03 July 2009

• Acajoom Component for Mambo/Joomla! Backdoor
• GForge SQL Injection and Cross-Site Scripting Vulnerabilities
• Softbiz Ads "image.php" SQL Injection
• XEmacs Multiple Integer Overflow Vulnerabilities
• Google Chrome HTTP Response Handling Remote Code Execution
• Apple iPhone and iPod touch Untrusted Certificate Exception Information Disclosure
• PHP "exif_read_data()" JPEG Image Processing Denial of Service
• Multiple F-PROT Products RAR/ARJ/LHA/LZH File Scan Evasion
• Citrix Secure Gateway Denial of Service
• IBM DB2 Universal Database Server "INSTALL_JAR" Arbitrary File Overwrite
• Sun Solaris Cassini Gigabit-Ethernet Device Driver Remote Denial of Service
• PCSC-Lite Local Insecure File Permissions

02 July 2009

• Campsite Multiple Remote Input Validation Vulnerabilities
• fuzzylime (cms) Multiple Local File Include and Arbitrary File Overwrite Vulnerabilities
• Shop-Script Pro "current_currency" Parameter SQL Injection
• Basic Analysis and Security Engine "readRoleCookie()" Authentication Bypass
• Mozilla Thudnerbird/Seamonkey Multipart Alternative Message Memory Corruption
• Apple iPhone and iPod touch "HTMLSelectElement" Denial of Service
• Apple iPhone and iPod touch Configuration Profile Handling Information Disclosure
• ClamAV CAB File Scan Evasion
• IBM AIX "rpc.ttdbserver" Remote Buffer Overflow
• IBM DB2 DAS Server Buffer Overflow
• Sun Solaris Ultra-SPARC T2 Crypto Provider Device Driver Local Denial of service
• Linux Kernel "/proc/iomem" Sparc64 Local Denial of Service

01 July 2009

• phpDatingClub "search.php" Cross-Site Scripting and SQL Injection Vulnerabilities
• Zen Cart "admin/sqlpatch.php" SQL Injection
• Kasseler CMS Arbitrary File Disclosure Vulnerability and Cross- Site Scripting
• Adobe Shockwave Player Unspecified Security
• strongSwan Crafted X.509 Certificate Multiple Remote Denial of Service Vulnerabilities
• Apple iPhone and iPod touch ICMP Echo Request Remote Denial of Service
• PHP Multiple Functions "safe_mode" Restriction Bypass
• Apple iPhone Call Approval Dialog Security Bypass
• OpenSSL "dtls1_retrieve_buffered_fragment()" DTLS Packet Denial of Service
• Mozilla Firefox "nsViewManager.cpp" Denial of Service
• Sun Solaris Event Port API Multiple Local Denial of Service Vulnerabilities
• DESlock+ "dlpcrypt.sys" Local Privilege Escalation

30 June 2009

• Movable Type Cross-Site Scripting and Security Bypass Vulnerabilities
• geccBBlite "postatoda" Parameter Multiple HTML Injection Vulnerabilities
• Joomla! and Mambo Tickets Component "id" Parameter SQL Injection
• DirectAdmin
• Nagios "statuswml.cgi" Remote Arbitrary Shell Command Injection
• LibTIFF "LZWDecodeCompat()" Remote Buffer Underflow
• Foxit Reader JPEG2000 Header Decoding Memory Corruption
• Apple iPhone and iPod touch Mail Client Information Disclosure Weakness
• IrfanView "TIFF" File Handling Remote Integer Overflow
• Apache Tomcat XML Parser Information Disclosure
• Multiple Browser Web Proxy Redirect Handling Man In The Middle
• NetBSD "proplib" Library XML Processing Null Pointer Exception Denial of Service
• Edraw PDF Viewer Component Active X Control Arbitrary File Overwrite

29 June 2009

• Zen Cart "record_company.php" Remote Code Execution
• CMS Buzz Multiple Security Vulnerabilities
• MyBB "birthdayprivacy" Parameter SQL Injection
• Apple Safari "parent/top" Cross-Domain Scripting
• Google Chrome SSL renegotiation Remote Denial of Service
• Apple iPhone and iPod touch Safari Search History Information Disclosure
• Foxit Reader JPEG2000 Negative Stream Offset Remote Memory Corruption
• Apple iPhone and iPod touch MPEG-4 Video Codec Denial of Service
• Citrix NetScaler Access Gateway Default Configuration Unauthorized Access
• Multiple Browsers Cached Certificate HTTP Site Spoofing
• Sun Solaris "IP(7P)" Multicast Reception Local Denial of Service
• NetBSD "pam_unix" Root Password Change Local Security Bypass Weakness
• Microsoft Internet Explorer HTML Attribute JavaScript URI Security Bypass

26 June 2009

• NetGear DG632 Router Multiple Remote Vulnerabilities
• TorrentTrader Classic Multiple Remote Vulnerabilities
• 4homepages 4images Multiple Cross-Site Scripting and HTML Injection Vulnerabilities
• Drupal Services Module Key Based Access Unauthorized Access
• WordPress Photoracer Plugin "id" Parameter SQL Injection
• ModSecurity SQL Injection Rule Security Bypass
• WebKit JavaScript Prototypes Cross-Site Scripting
• WebKit JavaScript "onload()" Event Cross-Domain Scripting
• F-Secure Messaging Security Gateway Email Relay
• Mozilla Firefox/Thunderbird/SeaMonkey Malicious Proxy HTTPS Man In The Middle
• ClamAV Embedded Archive File Scan Evasion
• Mozilla Firefox "NPObject" Access Remote Code Execution
• Safari X.509 Extended Validation Certificate Revocation Security Bypass
• Apple Safari CFNetwork Script Injection Weakness
• WebKit "about:blank" Security Bypass
• WebKit JavaScript DOM User After Free Remote Code Execution
• WebKit CSS "Attr" Function Remote Code Execution
• Apple Safari WebKit JavaScript Garbage Collector Memory Corruption
• Adobe Reader & Acrobat JBIG Pattern Dictionary Allocation Remote Heap Buffer Overflow
• Adobe Reader and Acrobat 9.1.1 and Prior Integer Overflow
• WebKit "Document()" Function Remote Information Disclosure
• Sun OpenSolaris "smbfs(7FS)" Local Information Disclosure
• Apple Safari for Windows Private Browsing Cookie Data Local Information Disclosure

25 June 2009

• Zend Framework "Zend_View::render()" Directory Traversal
• FireStats "firestats-wordpress.php" Remote File Include
• XOOPS "module_icon.php" Local File Include
• Drupal Taxonomy Manager Administrative Page HTML Injection
• iJoomla RSS Feeder Component "cat" Parameter SQL Injection
• TYPO3 Modern Guestbook / Commenting System Extension Unspecified Cross-Site Scripting
• WebKit Frame Transition Cross-Domain Scripting
• F5 Networks FirePass SSL VPN Unspecified Cross-Site Scripting
• Mozilla Firefox/SeaMonkey Address Bar URI Spoofing
• Mozilla Firefox/Thunderbird/SeaMonkey XUL Scripts Content-Policy Check Security Bypass
• Computer Associates ARCserve Backup Message Engine Denial of Service
• Apple QuickTime NULL Pointer Dereference Denial of Service
• Apple Safari "open-help-anchor" URI Handler Remote Code Execution
• WebKit Custom Cursor and Adjusting CSS3 Hotspot Properties Browser UI Element Spoofing
• IBM WebSphere Application Server "IsSecurityEnabled" Flag Information Disclosure
• WebKit XML External Entity Information Disclosure
• WebKit Subframe Click Jacking
• "Compress::Raw::Zlib" Perl Module Remote Code Execution
• Adobe Reader and Acrobat JBIG "Halftone Region" Remote Heap Buffer Overflow
• WebKit XSLT Redirects Remote Information Disclosure
• FreeBSD IPv6 "SIOCSIFINFO_IN6" Permission Check Local Security Bypass
• Apple Safari Windows Installer Local Privilege Escalation

24 June 2009

• vBulletin Radio and TV Player Add-On Multiple HTML Injection Vulnerabilities
• 4homepages 4images "global.php" Local File Include
• Yogurt Cross-Site Scripting and SQL Injection Vulnerabilities
• TYPO3 Virtual Civil Services Extension Unspecified SQL Injection
• Webmedia Explorer Multiple Cross-Site Scripting Vulnerabilities
• WebKit "Location" and "History" Objects Cross-Site Scripting
• Drupal Nodequeue Module Security Bypass and Cross-Site Scripting Vulnerabilities
• Apple QuickTime Clipping Region (CRGN) Atom Types Stack Overflow
• Mozilla Firefox/Thunderbird/SeaMonkey Double Frame Construction Memory Corruption
• Multiple IKARUS Products RAR/CAB/ZIP File Scan Evasion
• WebKit Java Applet Remote Code Execution
• Serena Dimensions CM "DOWNLOAD" Command Security Bypass
• IBM WebSphere Application Server Multiple Security Vulnerabilities
• WebKit "Canvas" HTML Element Image Capture Remote Information Disclosure
• Lxlabs Kloxo Hosting Platform Multiple Security Vulnerabilities
• Adobe Reader and Acrobat JBIG Segments "Text Region" Memory Corruption
• Adobe Reader and Acrobat JBIG "Pattern Dictionary" Remote Heap Buffer Overflow
• Adobe Reader and Acrobat JBIG2 Filter Unspecified Memory Corruption
• Adobe Reader and Acrobat JBIG Halftone Region Grid Area Remote Heap Buffer Overflow
• Mozilla Firefox Large GIF File Background Denial of Service
• FreeBSD Direct Pipe Write Local Information Disclosure
• McAfee Policy Manager "naPolicyManager.dll" Arbitrary File Overwrite

23 June 2009

• JoomlaPraise Projectfork Joomla! Component "section" Parameter Local File Include
• Pivot Multiple Cross-Site Scripting and HTML Injection Vulnerabilities
• phpWebThings "module" Parameter Local File Include
• TYPO3 References database Extension Unspecified SQL Injection
• phPortal "topicler.php" SQL Injection
• TYPO3 FrontEnd MP3 Player Extension Unspecified SQL Injection
• TBDEV.NET Multiple Cross-Site Scripting and HTML Injection Vulnerabilities
• WebKit HTML 5 Standard Method Cross-Site Scripting
• Mozilla Firefox/SeaMonkey "file://" URI Information Disclosure
• Mozilla Firefox/Thunderbird/SeaMonkey "file://" URI Security Bypass
• Mozilla Firefox/Thunderbird/SeaMonkey Null Owner Document Arbitrary Code Execution
• Mozilla Firefox and SeaMonkey JavaScript Chrome Privilege Escalation
• Mozilla Firefox/Thunderbird/SeaMonkey Multiple Browser Engine Memory Corruption Vulnerabilities
• Multiple Norman Products RAR/CAB File Scan Evasion
• WebKit Web Inspector Page Privilege Cross Domain Scripting
• WebKit SVG Animation Elements User After Free Remote Code Execution
• WebKit "Canvas" SVG Image Capture Remote Information Disclosure
• Multiple Browser HTTP Resource in HTTPS Context Security Bypass
• Apple Safari WebKit JavaScript Exception Handling Remote Code Execution
• Adobe Reader and Acrobat Huffman-encoded JBIG2 Text Heap Overflow
• Adobe Reader and Acrobat 9.1.1 and Prior Unspecified Memory Corruption
• Adobe Reader and Acrobat Unspecified Memory Corruption
• Ruby BigDecimal Library Denial of Service
• Linux Kernel RTL8169 NIC Remote Denial of Service
• Apple Safari CoreGraphics TrueType Font Handling Remote Code Execution

22 June 2009

• Uebimiau Webmail "admin/editor.php" Arbitrary File Overwrite
• SugarCRM Email Attachment Arbitrary File Upload
• Drupal Views Module Multiple Security Bypass and HTML Injection Vulnerabilities
• Joomla! "com_jumi" Component "fileid" Parameter SQL Injection
• phpWebThings "fdown.php" SQL Injection
• WebKit Web Inspector Cross-Site Scripting
• WebKit "document.implementation" Cross-Domain Scripting
• GUPnP Message Handling Denial of Service
• Sun Java Runtime Environment Aqua Look and Feel Multiple Privilege Escalation Vulnerabilities
• Mozilla Firefox/Thunderbird/SeaMonkey Multiple JavaScript Engine Memory Corruption Vulnerabilities
• Multiple Kaspersky Products PDF File Scan Evasion
• Multiple F-PROT Products TAR File Scan Evasion
• Apple Safari CFNetwork Downloaded Files Information Disclosure
• WebKit File Enumeration Information Disclosure
• Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2009-24 through -32 Multiple Remote Vulnerabilities
• Multiple Sophos Products CAB File Scan Evasion
• Apple Safari WebKit "Attr" DOM Objects Remote Code Execution
• Adobe Reader and Acrobat JBIG "Halftone Region" Remote Heap Buffer Overflow
• Adobe Reader and Acrobat Multiple Unspecified Remote Heap Buffer Overflow Vulnerabilities
• Mutt "mutt_ssl.c" X.509 Certificate Chain Security Bypass
• Sun Solaris "lp" Client Local Denial of Service
• Apple Safari for Windows Reset Password Information Disclosure
• Microsoft Windows Media Player ScriptCommand Multiple Information Disclosure Vulnerabilities