Search:Vulnerability:11.10.2004 - security vulnerabilities database

[EN] securityvulns.ru
no-pyccku

Multiple MySQL bugs
Published: 11.10.2004
Source: BUGTRAQ
SecurityVulns ID: 4079
Type: local
Level: 5/10
Description: DoS, protection bypass.

Original document SECUNIA, [SA12783] MySQL Two Vulnerabilities (11.10.2004)

Discuss: Read or add your comments to this news (0 comments)

Windows GDI+ libraries JPEG buffer overflow
updated since 15.09.2004
Published: 11.10.2004
Source: MICROSOFT
SecurityVulns ID: 4004
Type: library
Level: 8/10
Description: Buffer overflow in JPEG parsing routines.

Affected: MICROSOFT : Internet Explorer 6.0
MICROSOFT : Windows XP
MICROSOFT : Office XP
MICROSOFT : Windows 2003 Server
MICROSOFT : Project 2002
MICROSOFT : Visio 2002
BUSYNESSOBJECTS : Crystal Reports 10
MICROSOFT : Visual Studio .Net 2003
MICROSOFT : Office 2003
MICROSOFT : Project 2003
MICROSOFT : Visio 2003
MICROSOFT : Visual Studio .NET 2002
MICROSOFT : .NET Framework version 1.0 SDK
MICROSOFT : Greetings 2002
MICROSOFT : Picture It! 7.0
MICROSOFT : Digital Image Pro 7.0
MICROSOFT : Digital Image Pro 9
MICROSOFT : Picture It! 9
MICROSOFT : Digital Image Suite 9
MICROSOFT : GDI+
MICROSOFT : .NET Framework 1.0
MICROSOFT : .NET Framework 1.1

Original document SECUNIA, [SA12772] Crystal Reports JPEG Processing Buffer Overflow Vulnerability (11.10.2004)

CERT, US-CERT Technical Cyber Security Alert TA04-260A -- Microsoft Windows JPEG component buffer overflow (17.09.2004)

Nick D., Microsoft GDIPlus.DLL JPEG Parsing Engine Buffer Overflow (15.09.2004)

document MICROSOFT, Microsoft Security Bulletin MS04-028 Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987) (15.09.2004)

Files: GDIPLUS VULN - MS04-028 - CRASH TEST JPEG
GDI+ JPEG Remote Exploit
GDI+ buffer overrun Exploit, Modified by Crypto <crypto@xaker.ru>
Windows XP JPEG Buffer Overflow POC
Example of JPG Exploit & Shellcode
Microsoft Security Bulletin MS04-028 Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987)
Discuss: Read or add your comments to this news (0 comments)

Local file access and code execution in Microsoft Internet Explorer and Netscape/Mozilla XML component
updated since 17.12.2001
Published: 11.10.2004
Source: BUGTRAQ
SecurityVulns ID: 1629
Type: client
Level: 6/10
Description: Microsoft's Microsoft.XMLHTTP and Mozilla XMLHttpRequest incorrectly handle redirection allowing to access local files.

Affected: MICROSOFT : Internet Explorer 5.5
MICROSOFT : Internet Explorer 6.0
MOZILLA : Mozilla 0.9
NETSCAPE : Netscape 6.1
MOZILLA : Mozilla 1.0
NETSCAPE : Netscape 6.2

Original document SECUNIA, [SA12765] Microsoft Internet Explorer Disclosure of Sensitive XML Information (11.10.2004)

GreyMagic Software, Reading local files in Netscape 6 and Mozilla (GM#001-NS) (30.04.2002)

MICROSOFT, Security Bulletin MS02-008 (24.02.2002)

Jouko Pynnonen, MSIE may download and run programs automatically - details (15.01.2002)

document jelmer, More reading of local files in MSIE (05.01.2002)

CERT, Advisory CA-2001-36 Microsoft Internet Explorer Does Not Respect Content-Disposition and Content-Type MIME Headers (20.12.2001)

MICROSOFT, 13 December 2001 Cumulative Patch for IE (18.12.2001)

jelmer, MSIE6 can read local files (17.12.2001)

Files: Internet Explorer file reading demonstration
Discuss: Read or add your comments to this news (0 comments)

CGI bugs
updated since 11.10.2004
Published: 16.10.2004
Source:
SecurityVulns ID: 4078
Type: remote
Level: 5/10

Affected: ICEWARP : IceWarp Web Mail 5.2
PINNACLE : ShowCenter 1.51
MEDIAWIKI : MediaWiki 1.3
CJOVERKILL : CJOverkill 4.0
TURBOTRAFFICTRAD : Turbo Traffic Trader Nitro 1.0
GOSMART4U : GoSmart Message Board
ZANFI : ZanfiCmsLite 1.1
OCPORTAL : ocPortal 1.0
SCT : Fusetalk SCT Campus Pipeline
FUSETALK : fusetalk 4.0
THEPEAK : Thepeak File Upload 1.3
PHPMYADMIN : phpMyAdmin 2.6
IDEALBB : Ideal BB 1.5
NATTERCHAT : Natterchat 1.12
WEHELPBUS : WeHelpBUS 0.1
EXPRESSWEB : Express-Web Content Management System
ALIVESITES : AliveSites Forum 2.0
WOWBB : WowBB 1.61
CEBERSTRONG : CyberStrong eShop 4.6
DMXREADY : Site Chassis Manager
DEVOYBB : DevoyBB 1.0

Original document DEVOYBB, [SA12840] DevoyBB Unspecified Cross-Site Scripting and SQL Injection Vulnerabilities (16.10.2004)

SECUNIA, [SA12841] Dmxready Site Chassis Manager Unspecified Cross-Site Scripting and SQL Injection (16.10.2004)

SECUNIA, [SA12842] CyberStrong eShop ASP Shopping Card Unspecified Cross-Site Scripting (16.10.2004)

document SECUNIA, [SA12843] WowBB Forum Unspecified SQL Injection and Cross-Site Scripting (16.10.2004)

SECUNIA, [SA12844] AliveSites Forum Unspecified Cross-Site Scripting and SQL Injection (16.10.2004)

SECUNIA, [SA12839] Express-Web Content Management System Unspecified Cross-Site Scripting (16.10.2004)

document SECUNIA, [SA12831] WeHelpBUS Arbitrary Command Execution Vulnerability (16.10.2004)

SECUNIA, [SA12834] NatterChat Unspecified SQL Injection Vulnerability (16.10.2004)

SECUNIA, [SA12835] Ideal BB Multiple Unspecified Vulnerabilities (16.10.2004)

SECUNIA, [SA12613] Pinnacle ShowCenter Skin File Cross-Site Scripting Vulnerability (16.10.2004)

document SECUNIA, [SA12825] MediaWiki Multiple Vulnerabilities (16.10.2004)

SECUNIA, [SA12813] phpMyAdmin Unspecified Arbitrary Command Execution Vulnerability (16.10.2004)

bugtraq_(at)_rloxy.com, Clientexec Billing Software (16.10.2004)

keitel andres ortega, a path disclosure and a posibility file inclusion and vulneability in thepeak file upload v1.3 (16.10.2004)

document Matthew Oyer, XXS in fusetalk forum (15.10.2004)

Matthew Oyer, XXS in SCT email client (15.10.2004)

SECUNIA, [SA12789] IceWarp Web Mail Cross-Site Scripting Vulnerabilities (13.10.2004)

Exoduks, [hackgen-2004-#002] - Remote file inclusion bug in ocPortal 1.0.3. (13.10.2004)

document Lin Xiaofeng, Multiple vulnerabilities in ZanfiCmsLite (13.10.2004)

Alexander Antipov, [Full-Disclosure] [MAxpatrol Security Advisory] Multiple vulnerabilities in GoSmart Message Board (11.10.2004)

aCiDBiTS, [Full-Disclosure] Turbo Traffic Trader Nitro v1.0 SQL Injection & XSS Proofs of Concept (11.10.2004)

document aCiDBiTS, [Full-Disclosure] CJOverkill 4.0.3 XSS Proof of Concept (11.10.2004)

Discuss: Read or add your comments to this news (0 comments)

test server