Index: vuln.xml =================================================================== RCS file: /home/pcvs/ports/security/vuxml/vuln.xml,v retrieving revision 1.2145 diff -u -r1.2145 vuln.xml --- vuln.xml 23 Apr 2010 18:16:18 -0000 1.2145 +++ vuln.xml 24 Apr 2010 20:51:46 -0000 @@ -34,6 +34,100 @@ --> + + cacti -- SQL injection and command execution vulnerabilities + + + cacti + 0.8.7e4 + + + + +

Bonsai information security reports:

+
+

A Vulnerability has been discovered in Cacti, which + can be exploited by any user to conduct SQL Injection + attacks. Input passed via the "export_item_id" parameter + to "templates_export.php" script is not properly sanitized + before being used in a SQL query.

+
+

The same source also reported a command execution + vulnerability. This second issue can be exploited by + Cacti users who have the rights to modify device or + graph configurations.

+ + + + ports/146021 + http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php + http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-sql-injection-0104.php + + + 2010-04-21 + 2010-04-24 + + + + + moodle -- multiple vulnerabilities + + + moodle + 1.9.8 + + + + +

The Moodle release notes report multiple vulnerabilities + which could allow remote attackers to perform, amongst + others, cross site scripting, user enumeration and SQL + injection attacks.

+ + + + http://docs.moodle.org/en/Moodle_1.9.8_release_notes + + + 2010-03-25 + 2010-04-24 + + + + + tomcat -- information disclosure vulnerability + + + tomcat + 5.5.05.5.28 + 6.0.06.0.24 + + + + +

The Apache software foundation reports:

+
+

The "WWW-Authenticate" header for BASIC and DIGEST + authentication includes a realm name. If a <realm-name> + element is specified for the application in web.xml it + will be used. However, a <realm-name> is not + specified then Tomcat will generate one.

+

In some circumstances this can expose the local + hostname or IP address of the machine running Tomcat.

+
+ + + + CVE-2010-1157 + ports/146022 + http://seclists.org/bugtraq/2010/Apr/200 + + + 2010-04-22 + 2010-04-24 + + + emacs -- movemail symlink race condition