CVE-2008-0926 (eDirectory)

Unspecified vulnerability in the eMBox utility in Novell eDirectory 8.7.3.9 and earlier, and 8.8.x before 8.8.2, allows remote attackers to cause a denial of service or access local files via unknown vectors, probably involving unauthenticated SOAP requests.

Permanent link to this post (38 words, estimated 9 secs reading time)

CVE-2008-1537 (PowerBook)

Directory traversal vulnerability in pb_inc/admincenter/index.php in PowerScripts PowerBook 1.21 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.

Permanent link to this post (54 words, estimated 13 secs reading time)

CVE-2008-1545 (Internet Explorer)

The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST containing a “Transfer-Encoding: chunked” header and a request body with an incorrect chunk size.

Permanent link to this post (53 words, estimated 13 secs reading time)

CVE-2008-1539 (PHP_Nuke Platinum)

SQL injection vulnerability in includes/dynamic_titles.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execute arbitrary SQL commands via the p parameter to modules.php for the Forums module.

Permanent link to this post (28 words, estimated 7 secs reading time)

CVE-2008-1544 (Internet Explorer)

The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name, which allows remote attackers to (1) conduct HTTP request splitting and HTTP request smuggling attacks via an incorrect Content-Length header, (2) access arbitrary virtual hosts via a modified Host header, and (3) bypass referrer restrictions via an incorrect Referer header.

Permanent link to this post (71 words, estimated 17 secs reading time)

CVE-2008-1535 (Rekry Component)

SQL injection vulnerability in the Matti Kiviharju rekry (aka com_rekry or rekry!Joom) 1.0.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the op_id parameter in a view action to index.php.

Permanent link to this post (35 words, estimated 8 secs reading time)

CVE-2008-1537 (PowerBook)

Directory traversal vulnerability in pb_inc/admincenter/index.php in PowerScripts PowerBook 1.21 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.

Permanent link to this post (54 words, estimated 13 secs reading time)

CVE-2008-1540 (Datsogallery)

SQL injection vulnerability in the Datsogallery (com_datsogallery) 1.3.1 module for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Permanent link to this post (49 words, estimated 12 secs reading time)

CVE-2008-0926 (eDirectory)

Unspecified vulnerability in the eMBox utility in Novell eDirectory 8.7.3.9 and earlier, and 8.8.x before 8.8.2, allows remote attackers to cause a denial of service or access local files via unknown vectors, probably involving unauthenticated SOAP requests.

Permanent link to this post (38 words, estimated 9 secs reading time)

CVE-2008-1539 (PHP_Nuke Platinum)

SQL injection vulnerability in includes/dynamic_titles.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execute arbitrary SQL commands via the p parameter to modules.php for the Forums module.

Permanent link to this post (28 words, estimated 7 secs reading time)

« Previous Entries