Security-Database Alerts Monitor : Last 100 Alerts

Medium - RHSA-2009:1148-01 - Problem Description: Updated httpd packages...

Thu, 09 Jul 2009 00:00:00 +0200

Problem Description: Updated httpd packages that fix two security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by...

Medium - MDVSA-2009:149 - Problem Description: Multiple...

Thu, 09 Jul 2009 00:00:00 +0200

Problem Description: Multiple vulnerabilities has been found and corrected in apache: The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server...

High - CVE-2009-2421 - The CFCharacterSetInitInlineBuffer method in...

Thu, 09 Jul 2009 00:00:00 +0200

The CFCharacterSetInitInlineBuffer method in CoreFoundation.dll in Apple Safari 3.2.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or...

Medium - CVE-2009-2420 - Apple Safari 3.2.3 does not properly implement...

Thu, 09 Jul 2009 00:00:00 +0200

Apple Safari 3.2.3 does not properly implement the file: protocol handler, which allows remote attackers to read arbitrary files or cause a denial of service (launch of multiple Windows Explorer...

Medium - CVE-2009-2419 - Use-after-free vulnerability in the...

Thu, 09 Jul 2009 00:00:00 +0200

Use-after-free vulnerability in the servePendingRequests function in WebCore in WebKit in Apple Safari 4.0 and 4.0.1 allows remote attackers to cause a denial of service (application crash) or...

High - CVE-2009-2403 - Heap-based buffer overflow in SCMPX 1.5.1...

Thu, 09 Jul 2009 00:00:00 +0200

Heap-based buffer overflow in SCMPX 1.5.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long string in a .m3u playlist file.

High - CVE-2009-2402 - SQL injection vulnerability in index.php in the...

Thu, 09 Jul 2009 00:00:00 +0200

SQL injection vulnerability in index.php in the forum module in PHPEcho CMS 2.0-rc3 allows remote attackers to execute arbitrary SQL commands via the id parameter in a thread action, a different...

Medium - CVE-2009-2401 - Cross-site scripting (XSS) vulnerability in...

Thu, 09 Jul 2009 00:00:00 +0200

Cross-site scripting (XSS) vulnerability in PHPEcho CMS 2.0-rc3 allows remote attackers to inject arbitrary web script or HTML via a forum post.

High - CVE-2009-2400 - SQL injection vulnerability in the PHP...

Thu, 09 Jul 2009 00:00:00 +0200

SQL injection vulnerability in the PHP (com_php) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.

Medium - CVE-2009-2399 - PHP remote file inclusion vulnerability in...

Thu, 09 Jul 2009 00:00:00 +0200

PHP remote file inclusion vulnerability in dm-albums/template/album.php in DM FileManager 3.9.4, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in...

Medium - CVE-2009-2398 - Directory traversal vulnerability in...

Thu, 09 Jul 2009 00:00:00 +0200

Directory traversal vulnerability in test/index.php in PHP-Sugar 0.80 allows remote attackers to read arbitrary files via a ..// (dot dot slash slash) in the t parameter.

Medium - CVE-2009-2397 - Directory traversal vulnerability in...

Thu, 09 Jul 2009 00:00:00 +0200

Directory traversal vulnerability in download.php in Audio Article Directory allows remote attackers to read arbitrary files via directory traversal sequences in the file parameter.

High - CVE-2009-2396 - PHP remote file inclusion vulnerability in...

Thu, 09 Jul 2009 00:00:00 +0200

PHP remote file inclusion vulnerability in template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin, allows remote attackers to execute arbitrary PHP code via a URL in the...

High - CVE-2009-2395 - SQL injection vulnerability in the K2 (com_k2)...

Thu, 09 Jul 2009 00:00:00 +0200

SQL injection vulnerability in the K2 (com_k2) component 1.0.1 Beta and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the category parameter in an itemlist...

High - CVE-2009-2394 - SQL injection vulnerability in cat.php in...

Thu, 09 Jul 2009 00:00:00 +0200

SQL injection vulnerability in cat.php in SMSPages 1.0 in Mr.Saphp Arabic Script Mobile (aka Messages Library) 2.0 allows remote attackers to execute arbitrary SQL commands via the CatID parameter.

Medium - CVE-2009-2393 - admin/index.php in Virtuenetz Virtue Online...

Thu, 09 Jul 2009 00:00:00 +0200

admin/index.php in Virtuenetz Virtue Online Test Generator does not require administrative privileges, which allows remote authenticated users to have an unknown impact via unspecified vectors.

High - CVE-2009-2392 - SQL injection vulnerability in text.php in...

Thu, 09 Jul 2009 00:00:00 +0200

SQL injection vulnerability in text.php in Virtuenetz Virtue Online Test Generator allows remote attackers to execute arbitrary SQL commands via the tid parameter.

Medium - CVE-2009-2391 - Cross-site scripting (XSS) vulnerability in...

Thu, 09 Jul 2009 00:00:00 +0200

Cross-site scripting (XSS) vulnerability in text.php in Virtuenetz Virtue Online Test Generator allows remote attackers to inject arbitrary web script or HTML via the tid parameter.

High - CVE-2009-2390 - SQL injection vulnerability in the BookFlip...

Thu, 09 Jul 2009 00:00:00 +0200

SQL injection vulnerability in the BookFlip (com_bookflip) component 2.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the book_id parameter to index.php.

Medium - CVE-2009-2389 - Multiple SQL injection vulnerabilities in...

Thu, 09 Jul 2009 00:00:00 +0200

Multiple SQL injection vulnerabilities in newsscript.php in USOLVED NEWSolved 1.1.6, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) jahr or...

Medium - CVE-2009-2388 - SQL injection vulnerability in admin/index.php...

Thu, 09 Jul 2009 00:00:00 +0200

SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the txtPassword parameter. NOTE: the provenance of this information is...

Medium - CVE-2009-2387 - Unspecified vulnerability in the proc...

Thu, 09 Jul 2009 00:00:00 +0200

Unspecified vulnerability in the proc filesystem in Sun OpenSolaris snv_49 through snv_109 allows local users to cause a denial of service (deadlock and panic) via unknown vectors, related to the...

High - CVE-2009-1725 - WebKit in Apple Safari before 4.0.2 does not...

Thu, 09 Jul 2009 00:00:00 +0200

WebKit in Apple Safari before 4.0.2 does not properly handle numeric character references, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption...

Medium - CVE-2009-1724 - Cross-site scripting (XSS) vulnerability in...

Thu, 09 Jul 2009 00:00:00 +0200

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to parent and top objects.

High - CVE-2009-0667 - Untrusted search path vulnerability in...

Thu, 09 Jul 2009 00:00:00 +0200

Untrusted search path vulnerability in Agent/Backend.pm in Ocsinventory-Agent before 0.0.9.3, and 1.x before 1.0.1, in OCS Inventory allows local users to gain privileges via a Trojan horse Perl...

Medium - MDVSA-2009:124-1 - Problem Description: Multiple...

Wed, 08 Jul 2009 00:00:00 +0200

Problem Description: Multiple vulnerabilities has been found and corrected in apache: Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f...

High - CVE-2009-2385 - SQL injection vulnerability in the...

Wed, 08 Jul 2009 00:00:00 +0200

SQL injection vulnerability in the awardsMembers function in Sources/Profile.php in the Member Awards component 1.0.2 for Simple Machines Forum (SMF) allows remote attackers to execute arbitrary...

High - CVE-2009-2384 - Buffer overflow in amp.exe in Brothersoft PEamp...

Wed, 08 Jul 2009 00:00:00 +0200

Buffer overflow in amp.exe in Brothersoft PEamp 1.02b allows user-assisted remote attackers to execute arbitrary code via a long string in a .m3u playlist file. NOTE: some of these details are...

High - CVE-2009-2383 - SQL injection vulnerability in...

Wed, 08 Jul 2009 00:00:00 +0200

SQL injection vulnerability in BTE_RW_webajax.php in the Related Sites plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the guid parameter.

High - CVE-2009-2382 - admin.php in phpMyBlockchecker 1.0.0055 allows...

Wed, 08 Jul 2009 00:00:00 +0200

admin.php in phpMyBlockchecker 1.0.0055 allows remote attackers to bypass authentication and gain administrative access by setting the PHPMYBCAdmin cookie to LOGGEDIN.

Medium - CVE-2009-2381 - Gizmo 3.1.0.79 on Linux does not verify a...

Wed, 08 Jul 2009 00:00:00 +0200

Gizmo 3.1.0.79 on Linux does not verify a server's SSL certificate, which allows remote servers to obtain the credentials of arbitrary users via a spoofed certificate.

Medium - CVE-2009-2380 - Cross-site scripting (XSS) vulnerability in...

Wed, 08 Jul 2009 00:00:00 +0200

Cross-site scripting (XSS) vulnerability in includes/functions.php in 4images 1.7 through 1.7.7 allows remote attackers to inject arbitrary web script or HTML via vectors related to the url variable.

Medium - CVE-2009-2379 - Directory traversal vulnerability in...

Wed, 08 Jul 2009 00:00:00 +0200

Directory traversal vulnerability in public/index.php in BIGACE Web CMS 2.6 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cmd parameter.

High - CVE-2009-2378 - PHP remote file inclusion vulnerability in...

Wed, 08 Jul 2009 00:00:00 +0200

PHP remote file inclusion vulnerability in formmailer.admin.inc.php in Jax FormMailer 3.0.0 allows remote attackers to execute arbitrary PHP code via a URL in the BASE_DIR[jax_formmailer] parameter.

Medium - CVE-2009-2377 - Buffer overflow in the Avax Vector ActiveX...

Wed, 08 Jul 2009 00:00:00 +0200

Buffer overflow in the Avax Vector ActiveX control in avPreview.ocx in AVAX-software Avax Vector ActiveX 1.3 allows remote attackers to cause a denial of service (application crash) via a long...

Medium - CVE-2009-2376 - Cross-site scripting (XSS) vulnerability in the...

Wed, 08 Jul 2009 00:00:00 +0200

Cross-site scripting (XSS) vulnerability in the Html::textarea function in application/libraries/Html.php in TangoCMS 2.x before 2.3.0 allows remote attackers to inject arbitrary web script or HTML...

High - CVE-2009-2375 - Stack-based buffer overflow in Photo DVD Maker...

Wed, 08 Jul 2009 00:00:00 +0200

Stack-based buffer overflow in Photo DVD Maker 8.02, and possibly earlier versions, allows remote attackers to execute arbitrary code via a long File_Name parameter in a .pdm file. NOTE: some of...

Medium - CVE-2009-2374 - Drupal 5.x before 5.19 and 6.x before 6.13 does...

Wed, 08 Jul 2009 00:00:00 +0200

Drupal 5.x before 5.19 and 6.x before 6.13 does not properly sanitize failed login attempts for pages that contain a sortable table, which includes the username and password in links that can be...

Medium - CVE-2009-2373 - Cross-site scripting (XSS) vulnerability in the...

Wed, 08 Jul 2009 00:00:00 +0200

Cross-site scripting (XSS) vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Medium - CVE-2009-2372 - Drupal 6.x before 6.13 does not prevent users...

Wed, 08 Jul 2009 00:00:00 +0200

Drupal 6.x before 6.13 does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote...

Medium - CVE-2009-2371 - Advanced Forum 6.x before 6.x-1.1, a module for...

Wed, 08 Jul 2009 00:00:00 +0200

Advanced Forum 6.x before 6.x-1.1, a module for Drupal, does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled...

Medium - CVE-2009-2370 - Cross-site scripting (XSS) vulnerability in...

Wed, 08 Jul 2009 00:00:00 +0200

Cross-site scripting (XSS) vulnerability in Advanced Forum 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via...

Medium - CVE-2009-2369 - Integer overflow in the wxImage::Create...

Wed, 08 Jul 2009 00:00:00 +0200

Integer overflow in the wxImage::Create function in src/common/image.cpp in wxWidgets 2.8.10 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted...

High - CVE-2009-2368 - Unspecified vulnerability in Socks Server 5...

Wed, 08 Jul 2009 00:00:00 +0200

Unspecified vulnerability in Socks Server 5 before 3.7.8-8 has unknown impact and attack vectors.

High - CVE-2009-2367 - cgi-bin/makecgi-pro in Iomega StorCenter Pro...

Wed, 08 Jul 2009 00:00:00 +0200

cgi-bin/makecgi-pro in Iomega StorCenter Pro generates predictable session IDs, which allows remote attackers to hijack active sessions and gain privileges via brute force guessing attacks on the...

High - CVE-2009-2366 - SQL injection vulnerability in login.asp in...

Wed, 08 Jul 2009 00:00:00 +0200

SQL injection vulnerability in login.asp in DataCheck Solutions ForumPal FE 1.1 and ForumPal 1.5 allows remote attackers to execute arbitrary SQL commands via the (1) password parameter in 1.1 and...

High - CVE-2009-2365 - SQL injection vulnerability in login.asp in...

Wed, 08 Jul 2009 00:00:00 +0200

SQL injection vulnerability in login.asp in DataCheck Solutions GalleryPal FE 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: the provenance of this...

High - CVE-2009-2364 - Stack-based buffer overflow in Mp3-Nator 2.0...

Wed, 08 Jul 2009 00:00:00 +0200

Stack-based buffer overflow in Mp3-Nator 2.0 allows remote attackers to execute arbitrary code via a long string in a .plf file, possibly related to a track entry.

High - CVE-2009-2363 - Stack-based buffer overflow in KUDRSOFT...

Wed, 08 Jul 2009 00:00:00 +0200

Stack-based buffer overflow in KUDRSOFT AudioPLUS 2.00.215 allows remote attackers to execute arbitrary code via a .pls playlist file with a playlist entry containing a long File1 argument.

High - CVE-2009-2362 - Stack-based buffer overflow in KUDRSOFT...

Wed, 08 Jul 2009 00:00:00 +0200

Stack-based buffer overflow in KUDRSOFT AudioPLUS 2.0.0.215 allows remote attackers to execute arbitrary code via a long string in a (1) .lst or (2) .m3u playlist file.

High - CVE-2009-2361 - SQL injection vulnerability in...

Wed, 08 Jul 2009 00:00:00 +0200

SQL injection vulnerability in include/class.staff.php in osTicket before 1.6 RC5 allows remote attackers to execute arbitrary SQL commands via the staff username parameter.

Medium - CVE-2009-2360 - Cross-site scripting (XSS) vulnerability in...

Wed, 08 Jul 2009 00:00:00 +0200

Cross-site scripting (XSS) vulnerability in passwd/main.php in the Passwd module before 3.1.1 for Horde allows remote attackers to inject arbitrary web script or HTML via the backend parameter.

High - MDVSA-2009:148 - Problem Description: Some vulnerabilities...