Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
Published:		29.01.2008
Source:
SecurityVulns ID:		8614
Type:		remote
Level:		5/10
Description:		PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.

Affected:		PHPCMS : phpCMS 1.2
		MAMBO : Mambo 4.6
		ETICKET : eTicket 1.5
		PHPIP : phpIP 4.3
		CLANSPHERE : ClanSphere 2007.4
		WBB : WoltLab Burning Board 30
		SUNGUARDHE : Banner -- Student 7.2
		NUCLEUSCMS : Nucleus CMS 3.31

Original document		Digital Security Research Group [DSecRG], Nucleus 3.31 XSS in path (29.01.2008)
		Digital Security Research Group [DSecRG], Remote File Disclosure in phpCMS 1.2.2 (29.01.2008)
		banner_(at)_ch4n.org, CSRF/XSS in Sungard Banner (29.01.2008)
		Sw33t.h4cK3r_(at)_hotmail.com, VB Marketing "tseekdir.cgi" Local File Inclusion (29.01.2008)
		nbbn_(at)_gmx.net, WoltLab Burning Board 3.x.x Private Message Delete XSRF Vulnerability (29.01.2008)
		milad_sa2007_(at)_yahoo.com, ASPired2Protect bypass (29.01.2008)
		Alessandro Tanasi, eTicket 'index.php' Cross Site Scripting Path Vulnerability (29.01.2008)
		p4imi0, ClanSphere 2007.4.4 Remote File Disclosure Vulnerability. (29.01.2008)
		admin_(at)_bugreport.ir, Mambo 4.6.3 Path Disclosure, XSS , XSRF, DOS (29.01.2008)
		Charles Hooper, phpIP 4.3.2 - Numerous SQL Injection Vulnerablities (29.01.2008)

Discuss:

Read or add your comments to this news (0 comments)

yarssr RSS reader shell characters vulnerability
Published:		29.01.2008
Source:
SecurityVulns ID:		8617
Type:		client
Level:		5/10

Affected:		YARSSR : yarssr 0.2
CVE:		CVE-2007-5837 (GUI.pm in yarssr 0.2.2, when Gnome default URL handling is disabled, allows remote attackers to execute arbitrary commands via shell metacharacters in a link element in a feed.)

Original document

DEBIAN, [SECURITY] [DSA 1477-1] New yarssr packages fix arbitrary shell command execution (29.01.2008)

Discuss:

Read or add your comments to this news (0 comments)

Firebird SQL server integer overflow
Published:		29.01.2008
Source:		BUGTRAQ
SecurityVulns ID:		8615
Type:		remote
Level:		6/10
Description:		Integer overflow on XDR parsing leads to memory corruption.

Affected:		FIREBIRD : Firebird 1.5
		FIREBIRD : Firebird 2.0
CVE:		CVE-2008-0387

Original document

CORE SECURITY TECHNOLOGIES ADVISORIES, CORE-2007-1219: Firebird Remote Memory Corruption (29.01.2008)

Files:		Firebird remote BOF POC
Discuss:		Read or add your comments to this news (0 comments)

Move Networks Quantum Streaming Player ActiveX buffer overflow
Published:		29.01.2008
Source:		FULL-DISCLOSURE
SecurityVulns ID:		8619
Type:		client
Level:		5/10
Description:		QMPUpgrade.dll buffer overflow

Original document

Elazar Broad, [Full-disclosure] Move Networks Upgrade Manager QMPUpgrade.dll Buffer Overflow (29.01.2008)

Files:		Move Networks Upgrade Manager Control Buffer Overflow Exploit
Discuss:		Read or add your comments to this news (0 comments)

ngIRCd IRC daemon DoS
Published:		29.01.2008
Source:		BUGTRAQ
SecurityVulns ID:		8616
Type:		remote
Level:		5/10

Affected:		NGIRCD : ngIRCd 0.10
		NGIRCD : ngIRCd 0.11
CVE:		CVE-2008-0285 (ngIRCd 0.10.x before 0.10.4 and 0.11.0 before 0.11.0-pre2 allows remote attackers to cause a denial of service (crash) via crafted IRC PART message, which triggers an invalid dereference.)

Original document

GENTOO, [ GLSA 200801-13 ] ngIRCd: Denial of Service (29.01.2008)

Discuss:

Read or add your comments to this news (0 comments)

Tripwire Enterprise/Server crossite scripting
Published:		29.01.2008
Source:		BUGTRAQ
SecurityVulns ID:		8618
Type:		remote
Level:		4/10
Description:		Web management interface crossite scripting.

Affected:

TRIPWIRE : Tripwire Enterprise 7.0

Original document

Liquidmatrix Security Digest, Advisory: Tripwire Enterprise/Server XSS Vulnerability (29.01.2008)

Discuss:

Read or add your comments to this news (0 comments)