Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
Published:		07.08.2008
Source:
SecurityVulns ID:		9201
Type:		remote
Level:		5/10
Description:		PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. WordPress ME for XOOPS: crossite scripting.

Affected:		WORDPRESS : WordPress ME 0.3 module for XOOPS
		XAMPP : Xampp Linux 1.6
		IGES : IGES CMS 2.0
		PLUCK : Pluck 4.5
CVE:		CVE-2008-3389 (Stack-based buffer overflow in the libbecompat library in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and HP-UX allows local users to gain privileges by setting a long value of an environment variable before running (1) verifydb, (2) iimerge, or (3) csreport.)
		CVE-2008-3357 (Untrusted search path vulnerability in ingvalidpw in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and HP-UX allows local users to gain privileges via a crafted shared library, related to a "pointer overwrite vulnerability.")
		CVE-2008-3356 (verifydb in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and other Unix platforms sets the ownership or permissions of an iivdb.log file without verifying that it is the application's own log file, which allows local users to overwrite arbitrary files by creating a symlink with an iivdb.log filename.)

Original document		CA, CA Products That Embed Ingres Multiple Vulnerabilities (07.08.2008)
		lovebug_(at)_hotmail.it, MyClan Sql Injection (07.08.2008)
		lovebug_(at)_hotmail.it, PHP-NUKE module Kleinanzeigen SQL injection (lid) (07.08.2008)
		admin_(at)_bugreport.ir, Pluck 4.5.2 Multiple Cross Site Scripting Vulnerabilities (07.08.2008)
		admin_(at)_bugreport.ir, IGES CMS <=2.0 Multiple Vulnerabilities (07.08.2008)
		irancrash_(at)_gmail.com, Xampp Linux 1.6.7 Multiple Cross Site Scripting Vulnerabilities (07.08.2008)
		MustLive, Cross-Site Scripting vulnerabilities in WordPress ME for XOOPS (07.08.2008)

Discuss:

Read or add your comments to this news (0 comments)