Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
Published:		17.05.2006
Source:
SecurityVulns ID:		6147
Type:		remote
Level:		5/10
Description:		PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.

Affected:		MYBLOGGIE : myBloggie 2.1
		PHPFUSION : PHP-Fusion 6.0
		WEBSITEBAKER : Website Baker 2.6
		QUEZZA : Quezza BB 1.0
		NEWSPORTAL : Newsportal 0.36

Original document		philipp.niedziela_(at)_gmx.de, Newsportal <= 0.36 Remote File Inclusion Vulnerability (17.05.2006)
		Mustafa Can Bjorn IPEKCI, Advisory: Quezza BB <= 1.0 File Inclusion Vulnerability. (17.05.2006)
		SECUNIA, [SA20081] Website Baker "display_name" Script Insertion Vulnerability (17.05.2006)
		newsportal_(at)_florian-amrhein.de, Newsportal: code injection vulnerability (17.05.2006)
		LiNuX_rOOt1_(at)_hotmail.com, IceWarp Cross-Site Scripting(XSS) (17.05.2006)
		soot hackers, PhpRemoteView Multiple Xss Vulnerabilities (17.05.2006)
		h4cky0u, [Full-disclosure] HYSA-2006-008 myBloggie 2.1.3 CRLF & SQL Injection (17.05.2006)

Files:		Exploits PHP-Fusion <= v6.00.306 "srch_where" SQL Injection/Admin credentials disclosure
Discuss:		Read or add your comments to this news (0 comments)

SAP Web Application Server crossite scripting
Published:		17.05.2006
Source:		BUGTRAQ
SecurityVulns ID:		6148
Type:		remote
Level:		5/10
Description:		Crossite scripting with error messages.

Affected:

SAP : SAP WebAS 7.0

Original document

arnold.grossmann_(at)_gmail.com, vulnerability details (17.05.2006)

Discuss:

Read or add your comments to this news (0 comments)

Caucho Resin application server directory traversal
Published:		17.05.2006
Source:		BUGTRAQ
SecurityVulns ID:		6149
Type:		remote
Level:		6/10
Description:		There are few way to access content behind web root directory.

Affected:

CAUCHO : Resin 3.0

Original document		Rapid 7 Security Advisories, Caucho Resin Windows Directory Traversal Vulnerability (17.05.2006)
		Joseph Pierini, ScanAlert Security Advisory (17.05.2006)

Discuss:

Read or add your comments to this news (0 comments)

LiveData ICCP server DoS
Published:		17.05.2006
Source:		BUGTRAQ
SecurityVulns ID:		6151
Type:		remote
Level:		5/10
Description:		Buffer overflow on parsing ISO Transport Service packet.

Affected:

LIVEDATE : LiveData ICCP Server 5.0

Original document

SECUNIA, [SA20146] LiveData ICCP Server Buffer Overflow Vulnerability (17.05.2006)

Discuss:

Read or add your comments to this news (0 comments)

Unauthorized Sun Directory Server console acces
Published:		17.05.2006
Source:		SECUNIA
SecurityVulns ID:		6152
Type:		local
Level:		5/10

Affected:

SUN : Directory Server 5.2

Original document

SECUNIA, [SA20144] Sun Java System Directory Server Authentication Bypass (17.05.2006)

Discuss:

Read or add your comments to this news (0 comments)

FreeSSHd / FreeFTPd / wodSSHServer / FortressSSH SSH servers buffer overflow updated since 14.05.2006
Published:		17.05.2006
Source:		SECUNIA
SecurityVulns ID:		6141
Type:		remote
Level:		5/10
Description:		Buffer overflow on cryptographic keys exchange.

Affected:		FREEFTPD : FreeFTPd 1.0
		FREESSHD : FreeSSHd 1.0
		WEONLYDO : wodSSHServer 1.2
		WEONLYDO : wodSSHServer 1.3
		PRAGMA : FortressSSH 4.0

Original document		SECUNIA, [SA20136] FreeFTPd SFTP Key Exchange Algorithm String Buffer Overflow (17.05.2006)
		SECUNIA, [SA20114] FortressSSH SSH_MSG_KEXINIT Logging Buffer Overflow (16.05.2006)
		SECUNIA, [SA19845] wodSSHServer Key Exchange Algorithm String Buffer Overflow (14.05.2006)
		SECUNIA, [SA19846] FreeSSHd Key Exchange Algorithm String Buffer Overflow (14.05.2006)

Files:		POC exploit for freeSSHd version 1.0.9
Discuss:		Read or add your comments to this news (0 comments)

IPSwitch What's Up administration authentication bypass
Published:		17.05.2006
Source:		FULL-DISCLOSURE
SecurityVulns ID:		6150
Type:		remote
Level:		6/10
Description:		It's possible to bypass authentication by adding User-Application: NmConsole header.

Affected:

IPSWITCH : WhatsUp Professional 2006

Original document

'ken'@FTU , [Full-disclosure] What's Up Professional Spoofing Authentication Bypass (17.05.2006)

Discuss:

Read or add your comments to this news (0 comments)