Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
Published:		21.05.2009
Source:		BUGTRAQ
SecurityVulns ID:		9916
Type:		remote
Level:		5/10
Description:		PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.

Affected:		NOVELL : GroupWise 7.0
		DRUPAL : Drupal 6.12
		IMENAFZAR : Namad Cms 2.0
		DOGARCHIVE : -Dog Pedigree Online Database 1.0
		JORP : jorp 1.3
		SUN : Communications Express 6.3
		DMXREADY : DMXReady Registration Manager 1.1
		MYGESUAD : my-Gesuad 0.9
		MYCOOLEX : my-colex 1.4
		NOVELL : GroupWise 7.03
		NOVELL : Groupwise 8.0
CVE:		CVE-2009-1635 (Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via (1) the User.lang parameter to the login page (aka gw/webacc), (2) style expressions in a message that contains an HTML file, or (3) vectors associated with incorrect protection mechanisms against scripting, as demonstrated using whitespace between JavaScript event names and values.)

Original document		swhite_(at)_securestate.com, Novell GroupWise Web Access Multiple XSS (21.05.2009)
		y3nh4ck3r_(at)_gmail.com, MULTIPLE SQL INJECTION VULNERABILITIES --Flash Quiz Beta 2--> (21.05.2009)
		ddvulnalert_(at)_ddifronline.com, DDIVRT-2009-25 IPsession SQL Injection Vulnerability (21.05.2009)
		Justin C. Klein Keane, [Full-disclosure] Drupal 6.12 (core) User Module XSS Vulnerability (21.05.2009)
		info_(at)_securitylab.ir, DMXReady Registration Manager Arbitrary File Upload Vulnerability (21.05.2009)
		y3nh4ck3r_(at)_gmail.com, MULTIPLE REMOTE VULNERABILITIES --my-colex 1.4.2--> (21.05.2009)
		y3nh4ck3r_(at)_gmail.com, MULTIPLE REMOTE VULNERABILITIES --my-Gesuad 0.9.14--> (21.05.2009)
		CORE SECURITY TECHNOLOGIES ADVISORIES, CORE-2009-0109 - Multiple XSS in Sun Communications Express (21.05.2009)
		y3nh4ck3r_(at)_gmail.com, (GET vars 'x' & 'y') ADMIN FUNCTION EXECUTION--Jorp v-1.3.05.09--> (21.05.2009)
		y3nh4ck3r_(at)_gmail.com, INSECURE COOKIE HANDLING VULNERABILITIES --Dog Pedigree Online Database v1.0.1-Beta--> (21.05.2009)
		y3nh4ck3r_(at)_gmail.com, (GET var 'id') BLIND SQL INJECTION EXPLOIT --Dog Pedigree Online Database v1.0.1-Beta --> (21.05.2009)
		info_(at)_securitylab.ir, Namad Cms Remote File Download (21.05.2009)

Files:		(GET var 'id') BLIND SQL INJECTION EXPLOIT Dog Pedigree Online Database v1.0.1-Beta
Discuss:		Read or add your comments to this news (0 comments)