Информационная безопасность
[RU] switch to English

Ежедневная сводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)
Опубликовано:20 сентября 2008 г.
SecurityVulns ID:9298
Уровень опасности:
Описание:Инъекции PHP, инъекции SQL, обратный путь в каталогах, межсайтовый скриптинг, модификация файлов, утечка информации и т.д.
Затронутые продукты:MYPHPNUKE : myPHPNuke 1.8
 OSCOMMERCE : osCommerce 2.2
 SIMPLEDOWNLOADCO : Simple Download Counter 1.0
 QUICKCMS : Quick.Cms.Lite 2.1
 QUICKCART : Quick.Cart 3.1
 ATTACHMAX : Attachmax Dolphin 2.1
 MENALTO : menalto gallery 2.2
 CYASK : cyask 3.0
 LOOYU : LooYu Web IM 2008
 PHPPROBID : PHP pro bid 6.04
 ANNUTEL : Annuaire Téléphonique 1.0
 OPENWSMAN : Openwsman 1.5
CVE:CVE-2008-4096 (libraries/database_interface.lib.php in phpMyAdmin before allows remote authenticated users to execute arbitrary code via a request to server_databases.php with a sort_by parameter containing PHP sequences, which are processed by create_function.)
 CVE-2008-3662 (Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.)
 CVE-2008-3457 (Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify config/config.inc.php.)
 CVE-2008-3456 (phpMyAdmin before 2.11.8 does not sufficiently prevent its pages from using frames that point to pages in other domains, which makes it easier for remote attackers to conduct spoofing or phishing activities via a cross-site framing attack.)
 CVE-2008-3197 (Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before allows remote attackers to perform unauthorized actions via a link or IMG tag to (1) the db parameter in the "Creating a Database" functionality (db_create.php), and (2) the convcharset and collation_connection parameters related to an unspecified program that modifies the connection character set.)
Оригинальный текстdocumentVMWARE, VMSA-2008-0015 Updated ESXi and ESX 3.5 packages address critical security issue in openwsman (20.09.2008)
 documentJeiAr, Advanced Electron Forum <= 1.0.6 Remote Code Execution (20.09.2008)
 documentsn0oPy.team_(at)_gmail.com, Annuaire Téléphonique v1.0 Sensetive Files (MDP) (20.09.2008)
 documentJan van Niekerk, PHP pro bid v 6.04 SQL injection (20.09.2008)
 documentxsp, LooYu Web IM 2008 Cross-Site Scripting Vulnerabilities (20.09.2008)
 documentxuanmumu_(at)_gmail.com, cyask 3.x Local File Inclusion Vulnerability (20.09.2008)
 documentLagon666_(at)_Yahoo.com, Sama XSS Bug (20.09.2008)
 documentHanno Bock, menalto gallery: Session hijacking vulnerability, CVE-2008-3662 (20.09.2008)
 documentadv_(at)_e-rdc.org, [ECHO_ADV_101$2008] Attachmax Dolphin <= 2.1.0 Multiple Vulnerabilities (20.09.2008)
 documentJohn Cobb, [NOBYTES.COM: #13] Quick.Cart v3.1 Freeware - Cross Site Scripting (20.09.2008)
 documentJohn Cobb, [NOBYTES.COM: #14] Quick.Cms.Lite v2.1 Freeware - Cross Site Scripting (20.09.2008)
 documentJohn Cobb, [NOBYTES.COM: #12] osCommerce 2.2rc2a - Information Disclosure (20.09.2008)
 documentAlemin_Krali Krali, DUgallery - ALL VERSIONS (Upload/SQL/) Multiple Remote Vulnerabilities (20.09.2008)
 documentMustLive, SQL Injection vulnerability in Simple Download Counter (20.09.2008)
 documentMustLive, SQL Injection vulnerability in myPHPNuke (20.09.2008)

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород