[ISN] Secunia Weekly Summary - Issue: 2006-19
InfoSec News
isn at c4i.org
Fri May 12 04:11:14 EDT 2006
========================================================================
The Secunia Weekly Advisory Summary
2006-05-04 - 2006-05-11
This week: 91 advisories
========================================================================
Table of Contents:
1.....................................................Word From Secunia
2....................................................This Week In Brief
3...............................This Weeks Top Ten Most Read Advisories
4.......................................Vulnerabilities Summary Listing
5.......................................Vulnerabilities Content Listing
========================================================================
1) Word From Secunia:
The Secunia staff is spending hours every day to assure you the best
and most reliable source for vulnerability information. Every single
vulnerability report is being validated and verified before a Secunia
advisory is written.
Secunia validates and verifies vulnerability reports in many different
ways e.g. by downloading the software and performing comprehensive
tests, by reviewing source code, or by validating the credibility of
the source from which the vulnerability report was issued.
As a result, Secunia's database is the most correct and complete source
for recent vulnerability information available on the Internet.
Secunia Online Vulnerability Database:
http://secunia.com/
========================================================================
2) This Week in Brief:
Microsoft has released their monthly security bulletins for May, which
fixes several vulnerabilities.
Additional details can be found in the referenced Secunia advisories
listed below.
All users of Microsoft products are advised to visit Windows Update and
apply available patches.
Reference:
http://secunia.com/SA20000
http://secunia.com/SA20029
http://secunia.com/SA20045
--
A vulnerability has been reported in various Sophos Anti-Virus
products, which can be exploited by malicious people to compromise a
vulnerable system.
Successful exploitation allows execution of arbitrary code.
The vendor has issued updated versions, please refer to the
referenced Secunia advisory below.
Reference:
http://secunia.com/SA20028
--
VIRUS ALERTS:
Secunia has not issued any virus alerts during the week.
========================================================================
3) This Weeks Top Ten Most Read Advisories:
1. [SA19762] Internet Explorer "object" Tag Memory Corruption
Vulnerability
2. [SA19738] Internet Explorer "mhtml:" Redirection Disclosure of
Sensitive Information
3. [SA19521] Internet Explorer Window Loading Race Condition Address
Bar Spoofing
4. [SA18680] Microsoft Internet Explorer "createTextRange()" Code
Execution
5. [SA19802] Firefox "contentWindow.focus()" Deleted Object Reference
Vulnerability
6. [SA20029] Microsoft Exchange Server Calendar Vulnerability
7. [SA19969] AWStats "migrate" Shell Command Injection Vulnerability
8. [SA19926] Linux Kernel SCTP Netfilter Denial of Service
Vulnerability
9. [SA19927] PHP Multiple Unspecified Vulnerabilities
10. [SA20045] Microsoft Windows Flash Player Code Execution
Vulnerabilities
========================================================================
4) Vulnerabilities Summary Listing
Windows:
[SA20045] Microsoft Windows Flash Player Code Execution
Vulnerabilities
[SA20029] Microsoft Exchange Server Calendar Vulnerability
[SA19975] Anti-Trojan unacev2.dll Buffer Overflow Vulnerability
[SA19970] XM Easy Personal FTP Server USER Command Vulnerabilities
[SA19968] Cryptomathic Cenroll ActiveX Control "createPKCS10()" Buffer
Overflow
[SA20048] Novell Client DPRPCW32.DLL Buffer Overflow Vulnerability
[SA20043] EImagePro SQL Injection Vulnerabilities
[SA20039] MaxxSchedule SQL Injection and Cross-Site Scripting
[SA20035] IdealBB Multiple Vulnerabilities
[SA20033] FileCOPA FTP Server USER Command Denial of Service
[SA20030] MultiCalendars "calsids" Parameter SQL Injection
Vulnerability
[SA20017] EDirectoryPro "keyword" Parameter SQL Injection
[SA20004] VP-ASP Shopping Cart "cid" SQL Injection Vulnerability
[SA19978] acFTP USER Command Denial of Service Vulnerability
[SA19977] PowerArchiver unacev2.dll Buffer Overflow Vulnerability
[SA20000] Microsoft Windows MSDTC Heap Overflow Vulnerabilities
[SA20061] Microsoft Windows "itss.dll" Heap Corruption Vulnerability
[SA20036] Ocean12 Calendar Manager Pro Multiple Vulnerabilities
[SA20006] EPublisherPro "title" Cross-Site Scripting Vulnerability
[SA19981] Ublog "text" Script Insertion Vulnerability
[SA20001] Intel PROset/Wireless Software Insecure Shared Section
UNIX/Linux:
[SA20051] Gentoo update for mozilla-thunderbird
[SA20019] Gentoo update for mozilla-firefox
[SA20015] Debian update for mozilla
[SA20013] Gentoo update for nagios
[SA19998] Ubuntu update for nagios
[SA19991] Nagios Content-Length Handling Buffer Overflow Vulnerability
[SA19969] AWStats "migrate" Shell Command Injection Vulnerability
[SA20065] Gentoo update for quake
[SA20064] Gentoo update for ruby
[SA20055] Gentoo update for pdnsd
[SA20042] Avaya S87X0/S8500/S8300 Tar PAX Extended Headers Buffer
Overflow
[SA20024] Red Hat update for ruby
[SA20023] Red Hat update for libtiff
[SA20021] Debian update for tiff
[SA20014] SUSE update for cyrus-sasl-digestmd5
[SA20012] pstotext Filename Shell Command Injection Vulnerability
[SA20011] Gentoo update for rsync
[SA19994] ISPConfig "go_info[server][classes_root]" File Inclusion
[SA19990] Linux Kernel SCTP Denial of Service Vulnerabilities
[SA19987] vpopmail Cleartext Password Authentication Bypass
[SA19985] Debian update for cgiirc
[SA20022] Avahi Denial of Service and Buffer Overflow Vulnerabilities
[SA19983] Sun Solaris update for Xorg X Server
[SA20052] Gentoo update for php
[SA20050] Sun Solaris libike Denial of Service Vulnerability
[SA20046] Slackware update for apache
[SA19979] SUSE updates for php4 / php5
[SA20002] Ubuntu update for mysql
[SA20056] UnixWare update for Ghostscript
Other:
[SA20058] 3Com TippingPoint SMS Server Information Disclosure
[SA20044] Cisco PIX/ASA/FWSM WebSense URL Filtering Bypass
Cross Platform:
[SA19993] Jetbox CMS "relative_script_path" File Inclusion
Vulnerability
[SA20041] ACal "path" File Inclusion Vulnerability
[SA20040] EQdkp "eqdkp_root_path" File Inclusion Vulnerability
[SA20031] StatIt "statitpath" Parameter File Inclusion Vulnerability
[SA20028] Sophos Anti-Virus Cabinet File Processing Memory Corruption
[SA20027] phpRaid "phpbb_root_path" File Inclusion Vulnerability
[SA20003] Claroline File Inclusion Vulnerabilities
[SA19980] Dokeos "includePath" Parameter File Inclusion Vulnerability
[SA19976] Fast Click SQL Lite "path" File Inclusion Vulnerability
[SA20054] Dreamweaver Server Behavior SQL Injection Vulnerability
[SA20047] openEngine "template" Parameter Local File Inclusion
Vulnerability
[SA20037] IA-Calendar Cross-Site Scripting and SQL Injection
Vulnerabilities
[SA20034] SaphpLesson SQL Injection Vulnerabilities
[SA20032] IBM Websphere Application Server Multiple Vulnerabilities
[SA20025] IBM Websphere Application Server Welcome Page Security
Bypass
[SA20020] PassMasterFlexPlus "Hack Log" Script Insertion Vulnerability
[SA20018] OpenFAQ "q" Parameter Script Insertion Vulnerability
[SA20016] Flexcustomer Login SQL Injection Vulnerability
[SA20007] X7 Chat "avatar" Parameter Script Insertion Vulnerability
[SA20005] Online Universal Payment System "read" Parameter Two
Vulnerabilities
[SA19999] Creative Community Portal SQL Injection Vulnerabilities
[SA19997] Drupal "project.module" Script Insertion Vulnerability
[SA19996] 2005-Comments-Script Multiple Vulnerabilities
[SA19992] PHP-Fusion Multiple Vulnerabilities
[SA19989] evoTopsites Multiple SQL Injection Vulnerabilities
[SA19984] Quake3 Engine "remapShader" Buffer Overflow and Directory
Traversal
[SA19982] Cute Guestbook Multiple Script Insertion Vulnerabilities
[SA19972] Newsadmin "nid" SQL Injection Vulnerability
[SA19971] Big Webmaster Guestbook Script Multiple Script Insertion
Vulnerabilities
[SA20057] xpoll Authentication Bypass Security Issue
[SA20053] Jadu CMS "register.php" Cross-Site Scripting Vulnerabilities
[SA20038] EasyEvent "curr_year" Cross-Site Scripting Vulnerability
[SA20026] CuteNews "search.php" Cross-Site Scripting Vulnerabilities
[SA20008] PHP Arena paCheckbook Multiple SQL Injection Vulnerabilities
[SA19995] Dynamic Galerie "pfad" Cross-Site Scripting and Information
Disclosure
[SA19986] PunBB "redirect_url" Cross-Site Scripting Vulnerability
[SA19973] Invision Community Blog Module "selectedbids" SQL Injection
[SA19988] Netscape "View Image" Local Resource Linking Weakness
[SA19974] WebCalendar User Account Enumeration Weakness
========================================================================
5) Vulnerabilities Content Listing
Windows:--
[SA20045] Microsoft Windows Flash Player Code Execution
Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-05-09
Two vulnerabilities have been reported in Microsoft Windows, which can
be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/20045/
--
[SA20029] Microsoft Exchange Server Calendar Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-05-09
A vulnerability has been reported in Microsoft Exchange Server, which
can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/20029/
--
[SA19975] Anti-Trojan unacev2.dll Buffer Overflow Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-05-08
Secunia Research has discovered a vulnerability in Anti-Trojan, which
can be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/19975/
--
[SA19970] XM Easy Personal FTP Server USER Command Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2006-05-05
Two vulnerabilities have been discovered in XM Easy Personal FTP
Server, which can be exploited by malicious people to cause a DoS
(Denial of Service) and potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19970/
--
[SA19968] Cryptomathic Cenroll ActiveX Control "createPKCS10()" Buffer
Overflow
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-05-05
Dennis Rand has reported a vulnerability in Cryptomathic Cenroll
ActiveX Control, which can be exploited by malicious people to
compromise a user's system.
Full Advisory:
http://secunia.com/advisories/19968/
--
[SA20048] Novell Client DPRPCW32.DLL Buffer Overflow Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Unknown
Released: 2006-05-10
A vulnerability with an unknown impact has been reported in Novell
Client.
Full Advisory:
http://secunia.com/advisories/20048/
--
[SA20043] EImagePro SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-05-09
Dj_Eyes has reported some vulnerabilities in EImagePro, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/20043/
--
[SA20039] MaxxSchedule SQL Injection and Cross-Site Scripting
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data
Released: 2006-05-08
Dj_Eyes has reported two vulnerabilities in MaxxSchedule, which can be
exploited by malicious people to conduct cross-site scripting and SQL
injection attacks.
Full Advisory:
http://secunia.com/advisories/20039/
--
[SA20035] IdealBB Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data, Exposure of
sensitive information, System access
Released: 2006-05-09
CodeScan Labs have reported multiple vulnerabilities in IdealBB, which
can be exploited by malicious users to compromise a vulnerable system
or by malicious people to disclose certain sensitive information,
conduct cross-site scripting and SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/20035/
--
[SA20033] FileCOPA FTP Server USER Command Denial of Service
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2006-05-08
Bigeazer has discovered a vulnerability in FileCOPA, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/20033/
--
[SA20030] MultiCalendars "calsids" Parameter SQL Injection
Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-05-09
Dj_Eyes has reported a vulnerability in MultiCalendars, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/20030/
--
[SA20017] EDirectoryPro "keyword" Parameter SQL Injection
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-05-09
Dj_Eyes has reported a vulnerability in EDirectoryPro, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/20017/
--
[SA20004] VP-ASP Shopping Cart "cid" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-05-08
tracewar has reported a vulnerability in VP-ASP Shopping Cart, which
can be exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/20004/
--
[SA19978] acFTP USER Command Denial of Service Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2006-05-05
Preddy has discovered a vulnerability in acFTP, which can be exploited
by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/19978/
--
[SA19977] PowerArchiver unacev2.dll Buffer Overflow Vulnerability
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2006-05-08
Secunia Research has discovered a vulnerability in PowerArchiver, which
can be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/19977/
--
[SA20000] Microsoft Windows MSDTC Heap Overflow Vulnerabilities
Critical: Moderately critical
Where: From local network
Impact: DoS, System access
Released: 2006-05-09
Two vulnerabilities have been reported in Microsoft Windows, which can
be exploited by malicious people to cause a DoS (Denial of Service) and
potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/20000/
--
[SA20061] Microsoft Windows "itss.dll" Heap Corruption Vulnerability
Critical: Less critical
Where: From remote
Impact: System access
Released: 2006-05-10
Rubén Santamarta has discovered a vulnerability in Microsoft Windows,
which potentially can be exploited by malicious people to compromise a
user's system.
Full Advisory:
http://secunia.com/advisories/20061/
--
[SA20036] Ocean12 Calendar Manager Pro Multiple Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data
Released: 2006-05-08
Dj_Eyes has reported some vulnerabilities in Ocean12 Calendar Manager
Pro, which can be exploited by malicious users to conduct SQL injection
attacks and by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/20036/
--
[SA20006] EPublisherPro "title" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-05-09
Dj_Eyes has reported a vulnerability in EPublisherPro, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/20006/
--
[SA19981] Ublog "text" Script Insertion Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-05-05
omnipresent has discovered a vulnerability in Ublog, which can be
exploited by malicious users to conduct script insertion attacks.
Full Advisory:
http://secunia.com/advisories/19981/
--
[SA20001] Intel PROset/Wireless Software Insecure Shared Section
Critical: Less critical
Where: Local system
Impact: Exposure of sensitive information
Released: 2006-05-09
Rubén Santamarta has discovered a vulnerability in Intel
PROset/Wireless Software, which can be exploited by malicious, local
users to disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/20001/
UNIX/Linux:--
[SA20051] Gentoo update for mozilla-thunderbird
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, Spoofing, Exposure
of system information, Exposure of sensitive information, DoS, System
access
Released: 2006-05-09
Gentoo has issued an update for mozilla-thunderbird. This fixes some
vulnerabilities, which can be exploited by malicious people to conduct
cross-site scripting and phishing attacks, bypass certain security
restrictions, disclose sensitive information, and potentially
compromise a user's system.
Full Advisory:
http://secunia.com/advisories/20051/
--
[SA20019] Gentoo update for mozilla-firefox
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2006-05-08
Gentoo has issued an update for mozilla-firefox. This fixes a
vulnerability, which can be exploited by malicious people to cause a
DoS (Denial of Service) and potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/20019/
--
[SA20015] Debian update for mozilla
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2006-05-09
Debian has issued an update for mozilla. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service) and potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/20015/
--
[SA20013] Gentoo update for nagios
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2006-05-08
Gentoo has issued an update for nagios. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service) and potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/20013/
--
[SA19998] Ubuntu update for nagios
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2006-05-08
Ubuntu has issued an update for nagios. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service) and potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19998/
--
[SA19991] Nagios Content-Length Handling Buffer Overflow Vulnerability
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2006-05-08
A vulnerability has been reported in Nagios, which can be exploited by
malicious people to cause a DoS (Denial of Service) and potentially
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19991/
--
[SA19969] AWStats "migrate" Shell Command Injection Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-05-05
OS Reviews has reported a vulnerability in AWStats, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19969/
--
[SA20065] Gentoo update for quake
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2006-05-10
Gentoo has issued updates for multiple packages based on the Quake 3
engine. These fix a vulnerability, which can be exploited by malicious
people to potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/20065/
--
[SA20064] Gentoo update for ruby
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2006-05-10
Gentoo has issued an update for ruby. This fixes a vulnerability, which
can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/20064/
--
[SA20055] Gentoo update for pdnsd
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2006-05-10
Gentoo has issued an update for pdnsd. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/20055/
--
[SA20042] Avaya S87X0/S8500/S8300 Tar PAX Extended Headers Buffer
Overflow
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-05-10
Avaya has acknowledged a vulnerability in Avaya S87X0/S8500/S8300 Media
Servers, which potentially can be exploited by malicious people to cause
a DoS (Denial of Service) and to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/20042/
--
[SA20024] Red Hat update for ruby
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2006-05-09
Red Hat has issued an update for ruby. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/20024/
--
[SA20023] Red Hat update for libtiff
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-05-09
Red Hat has issued an update for libtiff. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) and potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/20023/
--
[SA20021] Debian update for tiff
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-05-09
Debian has issued an update for tiff. This fixes some vulnerabilities,
which can be exploited by malicious people to cause a DoS (Denial of
Service) and potentially to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/20021/
--
[SA20014] SUSE update for cyrus-sasl-digestmd5
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2006-05-08
SUSE has issued an update for cyrus-sasl-digestmd5. This fixes a
vulnerability, which can be exploited by malicious people to cause a
DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/20014/
--
[SA20012] pstotext Filename Shell Command Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2006-05-08
Brian May has reported a vulnerability in pstotext, which potentially
can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/20012/
--
[SA20011] Gentoo update for rsync
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-05-08
Gentoo has issued an update for rsync. This fixes a vulnerability,
which can be exploited by malicious users to cause a DoS (Denial of
Service) and potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/20011/
--
[SA19994] ISPConfig "go_info[server][classes_root]" File Inclusion
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2006-05-09
ReZEN has reported a vulnerability in ISPConfig, which can be exploited
by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19994/
--
[SA19990] Linux Kernel SCTP Denial of Service Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2006-05-09
Some vulnerabilities have been reported in the Linux Kernel, which can
be exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/19990/
--
[SA19987] vpopmail Cleartext Password Authentication Bypass
Critical: Moderately critical
Where: From remote
Impact: Security Bypass
Released: 2006-05-08
A security issue has been reported in vpopmail, which can be exploited
by malicious people to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/19987/
--
[SA19985] Debian update for cgiirc
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-05-08
Debian has issued an update for cgiirc. This fixes a vulnerability,
which can be exploited by malicious users to cause a DoS (Denial of
Service) and potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19985/
--
[SA20022] Avahi Denial of Service and Buffer Overflow Vulnerabilities
Critical: Moderately critical
Where: From local network
Impact: DoS, System access
Released: 2006-05-08
Two vulnerabilities have been reported in Avahi, which can be exploited
by malicious people to cause a DoS (Denial of Service) and potentially
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/20022/
--
[SA19983] Sun Solaris update for Xorg X Server
Critical: Moderately critical
Where: From local network
Impact: DoS, System access
Released: 2006-05-05
Sun has issued an update for Xorg X server. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service) and potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19983/
--
[SA20052] Gentoo update for php
Critical: Less critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, Exposure of
sensitive information, System access
Released: 2006-05-09
Gentoo has issued an update for php. This fixes some vulnerabilities,
which can be exploited by malicious, local users to bypass certain
security restrictions and by malicious people to gain knowledge of
potentially sensitive information, to conduct cross-site scripting
attacks, and to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/20052/
--
[SA20050] Sun Solaris libike Denial of Service Vulnerability
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2006-05-09
A vulnerability has been reported in Solaris, which can be exploited by
malicious users to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/20050/
--
[SA20046] Slackware update for apache
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-05-10
Slackware has issued an update for apache. This fixes a vulnerability,
which can be exploited by malicious people to conduct cross-site
scripting attacks.
Full Advisory:
http://secunia.com/advisories/20046/
--
[SA19979] SUSE updates for php4 / php5
Critical: Less critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, Exposure of
sensitive information
Released: 2006-05-05
SUSE has issued updates for php4 / php5. These fix some
vulnerabilities, which can be exploited by malicious, local users to
bypass certain security restrictions and by malicious people to bypass
certain security restrictions, to gain knowledge of potentially
sensitive information, and to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19979/
--
[SA20002] Ubuntu update for mysql
Critical: Less critical
Where: From local network
Impact: Exposure of sensitive information
Released: 2006-05-08
Ubuntu has issued an update for mysql. This fixes two vulnerabilities,
which can be exploited by malicious users to disclose potentially
sensitive information.
Full Advisory:
http://secunia.com/advisories/20002/
--
[SA20056] UnixWare update for Ghostscript
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2006-05-10
SCO has issued an update for Ghostscript. This fixes some
vulnerabilities, which can be exploited by malicious, local users to
perform certain actions on a vulnerable system with escalated
privileges.
Full Advisory:
http://secunia.com/advisories/20056/
Other:--
[SA20058] 3Com TippingPoint SMS Server Information Disclosure
Critical: Less critical
Where: From local network
Impact: Exposure of system information
Released: 2006-05-10
A vulnerability has been reported in 3Com TippingPoint SMS Server,
which can be exploited by malicious people to disclose certain system
information.
Full Advisory:
http://secunia.com/advisories/20058/
--
[SA20044] Cisco PIX/ASA/FWSM WebSense URL Filtering Bypass
Critical: Less critical
Where: From local network
Impact: Security Bypass
Released: 2006-05-09
George D. Gal has reported a vulnerability in Cisco PIX/ASA/FWSM, which
can be exploited by malicious people to bypass certain security
restrictions.
Full Advisory:
http://secunia.com/advisories/20044/
Cross Platform:--
[SA19993] Jetbox CMS "relative_script_path" File Inclusion
Vulnerability
Critical: Highly critical
Where:
Impact: System access
Released: 2006-05-08
beford has discovered a vulnerability in Jetbox CMS, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19993/
--
[SA20041] ACal "path" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-05-08
PiNGuX has discovered a vulnerability in ACal, which can be exploited
by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/20041/
--
[SA20040] EQdkp "eqdkp_root_path" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-05-08
OLiBekaS has discovered a vulnerability in EQdkp, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/20040/
--
[SA20031] StatIt "statitpath" Parameter File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-05-08
IGNOR3 has discovered a vulnerability in StatIt, which can be exploited
by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/20031/
--
[SA20028] Sophos Anti-Virus Cabinet File Processing Memory Corruption
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-05-09
A vulnerability has been reported in various Sophos Anti-Virus
products, which can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/20028/
--
[SA20027] phpRaid "phpbb_root_path" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-05-09
botan has discovered a vulnerability in phpRaid, which can be exploited
by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/20027/
--
[SA20003] Claroline File Inclusion Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-05-08
Some vulnerabilities have been discovered in Claroline, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/20003/
--
[SA19980] Dokeos "includePath" Parameter File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-05-08
beford has discovered a vulnerability in Dokeos, which can be exploited
by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19980/
--
[SA19976] Fast Click SQL Lite "path" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-05-05
R at 1D3N has discovered a vulnerability in Fast Click SQL Lite, which can
be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19976/
--
[SA20054] Dreamweaver Server Behavior SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-05-10
A vulnerability has been reported in Dreamweaver, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/20054/
--
[SA20047] openEngine "template" Parameter Local File Inclusion
Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Exposure of sensitive information
Released: 2006-05-09
ck has discovered a vulnerability in openEngine, which can be exploited
by malicious people to bypass certain security restrictions and disclose
sensitive information.
Full Advisory:
http://secunia.com/advisories/20047/
--
[SA20037] IA-Calendar Cross-Site Scripting and SQL Injection
Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data
Released: 2006-05-09
Dj_Eyes has reported some vulnerabilities in IA-Calendar, which can be
exploited by malicious people to conduct cross-site scripting and SQL
injection attacks.
Full Advisory:
http://secunia.com/advisories/20037/
--
[SA20034] SaphpLesson SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data, Exposure of system information
Released: 2006-05-08
Devil-00 has reported some vulnerabilities in SaphpLesson, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/20034/
--
[SA20032] IBM Websphere Application Server Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Unknown, Security Bypass, Exposure of sensitive
information
Released: 2006-05-09
Some vulnerabilities have been reported in IBM WebSphere Application
Server, where some have unknown impacts and others may disclose
sensitive information or bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/20032/
--
[SA20025] IBM Websphere Application Server Welcome Page Security
Bypass
Critical: Moderately critical
Where: From remote
Impact: Security Bypass
Released: 2006-05-08
A security issue has been reported in IBM Websphere Application Server,
which can be exploited by malicious people to bypass certain security
restrictions.
Full Advisory:
http://secunia.com/advisories/20025/
--
[SA20020] PassMasterFlexPlus "Hack Log" Script Insertion Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-05-08
Nomenumbra has discovered a vulnerability in PassMasterFlexPlus, which
can be exploited by malicious people to conduct script insertion
attacks.
Full Advisory:
http://secunia.com/advisories/20020/
--
[SA20018] OpenFAQ "q" Parameter Script Insertion Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-05-08
Kamil 'K3' Sienicki has discovered a vulnerability in OpenFAQ, which
can be exploited by malicious people to conduct script insertion
attacks.
Full Advisory:
http://secunia.com/advisories/20018/
--
[SA20016] Flexcustomer Login SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-05-08
Nomenumbra has discovered a vulnerability in Flexcustomer, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/20016/
--
[SA20007] X7 Chat "avatar" Parameter Script Insertion Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-05-08
Nomenumbra has discovered a vulnerability in X7 Chat, which can be
exploited by malicious people to conduct script insertion attacks.
Full Advisory:
http://secunia.com/advisories/20007/
--
[SA20005] Online Universal Payment System "read" Parameter Two
Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Exposure of sensitive information
Released: 2006-05-08
Preddy has reported two vulnerabilities in Online Universal Payment
System Script, which can be exploited by malicious people to conduct
cross-site scripting attacks and disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/20005/
--
[SA19999] Creative Community Portal SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-05-08
r0t has reported some vulnerabilities in Creative Community Portal,
which can be exploited by malicious people to conduct SQL injection
attacks.
Full Advisory:
http://secunia.com/advisories/19999/
--
[SA19997] Drupal "project.module" Script Insertion Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-05-08
A vulnerability has been reported in Drupal, which can be exploit by
malicious people to conduct script insertion attacks.
Full Advisory:
http://secunia.com/advisories/19997/
--
[SA19996] 2005-Comments-Script Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-05-08
Some vulnerabilities have been discovered in 2005-Comments-Script,
which can be exploited by malicious people to conduct cross-site
scripting attacks and script insertion attacks.
Full Advisory:
http://secunia.com/advisories/19996/
--
[SA19992] PHP-Fusion Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2006-05-09
rgod has reported some vulnerabilities in PHP-Fusion, which can be
exploited by malicious users to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19992/
--
[SA19989] evoTopsites Multiple SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-05-08
Hamid Ebadi has reported some vulnerabilities in evoTopsites and
evoTopsites Pro, which can be exploited by malicious people to conduct
SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/19989/
--
[SA19984] Quake3 Engine "remapShader" Buffer Overflow and Directory
Traversal
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2006-05-05
Two vulnerabilities have been reported in the Quake3 Engine, which can
be exploited by malicious people to access arbitrary files on a
vulnerable system and potentially to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/19984/
--
[SA19982] Cute Guestbook Multiple Script Insertion Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-05-05
Some vulnerabilities have been discovered in Cute Guestbook, which can
be exploited by malicious people to conduct script insertion attacks.
Full Advisory:
http://secunia.com/advisories/19982/
--
[SA19972] Newsadmin "nid" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-05-05
Aliaksandr Hartsuyeu has discovered a vulnerability in Newsadmin, which
can be exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/19972/
--
[SA19971] Big Webmaster Guestbook Script Multiple Script Insertion
Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-05-05
Javor Ninov has discovered some vulnerabilities in Big Webmaster
Guestbook Script, which can be exploited by malicious people to conduct
script insertion attacks.
Full Advisory:
http://secunia.com/advisories/19971/
--
[SA20057] xpoll Authentication Bypass Security Issue
Critical: Less critical
Where: From remote
Impact: Security Bypass
Released: 2006-05-09
alp_eren has discovered a security issue in xpoll, which can be
exploited by malicious people to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/20057/
--
[SA20053] Jadu CMS "register.php" Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-05-10
Some vulnerabilities have been reported in Jadu CMS, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/20053/
--
[SA20038] EasyEvent "curr_year" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-05-08
Dj_Eyes has reported a vulnerability in easyEvent, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/20038/
--
[SA20026] CuteNews "search.php" Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-05-08
k4p0 has discovered some vulnerabilities in CuteNews, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/20026/
--
[SA20008] PHP Arena paCheckbook Multiple SQL Injection Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Manipulation of data
Released: 2006-05-08
aLMaSTeR has reported some vulnerabilities in PHP Arena paCheckbook,
which can be exploited by malicious users to conduct SQL injection
attacks.
Full Advisory:
http://secunia.com/advisories/20008/
--
[SA19995] Dynamic Galerie "pfad" Cross-Site Scripting and Information
Disclosure
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting, Exposure of sensitive information
Released: 2006-05-08
d4igoro has discovered some vulnerabilities in Dynamic Galerie, which
can be exploited by malicious people to disclose certain sensitive
information and to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19995/
--
[SA19986] PunBB "redirect_url" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-05-05
o.y.6 has discovered a vulnerability in PunBB, which can be exploited
by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19986/
--
[SA19973] Invision Community Blog Module "selectedbids" SQL Injection
Critical: Less critical
Where: From remote
Impact: Manipulation of data
Released: 2006-05-05
o.y.6 has reported a vulnerability in the Invision Community Blog
module for Invision Power Board, which can be exploited by malicious
users to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/19973/
--
[SA19988] Netscape "View Image" Local Resource Linking Weakness
Critical: Not critical
Where: From remote
Impact: Security Bypass
Released: 2006-05-08
A weakness has been discovered in Netscape, which can be exploited by
malicious people to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/19988/
--
[SA19974] WebCalendar User Account Enumeration Weakness
Critical: Not critical
Where: From remote
Impact: Exposure of system information
Released: 2006-05-05
David Maciejak has discovered a weakness in WebCalendar, which can be
exploited by malicious people to identify valid user accounts.
Full Advisory:
http://secunia.com/advisories/19974/
========================================================================
Secunia recommends that you verify all advisories you receive,
by clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only use
those supplied by the vendor.
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Subscribe:
http://secunia.com/secunia_weekly_summary/
Contact details:
Web : http://secunia.com/
E-mail : support at secunia.com
Tel : +45 70 20 51 44
Fax : +45 70 20 51 45
More information about the ISN
mailing list