Ежедневная сводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)
Опубликовано:		21 мая 2009 г.
Источник:		BUGTRAQ
SecurityVulns ID:		9916
Тип:		удаленная
Опасность:		5/10
Описание:		Инъекции PHP, инъекции SQL, обратный путь в каталогах, межсайтовый скриптинг, модификация файлов, утечка информации и т.д.

Затронутые продукты:		NOVELL : GroupWise 7.0
		DRUPAL : Drupal 6.12
		IMENAFZAR : Namad Cms 2.0
		DOGARCHIVE : -Dog Pedigree Online Database 1.0
		JORP : jorp 1.3
		SUN : Communications Express 6.3
		DMXREADY : DMXReady Registration Manager 1.1
		MYGESUAD : my-Gesuad 0.9
		MYCOOLEX : my-colex 1.4
		NOVELL : GroupWise 7.03
		NOVELL : Groupwise 8.0
CVE:		CVE-2009-1635 (Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via (1) the User.lang parameter to the login page (aka gw/webacc), (2) style expressions in a message that contains an HTML file, or (3) vectors associated with incorrect protection mechanisms against scripting, as demonstrated using whitespace between JavaScript event names and values.)

Оригинальный текст		swhite_(at)_securestate.com, Novell GroupWise Web Access Multiple XSS (21.05.2009)
		y3nh4ck3r_(at)_gmail.com, MULTIPLE SQL INJECTION VULNERABILITIES --Flash Quiz Beta 2--> (21.05.2009)
		ddvulnalert_(at)_ddifronline.com, DDIVRT-2009-25 IPsession SQL Injection Vulnerability (21.05.2009)
		Justin C. Klein Keane, [Full-disclosure] Drupal 6.12 (core) User Module XSS Vulnerability (21.05.2009)
		info_(at)_securitylab.ir, DMXReady Registration Manager Arbitrary File Upload Vulnerability (21.05.2009)
		y3nh4ck3r_(at)_gmail.com, MULTIPLE REMOTE VULNERABILITIES --my-colex 1.4.2--> (21.05.2009)
		y3nh4ck3r_(at)_gmail.com, MULTIPLE REMOTE VULNERABILITIES --my-Gesuad 0.9.14--> (21.05.2009)
		CORE SECURITY TECHNOLOGIES ADVISORIES, CORE-2009-0109 - Multiple XSS in Sun Communications Express (21.05.2009)
		y3nh4ck3r_(at)_gmail.com, (GET vars 'x' & 'y') ADMIN FUNCTION EXECUTION--Jorp v-1.3.05.09--> (21.05.2009)
		y3nh4ck3r_(at)_gmail.com, INSECURE COOKIE HANDLING VULNERABILITIES --Dog Pedigree Online Database v1.0.1-Beta--> (21.05.2009)
		y3nh4ck3r_(at)_gmail.com, (GET var 'id') BLIND SQL INJECTION EXPLOIT --Dog Pedigree Online Database v1.0.1-Beta --> (21.05.2009)
		info_(at)_securitylab.ir, Namad Cms Remote File Download (21.05.2009)

Файлы:		(GET var 'id') BLIND SQL INJECTION EXPLOIT Dog Pedigree Online Database v1.0.1-Beta
Обсудить:		Прочитать или оставить комментарии к новости (0 комментариев)