Computer Security
[EN] securityvulns.ru no-pyccku


Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
Published:23.12.2008
Source:
SecurityVulns ID:9541
Type:remote
Threat Level:
5/10
Description:PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. NetCat CMS: directory traversal, SQL injection.
Affected:ROUNDCUBE : Roundcube Webmail 0.2
 NAGIOS : Nagios 3.0
 OP5MONITOR : op5 Monitor 4.0
 NETCAT : NetCat 3.12
CVE:CVE-2008-5619 (html2text.php in RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.)
 CVE-2008-5028 (Cross-site request forgery (CSRF) vulnerability in cmd.cgi in (1) Nagios 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote attackers to send commands to the Nagios process, and trigger execution of arbitrary programs by this process, via unspecified HTTP requests.)
 CVE-2008-5027 (The Nagios process in (1) Nagios before 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote authenticated users to bypass authorization checks, and trigger execution of arbitrary programs by this process, via an (a) custom form or a (b) browser addon.)
Original documentdocumentS4aVRd0w, Многочисленные уязвимости в NetCat CMS <= 3.12 (23.12.2008)
 documentMarc Deslauriers, [USN-698-1] Nagios vulnerability (23.12.2008)
 documentJacobo Avariento Gimeno, POC for CVE-2008-5619 (roundcubemail PHP arbitrary code injection) (23.12.2008)
 documentISecAuditors Security Advisories, [ISecAuditors Security Advisories] Wordpress is vulnerable to an unauthorized upgrade and XSS (23.12.2008)
Files:Blind SQL Injection exploit for CMS NetCat v3.12

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod