PHP Newsfeed searchnews.php tablename Variable SQL Injection

Network Security News – Wednesday, May 03, 2006 Events

PHP Newsfeed searchnews.php tablename Variable SQL Injection

PHP Newsfeed contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the searchnews.php script not properly sanitizing user-supplied input to the 'tablename' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.. Read more at osvdb.org/25135

PHP Newsfeed manualsubmit.php Multiple Variable SQL Injection

PHP Newsfeed contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the manualsubmit.php script not properly sanitizing user-supplied input to the 'select', 'header', 'url', 'source' or 'time' variables. This may allow an attacker to inject or manipulate SQL queries in the backend database.. Read more at osvdb.org/25133

PHP Newsfeed deltables.php name Variable SQL Injection

PHP Newsfeed contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the deltables.php script not properly sanitizing user-supplied input to the 'name' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.. Read more at osvdb.org/25132

PHP Newsfeed delete.php num Variable SQL Injection

PHP Newsfeed contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the delete.php script not properly sanitizing user-supplied input to the 'num' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.. Read more at osvdb.org/25134

IRIX wrap CGI Traversal Arbitrary Directory Listing

IRIX contains a flaw that allows a remote attacker to view files outside of the web path. The issue is due to the wrap script not properly sanitizing user input, specifically directory traversal style attacks (../../).. Read more at osvdb.org/247

vBulletin ImpEx Module ImpExModule.php systempath Variable Remote File Inclusion

vBulletin ImpEx Module contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to ImpExModule.php not properly sanitizing user input supplied to the 'systempath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.. Read more at osvdb.org/24690

vBulletin ImpEx Module ImpExDisplay.php systempath Variable Remote File Inclusion

vBulletin ImpEx Module contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to ImpExDisplay.php not properly sanitizing user input supplied to the 'systempath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.. Read more at osvdb.org/24692

vBulletin ImpEx Module ImpExController.php systempath Variable Remote File Inclusion

vBulletin ImpEx Module contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to ImpExController.php not properly sanitizing user input supplied to the 'systempath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.. Read more at osvdb.org/24691

WinHKI ztvunacev2.dll ACE Archive Filename Overflow

A remote overflow exists in WinHKI. WinHKI fails to handle an ACE archive that contains a file with an overly long filename resulting in a stack-based overflow. With a specially crafted request, an attacker can compromise a user's system resulting in a loss of confidentiality and/or integrity.. Read more at osvdb.org/25129

TrueCrypt External Command Path Subversion Local Privilege Escalation

TrueCrypt contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is caused by the unsafe use of the 'execvp()' function to execute external commands without sanitising the user's current PATH settings. This flaw may lead to a loss of integrity.. Read more at osvdb.org/25131

Vuln: RSync Receive_XATTR Integer Overflow Vulnerability

RSync Receive_XATTR Integer Overflow Vulnerability. Read more at securityfocus.com/bid/17788

Vuln: Russcom Network LoginPHP Open EMail Relay Vulnerability

Russcom Network LoginPHP Open EMail Relay Vulnerability. Read more at securityfocus.com/bid/17787

Vuln: FileProtection Express Authentication Bypass Vulnerability

FileProtection Express Authentication Bypass Vulnerability

. Read more at securityfocus.com/bid/17786