Network Security News – Friday, January 06, 2006 Events
phpBB HTML Tags in MSIE Arbitrary Script Insertion
phpBB contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'url' variable upon submission to an unspecified script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.
Note that this vulnerability only affects Microsoft Internet Explorer (MSIE).. Read more at osvdb.org/22162
IRIX runpriv Arbitrary Command Execution
IRIX contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when a malicious user appends a string, which contains additional commands to execute, to the end of an authorized command string. This flaw may lead to a loss of integrity.. Read more at osvdb.org/19907
ScozBook auth.php username Field SQL Injection
ScozBook contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'auth.php' script not properly sanitizing user-supplied input to the 'username' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.. Read more at osvdb.org/22221