Alexander Hristov

**Name of the Vulnerable Software and Affected Versions** Google Earth version 4.0.2091 (beta) **Description** A buffer overflow issue allows remote user-assisted attackers to cause a denial of service, resulting in a crash, via a KML or KMZ file containing a long `href` element. **Recommendations** For Google Earth version 4.0.2091 (beta), consider avoiding the use of KML or KMZ files with long `href` elements until a fix is available. As a temporary workaround, restrict the handling of such files to minimize the risk of a denial of service.

**Name of the Vulnerable Software and Affected Versions** McAfee Network Agent version 1.0.178.0 **Description** The issue allows remote attackers to cause a denial of service, resulting in the agent crashing, potentially due to an invalid string position field value when a long packet is sent. **Recommendations** For McAfee Network Agent version 1.0.178.0, at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Limbo CMS versions 1.0.4.1 through 1.0.4.2 Description: The issue allows remote attackers to execute arbitrary PHP commands. This is achieved via the `Itemid` parameter in the "index.php" endpoint. Recommendations: For Limbo CMS versions 1.0.4.1 and 1.0.4.2, consider restricting access to the `index.php` endpoint to minimize the risk of exploitation. Avoid using the `Itemid` parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** sNews version 1.3 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `category` and `id` parameters in the "index.php" file. **Recommendations** For sNews version 1.3, consider restricting access to the vulnerable parameters `category` and `id` in the "index.php" file until a patch is available. As a temporary workaround, avoid using the `category` and `id` parameters in the affected API endpoint until the issue is resolved.