
Red Hat has issued an update for bind. This fixes a security issue,
which can be exploited by malicious, local users to bypass certain
security restrictions, and a vulnerability, which can be exploited by
malicious people to cause a DoS (Denial of Service) or to potentially
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/30313/
--
[SA30291] Fedora update for Django
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2008-05-21
Fedora has issued an update for Django. This fixes a vulnerability,
which can be exploited by malicious people to conduct cross-site
scripting attacks.
Full Advisory:
http://secunia.com/advisories/30291/
--
[SA30283] Nagios CGI Unspecified Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2008-05-20
A vulnerability has been reported in Nagios, which can be exploited by
malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/30283/
--
[SA30351] Red Hat update for mysql
Critical: Less critical
Where: From local network
Impact: Security Bypass, Privilege escalation, DoS
Released: 2008-05-22
Red Hat has issued an update for mysql. This fixes some security issues
and vulnerabilities, which can be exploited by malicious users to cause
a DoS (Denial of Service), bypass certain security restrictions, and
gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/30351/
--
[SA30312] Mtr "split_redraw()" Buffer Overflow Vulnerability
Critical: Less critical
Where: From local network
Impact: System access
Released: 2008-05-20
Adam Zabrocki has discovered a vulnerability in Mtr, which potentially
can be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/30312/
--
[SA30294] Red Hat update for kernel
Critical: Less critical
Where: From local network
Impact: DoS
Released: 2008-05-20
Red Hat has issued an update for the kernel. This fixes some
vulnerabilities, which can be exploited by malicious, local users and
malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/30294/
--
[SA30361] IBM AIX update for OpenSSH
Critical: Less critical
Where: Local system
Impact: Security Bypass, Exposure of sensitive information
Released: 2008-05-22
IBM has acknowledged some vulnerabilities in OpenSSH, which can be
exploited by malicious, local users to bypass certain security
restrictions or disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/30361/
--
[SA30349] IBM AIX Multiple Vulnerabilities
Critical: Less critical
Where: Local system
Impact: Privilege escalation, DoS
Released: 2008-05-22
Some vulnerabilities have been reported in IBM AIX, which can be
exploited by malicious, local users to cause a DoS (Denial of Service)
or gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/30349/
--
[SA30339] Red Hat update for setroubleshoot
Critical: Less critical
Where: Local system
Impact: Cross Site Scripting, Privilege escalation
Released: 2008-05-22
Red Hat has issued an update for setroubleshoot. This fixes two
security issues, which can be exploited by malicious, local users to
conduct script insertion attacks and to perform certain actions with
escalated privileges.
Full Advisory:
http://secunia.com/advisories/30339/
--
[SA30286] Debian update for gforge
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2008-05-16
Debian has issued an update for gforge. This fixes a security issue,
which can be exploited by malicious, local users to perform certain
actions with escalated privileges.
Full Advisory:
http://secunia.com/advisories/30286/
--
[SA30360] IBM AIX ftpd "quote cwd" Full Path Disclosure Weakness
Critical: Not critical
Where: From remote
Impact: Exposure of system information
Released: 2008-05-22
A weakness has been reported in IBM AIX, which can be exploited by
malicious people to disclose system information.
Full Advisory:
http://secunia.com/advisories/30360/
--
[SA30357] Sun Solaris STREAMS Administrative Driver Denial of Service
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2008-05-22
A vulnerability has been reported in Sun Solaris, which can be
exploited by malicious, local users to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/30357/
--
[SA30329] Red Hat update for compiz
Critical: Not critical
Where: Local system
Impact: Security Bypass
Released: 2008-05-22
Red Hat has issued an update for compiz. This fixes a security issue,
which can be exploited by malicious people with physical access to a
system to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/30329/
--
[SA30308] HP-UX useradd Security Bypass
Critical: Not critical
Where: Local system
Impact: Security Bypass
Released: 2008-05-20
A security issue has been reported in HP-UX, which can be exploited by
malicious, local users to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/30308/
Other:--
[SA30322] Cisco IOS SSH Server Denial of Service
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2008-05-22
Some vulnerabilities have been reported in Cisco IOS, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/30322/
--
[SA30316] Cisco Service Control Engine SSH Server Denial of Service
Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2008-05-22
Some vulnerabilities have been reported in Cisco Service Control
Engine, which can be exploited by malicious people to cause a DoS
(Denial of Service).
Full Advisory:
http://secunia.com/advisories/30316/
Cross Platform:--
[SA30332] IBM Lotus Domino 6 Web Server Cross-Site Scripting and Buffer
Overflow
Critical: Highly critical
Where: From remote
Impact: Cross Site Scripting, DoS, System access
Released: 2008-05-21
Some vulnerabilities have been reported in IBM Lotus Domino, which can
be exploited by malicious people to conduct cross-site scripting
attacks or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/30332/
--
[SA30330] FileZilla GnuTLS Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2008-05-21
Some vulnerabilities have been reported in FileZilla, which can be
exploited by malicious people to cause a DoS (Denial of Service) or to
potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/30330/
--
[SA30310] IBM Lotus Domino Web Server Cross-Site Scripting and Buffer
Overflow
Critical: Highly critical
Where: From remote
Impact: Cross Site Scripting, DoS, System access
Released: 2008-05-21
Some vulnerabilities have been reported in IBM Lotus Domino, which can
be exploited by malicious people to conduct cross-site scripting
attacks or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/30310/
--
[SA30319] ComicShout "comic_id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information
Released: 2008-05-21
D3m0n has reported a vulnerability in ComicShout, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/30319/
--
[SA30315] libxslt XSL File Processing Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2008-05-21
A vulnerability has been reported in libxslt, which can be exploited by
malicious people to cause a DoS (Denial of Service) and potentially to
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/30315/
--
[SA30314] PHP-Jokesite "cat_id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2008-05-21
Cyb3r-1sT has reported a vulnerability in PHP-Jokesite, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/30314/
--
[SA30304] PHP-Fusion Forum Rank System Local File Inclusion
Critical: Moderately critical
Where: From remote
Impact: Exposure of system information, Exposure of sensitive
information
Released: 2008-05-20
Matrix86 has reported two vulnerabilities in the Forum Rank System
module for PHP-Fusion, which can be exploited by malicious people to
disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/30304/
--
[SA30301] GNU/Gallery "show" Local File Inclusion Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Exposure of system information, Exposure of sensitive
information
Released: 2008-05-19
t0pP8uZz has discovered a vulnerability in GNU/Gallery, which can be
exploited by malicious people to disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/30301/
--
[SA30299] Borland Interbase 2007 Packet Processing Buffer Overflow
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2008-05-21
Damian Frizza has reported a vulnerability in Borland Interbase, which
can be exploited by malicious people to cause a DoS (Denial of Service)
or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/30299/
--
[SA30296] WR-Meeting "msnum" File Disclosure Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Exposure of system information, Exposure of sensitive
information
Released: 2008-05-19
Cr@zy_King has discovered a vulnerability in WR-Meeting, which can be
exploited by malicious people to disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/30296/
--
[SA30293] CMS WebManager-Pro SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information
Released: 2008-05-19
dun has reported some vulnerabilities in CMS WebManager-Pro, which can
be exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/30293/
--
[SA30284] FireFTP Extension for Firefox Directory Traversal
Vulnerability
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2008-05-20
Tan Chew Keong has reported a vulnerability in the FireFTP extension
for Firefox, which can be exploited by malicious people to compromise a
user's system.
Full Advisory:
http://secunia.com/advisories/30284/
--
[SA30282] SunShop Shopping Cart "id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2008-05-19
irvian has reported a vulnerability in SunShop Shopping Cart, which can
be exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/30282/
--
[SA30281] FicHive "letter" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2008-05-21
A vulnerability has been discovered in FicHive, which can be exploited
by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/30281/
--
[SA30279] Rantx "logininfo" Security Bypass Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Security Bypass
Released: 2008-05-16
t0pP8uZz has discovered a vulnerability in Rantx, which can be
exploited by malicious people to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/30279/
--
[SA30300] CA ARCserve Backup Multiple Vulnerabilities
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2008-05-20
Some vulnerabilities have been reported in CA ARCserve Backup, which
can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/30300/
--
[SA30356] IBM HTTP Server Multiple Cross-Site Scripting
Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2008-05-22
IBM has acknowledged some vulnerabilities in IBM HTTP Server, which can
be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/30356/
--
[SA30348] Snort Fragmented IP Packets TTL Security Bypass
Critical: Less critical
Where: From remote
Impact: Security Bypass
Released: 2008-05-22
A vulnerability has been reported in Snort, which can be exploited by
malicious people to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/30348/
--
[SA30335] Stunnel OCSP Revoked Certificate Security Issue
Critical: Less critical
Where: From remote
Impact: Security Bypass
Released: 2008-05-22
A security issue has been reported in Stunnel, which can be exploited
by malicious people to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/30335/
--
[SA30334] SAP Web Application Server Cross-Site Scripting
Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2008-05-22
Digital Security Research Group has reported a vulnerability in SAP Web
Application Server, which can be exploited by malicious people to
conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/30334/
--
[SA30307] dotCMS "search_query" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2008-05-20
Russ McRee has reported a vulnerability in dotCMS, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/30307/
========================================================================
Secunia recommends that you verify all advisories you receive,
by clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only use
those supplied by the vendor.
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Subscribe:
http://secunia.com/secunia_weekly_summary/
Contact details:
Web : http://secunia.com/
E-mail : support@private
Tel : +45 70 20 51 44
Fax : +45 70 20 51 45
_______________________________________________
Attend Black Hat USA, August 2-7 in Las Vegas,
the world's premier technical event for ICT security experts.
Featuring 40 hands-on training courses and 80 Briefings
presentations with lots of new content and new tools.
Network with 4,000 delegates from 50 nations.
Visit product displays by 30 top sponsors in
a relaxed setting. http://www.blackhat.com
This archive was generated by hypermail 2.1.3 : Fri May 23 2008 - 00:25:36 PDT