Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
Published:		20.09.2006
Source:
SecurityVulns ID:		6633
Type:		remote
Level:		5/10
Description:		PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.

Affected:		AEDATING : aeDating 4.1
		ECARDPRO : ECardPro 2.0
		INNOVATEBOARD : Innovate Portal v.0
		PTNEWS : PT News 1.7
		SITEATSCHOOL : Site@School 2.4
		neon : Neon WebMail for Java 5.07
		BCWB : BCWB 0.99
		DIGITALWEBSHOP : Digital WebShop 1.128
		TEKMAN : Tekman Portal 1.0
		SDB : Simple Discussion Board 0.1
		MYREVIEW : MyReview 1.9
		EXPONENT : Exponent CMS 0.96
		MOREGROUPWARE : more.groupware 0.7
		PNPHPBB : PNphpBB2 1.2
		ALSTRASOFT : AlstraSoft Efriends 4.85
		PHPPOST : PHP-Post 1.01
		AMAZINGLP : Amazing Little Poll 1.3
		CMTEXTS : CMtextS 1.0
		QUALITEAM : Qualiteam X-Cart Pro 4.1

Original document		SECUNIA, [SA22005] Qualiteam X-Cart cmpi.php Variable Overwriting Vulnerability (20.09.2006)
		SECUNIA, [SA21911] BizDirectory "message" Cross-Site Scripting Vulnerability (20.09.2006)
		SECUNIA, [SA22013] ECardPro "keyword" SQL Injection Vulnerability (20.09.2006)
		SECUNIA, [SA21988] CMtextS admin.txt Password Disclosure (20.09.2006)
		SECUNIA, [SA21997] Amazing Little Poll "lp_settings.inc" Password Disclosure (20.09.2006)
		SECUNIA, [SA22014] PHP-Post Multiple Vulnerabilities (20.09.2006)
		MILW0RM, PNphpBB2 <= 1.2g (phpbb_root_path) Remote File Include Vulnerability (20.09.2006)
		SnIpEr_SA, Pie Cart Pro => (Inc_Dir) Remote File Inclusion Exploit (20.09.2006)
		Saudi Hackrz, Pie Cart Pro => (Home_Path) Remote File Inclusion Exploit (20.09.2006)
		CeNGiZ-HaN, Simple Discussion Board Multiple F.le Inclusion Vulnerability (20.09.2006)
		fixtr_(at)_bsdmail.com, Tekman Portal v1.0 (tr) SQL Injection Vulnerability (20.09.2006)
		ajannhwt_(at)_hotmail.com, Digital WebShop = v1.128 Multiple Remote File Include Vulnerabilities (20.09.2006)
		ajannhwt_(at)_hotmail.com, Bcwb 0.99(root_path)Remote File Include Vulnerability (20.09.2006)
		SECUNIA, [SA21956] Gnuturk Portal "t_id" Parameter SQL Injection Vulnerability (20.09.2006)
		SECUNIA, [SA21955] aeDating "dir[inc]" File Inclusion Vulnerabilities (20.09.2006)
		cdg393, [Full-disclosure] A.I-Pifou (Cookie) Local File Inclusion (20.09.2006)
		contact_(at)_secureshapes.com, [Full-disclosure] DotNetNuke HTML Code Injection (20.09.2006)
		TAN Chew Keong, [Full-disclosure] [vuln.sg] Neon WebMail for Java Multiple Vulnerabilities (20.09.2006)
		simo64_(at)_morx.org, Site@School 2.4.02 and below Multiple remote Command Execution Vulnerabilities (20.09.2006)
		meto5757_(at)_hotmail.com, NextAge Cart Cross-Site Scripting multiple Vulnerabilities (20.09.2006)
		Snake.Apollyon_(at)_Yahoo.com, PT News 1.7.8 (Search.php) XSS Vulnerability (20.09.2006)
		Saudi Hackrz, Pie Cart Pro => (Home_Path) Remote File Inclusion Exploit (20.09.2006)
		meto5757_(at)_hotmail.com, Innovate Portal v2.0 Index.PHP Xss Vuln. (20.09.2006)

Files:		Site\@school remote file upload Xploit
		MyReview 1.9.4 SQL Injection exploit
		Exponent CMS 0.96.3 stable (possibly other versions) "view" arbitrary local inclusion / remote commands xctn exploit
		Exploits more.groupware 0.7.4 remote sql injection
		AlstraSoft Efriends 4.85 Remote Command Execution Exploit
Discuss:		Read or add your comments to this news (0 comments)

WS_FTP FTP client buffer overflow
Published:		20.09.2006
Source:		MILW0RM
SecurityVulns ID:		6635
Type:		client
Level:		5/10
Description:		Buffer overflow on PASV command response parsing.

Affected:

IPSWITCH : WS_FTP LE 5.08

Files:		WS_FTP LE 5.08 (PASV response) 0day buffer overflow exploit
Discuss:		Read or add your comments to this news (0 comments)

Cisco Guard crossite scripting
Published:		20.09.2006
Source:		BUGTRAQ
SecurityVulns ID:		6636
Type:		remote
Level:		5/10

Affected:		CISCO : Cisco Guard Appliance 5.1
		CISCO : Cisco Guard Appliance 5.0

Original document

CISCO, Cisco Security Advisory: Cisco Guard enables Cross Site Scripting (20.09.2006)

Discuss:

Read or add your comments to this news (0 comments)

Cisco Intrusion Prevention System DoS and protection bypass
Published:		20.09.2006
Source:		BUGTRAQ
SecurityVulns ID:		6637
Type:		remote
Level:		5/10
Description:		Malformed SSLv2 handshake DoS, fragmented packets filtering evasion.

Affected:		CISCO : Cisco IPS 5.1
		CISCO : Cisco IPS 5.0

Original document

CISCO, Cisco Security Advisory: Cisco Intrusion Prevention System Management Interface Denial of Service and Fragmented Packet Evasion Vulnerabilities (20.09.2006)

Discuss:

Read or add your comments to this news (0 comments)

Cisco routers unauthorized SNMP access
Published:		20.09.2006
Source:		BUGTRAQ
SecurityVulns ID:		6638
Type:		remote
Level:		6/10
Description:		Read/write DOCSIS community exists on non-DOCSIS routers.

Affected:		CISCO : Cisco IAD2430
		CISCO : Cisco IAD2431
		CISCO : Cisco IAD2432
		CISCO : Cisco VG224
		CISCO : Cisco MWR 1900
		CISCO : Cisco MWR 1941

Original document

CISCO, Cisco Security Advisory: DOCSIS Read-Write Community String Enabled in Non-DOCSIS Platforms (20.09.2006)

Discuss:

Read or add your comments to this news (0 comments)

Citrix Access Gateway authentication bypass
Published:		20.09.2006
Source:		SECUNIA
SecurityVulns ID:		6634
Type:		remote
Level:		5/10
Description:		Unauthenticated access is possible if Advanced Access Control is used with LDAP authentication.

Affected:

CITRIX : Citrix Access Gateway 4.2

Original document

SECUNIA, [SA21941] Citrix Access Gateway Advanced Access Control Authentication Bypass (20.09.2006)

Discuss:

Read or add your comments to this news (0 comments)

Dr.Web antivirus buffer overflow
Published:		20.09.2006
Source:		FULL-DISCLOSURE
SecurityVulns ID:		6631
Type:		client
Level:		7/10
Description:		Buffer overflow on oversized LHA archive directory name.

Affected:

DRWEB : Dr.Web 4.33

Original document

Jean-Sébastien Guay-Leroux, [Full-disclosure] Dr.Web 4.33 antivirus LHA long directory name heap overflow (20.09.2006)

Files:		Exploits Dr.Web 4.33 antivirus LHA directory name heap overflow for linux
Discuss:		Read or add your comments to this news (0 comments)

Multiple OSU httpd security vulnerabilities
Published:		20.09.2006
Source:		BUGTRAQ
SecurityVulns ID:		6632
Type:		remote
Level:		5/10
Description:		Physical path and directory content disclosure.

Affected:

OSU : OSU httpd 3.11

Original document

rfdslabs_(at)_rfdslabs.com.br, [RLSA_02-2006] OSU httpd for OpenVMS path and directory disclosure - is this a bug or a feature? (20.09.2006)

Discuss:

Read or add your comments to this news (0 comments)

Microsoft Windows / Internet Explorer 0-day vulnerability updated since 20.09.2006
Published:		27.09.2006
Source:		FULL-DISCLOSURE
SecurityVulns ID:		6629
Type:		client
Level:		10/10
Description:		Microsoft Vector Graphics Rendering Library vulnerability is used for hidden malware installation.

Affected:		MICROSOFT : Windows 2000 Server
		MICROSOFT : Windows 2000 Professional
		MICROSOFT : Windows XP
		MICROSOFT : Windows 2003 Server

Original document		MICROSOFT, Microsoft Security Bulletin MS06-055 Vulnerability in Vector Markup Language Could Allow Remote Code Execution (925486) (27.09.2006)
		CERT, US-CERT Vulnerability Note VU#416092 (20.09.2006)
		Eric Sites, [Full-disclosure] [SECURITY] Sunbelt Software: New Microsoft Internet Explorer Expolit - 9-18-2006 (20.09.2006)

Files:		Internet Explorer VML Buffer Overflow Download Exec Exploit
		Microsoft Internet Explorer VML Remote Buffer Overflow Exploit (0day) Works on all Windows XP versions including SP2
		MS Internet Explorer (VML) Remote Denial of Service Exploit PoC
		Exploits Microsoft Internet Explorer VML Remote Buffer Overflow (Windows XP SP0-SP1 + Windows 2000 SP4)
		Microsoft Security Bulletin MS06-055 Vulnerability in Vector Markup Language Could Allow Remote Code Execution (925486)
		Microsoft Security Advisory (925568) Vulnerability in Vector Markup Language Could Allow Remote Code Execution
Discuss:		Read or add your comments to this news (0 comments)