30.09.2008 Detailed

7! Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities updated since 29.09.2008   Memory corruptions, privilege escalation, crossite scripting, DoS, buffer overflow 6! HP Insight Diagnostics unauthorized files access       6! Novell ZenWorks ActiveX buffer overflow   CanUninstall method buffer overflow.

6! Checkpoint ZoneAlarm DoS   HTTP traffic parsing DoS.

6! MPlayer buffer overflow   Three integer overflows on video files parsing lead to buffer overflow.

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)   PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.

DATAC RealWin buffer overflow   Buffer overflow on TCP/910 network packet reading.

Linksys WRT350N unauthorized access   Outdated SAMBA version is used, default admin:admin account is present and default guest account.

CA Service Desk crossite scripting updated since 30.09.2008   Multiple crossite scripting vulnerabilities.

29.09.2008 Detailed

7! Cisco IOS, Cisco 10000, uBR10012, uBR7200 and Cisco UCM multiple security vulnerabilities   DoS with L2TP, MPLS, IPS, SIP, SSL vulnerabilities, information leaks, multiple multicast security vulnerabilities, NAT SCP, IOS Software firewall application inspection security vulnerabilities.   Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)   PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. FCKEditor: arbitrary file upload eCaptcha: crossite scripting   Internet Information Server and IAS ActiveX unauthorized access and DoS   ActiveX allows privileged actions to be silently executed.

BitlBee IM to IRC gateway multiple security vulnerabilities   DoS, privilege escalation.

24.09.2008 Detailed

6! Unreal Tournament game server directory traversal   Directory traversal in built-in Web-server.   newsbeuter shell characters vulnerability   Shell characters vulnerability on "open-in-browser" command.   Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)   PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.

Aruba Mobility Controller shared certificate   All devices share same certificate with same private key.

22.09.2008 Detailed

6! IBM DB2 multiple security vulnerabilities   XMLQUERY and XMLEXIST buffer overflow, CLR stored procedures privilege escalation and DoS.   Microsoft Internet Explorer DoS   Browser hangs on malcrafted PNG image.   Mozilla Firefox / Opera / Microsoft Internet Explorer browsers DoS   window.sidebar.addPanel() in the loop causes browser to hang.

20.09.2008 Detailed

6! Microsoft Outlook Express / Microsoft Outlook DoS   Crash on <style>*{position:relative}</style> <table>DoS</table> in HTML content.   R symbolic links security vulnerability   javareconf script insecure temporary fiels creation.   Surgemail IMAP server DoS   Crash on APPEND command processing.

Wireshark / TShark multiple security vulnerabilities   Multiple DoS conditions on different protocols parsing.

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)   PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.

16.09.2008 Detailed

7! Apple QuickTime multiple security vulnerabilities updated since 10.09.2008   Integer overflow on PICT parsing, memory corruptions on STSZ, MDAT and H.264 parsing. Buffer overflows on AVC1 and Panorama PDAT parsing. 6! Landesk QIP Server buffer overflow   Buffer overflow on TCP/12175 packet parsing.   Airtel ADSL modems backdoor   Undocumented accounts 'user' and 'support'.

Microsoft Windows DoS   Uninitialized memory reference on WRITE_ANDX SMB request handling.

Unreal game engine multiple security vulnerabilities updated since 15.09.2008   Server integer overflow, client format string vulnerability.

Nokia e90 phone Wi-Fi DoS updated since 14.09.2008   Device crash on malformed Wi-Fi frame.

Baidu Hi instant messenger integer overflow updated since 14.09.2008   Integer overflow on encrypted message decyphering causes buffer overflow.

InstallShield Update Services server spoofing   Server's identity is not checked during update rules download.

15.09.2008 Detailed

HP OpenVMS privilege escalation   Privilege escalation with SMGRTL library.   Avant Browser DoS   Integer overflow on Javascript handling.

14.09.2008 Detailed

Apple iPhone Safari DoS   Invalid memory read on JavaScript alert() function.   Linux kernel multiple security vulnerabilities updated since 13.09.2008   Multiple local DoS conditions, snd_seq_oss_synth_make_info() information leaks, integer overflows in DCCP and SCTP_AUTH_KEY.   Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl) updated since 13.09.2008   PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.

13.09.2008 Detailed

ZoneAlarm Security Suite buffer overflow   Buffer overflow on oversized path to file being scanned.   Google Chrome browser multiple security vulnerabilities updated since 04.09.2008   Automatic file download, DoS, buffer overflows.

10.09.2008 Detailed

8! Microsoft Windows GDI library multiple security vulnerabilities   Multiple vulnerabilities on different graphics format parsing. 7! Microsoft Windows Media Encoder ActiveX code execution   Control supports unsafe methods. 6! Microsoft Windows Media Player memory corruption   Server-Side playlists parsing memory corruption.

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)   PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.

Sun M4000-M9000 chassis DoS   Crash on a single domain requires long repair procedure and rebooting of whole chassis.

Microsoft Office code execution   Code execution on OneNote: URI.

09.09.2008 Detailed

6! VLC Media Player integer overflow updated since 03.07.2008   Integer overflow on WAV and TTA files parsing.   Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)   PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. myPHPNuke: SQL injection.   D-Link DIR-100 URL filtering bypass   Filtering doesn't work for oversized URLs.

07.09.2008 Detailed

6! Atheros wireless drivers buffer overflow   Buffer overflow on oversized information element. 6! Marvell wireless drivers multiple security vulnerabilities   DoS, buffer overflow. 6! courier-autlib authentication library SQL injection

6! Cisco Secure ACS DoS   Crash on EAP authentication parsing.

dnsmasq multiple security vulnerabilities   DNS records spoofing, DoS.

HP OpenView Select Identity Connectors information leak

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)   PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. myPHPNuke: SQL injection.

06.09.2008 Detailed

ClamAV antivirus CHM files DoS

04.09.2008 Detailed

6! Cisco PIX and Cisco ASA multiple security vulnerabilities   Multiple DoS conditions on SIP parsing and VPN authentication, memory leaks, information leak. 6! libtiff memory corruption   Memory corruption on LZW decoding.   Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)   PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. myPHPNuke: SQL injection.

Novell iPrint client multiple security vulnerabilities updated since 26.08.2008   Information leak, multiple buffer overflow.

02.09.2008 Detailed

6! Netscape / RedHat Directory Server multiple security vulnerabilities   DoS, Crossite scripting.   Softalk IMAP Server DoS   IMAP APPEND command handling vulnerability.   WordNet library multiple buffer overflows

VMWare multiple applications security vulnerabilities   Multiple ActiveX vulnerabilities, privilege escalation, ISAPI filters DoS, third party components updates.

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)   PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. myPHPNuke: SQL injection.

Dreambox DM500 DoS   Device crashes on oversized HTTP request.

Postfix DoS   File descriptor leaks under Linux.

Postfix mail server hardlinks privilege escalation updated since 14.08.2008   It's possible to cause Postfix to deliver mail to system file by using hardlinks to symlink (available against standard in Linux, IRIX, Solaris).

01.09.2008 Detailed

7! ipsec-tools / racoon IPSec DoS   DoS attack with memory exhaustion.   Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)   PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. FeedBurner FeedSmith: crossite scripting, information leak. myPHPNuke: crossite scripting, SQL injection.   Mita Scanner File Utility multiple security vulnerabilities   Directory traversal, unauthorized access.

Grub, DiskCryptor, LILO, DriveCrypt, TrueCRYPT and Intel, IBM, HP BIOS disk ebcryption utilities information leak updated since 26.08.2008   Cleartext password is not erased from BIOS data buffer.