[ISN] Secunia Weekly Summary - Issue: 2005-48
InfoSec News
isn at c4i.org
Fri Dec 2 01:15:21 EST 2005
========================================================================
The Secunia Weekly Advisory Summary
2005-11-24 - 2005-12-01
This week : 83 advisories
========================================================================
Table of Contents:
1.....................................................Word From Secunia
2....................................................This Week In Brief
3...............................This Weeks Top Ten Most Read Advisories
4.......................................Vulnerabilities Summary Listing
5.......................................Vulnerabilities Content Listing
========================================================================
1) Word From Secunia:
The Secunia staff is spending hours every day to assure you the best
and most reliable source for vulnerability information. Every single
vulnerability report is being validated and verified before a Secunia
advisory is written.
Secunia validates and verifies vulnerability reports in many different
ways e.g. by downloading the software and performing comprehensive
tests, by reviewing source code, or by validating the credibility of
the source from which the vulnerability report was issued.
As a result, Secunia's database is the most correct and complete source
for recent vulnerability information available on the Internet.
Secunia Online Vulnerability Database:
http://secunia.com/
========================================================================
2) This Week in Brief:
Some vulnerabilities have been reported in Sun Java JRE (Java Runtime
Environment), which can be exploited by malicious people to compromise
a user's system.
Please refer to the referenced Secunia advisory below for additional
information.
Reference:
http://secunia.com/SA17748
--
Apple has released a security update for Mac OS X, which fixes 13
vulnerabilities.
A complete list and details about the vulnerabilities can be found in
the Secunia advisory below.
Reference:
http://secunia.com/SA17813
VIRUS ALERTS:
Secunia has not issued any virus alerts during the week.
========================================================================
3) This Weeks Top Ten Most Read Advisories:
1. [SA15546] Microsoft Internet Explorer "window()" Arbitrary Code
Execution Vulnerability
2. [SA17748] Sun Java JRE Sandbox Security Bypass Vulnerabilities
3. [SA16907] Opera Command Line URL Shell Command Injection
4. [SA17437] Opera Macromedia Flash Player SWF Arbitrary Code
Execution
5. [SA17430] Macromedia Flash Player SWF File Handling Arbitrary Code
Execution
6. [SA11762] Opera Browser Favicon Displaying Address Bar Spoofing
Vulnerability
7. [SA15601] Mozilla / Mozilla Firefox Frame Injection Vulnerability
8. [SA17786] Linux Kernel Multiple Denial of Service Vulnerabilities
9. [SA17813] Mac OS X Security Update Fixes Multiple Vulnerabilities
10. [SA17780] Cisco IOS HTTP Server Script Insertion Vulnerability
========================================================================
4) Vulnerabilities Summary Listing
Windows:
[SA17765] Panda Antivirus ZOO Archive Decompression Buffer Overflow
[SA17792] ASP-rider "referer" Header SQL Injection Vulnerability
[SA17740] MailEnable "RENAME" Command Denial of Service Vulnerability
[SA17737] Freeftpd PORT Command Denial of Service Vulnerability
[SA17815] Cisco Security Agent Local Privilege Escalation
Vulnerability
UNIX/Linux:
[SA17813] Mac OS X Security Update Fixes Multiple Vulnerabilities
[SA17757] SGI Advanced Linux Environment Multiple Updates
[SA17738] Gentoo update for netscape-flash
[SA17778] Gentoo update for inkscape
[SA17775] KchmViewer chmlib Buffer Overflow Vulnerabilities
[SA17774] unalz Filename Handling Buffer Overflow Vulnerability
[SA17770] Debian update for gtk+2.0
[SA17768] ktools VGETSTRING Buffer Overflow Vulnerability
[SA17735] ShockBoard "offset" SQL Injection Vulnerability
[SA17817] Usermin "miniserv.pl" Format String Denial of Service
Vulnerability
[SA17749] Webmin "miniserv.pl" Format String Denial of Service
Vulnerability
[SA17754] NuFW Packet Parsing Denial of Service Vulnerability
[SA17781] QNX RTOS "phgrafx" Buffer Overflow Vulnerability
[SA17818] Debian update for centericq
[SA17798] Centericq Empty Packet Denial of Service Weakness
[SA17764] Kadu Message Denial of Service Weakness
[SA17739] Gaim-Encryption Malformed Encrypted Message Denial of
Service
[SA17787] Fedora update for kernel
[SA17786] Linux Kernel Multiple Denial of Service Vulnerabilities
[SA17761] Linux Kernel ptrace Denial of Service Vulnerability
Other:
[SA17780] Cisco IOS HTTP Server Script Insertion Vulnerability
Cross Platform:
[SA17790] GuppY PHP Code Injection and Local File Inclusion
Vulnerabilities
[SA17779] Ampache Snoopy "_httpsrequest()" Command Injection
Vulnerability
[SA17777] eFiction Multiple Vulnerabilities
[SA17771] Q-News "id" File Inclusion Vulnerability
[SA17748] Sun Java JRE Sandbox Security Bypass Vulnerabilities
[SA17730] DeskLance "main" File Inclusion Vulnerability
[SA17812] Atlantis Knowledge Base Software "searchStr" SQL Injection
[SA17811] FAQRing "id" SQL Injection Vulnerability
[SA17810] WSN Knowledge Base SQL Injection Vulnerabilities
[SA17809] Softbiz FAQ Script SQL Injection Vulnerabilities
[SA17808] Softbiz B2B Trading Marketplace Script "cid" SQL Injection
[SA17807] SocketKB SQL Injection and Local File Inclusion
Vulnerabilities
[SA17806] KBase Express SQL Injection Vulnerabilities
[SA17805] Orca Knowledgebase "qid" SQL Injection Vulnerability
[SA17804] Orca Blog "msg" SQL Injection Vulnerability
[SA17803] Orca Ringmaker "start" SQL Injection Vulnerability
[SA17801] FAQ System SQL Injection Vulnerabilities
[SA17800] Survey System "SURVEY_ID" SQL Injection Vulnerability
[SA17799] ltwCalendar "id" SQL Injection Vulnerability
[SA17796] 88Scripts Event Calendar "m" SQL Injection Vulnerability
[SA17795] O-Kiraku Nikki "day_id" SQL Injection Vulnerability
[SA17789] PHP Web Statistik Multiple Vulnerabilities and Security
Issue
[SA17788] Xaraya "module" Local File Inclusion Vulnerability
[SA17785] N-13 News "id" SQL Injection Vulnerability
[SA17783] FreeWebStat Script Insertion Vulnerabilities
[SA17782] randshop SQL Injection Vulnerabilities
[SA17776] Gentoo update for chmlib / kchmviewer
[SA17773] OmniStar KBase SQL Injection Vulnerabilities
[SA17772] Nephp Publisher SQL Injection Vulnerabilities
[SA17769] DotClear Unspecified trackbacks Security Issue
[SA17767] Babe Logger "gal" and "id" SQL Injection Vulnerabilities
[SA17766] Zainu SQL Injection Vulnerabilities
[SA17763] PHP "mb_send_mail()" "To:" Header Injection Vulnerability
[SA17760] BedengPSP Multiple SQL Injection Vulnerabilities
[SA17759] DMANews Multiple SQL Injection Vulnerabilities
[SA17758] Fantastic News "category" SQL Injection Vulnerability
[SA17753] Entergal MX SQL Injection Vulnerabilities
[SA17752] BosDates SQL Injection Vulnerabilities
[SA17747] Gallery Unspecified Vulnerability
[SA17745] PHP Doc System Local File Inclusion Vulnerability
[SA17744] ADC2000 NG Pro "cat" SQL Injection Vulnerability
[SA17742] Netzbrett "p_entry" SQL Injection Vulnerability
[SA17734] UGroup Multiple SQL Injection Vulnerabilities
[SA17733] phpWordPress SQL Injection Vulnerabilities
[SA17732] ActiveCampaign KnowledgeBuilder SQL Injection and Denial of
Service
[SA17731] ActiveCampaign SupportTrio "page" Local File Inclusion
Vulnerability
[SA17729] Nicecoder iDesk "cat_id" SQL Injection Vulnerability
[SA17784] WebCalendar SQL Injection and Local File Overwrite
Vulnerabilities
[SA17756] ClientExec Multiple SQL Injection Vulnerabilities
[SA17755] drzes HMS Cross-Site Scripting and SQL Injection
Vulnerabilities
[SA17751] Post Affiliate Pro "sortorder" SQL Injection Vulnerability
[SA17750] GhostScripter Amazon Shop "query" Cross-Site Scripting
Vulnerability
[SA17746] Simple Document Management System SQL Injection
Vulnerability
[SA17743] Enterprise Connector "messageid" SQL Injection
Vulnerabilities
[SA17741] blogBuddies Cross-Site Scripting Vulnerabilities
[SA17736] SmartPPC Pro "username" Cross-Site Scripting Vulnerability
========================================================================
5) Vulnerabilities Content Listing
Windows:--
[SA17765] Panda Antivirus ZOO Archive Decompression Buffer Overflow
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-11-30
Alex Wheeler has reported a vulnerability in Panda Antivirus, which
potentially can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/17765/
--
[SA17792] ASP-rider "referer" Header SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-30
info has reported a vulnerability in ASP-rider, which can be exploited
by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17792/
--
[SA17740] MailEnable "RENAME" Command Denial of Service Vulnerability
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2005-11-25
Josh Zlatin-Amishav has discovered a vulnerability in MailEnable
Professional and MailEnable Enterprise, which can be exploited by
malicious users to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/17740/
--
[SA17737] Freeftpd PORT Command Denial of Service Vulnerability
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2005-11-25
Stefan Lochbihler has discovered a vulnerability in freeftpd, which can
be exploited by malicious users to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/17737/
--
[SA17815] Cisco Security Agent Local Privilege Escalation
Vulnerability
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-11-30
A vulnerability has been reported in Cisco Security Agent (CSA), which
can be exploited by malicious, local users to gain escalated
privileges.
Full Advisory:
http://secunia.com/advisories/17815/
UNIX/Linux:--
[SA17813] Mac OS X Security Update Fixes Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, Spoofing,
Manipulation of data, Exposure of sensitive information, Privilege
escalation, DoS, System access
Released: 2005-11-30
Apple has issued a security update for Mac OS X, which fixes 13
vulnerabilities.
Full Advisory:
http://secunia.com/advisories/17813/
--
[SA17757] SGI Advanced Linux Environment Multiple Updates
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, DoS, System access
Released: 2005-11-29
SGI has issued a patch for SGI Advanced Linux Environment. This fixes
some vulnerabilities, which can be exploited by malicious people to
conduct cross-site scripting attacks, bypass certain security
restrictions, cause a DoS (Denial of Service), and to compromise a
user's system.
Full Advisory:
http://secunia.com/advisories/17757/
--
[SA17738] Gentoo update for netscape-flash
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-11-25
Gentoo has issued an update for netscape-flash. This fixes a
vulnerability, which can be exploited by malicious people to compromise
a user's system.
Full Advisory:
http://secunia.com/advisories/17738/
--
[SA17778] Gentoo update for inkscape
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2005-11-28
Gentoo has issued an update for inkscape. This fixes a vulnerability,
which potentially can be exploited by malicious people to compromise a
user's system.
Full Advisory:
http://secunia.com/advisories/17778/
--
[SA17775] KchmViewer chmlib Buffer Overflow Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2005-11-28
Some vulnerabilities have been reported in KchmViewer, which
potentially can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/17775/
--
[SA17774] unalz Filename Handling Buffer Overflow Vulnerability
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2005-11-28
Ulf Harnhammar has reported a vulnerability in unalz, which potentially
can be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/17774/
--
[SA17770] Debian update for gtk+2.0
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2005-11-30
Debian has issued an update for gtk+2.0. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) and potentially to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/17770/
--
[SA17768] ktools VGETSTRING Buffer Overflow Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Unknown
Released: 2005-11-28
Mehdi Oudad and Kevin Fernandez have reported a vulnerability in
ktools, which has an unknown impact.
Full Advisory:
http://secunia.com/advisories/17768/
--
[SA17735] ShockBoard "offset" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-28
r0t has reported a vulnerability in ShockBoard, which can be exploited
by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17735/
--
[SA17817] Usermin "miniserv.pl" Format String Denial of Service
Vulnerability
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2005-11-30
A vulnerability has been reported in Usermin, which can be exploited by
malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/17817/
--
[SA17749] Webmin "miniserv.pl" Format String Denial of Service
Vulnerability
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2005-11-29
Jack Louis has discovered a vulnerability in Webmin, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/17749/
--
[SA17754] NuFW Packet Parsing Denial of Service Vulnerability
Critical: Less critical
Where: From local network
Impact: DoS
Released: 2005-11-29
A vulnerability has been reported in NuFW, which can be exploited by
malicious users to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/17754/
--
[SA17781] QNX RTOS "phgrafx" Buffer Overflow Vulnerability
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-11-30
Pasquale Minervini has reported a vulnerability in QNX RTOS, which
potentially can be exploited by malicious, local users to gain
escalated privileges.
Full Advisory:
http://secunia.com/advisories/17781/
--
[SA17818] Debian update for centericq
Critical: Not critical
Where: From remote
Impact: DoS
Released: 2005-11-30
Debian has issued an update for centericq. This fixes a weakness, which
can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/17818/
--
[SA17798] Centericq Empty Packet Denial of Service Weakness
Critical: Not critical
Where: From remote
Impact: DoS
Released: 2005-11-30
Wernfried Haas has reported a vulnerability in Centericq, which
potentially can be exploited by malicious people to cause a DoS (Denial
of Service).
Full Advisory:
http://secunia.com/advisories/17798/
--
[SA17764] Kadu Message Denial of Service Weakness
Critical: Not critical
Where: From remote
Impact: DoS
Released: 2005-11-29
Michal Gizowski has reported a weakness in Kadu, which can be exploited
by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/17764/
--
[SA17739] Gaim-Encryption Malformed Encrypted Message Denial of
Service
Critical: Not critical
Where: From remote
Impact: DoS
Released: 2005-11-25
Joerg Kurlbaum has discovered a weakness in Gaim-Encryption, which can
be exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/17739/
--
[SA17787] Fedora update for kernel
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2005-11-29
Fedora has issued an update for the kernel. This fixes some
vulnerabilities, which can be exploited by malicious, local users to
cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/17787/
--
[SA17786] Linux Kernel Multiple Denial of Service Vulnerabilities
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2005-11-29
Some vulnerabilities have been reported in the Linux Kernel, which
potentially can be exploited by malicious, local users to cause a DoS
(Denial of Service).
Full Advisory:
http://secunia.com/advisories/17786/
--
[SA17761] Linux Kernel ptrace Denial of Service Vulnerability
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2005-11-29
A vulnerability has been reported in the Linux Kernel, which
potentially can be exploited by malicious, local users to cause a DoS
(Denial of Service).
Full Advisory:
http://secunia.com/advisories/17761/
Other:--
[SA17780] Cisco IOS HTTP Server Script Insertion Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2005-11-29
Hugo Vazquez Carames has reported a vulnerability in Cisco IOS, which
can be exploited by malicious people to conduct script insertion
attacks.
Full Advisory:
http://secunia.com/advisories/17780/
Cross Platform:--
[SA17790] GuppY PHP Code Injection and Local File Inclusion
Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Exposure of sensitive information, System access
Released: 2005-11-29
rgod has reported some vulnerabilities in GuppY, which can be exploited
by malicious people to disclose sensitive information and compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/17790/
--
[SA17779] Ampache Snoopy "_httpsrequest()" Command Injection
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-11-28
A vulnerability has been reported in Ampache, which can be exploited by
malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/17779/
--
[SA17777] eFiction Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, Manipulation of
data, Exposure of system information, System access
Released: 2005-11-28
rgod has reported some vulnerabilities in eFiction, which can be
exploited by malicious people to disclose system information, conduct
cross-site scripting and SQL injection attacks, and compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/17777/
--
[SA17771] Q-News "id" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-11-28
][GB][ has discovered a vulnerability in Q-News, which can be exploited
by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/17771/
--
[SA17748] Sun Java JRE Sandbox Security Bypass Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-11-29
Some vulnerabilities have been reported in Sun Java JRE (Java Runtime
Environment), which can be exploited by malicious people to compromise
a user's system.
Full Advisory:
http://secunia.com/advisories/17748/
--
[SA17730] DeskLance "main" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-11-25
r0t has reported a vulnerability in DeskLance, which can be exploited
by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/17730/
--
[SA17812] Atlantis Knowledge Base Software "searchStr" SQL Injection
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-30
r0t has reported a vulnerability in Atlantis Knowledge Base Software,
which can be exploited by malicious people to conduct SQL injection
attacks.
Full Advisory:
http://secunia.com/advisories/17812/
--
[SA17811] FAQRing "id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-30
r0t has reported a vulnerability in FAQRing, which can be exploited by
malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17811/
--
[SA17810] WSN Knowledge Base SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-30
r0t has reported some vulnerabilities in WSN Knowledge Base, which can
be exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17810/
--
[SA17809] Softbiz FAQ Script SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-30
r0t has reported some vulnerabilities in Softbiz FAQ Script, which can
be exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17809/
--
[SA17808] Softbiz B2B Trading Marketplace Script "cid" SQL Injection
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-30
r0t has reported a vulnerability in Softbiz B2B Trading Marketplace
Script, which can be exploited by malicious people to conduct SQL
injection attacks.
Full Advisory:
http://secunia.com/advisories/17808/
--
[SA17807] SocketKB SQL Injection and Local File Inclusion
Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information
Released: 2005-11-30
r0t has reported some vulnerabilities in SocketKB, which can be
exploited by malicious people to conduct SQL injection attacks and
disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/17807/
--
[SA17806] KBase Express SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
r0t has reported two vulnerabilities in KBase Express, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17806/
--
[SA17805] Orca Knowledgebase "qid" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
r0t has discovered a vulnerability in Orca Knowledgebase, which can be
exploited by malicious users to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17805/
--
[SA17804] Orca Blog "msg" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
r0t has discovered a vulnerability in Orca Blog, which can be exploited
by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17804/
--
[SA17803] Orca Ringmaker "start" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
r0t has discovered a vulnerability in Orca Ringmaker, which can be
exploited by malicious users to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17803/
--
[SA17801] FAQ System SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
r0t has reported two vulnerabilities in FAQ System, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17801/
--
[SA17800] Survey System "SURVEY_ID" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
r0t has reported a vulnerability in Survey System, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17800/
--
[SA17799] ltwCalendar "id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
r0t has reported a vulnerability in ltwCalendar, which can be exploited
by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17799/
--
[SA17796] 88Scripts Event Calendar "m" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-30
r0t has reported a vulnerability in 88Scripts Event Calendar, which can
be exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17796/
--
[SA17795] O-Kiraku Nikki "day_id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-30
r0t has discovered a vulnerability in O-Kiraku Nikki, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17795/
--
[SA17789] PHP Web Statistik Multiple Vulnerabilities and Security
Issue
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Exposure of system information, DoS
Released: 2005-11-29
Francesco "aScii" Ongaro has discovered some vulnerabilities and a
security issue in PHP Web Statistik, which can be exploited by
malicious people to disclose system information, cause a DoS (Denial of
Service), and conduct cross-site scripting and script insertion
attacks.
Full Advisory:
http://secunia.com/advisories/17789/
--
[SA17788] Xaraya "module" Local File Inclusion Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information,
DoS
Released: 2005-11-30
rgod has discovered a vulnerability in Xaraya, which can be exploited
by malicious people to disclose and manipulate sensitive information.
Full Advisory:
http://secunia.com/advisories/17788/
--
[SA17785] N-13 News "id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-30
KingOfSka has discovered a vulnerability in N-13 News, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17785/
--
[SA17783] FreeWebStat Script Insertion Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2005-11-29
Francesco "aScii" Ongaro has reported some vulnerabilities in
FreeWebStat, which can be exploited by malicious people to conduct
script insertion attacks.
Full Advisory:
http://secunia.com/advisories/17783/
--
[SA17782] randshop SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
Liz0ziM and wannacut have discovered two vulnerabilities in randshop,
which can be exploited by malicious people to conduct SQL injection
attacks.
Full Advisory:
http://secunia.com/advisories/17782/
--
[SA17776] Gentoo update for chmlib / kchmviewer
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2005-11-28
Gentoo has issued updates for chmlib / kchmviewer. This fixes a
vulnerability, which potentially can be exploited by malicious people
to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/17776/
--
[SA17773] OmniStar KBase SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
r0t has reported some vulnerabilities in OmniStar KBase, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17773/
--
[SA17772] Nephp Publisher SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
r0t has reported some vulnerabilities in Nephp Publisher, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17772/
--
[SA17769] DotClear Unspecified trackbacks Security Issue
Critical: Moderately critical
Where: From remote
Impact: Unknown
Released: 2005-11-29
A security issue with an unknown impact has been reported in DotClear.
Full Advisory:
http://secunia.com/advisories/17769/
--
[SA17767] Babe Logger "gal" and "id" SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
r0t has reported two vulnerabilities in Babe Logger, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17767/
--
[SA17766] Zainu SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
r0t has reported two vulnerabilities in Zainu, which can be exploited
by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17766/
--
[SA17763] PHP "mb_send_mail()" "To:" Header Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Manipulation of data
Released: 2005-11-28
s.masugata has reported a vulnerability in PHP, which potentially can
be exploited by malicious people to use it as an open mail relay.
Full Advisory:
http://secunia.com/advisories/17763/
--
[SA17760] BedengPSP Multiple SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
r0t has discovered some vulnerabilities in BedengPSP, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17760/
--
[SA17759] DMANews Multiple SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
r0t has discovered some vulnerabilities in DMANews, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17759/
--
[SA17758] Fantastic News "category" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
r0t has discovered a vulnerability in Fantastic News, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17758/
--
[SA17753] Entergal MX SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
r0t has reported two vulnerabilities in Entergal MX, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17753/
--
[SA17752] BosDates SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
r0t has reported two vulnerabilities in BosDates, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17752/
--
[SA17747] Gallery Unspecified Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Unknown
Released: 2005-11-29
A vulnerability with an unknown impact has been reported in Gallery.
Full Advisory:
http://secunia.com/advisories/17747/
--
[SA17745] PHP Doc System Local File Inclusion Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2005-11-28
r0t has discovered a vulnerability in PHP Doc System, which can be
exploited by malicious people to disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/17745/
--
[SA17744] ADC2000 NG Pro "cat" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-28
r0t has reported a vulnerability in ADC2000 NG Pro which can be
exploited by malicious users to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17744/
--
[SA17742] Netzbrett "p_entry" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-28
r0t has discovered a vulnerability in Netzbrett, which can be exploited
by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17742/
--
[SA17734] UGroup Multiple SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-28
r0t has reported some vulnerabilities in Ugroup, which can be exploited
by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17734/
--
[SA17733] phpWordPress SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-25
r0t has reported some vulnerabilities in phpWordPress, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17733/
--
[SA17732] ActiveCampaign KnowledgeBuilder SQL Injection and Denial of
Service
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data, DoS
Released: 2005-11-25
r0t has discovered two vulnerabilities in ActiveCampaign
KnowledgeBuilder, which can be exploited by malicious people to cause a
DoS (Denial of Service) and conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17732/
--
[SA17731] ActiveCampaign SupportTrio "page" Local File Inclusion
Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2005-11-25
r0t has discovered a vulnerability in ActiveCampaign SupportTrio, which
can be exploited by malicious people to disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/17731/
--
[SA17729] Nicecoder iDesk "cat_id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-25
r0t has discovered a vulnerability in iDesk, which can be exploited by
malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17729/
--
[SA17784] WebCalendar SQL Injection and Local File Overwrite
Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
Francesco "aScii" Ongaro has reported some vulnerabilities in
WebCalendar, which can be exploited by malicious users to manipulate
certain information and conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17784/
--
[SA17756] ClientExec Multiple SQL Injection Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
r0t has reported some vulnerabilities in ClientExec, which can be
exploited by malicious users to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17756/
--
[SA17755] drzes HMS Cross-Site Scripting and SQL Injection
Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data
Released: 2005-11-29
r0t has reported some vulnerabilities in drzes HMS, which can be
exploited by malicious users to conduct SQL injection attacks and by
malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/17755/
--
[SA17751] Post Affiliate Pro "sortorder" SQL Injection Vulnerability
Critical: Less critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-29
r0t has reported a vulnerability in Post Affiliate Pro, which can be
exploited by malicious users to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17751/
--
[SA17750] GhostScripter Amazon Shop "query" Cross-Site Scripting
Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2005-11-29
r0t has reported a vulnerability in GhostScripter Amazon Shop, which
can be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/17750/
--
[SA17746] Simple Document Management System SQL Injection
Vulnerability
Critical: Less critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-28
r0t has discovered a vulnerability in Simple Document Management System
(SDMS), which can be exploited by malicious users to conduct SQL
injection attacks.
Full Advisory:
http://secunia.com/advisories/17746/
--
[SA17743] Enterprise Connector "messageid" SQL Injection
Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Manipulation of data
Released: 2005-11-28
r0t has reported some vulnerabilities in Enterprise Connector, which
can be exploited by malicious users to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/17743/
--
[SA17741] blogBuddies Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2005-11-25
][GB][ has discovered some vulnerabilities in blogBuddies, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/17741/
--
[SA17736] SmartPPC Pro "username" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2005-11-25
BiPi_HaCk has reported a vulnerability in SmartPPC Pro, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/17736/
========================================================================
Secunia recommends that you verify all advisories you receive,
by clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only use
those supplied by the vendor.
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Subscribe:
http://secunia.com/secunia_weekly_summary/
Contact details:
Web : http://secunia.com/
E-mail : support at secunia.com
Tel : +45 70 20 51 44
Fax : +45 70 20 51 45
More information about the ISN
mailing list