Computer Security
[EN] no-pyccku

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
updated since 21.09.2009
SecurityVulns ID:10249
Threat Level:
Description:PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.
Affected:DAWAWEEN : Dawaween 1.03
 MAMBO : Mambo 4.6
 HORDE : Horde 3.2
 FCKEDITOR : FCKeditor 2.6
Original documentdocumentMustLive, XSS and Content Spoofing vulnerabilities in FCKeditor (22.09.2009)
 documentPaweі Јaskarzewski, Mambo 4.6.3 arbitrary file upload (21.09.2009)
 documentCrAzY_CrAcKeR_(at), rubrique 'rubrique.php' SQL Injection Vulnerability (21.09.2009)
 documentDazz.band_(at), Dawaween V 1.03 <<----SQL Injection Exploit (21.09.2009)
 documentStefan Esser, Advisory 01/2009: Horde_Form_Type_image Arbitrary File Overwrite Vulnerability (21.09.2009)
 documentMustLive, Vulnerabilities in FileDownload Snippet for MODx (21.09.2009)

PostgreSQL multiple security vulnerabilities
SecurityVulns ID:10252
Threat Level:
Description:Denial of Service, privilege escalation, LDAP authentication bypass.
Affected:POSTGRES : PostgreSQL 8.2
 POSTGRES : PostgreSQL 8.3
 POSTGRES : PostgreSQL 8.4
CVE:CVE-2009-3231 (The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password.)
 CVE-2009-3230 (The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600.)
 CVE-2009-3229 (The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, and 8.2 before 8.2.14 allows remote authenticated users to cause a denial of service (backend shutdown) by "re-LOAD-ing" libraries from a certain plugins directory.)
Original documentdocumentUBUNTU, [USN-834-1] PostgreSQL vulnerabilities (22.09.2009)

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod