** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-3899. Reason: This candidate is a duplicate of CVE-2005-3899. Notes: All CVE users should reference CVE-2005-3899 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.PHP remote file include vulnerability in includes/orderSuccess.inc.php in CubeCart allows remote attackers to execute arbitrary PHP code via a URL in the glob[rootDir] parameter.ADV-2006-00161398SQL injection vulnerability in (1) functions.php, (2) functions_update.php, and (3) functions_display.php in VEGO Web Forum 1.26 and earlier allows remote attackers to execute arbitrary SQL commands via the theme_id parameter in index.php.20060101 [eVuln] VEGO Web Forum SQL Injection VulnerabilityADV-2006-000318273http://evuln.com/vulns/1/summary.html1610722140315SQL injection vulnerability in index.php in PHPjournaler 1.0 allows remote attackers to execute arbitrary SQL commands via the readold parameter.1611120060101 [eVuln] PHPjournaler SQL Injection Vulnerability22149ADV-2006-000618265http://evuln.com/vulns/9/summary.htmlSQL injection vulnerability in login.php in VEGO Links Builder 2.00 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.ADV-2006-000418272http://evuln.com/vulns/2/summary.html1610822139SQL injection vulnerability in Primo Cart 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) q parameter to search.php and (2) email parameter to user.php.ADV-2006-000818264161252214722146http://pridels0.blogspot.com/2006/01/primo-cart-sql-inj.htmlCross-site scripting (XSS) vulnerability in addentry.php in Chipmunk Guestbook 1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the homepage parameter.190871611220060101 [eVuln] Chipmunk Guestbook XSS Vulnerability18270http://evuln.com/vulns/4/summary.html** DISPUTED ** Drupal allows remote attackers to conduct cross-site scripting (XSS) attacks via an IMG tag with an unusual encoded Javascript function name, as demonstrated using variations of the alert() function. NOTE: a followup by the vendor suggests that the issue does not exist in 4.5.6 or 4.6.4 when "Filtered HTML" is enabled, and since "Full HTML" would not filter HTML by design, perhaps this should not be included in CVE.20060103 Re: Drupal all versiyon xss cehennem.org20060102 Drupal all versiyon xss cehennem.orgThe ebuild for pinentry before 0.7.2-r2 on Gentoo Linux sets setgid bits for pinentry programs, which allows local users to read or overwrite arbitrary files as gid 0.16120GLSA-200601-012221118284Buffer overflow in termsh on SCO OpenServer 5.0.7 allows remote attackers to execute arbitrary code via a long -o command line argument. NOTE: this is probably a different vulnerability than CVE-2005-0351 since it involves a distinct attack vector.1612220060102 SCO Openserver 5.0.x exploithttp://downloads.securityfocus.com/vulnerabilities/exploits/Openserver_bof.cCross-site scripting (XSS) vulnerability in DiscusWare Discus Freeware 3.10.5 and Professional 3.10.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a URL, which is not properly sanitized from the resulting error message. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.161192215318283SQL injection vulnerability in profile.php in PHPenpals allows remote attackers to execute arbitrary SQL commands via the personalID parameter. NOTE: it was later reported that 1.1 and earlier are affected.1610920060101 [eVuln] PHPenpals SQL Injection Vulnerabilit221508706ADV-2006-000518269http://evuln.com/vulns/5/summary.htmlDirect static code injection vulnerability in phpBook 1.3.2 and earlier allows remote attackers to execute arbitrary PHP code via the e-mail field (mail variable) in a new message, which is written to a PHP file.1610620060101 [eVuln] phpBook PHP Code ExecutionADV-2006-0002http://evuln.com/vulns/6/summary.html18268PHP remote file include vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter.1610520060531 Re: OaBoard 1.0 Remote File inclusion20060530 OaBoard 1.0 Remote File inclusion20060101 [eVuln] oaBoard PHP Code Execution1016211http://evuln.com/vulns/3/summary.htmlOff-by-one error in the getfattr function in File::ExtAttr before 0.03 allows attackers to trigger a buffer overflow via unspecified attack vectors.16118ADV-2006-0013http://sourceforge.net/project/shownotes.php?release_id=382199&group_id=1531161825322160Multiple cross-site scripting (XSS) vulnerabilities in B-net Software 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) shout variables to (a) shout.php, or the (3) title and (4) message variables to (b) guestbook.php.1611420060102 [eVuln] B-net Software Multiple XSS Vulnerabilities18271http://evuln.com/vulns/10/summary.html20060825 Re: [eVuln] B-net Software Multiple XSS Vulnerabilities2219122190ADV-2006-0018http://sourceforge.net/project/shownotes.php?release_id=442067&group_id=117067316SQL injection vulnerability in auth.php in ScozNet ScozBook BETA 1.1 allows remote attackers to execute arbitrary SQL commands via the username field (adminname variable).1611520060102 [eVuln] ScozBook "adminname" Authentication Bypasshttp://evuln.com/vulns/11/summary.html22221ADV-2006-00273188476Cross-site scripting (XSS) vulnerability in vBulletin 3.5.2, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the title of an event, which is not properly filtered by (1) calendar.php and (2) reminder.php.1611620060108 Html_Injection in vBulletin 3.5.220060101 [KAPDA::#19] - Html Injection in vBulletin 3.5.22222022210ADV-2006-003318299http://kapda.ir/advisory-177.htmlialmnt5.sys in the ialmrnt5 display driver in Intel Graphics Accelerator Driver 6.14.10.4308 allows attackers to cause a denial of service (crash or screen resolution change) via a long text field, as demonstrated using a long window title.1612722196ADV-2006-00171828620060103 Re: Buffer Overflow vulnerability in Windows Display Manager [Suspected]20060102 Buffer Overflow vulnerability in Windows Display Manager [Suspected]Format string vulnerability in the SetImageInfo function in image.c for ImageMagick 6.2.3 and other versions, and GraphicsMagick, allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a numeric format string specifier such as %d in the file name, a variant of CVE-2005-0397, and as demonstrated using the convert program.12717GLSA-200602-13.xmlGLSA-200602-06SSA:2006-045-0319183190301885118607MDKSA-2006:02420060301-01-UUSN-246-1SUSE-SR:2006:0061015623194081887118261RHSA-2006:0178http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=345876https://issues.rpath.com/browse/RPL-38920061127 rPSA-2006-0218-1 ImageMagickMDKSA-2006:024ADV-2008-0412DSA-1213231321500288002309022998Cross-site scripting vulnerability in index.php in raSMP 2.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the $_SERVER[HTTP_USER_AGENT] variable (User-Agent header).1613822198ADV-2006-003018292http://evuln.com/vulns/13/summary.html101543220060116 vendor ack/fix: 22198: raSMP index.php User-Agent Field XSS (fwd)SQL injection vulnerability in Nkads 1.0 alfa 3 allows remote attackers to execute arbitrary SQL commands via the (1) usuario_nkads_admin or (2) password_nkads_admin parameters.http://www.soulblack.com.ar/repo/papers/advisory/nkads_advisory.txtADV-2006-00401830222206Cross-site scripting vulnerability in index.php in Next Generation Image Gallery 0.0.1 Lite Edition allows remote attackers to inject arbitrary web script or HTML via the page parameter.ADV-2006-00371830922202http://osvdb.org/ref/22/22202-nextgen.txtSQL injection vulnerability in (1) pages.php and (2) detail.php in Lizard Cart CMS 1.04 allows remote attackers to execute arbitrary SQL commands via the id parameter.1614020060104 [eVuln] Lizard Cart CMS SQL Injection VulnerabilityADV-2006-0029182972220022199http://www.evuln.com/vulns/12/summary.html1015435314SQL injection vulnerability in intouch.lib.php in inTouch 0.5.1 Alpha allows remote attackers to execute arbitrary SQL commands via the user parameter.1611020060101 [eVuln] inTouch Authentication BypassADV-2006-0026http://evuln.com/vulns/8/summary.htmlintouch-intouch-sql-injection(23954)22382Buffer overflow in ESRI ArcPad 7.0.0.156 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a .amp file with a COORDSYS tag with a long string attribute.16136ADV-2006-0032http://users.pandora.be/bratax/advisories/b007.html1829422208Directory traversal vulnerability in index.php in IDV Directory Viewer before 2005.1 allows remote attackers to view arbitrary directory contents via a .. (dot dot) in the dir parameter.http://sourceforge.net/project/shownotes.php?release_id=382593&group_id=152499ADV-2006-00311829816137Cross-site scripting (XSS) vulnerability in webmail in Open-Xchange 0.8.1-6 and earlier, with "Inline HTML" enabled, allows remote attackers to inject arbitrary web script or HTML via e-mail attachments, which are rendered inline.ADV-2006-00341828520060103 Open Xchange XSS1015431** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-0992, CVE-2006-0158. Reason: this candidate was intended for one issue, but a typo caused it to be associated with a Novell/Groupwise issue. In addition, this issue was a duplicate of a SiteSuite issue that was also assigned CVE-2006-0158. Notes: All CVE users should consult CVE-2006-0992 and CVE-2006-0158 to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage.Cross-site scripting (XSS) vulnerability in index.php in @Card ME PHP allows remote attackers to inject arbitrary web script or HTML via the cat parameter.22203ADV-2006-003918306http://osvdb.org/ref/22/22203-ecardmax.txtPHP remote file include vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc_stat parameter, a different vulnerability than CVE-2006-0076. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-002817373Cross-site scripting (XSS) vulnerability in phpBB 2.0.19, when "Allowed HTML tags" is enabled, allows remote attackers to inject arbitrary web script or HTML via a permitted HTML tag with ' (single quote) characters and active attributes such as onmouseover, a variant of CVE-2005-4357.31320060105 phpBB 2.0.19 XSS22672ADV-2006-0051Cross-site scripting (XSS) vulnerability in WCONSOLE.DLL in Rockliffe MailSite 5.x and 6.1.22 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string.ADV-2006-02841855120060120 RockLiffe MailSite wconsole.dll Denial of Service/Script Injection Vulnerabilitymailsite-wconsole-xss(24256)1633022677dm-crypt in Linux kernel 2.6.15 and earlier does not clear a structure before it is freed, which leads to a memory disclosure that could allow local users to obtain sensitive information about a cryptographic key.[linux-kernel] 20060104 [Patch 2.6] dm-crypt: zero key before freeing it[linux-kernel] 20060104 [Patch 2.6] dm-crypt: Zero key material before free to avoid information leakkernel-dmcrypt-information-disclosure(24189)USN-244-12006-000416301FLSA:157459-4RHSA-2006:0132FEDORA-2006-10222418SUSE-SA:2006:028MDKSA-2006:040ADV-2006-0235DSA-10171015740388203981937419160187741852718487MDKSA-2006:040wan/sdla.c in Linux kernel 2.6.x before 2.6.11 and 2.4.x before 2.4.29 does not require the CAP_SYS_RAWIO privilege for an SDLA firmware upgrade, with unknown impact and local attack vectors. NOTE: further investigation suggests that this issue requires root privileges to exploit, since it is protected by CAP_NET_ADMIN; thus it might not be a vulnerability, although capabilities provide finer distinctions between privilege levels.MDKSA-2006:044USN-244-116304http://www.kernel.org/git/?p=linux/kernel/git/tglx/history.git;a=commitdiff;h=0f1d4813a4a65296e1131f320a60741732bc068fDSA-1017193741897718527http://linux.bkbits.net:8080/linux-2.4/cset@1.1448.91.23?nav=index.html|src/|src/drivers|src/drivers/net|src/drivers/net/wan|related/drivers/net/wan/sdla.cStack-based buffer overflow in the create_named_pipe function in libmysql.c in PHP 4.3.10 and 4.4.x before 4.4.3 for Windows allows attackers to execute arbitrary code via a long (1) arg_host or (2) arg_unix_socket argument, as demonstrated by a long named pipe variable in the host argument to the mysql_connect function.1614520060105 Windows PHP 4.x "0-day" buffer overflowhttp://www.php.net/ChangeLog-4.php#4.4.322232ADV-2006-00461827520060105 Windows PHP 4.x "0-day" buffer overflow20060108 RE: Windows PHP 4.x "0-day" buffer overflowThe dupfdopen function in sys/kern/kern_descrip.c in OpenBSD 3.7 and 3.8 allows local users to re-open arbitrary files by using setuid programs to access file descriptors using /dev/fd/.16144[3.7] 20060105 008: SECURITY FIX: January 5, 200618296ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/008_fd.patch222311015437PHP remote file include vulnerability in (1) include/templates/categories/default.php and (2) certain other include/templates/categories/ PHP scripts in Valdersoft Shopping Cart 3.0 allows remote attackers to execute arbitrary code via a URL in the catalogDocumentRoot parameter.16126http://downloads.securityfocus.com/vulnerabilities/exploits/cijfer-vscxpl.pl1401Buffer overflow in NicoFTP 3.0.1.19 and earlier might allow local users to execute arbitrary code via a long string in the "Name of site" field of an FTP account. NOTE: because this program executes with the privileges of the invoking user, and because remote programs do not normally have the ability to create or modify FTP accounts in this program, there may not be a typical attack vector for the issue that crosses privilege boundaries. Therefore this may not be a vulnerability.20060102 NicoFTP Stack Overflow317Multiple cross-site scripting (XSS) vulnerabilities in sBLOG 0.7.1 Beta 20051202 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) p and (2) keyword parameters in (a) index.php and (b) search.php.sblog-multiple-scripts-xss(23979)2237422373ADV-2006-0041http://osvdb.org/ref/22/22373-sblog.txtCross-site scripting (XSS) vulnerability in TinyPHPForum (TPF) 3.6 and earlier allows remote attackers to inject arbitrary web script via a javascript: scheme in an "[a]" bbcode tag, possibly the txt parameter to action.php.20060105 [eVuln] TinyPHPForum Multiple Vulnerabilities22256ADV-2006-0054101543618293http://evuln.com/vulns/14/summary.html320TinyPHPForum 3.6 and earlier stores the (1) users/[USERNAME].hash and (2) users/[USERNAME].email files under the web root with insufficient access control, which allows remote attackers to list all registered users and possibly obtain other sensitive information.20060417 Tiny PHP forum - vulns20060105 [eVuln] TinyPHPForum Multiple Vulnerabilities22257ADV-2006-0054101543618293http://evuln.com/vulns/14/summary.htmltinyphpforum-users-information-disclosure(24016)320Directory traversal vulnerability in TinyPHPForum 3.6 and earlier allows remote attackers to create a new user account, create a new topic, or view the profile of a user account, as demonstrated via a .. (dot dot) in the uname parameter to profile.php.20060105 [eVuln] TinyPHPForum Multiple VulnerabilitiesADV-2006-005418293http://evuln.com/vulns/14/summary.htmlhttp://evuln.com/vulns/14/exploit.html16163222581015436320gdi/driver.c and gdi/printdrv.c in Wine 20050930, and other versions, implement the SETABORTPROC GDI Escape function call for Windows Metafile (WMF) files, which allows attackers to execute arbitrary code, the same vulnerability as CVE-2005-4560 but in a different codebase.ADV-2006-009818323http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=346197[Dailydave] 20060105 WMF goes away :<win-wmf-execute-code(23846)20060117 ERRATA: [ GLSA 200601-09 ] Wine: Windows Metafile SETABORTPROC vulnerabilitySUSE-SR:2006:002MDKSA-2006:014GLSA-200601-09DSA-954185781854918451MDKSA-2006:014SQL injection vulnerability in Timecan CMS allows remote attackers to execute arbitrary SQL commands via the viewID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Due to the unavailability of the original source, it cannot be determined if this is the same issue as identified by CVE-2006-0108.161592225218324timecancms-sql-injection(24014)SQL injection vulnerability in mcl_login.asp in Timecan CMS allows remote attackers to execute arbitrary SQL commands via the email parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Due to the unavailability of the original source, it cannot be determined if this is the same issue as identified by CVE-2006-0107.2225322252ADV-2006-0078timecancms-sql-injection(24014)Cross-site scripting vulnerability in category.php in Modular Merchant Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the cat parameter.183201616022243http://www.modularmerchant.com/forums/viewtopic.php?t=46ADV-2006-0076http://osvdb.org/ref/22/22243-modular.txt20060214 vendor ack/fix 22243: Modular Merchant Marketplace Shopping Cart category.php cat Variable XSS (fwd)Cross-site scripting (XSS) vulnerability in escribir.php in Foro Domus 2.10 allows remote attackers to inject arbitrary web script via the email parameter.1615420060106 [eVuln] Proyecto Domus 'email' XSS Vulnerability22263ADV-2006-007318327http://evuln.com/vulns/16/summary.htmldomus-escribir-xss(24020)Cross-site scripting vulnerability in index.php in Boxcar Media Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the (1) parent or (2) pg parameter.boxcar-index-xss(24019)22360ADV-2006-0080http://osvdb.org/ref/22/22360-boxcar.txtCross-site scripting (XSS) vulnerability in index.php in Enhanced Simple PHP Gallery 1.7 allows remote attackers to inject arbitrary web script or HTML via the dir parameter.22201ADV-2006-003618310http://osvdb.org/ref/22/22201-espg.txtEnhanced Simple PHP Gallery 1.7 allows remote attackers to obtain the full path of the application via a direct request to sp_helper_functions.php, which leaks the pathname in an error message.18310http://osvdb.org/ref/22/22201-espg.txt22417The vCard functions in Joomla! 1.0.5 use predictable sequential IDs for vcards and do not restrict access to them, which allows remote attackers to obtain valid e-mail addresses to conduct spam attacks by modifying the contact_id parameter to index2.php.16185ADV-2006-009718361http://forum.joomla.org/index.php/topic,29031.0.htmlhttp://forge.joomla.org/sf/go/artf2950joomla-vcard-information-disclosure(24042)Multiple SQL injection vulnerabilities in OnePlug Solutions OnePlug CMS allow remote attackers to execute arbitrary SQL commands via the (1) Press_Release_ID parameter in press/details.asp, (2) Service_ID parameter in services/details.asp, and (3) Product_ID parameter in products/details.asp.16155222502224922248ADV-2006-007918325http://osvdb.org/ref/22/22248-oneplug.txtCross-site scripting vulnerability search.inetstore in iNETstore Ebusiness Software 2.0 allows remote attackers to inject arbitrary web script or HTML via the searchterm parameter.1615620060126 Re: [OSVDB Mods] iNETstore E Commerce Solution - Cross Site Scripting22251ADV-2006-007520060127 vendor confirms versions: iNETstore E Commerce Solution - Cross Site Scripting (fwd)18322http://osvdb.org/ref/22/22251-inetstore.txtBuffer overflow in IBM Lotus Notes and Domino Server before 6.5.5 allows attackers to cause a denial of service (router crash or hang) via unspecified vectors involving "CD to MIME Conversion".1615818328http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/21d8fd7989fdf78d852570e4001bae68?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/50c634bfe193efa5852570e4001baace?OpenDocumenthttp://www-1.ibm.com/support/docview.wss?uid=swg27007054lotus-cdtomime-dos(24205)ADV-2006-0081Unspecified vulnerability in IBM Lotus Notes and Domino Server before 6.5.5, when running on AIX, allows attackers to cause a denial of service (deep recursion leading to stack overflow and crash) via long formulas.1615818328http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/21d8fd7989fdf78d852570e4001bae68?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/50c634bfe193efa5852570e4001baace?OpenDocumenthttp://www-1.ibm.com/support/docview.wss?uid=swg27007054lotus-long-formula-bo(24206)ADV-2006-0081Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before 6.5.5 have unknown impact and attack vectors, due to "potential security issues" as identified by SPR numbers (1) GPKS6C9J67 in Agents, (2) JGAN6B6TZ3 and (3) KSPR699NBP in the Router, (4) GPKS5YQGPT in Security, or (5) HSAO6BNL6Y in the Web Server. NOTE: vector 3 is related to an issue in NROUTER in IBM Lotus Notes and Domino Server before 6.5.4 FP1, 6.5.5, and 7.0, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted vCal meeting request sent via SMTP (aka SPR# KSPR699NBP).16158183281802020060626 SYMSA-2006-006: Lotus Domino SMTP Based Denial of ServiceADV-2006-2564ADV-2006-0081http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/f97fe7cfd9a8113b8525709200001db4?OpenDocument&Highlight=0,GPKS6C9J67http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/e4deb1cbb011c747852570e4001ba9bb?OpenDocument&Highlight=0,GPKS5YQGPThttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/de2ab57a5b9547848525701b00420c2c?OpenDocument&Highlight=0,KSPR699NBPhttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/d1150fc9c5dec8b18525709200001da6?OpenDocument&Highlight=0,GPKS6C9J67http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/9a1650d1a771f3078525702a00420def?OpenDocument&Highlight=0,HSAO6BNL6Yhttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/94a77eb898843aca8525709200001de1?OpenDocument&Highlight=0,JGAN6B6TZ3http://www-1.ibm.com/support/docview.wss?uid=swg27007054101639020855domino-smtp-nrouter-dos(27413)lotus-web-unspecified-xss(24211)lotus-multiple-unspecified(24207)Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before 6.5.5 allow attackers to cause a denial of service (application crash) via multiple vectors, involving (1) a malformed message sent to an "Out Of Office" agent (SPR LPEE6DMQWJ), (2) the compact command (RTIN5U2SAJ), (3) malformed bitmap images (MYAA6FH5HW), (4) the "Delete Attachment" action (YPHG6844LD), (5) parsing certificates from a remote Certificate Table (AELE6DZFJW), and (6) creating a SSL key ring with the Domino Administration client (NSUA4FQPTN).1615818328http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/ced5f873baea4e8b852570e4001baa6d?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/ad0dd14aa109f96b852570e4001bb08c?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/5f166a44ee743b2c852570e4001baf31?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/4118a1f266afb26c852570e4001baf5e?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/2bb4f466a9e986ae852570e4001babbb?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/040482aeb1416bb7852570e4001badd6?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/258394eaa824f2c08525708a004209d3?OpenDocumenthttp://www-1.ibm.com/support/docview.wss?uid=swg27007054lotus-ssl-keyring-dos(24217)lotus-certificate-parsing-dos(24216)lotus-delete-attachment-dos(24215)lotus-bmp-dos(24214)lotus-compact-dos(24213)lotus-outofoffice-dos(24212)ADV-2006-0081Multiple memory leaks in IBM Lotus Notes and Domino Server before 6.5.5 allow attackers to cause a denial of service (memory consumption and crash) via unknown vectors related to (1) unspecified vectors during the SSL handshake (SPR# MKIN67MQVW), (2) the stash file during the SSL handshake (SPR# MKIN693QUT), and possibly other vectors. NOTE: due to insufficient information in the original vendor advisory, it is not clear whether there is an attacker role in other memory leaks that are specified in the advisory.1615818328http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/2221243535d88a2b8525701b00420cd6?OpenDocument&Highlight=0,MKIN693QUThttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/20f66e356a76c90f8525702a00420e08?OpenDocument&Highlight=0,MKIN67MQVWhttp://www-1.ibm.com/support/docview.wss?uid=swg27007054lotus-ssl-handshake-dos(24223)ADV-2006-0081Cross-site scripting (XSS) vulnerability in Public/Index.asp in Aquifer CMS allows remote attackers to inject arbitrary web script or HTML via the Keyword parameter.Vendor provided solution:
"Liquid Development has identified this vulnerability in all shipping versions of AquiferCMS and coded a software fix. The fix will be included in all releases of AquiferCMS built on or after January 24, 2006. Customers should contact Liquid Development to obtain the fix for this vulnerability. For more information visit www.aquifercms.com."2224716162ADV-2006-007418326http://osvdb.org/ref/22/22247-aquifer.txt20060124 vendor ack/fix: Aquifer CMS Index.asp Keyword Variable XSS (fwd)Multiple SQL injection vulnerabilities in ADN Forum 1.0b allow remote attackers to execute arbitrary SQL commands via the (1) fid parameter in index.php and (2) pagid parameter in verpag.php, and possibly other vectors.1615720060105 [eVuln] ADNForum Multiple Vulnerabilities2224122240ADV-2006-0077101544518300http://evuln.com/vulns/15/summary.htmlCross-site scripting (XSS) vulnerability in crear.php in ADN Forum 1.0b allows remote attackers to inject arbitrary web script or HTML via the titulo parameter, which is used by the "Topic name" field.1615720060105 [eVuln] ADNForum Multiple VulnerabilitiesADV-2006-007718300http://evuln.com/vulns/15/summary.html222421015445Unspecified vulnerability in appserv/main.php in AppServ 2.4.5 allows remote attackers to include arbitrary files via the appserv_root parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. There is not enough detail from these third party sources to know whether this is directory traversal, remote file include, or another issue.22228ADV-2006-00531816316166rxvt-unicode before 6.3, on certain platforms that use openpty and non-Unix pty devices such as Linux and most BSD platforms, does not maintain the intended permissions of tty devices, which allows local users to gain read and write access to the devices.22223ADV-2006-005218301http://dist.schmorp.de/rxvt-unicode/ChangesDirectory traversal vulnerability in the IMAP service of Rockliffe MailSite before 6.1.22.1 allows remote authenticated users to rename the folders of other users via a .. (dot dot) in the RENAME command.http://zur.homelinux.com/Advisories/RockliffeMailsiteDirTransveral.txt22229ADV-2006-00551831820060104 Rockliffe Directory Transversal Vulnerability20060105 Re: Rockliffe Directory Transversal VulnerabilityBuffer overflow in the IMAP service of Rockliffe MailSite before 6.1.22.1 allows remote attackers to have an unknown impact via unknown attack vectors.http://zur.homelinux.com/Advisories/RockliffeMailsiteDirTransveral.txt20060104 Rockliffe Directory Transversal Vulnerabilityrockliffe-imap-unspecified-bo(39991)Mail Management Agent (MAILMA) (aka Mail Management Server) in Rockliffe MailSite 7.0.3.1 and earlier generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames via user requests to TCP port 106.ADV-2006-005518318http://zur.homelinux.com/Advisories/RockliffeMailsiteUserEnum.txt2223020060104 Rockliffe Mailsite User Enumeration FlawMail Management Agent (MAILMA) (aka Mail Management Server) in Rockliffe MailSite 7.0.3.1 and earlier allows remote attackers to attempt authentication with an unlimited number of user account names and passwords without denying connections, limiting the rate of connections, or locking out an account.http://zur.homelinux.com/Advisories/RockliffeMailsiteUserEnum.txt20060104 Rockliffe Mailsite User Enumeration FlawboastMachine 3.1 allows remote attackers to obtain sensitive information via a direct request to (1) footer.php and (2) side_menu.php, which reveals the path in an error message.20060105 [ECHO_ADV_25$2006] Full path disclosure on boastMachine v3.1http://echo.or.id/adv/adv26-K-159-2006.txtDirectory traversal vulnerability in webftp.php in SysCP WebFTP 1.2.6 and possibly earlier allows remote attackers to include and execute arbitrary local PHP scripts, and possibly read other types of files, via a .. (dot dot) and a trailing null in the webftp_language parameter.ADV-2006-0090183551617520060104 SysCP WebFTP local file inclusion vulnerabilitywebftp-language-file-include(24018)Multiple directory traversal vulnerabilities in AIX 5.3 ML03 allow local users to determine the existence of files and read partial contents of certain files via a .. (dot dot) in the argument to (1) getCommand.new (aka getCommand) and (2) getShell, a different vulnerability than CVE-2005-4273.161031610220060101 [xfocus-SD-060101]AIX getCommand&getShell two vulnerabilities1015429Cross-site scripting (XSS) vulnerability in register.php in TheWebForum (twf) 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the www parameter.1616120060106 [eVuln] TheWebForum Script Insertion and Authentication BypassADV-2006-0093101545018392http://evuln.com/vulns/17/summary.htmlhttp://evuln.com/vulns/17/exploit.htmlthewebforum-register-xss(24007)22295SQL injection vulnerability in login.php in TheWebForum (twf) 1.2.1 allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the username parameter (aka the u variable).1616120060106 [eVuln] TheWebForum Script Insertion and Authentication BypassADV-2006-0093101545018392http://evuln.com/vulns/17/summary.htmlhttp://evuln.com/vulns/17/exploit.htmlthewebforum-login-sql-injection(24027)22294321Multiple cross-site scripting (XSS) vulnerabilities in the guestbook module in modules.php in Phanatic Softwares Chimera Web Portal System 0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) comment_poster, (2) comment_poster_email, (3) comment_poster_homepage, and (4) comment_text parameters.1611320060101 [eVuln] Chimera Web Portal System Multiple VulnerabilitiesADV-2006-0025http://evuln.com/vulns/7/summary.htmlhttp://evuln.com/vulns/7/exploit.htmlSQL injection vulnerability in linkcategory.php in Phanatic Softwares Chimera Web Portal System 0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.1611320060101 [eVuln] Chimera Web Portal System Multiple VulnerabilitiesADV-2006-0025http://evuln.com/vulns/7/summary.htmlhttp://evuln.com/vulns/7/exploit.htmlchimera-linkcategory-sql-injection(23963)22420aMSN (aka Alvaro's Messenger) allows remote attackers to cause a denial of service (client hang and termination of client's instant-messaging session) by repeatedly sending crafted data to the default file-transfer port (TCP 6891).http://www.securiteam.com/exploits/5JP090KHFQ.html22186The send-private-message functionality (send-private-message.asp) in PD9 Software MegaBBS 2.1 allows remote attackers to read private messages of other users via a modified replyid parameter.16168http://www.pd9soft.com/megabbs/forums/thread-view.asp?tid=4924http://www.hamid.ir/security/megabbs.txtADV-2006-009518342megabbs-sendprivatemessage-disclosure(24050)1015452Cross-site scripting (XSS) vulnerability in post.php in NavBoard V16 Stable(2.6.0) and V17beta2 allows remote attackers to inject arbitrary web script or HTML via the (1) b, (2) textlarge, and (3) url bbcode tags.navboard-post-xss(24021)1616520060107 [eVuln] NavBoard BBcode XSS Vulnerability22277ADV-2006-009218345http://evuln.com/vulns/19/summary.htmlQualcomm Eudora Internet Mail Server (EIMS) before 3.2.8 allows remote attackers to cause a denial of service (crash) via (1) malformed NTLM authentication requests, or a malformed (2) Incoming Mail X or (3) Temporary Mail file.ADV-2006-0099http://www.eudora.co.nz/updates.html1835616179eims-corrupted-mail-dos(24033)eims-ntlm-auth-dos(24032)Cross-site scripting (XSS) vulnerability in andromeda.php in Andromeda 1.9.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the s parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.16183ADV-2006-009618359andromeda-script-xss(24031)Microsoft Windows Graphics Rendering Engine (GRE) allows remote attackers to corrupt memory and cause a denial of service (crash) via a WMF file containing (1) ExtCreateRegion or (2) ExtEscape function calls with arguments with inconsistent lengths.10154531616720060109 [UPDATE]Microsoft Windows GRE WMF Format Multiple Unauthorized Memory Access Vulnerabilities20060107 Microsoft Windows GRE WMF Format Multiple Memory Overrun VulnerabilitiesADV-2006-0115http://blogs.technet.com/msrc/archive/2006/01/09/417198.aspxwin-gre-wmf-dos(24044)http://lostmon.blogspot.com/2007/08/windows-extended-file-attributes-buffer.htmlFormat string vulnerability in the logging code of SMS Server Tools (smstools) 1.14.8 and earlier allows local users to execute arbitrary code via unspecified attack vectors.18357smstools-logging-format-string(24034)1618822287DSA-93018343The proxy server feature in go-pear.php in PHP PEAR 0.2.2, as used in Apache2Triad, allows remote attackers to execute arbitrary PHP code by redirecting go-pear.php to a malicious proxy server that provides a modified version of Tar.php with a malicious extractModify function.ADV-2006-014818390gopear-proxy-redirection(24076)1617420060109 New PEAR / Apache2Triad Exploithttp://apache2triad.net/forums/viewtopic.php?p=14670The kernfs_xread function in kernfs in NetBSD 1.6 through 2.1, and OpenBSD 3.8, does not properly validate file offsets against negative 32-bit values that occur as a result of truncation, which allows local users to read arbitrary kernel memory and gain privileges via the lseek system call.16173http://www.securitylab.net/research/2006/02/advisory_netbsd_openbsd_kernfs.html20060202 [SLAB] NetBSD / OpenBSD kernfs_xread patch evasion222931871218388NetBSD-SA2006-001netbsd-kernfs-memory-disclosure(24035)405The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.http://www.xaraya.com/index.php/news/5691618720060202 Bug for libs in php link directory 2.022290GLSA-200604-07ADV-2006-1419ADV-2006-1304ADV-2006-0447ADV-2006-0370ADV-2006-0105ADV-2006-0104ADV-2006-0103ADV-2006-0101DSA-1031DSA-1030DSA-1029http://secunia.com/secunia_research/2005-64/advisory/19699195911959019563195551872018276182601823317418adodb-server-command-execution(24051)20070418 MediaBeez Sql query Execution .. Wear isn't ?? :)20060409 PhpOpenChat 3.0.x ADODB Server.php "sql" SQL injectionhttp://www.maxdev.com/Article550.phtmlADV-2006-1305ADV-2006-01027132495419691196001826718254http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.htmlDynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo.22291GLSA-200604-07ADV-2006-1332ADV-2006-0104ADV-2006-0103ADV-2006-0102ADV-2006-0101DSA-1030DSA-1029http://secunia.com/secunia_research/2005-64/advisory/19628195911959019555182761826018254182331741820060412 Simplog <=0.9.2 multiple vulnerabilities20060409 PhpOpenChat 3.0.x ADODB Server.php "sql" SQL injectionADV-2006-1305DSA-10311960018267http://retrogod.altervista.org/simplog_092_incl_xpl.htmlhttp://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html1663adodb-tmssql-command-execution(24052)19691NetSarang Xlpd 2.1 allows remote attackers to cause a denial of service (crash) via a large number of connections from the same IP address.16164http://www.ipomonis.com/advisories/xlpd.txt1015444xlpd-connection-dos(24041)Cross-site scripting (XSS) vulnerability in SimpBook 1.0, with html_enable on (the default), allows remote attackers to inject arbitrary web script or HTML via the message field.101545120060106 SimpBook "message" Remote Cross-Site Scripting VulnerabilityMultiple format string vulnerabilities in the auth_ldap_log_reason function in Apache auth_ldap 1.6.0 and earlier allows remote attackers to execute arbitrary code via various vectors, including the username.MDKSA-2006:01716177RHSA-2006:0179ADV-2006-0117DSA-9521856818412184051838220060109 Digital Armaments Security Advisory 01.09.2006: Apache auth_ldap module Multiple Format Strings Vulnerabilityhttp://www.rudedog.org/auth_ldap/Changes.htmlhttp://www.digitalarmaments.com/2006090173928420.html1015456apache-authldap-format-string(24030)sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158.18363USN-235-216184183582006-0010SUSE-SR:2006:002MDKSA-2006:159DSA-946SSA:2006-045-082169219016189061855818549MDKSA-2006:159Cross-site scripting (XSS) in search_result.php in phpChamber 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the needle parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.16180ADV-2006-009418360phpchamber-searchresult-xss(24029)22282427BB 2.2 and 2.2.1 verifies authentication credentials based on the username, authenticated, and usertype cookies, which allows remote attackers to bypass authentication by using a valid username and usertype and setting the authenticated cookie.1617820060107 [eVuln] 427BB Multiple Vulnerabilities (Cookie-based Authentication Bypass, SQL Injections, XSS)ADV-2006-009118354http://evuln.com/vulns/18/summary.html427bb-scripts-security-bypass(24038)22274SQL injection vulnerability in showthread.php in 427BB 2.2 and 2.2.1 allows remote attackers to execute arbitrary SQL commands via the ForumID parameter.1616920060107 [eVuln] 427BB Multiple Vulnerabilities (Cookie-based Authentication Bypass, SQL Injections, XSS)ADV-2006-009118354http://evuln.com/vulns/18/summary.html427bb-showthread-sql-injection(24039)22275Cross-site scripting (XSS) vulnerability in posts.php in 427BB 2.2 and 2.2.1 allows remote attackers to inject arbitrary Javascript via a new message with a url bbcode tag containing a javascript URI.20060107 [eVuln] 427BB Multiple Vulnerabilities (Cookie-based Authentication Bypass, SQL Injections, XSS)ADV-2006-009118354http://evuln.com/vulns/18/summary.html427bb-posts-xss(24040)22276Cross-site scripting (XSS) vulnerability in Foxrum 4.0.4f allows remote attackers to inject arbitrary Javascript via the javascript URI in bbcode url tags in (1) addpost1.php and (2) addtopic1.php.1617220060109 [eVuln] Foxrum BBCode XSS VulnerabiltyADV-2006-012118386http://evuln.com/vulns/20foxrum-bbcode-xss(24043)325settings.php in Reamday Enterprises Magic News Plus 1.0.3 allows remote attackers to change the administrator password via a change action that specifies identical values for the passwd and admin_password parameters, then declares the new password string in the new_passwd and confirm_passwd parameters.16182http://downloads.securityfocus.com/vulnerabilities/exploits/MagicNewsPlus-pw-change.pl18601SQL injection vulnerability in index.php in CyberDoc SiteSuite CMS allows remote attackers to execute arbitrary SQL commands via the page parameter.22205ADV-2006-003818305http://osvdb.org/ref/22/22205-sitesuite.txtSQL injection vulnerability in escribir.php in Foro Domus 2.10 allows remote attackers to execute arbitrary SQL commands via the email parameter. NOTE: the provenance of this information is unknown, although it may be based on post-disclosure analysis of CVE-2006-0110; the details are obtained solely from third party information.22264ADV-2006-007318327domus-escribir-sql-injection(24017)SQL injection vulnerability in add_post.php3 in Venom Board 1.22 allows remote attackers to execute arbitrary SQL commands via the (1) parent, (2) root, and (3) topic_id parameters to post.php3.venomboard-addpost-sql-injection(24046)1617622297ADV-2006-01221838320060109 [eVuln] Venom Board SQL Injection Vulnerability20060109 [eVuln] Venom Board SQL Injection Vulnerabilityhttp://evuln.com/vulns/21/summary.html326Unspecified vulnerability in uucp in Sun Solaris 8 and 9 has unknown impact and attack vectors. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this is related to CVE-2004-0780.101933ADV-2006-0113http://support.avaya.com/elmodocs2/security/ASA-2006-056.htm10154551908718371oval:org.mitre.oval:def:1534Heap-based buffer overflow in libclamav/upx.c in Clam Antivirus (ClamAV) before 0.88 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted UPX files.VU#38590816191ADV-2006-011618379http://www.clamav.net/doc/0.88/ChangeLogclamav-libclamav-upx-bo(24047)http://www.zerodayinitiative.com/advisories/ZDI-06-001.html2006-000222318MDKSA-2006:016GLSA-200601-07DSA-94710154573421854818478184631845320060112 ZDI-06-001: Clam AntiVirus UPX Unpacking Code Execution VulnerabilityMDKSA-2006:016PostgreSQL 8.0.x before 8.0.6 and 8.1.x before 8.1.2, when running on Windows, allows remote attackers to cause a denial of service (postmaster exit and no new connections) via a large number of simultaneous connection requests.[pgsql-announce] 20060109 CRITICAL RELEASE: Minor Releases to Fix DoS Vulnerabilitypostgresql-connection-request-dos(24049)1620120060111 PostgreSQL security releases 8.0.6 and 8.1.2http://www.postgresql.org/about/news.456ADV-2006-0114101548232718419An unspecified Microsoft WMF parsing application, as used in Internet Explorer 5.01 SP4 on Windows 2000 SP4, and 5.5 SP2 on Windows Millennium, and possibly other versions, allows attackers to cause a denial of service (crash) and possibly execute code via a crafted WMF file with a manipulated WMF header size, possibly involving an integer overflow, a different vulnerability than CVE-2005-4560, and aka "WMF Image Parsing Memory Corruption Vulnerability."VU#312956TA06-045A16516MS06-004ADV-2006-04691872922976http://www.microsoft.com/technet/security/advisory/913333.mspx18912[funsec] 20060110 Another WMF flaw without a Microsoft patchoval:org.mitre.oval:def:1638Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression.TA06-010AVU#91593016194MS06-002ADV-2006-011818365win-embedded-fonts-bo(23922)http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=37552520060110 [EEYEB-2000801] - Windows Embedded Open Type (EOT) Font Heap Overflow Vulnerability18829EEYEB20050801http://support.avaya.com/elmodocs2/security/ASA-2006-004.htm10154591839118311oval:org.mitre.oval:def:714oval:org.mitre.oval:def:698oval:org.mitre.oval:def:1491oval:org.mitre.oval:def:1462oval:org.mitre.oval:def:1185oval:org.mitre.oval:def:1126Unspecified vulnerability in Microsoft Outlook 2000 through 2003, Exchange 5.0 Server SP2 and 5.5 SP4, Exchange 2000 SP3, and Office allows remote attackers to execute arbitrary code via an e-mail message with a crafted Transport Neutral Encapsulation Format (TNEF) MIME attachment, related to message length validation.TA06-010AVU#2521461619720060110 Microsoft Outlook Critical Vulnerability20060110 Microsoft Exchange Critical VulnerabilityMS06-003ADV-2006-01191015461101546018368http://support.avaya.com/elmodocs2/security/ASA-2006-004.htmwin-tnef-overflow(22878)331330oval:org.mitre.oval:def:624oval:org.mitre.oval:def:1485oval:org.mitre.oval:def:1456oval:org.mitre.oval:def:1316oval:org.mitre.oval:def:1165oval:org.mitre.oval:def:1082The netlink_rcv_skb function in af_netlink.c in Linux kernel 2.6.14 and 2.6.15 allows local users to cause a denial of service (infinite loop) via a nlmsg_len field of 0.2006-00041848216414http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ad8e4b75c8a7bed475d72ce09bf5267188621961kernel-afnetlink-dos(24202)ADV-2006-0220388The ipfw firewall in FreeBSD 6.0-RELEASE allows remote attackers to cause a denial of service (firewall crash) via ICMP IP fragments that match a reset, reject or unreach action, which leads to an access of an uninitialized pointer.1620918378FreeBSD-SA-06:04ipfw-icmp-fragment-dos(24073)223191015477The ispell_op function in ee on FreeBSD 4.10 to 6.0 uses predictable filenames and does not confirm which file is being written, which allows local users to overwrite arbitrary files via a symlink attack when ee invokes ispell.1620718404FreeBSD-SA-06:02ee-ispell-op-symlink(24074)223201015469SQL injection vulnerability in the search module (modules/Search/index.php) of PHPNuke EV 7.7 -R1 allows remote attackers to execute arbitrary SQL commands via the query parameter, which is used by the search field. NOTE: This is a different vulnerability than CVE-2005-3792.phpnukeev-search-sql-injection(44978)1618622316ADV-2006-012018394http://lostmon.blogspot.com/2006/01/phpnuke-ev-77-search-module-query.htmlphgstats.inc.php in phgstats before 0.5.1, if register_globals is enabled, allows remote attackers to include arbitrary files and execute arbitrary PHP code by modifying the PHGDIR variable.ADV-2006-0123http://sourceforge.net/project/shownotes.php?release_id=38423218346phgstats-php-file-include(24062)1746922302Cross-site scripting (XSS) vulnerability in the DataForm Entries functionality in Plain Black WebGUI before 6.8.4 (gamma) allows remote attackers to inject arbitrary Javascript via the (1) url and (2) name field of the default email form.ADV-2006-0126http://sourceforge.net/project/shownotes.php?release_id=384153&group_id=5141718372http://sourceforge.net/tracker/index.php?func=detail&aid=1395371&group_id=51417&atid=463213webgui-forms-xss(24053)Symantec Norton SystemWorks and SystemWorks Premier 2005 and 2006 stores temporary copies of files in the Norton Protected Recycle Bin NProtect directory, which is hidden from the FindFirst and FindNext Windows APIs and allows remote attackers to hide arbitrary files from virus scanners and other products.ADV-2006-01431015462http://securityresponse.symantec.com/avcenter/security/Content/2006.01.10.html18402systemworks-nprotect-hidden(24061)SQL injection vulnerability in MyPhPim 01.05 allows remote attackers to execute arbitrary SQL commands via the (1) cal_id parameter in calendar.php3 and the (2) password field on the login page.myphpim-login-sql-injection(24075)myphpim-calendar-sql-injection(24066)1621020060111 [eVuln] MyPhPim Multiple SQL Injection and XSS Vulnerabilities2232522324ADV-2006-014718399http://evuln.com/vulns/22/summary.htmlCross-site scripting (XSS) vulnerability in MyPhPim 01.05 allows remote attackers to inject arbitrary web script or HTML via the description field on the "Create New todo" page.myphpim-todo-xss(24071)1621020060111 [eVuln] MyPhPim Multiple SQL Injection and XSS Vulnerabilities22326ADV-2006-014718399http://evuln.com/vulns/22/summary.htmladdresses.php3 in MyPhPim 01.05 does not restrict uploaded files, which allows remote attackers to execute arbitrary PHP code via the pdbfile variable, then directly accessing those files from the uploads directory.myphpim-addresses-file-upload(24070)1620820060111 [eVuln] MyPhPim Arbitrary File UploadADV-2006-014718399http://evuln.com/vulns/23/summary.html** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-0035. Reason: This candidate is a duplicate of CVE-2006-0035. Notes: All CVE users should reference CVE-2006-0035 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.PHP remote file include vulnerability in index.php in OrjinWeb E-commerce allows remote attackers to execute arbitrary code via a URL in the page parameter. NOTE: it is not clear, but OrjinWeb might be an application service, in which case it should not be included in CVE.1619920060106 Orjinweb E-commerceorjinweb-url-file-include(24097)22387Cross-site scripting (XSS) vulnerability in the file manager utility in Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to inject arbitrary web script or HTML in an uploaded page, which is published without a check for hostile scripting.ADV-2006-01451619520060110 Multiple Vulnerabilities in Hummingbird Collaborationhttp://www.securenetwork.it/advisories/sn-2006-01.html18411hummingbird-enterprise-xss(24067)Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to misrepresent the type and name of a file via modified doc_ext and id parameters, which might trick a user into downloading dangerous or unexpected content.ADV-2006-01451619520060110 Multiple Vulnerabilities in Hummingbird Collaborationhttp://www.securenetwork.it/advisories/sn-2006-01.html18411hummingbird-enterprise-file-download(24068)Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to obtain sensitive information (intranet IP addresses and enumerations of valid parameter values) via a direct request to hc, which reveals the information in an error message or a cookie.1619520060110 Multiple Vulnerabilities in Hummingbird Collaborationhttp://www.securenetwork.it/advisories/sn-2006-01.htmlADV-2006-014518411hummingbird-enterprise-information-disclosure(24069)328Cross-site scripting (XSS) vulnerability in search_form.asp in Web Wiz Forums 6.34 allows remote attackers to inject arbitrary web script or HTML via the search parameter.1619620060111 Advisory:XSS vulnerability on WebWiz Forums <= 6.34(search_form.asp)20060109 Advisory:XSS vulnerability on WebWiz Forums <= 6.34 (search_form.asp)webwizforums-searchform-xss(24048)22398Buffer overflow in certain functions in src/fileio.c and src/unix/fileio.c in xmame before 11 January 2006 may allow local users to gain privileges via a long (1) -lang, (2) -ctrlr, (3) -pb, or (4) -rec argument on many operating systems, and via a long (5) -jdev argument on Ubuntu Linux.1620320060110 mysec.org Security Advisory : Xmame buffer overflow, with a possibility of privilege escalation20060110 mysec.org Security Advisory : Xmame buffer overflow, with a possibility of privilege escalation.xmame-multiple-parameters-bo(24102)http://x.mame.net/changes-unix.htmlMultiple buffer overflows in Cray UNICOS 9.0.2.2 might allow local users to gain privileges by (1) invoking /usr/bin/script with a long command line argument or (2) setting the -c option of /etc/nu to the name of a file containing a long line.1620520060110 SUID root overflows in UNICOS and partial shellcodeunicos-command-line-bo(24276)Format string vulnerability in /bin/ftp in UNICOS 9.0.2.2 allows local users to have an unknown impact via format string specifiers in the quote command. NOTE: because the program is not setuid and not normally called from remote programs, there may not be a typical attack vector for the issue that crosses privilege boundaries. Therefore this may not be a vulnerability.1620520060110 SUID root overflows in UNICOS and partial shellcodeunicos-ftp-format-string(24277)The Cisco IP Phone 7940 allows remote attackers to cause a denial of service (reboot) via a large amount of TCP SYN packets (syn flood) to arbitrary ports, as demonstrated to port 80.ADV-2006-0202101548818479cisco-ipphone-synflood-dos(24117)162002246920060113 Response to Cisco IP Phone 7940 DoS Exploit posted on milw0rm.comhttp://downloads.securityfocus.com/vulnerabilities/exploits/cisco_ip7940_dos.plCross-site scripting (XSS) vulnerability in CaLogic Calendars 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the Title field on the "Adding New Event" page, and possibly other vectors, involving iframe tags.16206ADV-2006-014918417http://evuln.com/vulns/24/summary.htmlcalogic-newevent-xss(24077)20060116 [eVuln] CaLogic Calendars Multiple XSS Vulnerabilities22322Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.1.3 has an undocumented administrative account with a default password, which allows local users to gain privileges via the expert command.1621120060111 Default Administrative Password in Cisco Security Monitoring, Analysis and Response System (CS-MARS)cisco-csmars-default-password(24065)22346ADV-2006-0154101547133518424login.php in ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside".ADV-2006-0152http://evuln.com/vulns/25/summary.htmlacal-login-auth-bypass(24104)20060112 [eVuln] ACal Authentication Bypass & PHP Code Insertion2234434318432Direct static code injection vulnerability in edit.php in ACal Calendar Project 2.2.5 allows authenticated users to execute arbitrary PHP code via (1) the edit=header value, which modifies header.php, or (2) the edit=footer value, which modifies footer.php. NOTE: this issue might be resultant from the poor authentication as identified by CVE-2006-0182. Since the design of the product allows the administrator to edit the code, perhaps this issue should not be included in CVE, except as a consequence of CVE-2006-0182.ADV-2006-0152http://evuln.com/vulns/25/summary.htmlacal-header-footer-code-execute(24107)20060112 [eVuln] ACal Authentication Bypass & PHP Code Insertion2234534318432Multiple SQL injection vulnerabilities in AspTopSites allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to goto.asp or (2) password parameter to includeloginuser.asp.ADV-2006-0146http://www.exploitlabs.com/files/advisories/EXPL-A-2006-001-asptopsites.txt18408asptopsites-goto-sql-injection(24072)2233020060110 AspTopSites SQL injectionMultiple cross-site scripting vulnerabilities in the (1) Pool or (2) News Modules in Php-Nuke allow remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of an IMG tag.1619220060107 Php-Nuke Pool and News Module IMG Tag Cross SiteADV-2006-012518374** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-4500. Reason: This candidate is a duplicate of CVE-2005-4500. Notes: All CVE users should reference CVE-2005-4500 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.By design, Microsoft Visual Studio 2005 automatically executes code in the Load event of a user-defined control (UserControl1_Load function), which allows user-assisted attackers to execute arbitrary code by tricking the user into opening a malicious Visual Studio project file.1622520060113 Visual Studio Remote Code ExecutionADV-2006-015118409visualstudio-usercontrol-code-execution(24116)Buffer overflow in eStara Softphone 3.0.1.14 through 3.0.1.46 allows remote attackers to execute arbitrary code via a long attribute (aka "a") field in the SDP data of a SIP packet on UDP port 5060.This is the vendor provided solution:
"eStara has released Softphone version 3.0.1.47 to resolve the buffer overflow demonstrated in parsing SDP with long "a=" lines. Licensed customers can download a new version via the email sent to them with purchase, customers testing may go back to http://www.estara.com/softphone/ to obtain a new free trial. Version information can be gathered by going to Help->About. eStara highly recommends all customers upgrade to avoid this issue. If there's further questions please email us: softphone@estara.com.
eStara would like to thank ZwelL for bringing the issue to our attention."estara-sip-sdp-bo(24090)1621320060111 eStara Softphone SIP stack Buffer Overflow VulnerabilityADV-2006-016710154811841022348Unspecified vulnerability in Sun Solaris 9 and 10 for the x86 platform allows local users to gain privileges or cause a denial of service (panic) via unspecified vectors, possibly involving functions from the mm driver.ADV-2006-016510206618421solaris-unspecified-root-access(24084)16224http://support.avaya.com/elmodocs2/security/ASA-2006-056.htm101547819087oval:org.mitre.oval:def:702Unspecified vulnerability in Sun Solaris 10 allows local users to cause a denial of service (null dereference) via unspecified vectors involving the use of the find command on the "/proc" filesystem. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this is related to CVE-2005-3250.ADV-2006-016610210818420solaris-find-proc-dos(24085)1622222347http://support.avaya.com/elmodocs2/security/ASA-2006-056.htm101547919087oval:org.mitre.oval:def:1608SQL injection vulnerability in Login_Validate.asp in ASPSurvey 1.10 allows remote attackers to execute arbitrary SQL commands via the Password parameter to login.asp.aspsurvey-loginvalidate-sql-injection(24087)1649620060204 sql injection in ASP Survey22342ADV-2006-016418422414Cross-site scripting (XSS) vulnerability in the Hosting Control Panel (psoft.hsphere.CP) in Positive Software H-Sphere 2.4.3 Patch 8 and earlier allows remote attackers to inject arbitrary web script or HTML via the login parameter in a login action.20060112 H-Sphere Security Vulnerabilityhttp://www.psoft.net/HSdocumentation/versions/?v=all&p=rhsphere-login-xss(24096)http://www.psoft.net/HSdocumentation/versions/index.php?v=243p9&p=r22372ADV-2006-017218447Cross-site scripting (XSS) vulnerability in default.asp in FogBugz 4.029, and other versions before 4.0.33, allows remote attackers to inject arbitrary web script or HTML via the dest parameter in the pgLogon page.1621620060112 FogBugz Cross Site Scripting Vulnerabilityhttp://www.fogcreek.com/FogBugz/KB/releaseNotes/WhatsNewInFogBugz4.0.33.htmlfogbugz-login-xss(24103)22370ADV-2006-017418443Unspecified vulnerability in Serial line sniffer (aka slsnif) 0.4.4 allows local users to gain privileges via a long value of the HOME environment variable, possibly because of a buffer overflow.slsnif-home-bo(24082)20060111 Serial Line Sniffer 0.4.4 Buffer Overflowhttp://shellcoders.com/sintigan/slsnif-ploit.plADV-2006-021218497The XClientMessageEvent struct used in certain components of X.Org 6.8.2 and earlier, possibly including (1) the X server and (2) Xlib, uses a "long" specifier for elements of the l array, which results in inconsistent sizes in the struct on 32-bit versus 64-bit platforms, and might allow attackers to cause a denial of service (application crash) and possibly conduct other attacks.20060108 xorg server 6.8.2 and below on 64bit archCross-site scripting (XSS) vulnerability in a certain module, possibly poll or Pool, for XOOPS allows remote attackers to inject arbitrary web script or HTML via JavaScript in the SRC attribute of an IMG element in a comment.http://www.xoops.org/modules/newbb/viewtopic.php?topic_id=45637&forum=2&post_id=2004811618920060107 Xoops Pool Module IMG Tag Cross Site Scriptingxoops-pool-imagetag-xss(24091)SQL injection vulnerability in news.asp in Mini-Nuke CMS System 1.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the hid parameter.mininuke-news-sql-injection(24098)20060113 Advisory: MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injectionvulnerability22384http://www.nukedx.com/?viewdoc=7ADV-2006-01731843920060112 Advisory: MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injection vulnerability340Format string vulnerability in the error-reporting feature in the mysqli extension in PHP 5.1.0 and 5.1.1 might allow remote attackers to execute arbitrary code via format string specifiers in MySQL error messages.php-extmysqli-format-string(24095)16219http://www.php.net/release_5_1_2.phpADV-2006-01771843120060112 Advisory 02/2006: PHP ext/mysqli Format String Vulnerabilityhttp://www.hardened-php.net/advisory_022006.113.htmlADV-2006-03691015485337Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50, and possibly earlier versions, allows remote attackers to enter false payment entries into the log file via HTTP POST requests to ipn_success.php.ADV-2006-0183http://www.uinc.ru/articles/vuln/ptpaypal050.shtml1621820060112 Multiple PHP Toolkit for PayPal Vulnerabilities1844422378Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50 and possibly earlier has (1) world-readable permissions for ipn/logs/ipn_success.txt, which allows local users to view sensitive information (payment data), and (2) world-writable permissions for ipn/logs, which allows local users to delete or replace payment data.ADV-2006-0183http://www.uinc.ru/articles/vuln/ptpaypal050.shtml1621820060112 Multiple PHP Toolkit for PayPal Vulnerabilities1844422379membership.asp in Mini-Nuke CMS System 1.8.2 and earlier does not verify the old password when changing a password, which allows remote attackers to change the passwords of other members via a lostpassnew action with a modified x parameter.mininuke-membership-change-password(24101)20060113 Advisory: MiniNuke CMS System <= 1.8.2 (membership.asp) remoteuser password change exploit22385ADV-2006-01731843920060112 Advisory: MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injection vulnerability20060112 Advisory: MiniNuke CMS System <= 1.8.2 (membership.asp) remote user password change exploit20060129 [xpl#2] MiniNuke 1.8.2 - change member's passwrod < Perl >344Multiple cross-site scripting (XSS) vulnerabilities in Wordcircle 2.17 allow remote attackers to inject arbitrary web script or HTML via (1) the "Course name" field in index.php when the frm parameter has the value "mine" and (2) possibly certain other fields in unspecified scripts.wordcircle-index-xss(24106)1622720060112 [eVuln] Wordcircle Multiple SQL Injection & XSS Vulnerabilities22359ADV-2006-018518440http://evuln.com/vulns/28/summary.html345Multiple SQL injection vulnerabilities in Wordcircle 2.17 allow remote attackers to (1) execute arbitrary SQL commands and bypass authentication via the password field in the login action to index.php (involving v_login.php and s_user.php) and (2) have other unknown impact via certain other fields in unspecified scripts.wordcircle-login-security-bypass(24108)wordcircle-sql-injection(24105)1622720060112 [eVuln] Wordcircle Multiple SQL Injection & XSS Vulnerabilities20060112 [eVuln] Wordcircle Authentication Bypass22358ADV-2006-018518440http://evuln.com/vulns/28/summary.htmlhttp://evuln.com/vulns/27/summary.html346345Eval injection vulnerability in Light Weight Calendar (LWC) 1.0 (20040909) and earlier allows remote attackers to execute arbitrary PHP code via the date parameter in cal.php, which is included by index.php.1622918450http://evuln.com/vulns/29/summary.htmlhttp://evuln.com/vulns/29/exploit.htmllwc-cal-execute-code(24110)2237620060318 Source VERIFY - Light Weight Calendar issue is eval injectionMultiple HTTP response splitting vulnerabilities in PHP 5.1.1 allow remote attackers to inject arbitrary HTTP headers via a crafted Set-Cookie header, related to the (1) session extension (aka ext/session) and the (2) header function.php-session-response-splitting(24094)16220GLSA-200603-22ADV-2006-0369ADV-2006-0177101548419355191791869718431MDKSA-2006:028USN-261-1http://www.php.net/release_5_1_2.phphttp://www.hardened-php.net/advisory_012006.112.html19012SUSE-SR:2006:004MDKSA-2006:028DSA-133125945Multiple cross-site scripting (XSS) vulnerabilities in PHP 4.4.1 and 5.1.1, when display_errors and html_errors are on, allow remote attackers to inject arbitrary web script or HTML via inputs to PHP applications that are not filtered when they are included in the resulting error message.16803http://www.php.net/release_5_1_2.phpGLSA-200603-22ADV-2006-0369ADV-2006-017719355191791869718431MDKSA-2006:028https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178028USN-261-1http://www.php.net/ChangeLog-4.php#4.4.219012SUSE-SR:2006:004RHSA-2006:0501MDKSA-2006:028ADV-2006-2685http://support.avaya.com/elmodocs2/security/ASA-2006-160.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-129.htm215642125220951202222021019832RHSA-2006:0549RHSA-2006:027620060501-01-USQL injection vulnerability in general_functions.php in TankLogger 2.4 allows remote attackers to execute arbitrary SQL commands via the (1) livestock_id parameter to showInfo.php and (2) tank_id parameter, possibly to livestock.php.ADV-2006-0153http://evuln.com/vulns/26/summary.htmltanklogger-generalfunctions-sql-injection(24080)1622820060112 [eVuln] TankLogger SQL Injection Vulnerability22369223683411844120060113 Verified TankLogger SQl inject by source inspectionCross-site scripting (XSS) vulnerability in index.php in Interspire TrackPoint NX before 0.1 allows remote attackers to inject arbitrary web script or HTML via the username parameter when using the Login page.16214http://www.interspire.com/forum/showthread.php?p=29606trackpointnx-login-xss(24112)20060112 Interspire TrackPoint NX XSS Vulnerability22377ADV-2006-017518445Cross-site scripting (XSS) vulnerability in forgotPassword.asp in Helm Hosting Control Panel 3.2.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the txtEmailAddress parameter.20060112 Helm XSS Vulnerabilityhelm-forgotpassword-xss(24139)http://www.webhostautomation.com/webhost-3011623422454ADV-2006-020318492Directory traversal vulnerability in OBEX Push services in Toshiba Bluetooth Stack 4.00.23(T) and earlier allows remote attackers to upload arbitrary files to arbitrary remote locations specified by .. (dot dot) sequences, as demonstrated by ..\\ sequences in the RFILE argument of ussp-push.16236ADV-2006-0184http://www.digitalmunition.com/DMA%5B2006-0112a%5D.txt1843720060113 DMA[2006-0112a] - 'Toshiba Bluetooth Stack Directory Transversal'20060113 DMA[2006-0112a] - 'Toshiba Bluetooth Stack Directory Transversal'20060113 DMA[2006-0112a] - 'Toshiba Bluetooth Stack Directory Transversal'223801015486http://aps.toshiba-tro.de/bluetooth/pages/driverinfo.php?txt=sp2Kolab Server 2.0.1, 2.0.2 and development versions pre-2.1-20051215 and earlier, when authenticating users via secure SMTP, stores authentication credentials in plaintext in the postfix.log file, which allows local users to gain privileges.ADV-2006-018618438http://kolab.org/security/kolab-vendor-notice-08.txtkolab-smtp-logging(24123)22381Eval injection vulnerability in ezDatabase 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the db_id parameter to visitorupload.php, as demonstrated using phpinfo and include function calls.ezdatabase-visitorupload-file-include(24136)1623735118043http://pridels0.blogspot.com/2006/01/ezdatabase-20-and-below.htmlCross-site scripting (XSS) vulnerability in admin.php in QualityEBiz Quality PPC (QPPC) 1.0 build 1644 allows remote attackers to inject arbitrary web script or HTML via the cpage parameter. NOTE: this issue might be resultant from CVE-2006-0216.22352http://osvdb.org/ref/22/22352-qualityppc.txtadmin.php in QualityEBiz Quality PPC (QPPC) 1.0 build 1644 allows remote attackers to obtain sensitive information, possibly the installation path of the application, via unspecified "meta characters" to the cpage parameter.22353http://osvdb.org/ref/22/22353-qualityppc.txthttp://osvdb.org/ref/22/22352-qualityppc.txtMultiple cross-site scripting (XSS) vulnerabilities in Ultimate Auction 3.67 allow remote attackers to inject arbitrary web script or HTML via the (1) item parameter in item.pl and (2) category parameter in itemlist.pl, which reflects the XSS in an error message. NOTE: the affected version might be wrong since the current version as of 20060116 is 3.6.1.162392244422443ADV-2006-01871847720060115 Ultimate Auction <=3.67ultimate-auction-item-xss(24138)16254Multiple unspecified vulnerabilities in MyBulletinBoard (MyBB) before 1.0.2 have unspecified impact and attack vectors, related to (1) admin/moderate.php, (2) admin/themes.php, (3) inc/functions.php, (4) inc/functions_upload.php, (5) printthread.php, and (6) usercp.php, and probably related to SQL injection. NOTE: it is likely that this issue subsumes CVE-2005-4602 and CVE-2005-4603. However, since the vendor advisory is vague and additional files are mentioned, is is likely that this contains at least one distinct vulnerability from CVE-2005-4602 and CVE-2005-4603.http://community.mybboard.net/showthread.php?tid=5852The original distribution of MyBulletinBoard (MyBB) to update from older versions to 1.0.2 omits or includes older versions of certain critical files, which allows attackers to conduct (1) SQL injection attacks via an attachment name that is not properly handled by inc/functions_upload.php (CVE-2005-4602), and possibly (2) other attacks related to threadmode in usercp.php.http://community.mybboard.net/showthread.php?tid=596016230http://community.mybboard.net/showthread.php?tid=5853&pid=35151#pid35151http://community.mybboard.net/showthread.php?tid=5853&pid=35088#pid35088mybb-usercp-script-sql-injection(24115)Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 5.3 through 6.1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the day parameter in calendar.php and (2) the input form in search.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. It is possible that this issue is resultant from an SQL injection problem in CVE-2005-4227.3 and CVE-2005-4227.13.1623220060113 DCP Portal Cross-Site Scripting Vulnerabilitydcpportal-calendar-search-xss(24153)SQL injection vulnerability in index.asp in the Admin Panel in Dragon Design Services Network (DDSN) cm3 content manager (CM3CMS) allows remote attackers to execute arbitrary SQL commands via the (1) username or (2) password.cm3-login-sql-injection(24266)1623120060113 DDSN CMS Admin Panel SQL Injection Vulnerability22696Cross-site scripting (XSS) vulnerability in fullview.php in AlstraSoft Template Seller Pro allows remote attackers to inject arbitrary web script or HTML via the tempid parameter.template-seller-fullview-xss(24235)1623320060113 AlstraSoft Template Seller Pro Cross-Site Scripting Vulnerability22746Directory traversal vulnerability in Shanghai TopCMM 123 Flash Chat Server Software 5.1 allows attackers to create or overwrite arbitrary files on the server via ".." (dot dot) sequences in the username field.16235http://www.123flashchat.com/flash-chat-server-v512.html22440ADV-2006-019818455123flashchat-user-directory-traversal(24137)Multiple unspecified vulnerabilities in lpsched in Sun Solaris 8, 9, and 10 allow local users to delete arbitrary files or disable the LP print service via unknown attack vectors.ADV-2006-0200102033101549218498solaris-lpsched-dos(24127)162452244222441http://support.avaya.com/elmodocs2/security/ASA-2006-056.htm19087oval:org.mitre.oval:def:662The RBAC functionality in grsecurity before 2.1.8 does not properly handle when the admin role creates a service and then exits the shell without unauthenticating, which causes the service to be restarted with the admin role still active.16261ADV-2006-019918458http://www.grsecurity.org/news.php#grsec218grsecurity-rbac-admin-privileges(24156)Unquoted Windows search path vulnerability in Wehntrust might allow local users to gain privileges via a malicious "program.exe" file in the C: folder, which is run when Wehntrust creates the autostart key.20060116 Re: [Full-disclosure] WehnTrust - When you have to trust Wehntrust1626820060116 WehnTrust - When you have to trust Wehntrustwehntrust-service-start-file-execution(24315)http://www.wehnus.com/downloads.plCross-site scripting (XSS) vulnerability in functions.php in microBlog 2.0 RC-10 allows remote attackers to inject arbitrary web script and HTML via a javascript: URI in a [url] BBcode tag.microblog-functions-xss(24140)1627220060117 [eVuln] microBlog BBCode XSS Vulnerability1015496http://evuln.com/vulns/36/summary.htmlSQL injection vulnerability in index.php in microBlog 2.0 RC-10 allows remote attackers to execute arbitrary SQL commands via the (1) month and (2) year parameters.1627020060117 [eVuln] microBlog SQL Injection Vulnerabilitymicroblog-index-sql-injection(24132)22512ADV-2006-0239101549618442http://evuln.com/vulns/35/summary.htmlSQL injection vulnerability in WhiteAlbum 2.5 allows remote attackers to execute arbitrary SQL commands via the dir parameter to pictures.php.1624720060116 White Album Sql İnjection biyosecurity.bewhitealbum-pictures-sql-injection(24271)22520ADV-2006-0241http://www.biyosecurity.be/bugs/whitealbum.txt18460GUI display truncation vulnerability in Mozilla Thunderbird 1.0.2, 1.0.6, and 1.0.7 allows user-assisted attackers to execute arbitrary code via an attachment with a filename containing a large number of spaces ending with a dangerous extension that is not displayed by Thunderbird, along with an inconsistent Content-Type header, which could be used to trick a user into downloading dangerous content by dragging or saving the attachment.1627120060117 Secunia Research: Mozilla Thunderbird Attachment SpoofingVulnerabilityADV-2006-0230http://secunia.com/secunia_research/2005-22/advisory15907https://bugzilla.mozilla.org/show_bug.cgi?id=300246MDKSA-2006:021thunderbird-attachment-ext-spoofing(24164)MDKSA-2006:021Cross-site scripting (XSS) vulnerability in index.php in GTP iCommerce allows remote attackers to inject arbitrary web script or HTML via the (1) cat and (2) subcat parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.16255ADV-2006-021418470gtpicommerce-index-xss(24150)SQL injection vulnerability in wp-stats.php in GaMerZ WP-Stats 2.0 allows remote attackers to execute arbitrary SQL commands via the author parameter.http://www.lesterchan.net/blogs/1847116241ADV-2006-0192wpstats-script-sql-injection(24163)22450http://www.lesterchan.net/blogs/archives/2006/01/18/wp-stats-sql-injection-vulnerabilityhttp://osvdb.org/ref/22/22450-wpstats.txtMultiple cross-site scripting (XSS) vulnerabilities in Simple Blog 2.1 allow remote attackers to inject arbitrary web script or HTML via (1) a comment to comments.asp and (2) possibly certain other fields in unspecified scripts.1624320060114 [HSC Security Group] Multiple SQL injection/XSS in SimpleBlog 2.1ADV-2006-019418488simpleblog-comment-xss(24154)22448http://www.hackerscenter.com/archive/view.asp?id=21926Multiple SQL injection vulnerabilities in Simple Blog 2.1 allow remote attackers to execute arbitrary SQL commands via the month parameter in an archives view operation and possibly certain other parameters in unspecified scripts.simpleblog-month-sql-injection(24155)1624320060114 [HSC Security Group] Multiple SQL injection/XSS in SimpleBlog 2.122447http://www.hackerscenter.com/archive/view.asp?id=21926ADV-2006-019418488Cross-site scripting vulnerability in WBNews 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the Name field.1627720060117 XSS in WBNews < = v1.1.0ADV-2006-023718499Cross-site scripting vulnerability in index.php in PHP Fusebox 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter.20060117 IndonesiaHack Advisory HTML injection in PHP Fusebox16274355Cross-site scripting (XSS) vulnerability in SMBCMS 2.1 allows remote attackers to inject arbitrary web script or HTML via the text parameter, which is used by the "Search Site" field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.16281ADV-2006-022918454smbcms-sitesearch-xss(24187)22494** DISPUTED ** Directory traversal vulnerability in workspaces.php in phpXplorer 0.9.33 allows remote attackers to include arbitrary files via a .. (dot dot) and trailing null byte (%00) in the sShare parameter. NOTE: a followup post claims that this is not a vulnerability since the functionality of phpXplorer supports the upload of PHP files, which would not cross privilege boundaries since the PHP functionality would support read access outside the web root.1626320060116 Re: Directory traversal in phpXplorer20060116 Directory traversal in phpXplorerADV-2006-0232http://www.arrelnet.com/advisories/adv20060116.html18518phpxplorer-sshare-directory-traversal(39982)353Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.7-pl1 allow remote attackers to inject arbitrary web script or HTML via the (3) redir, (4) productId, (5) docId, (6) act, and (7) catId parameters in index.php; and the (8) username field in a login action in index.php. NOTE: the cart.php/redir and index.php/searchStr vectors are already covered by CVE-2005-3152.1625922471ADV-2006-022718519http://lostmon.blogspot.com/2006/01/cubecart-307-pl1-indexphp-multiple.htmlhttp://bugs.cubecart.com/?do=details&id=459cubecart-index-script-xss(24177)Cross-site scripting (XSS) vulnerability in down.pl in Widexl Download Tracker 1.06 allows remote attackers to inject arbitrary web script or HTML via the ID parameter.1626522462ADV-2006-021318472http://osvdb.org/ref/22/22462-widexl.txtdownloadtracker-down-xss(24161)Cross-site scripting (XSS) vulnerability in anyboard.cgi in Netbula Anyboard 9.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the tK parameter in a find command.1626422461ADV-2006-018818469http://osvdb.org/ref/22/22461-anyboard.txtnetbula-anyboard-script-xss(24167)Virata-EmWeb web server 6_1_0, as used in (1) Intracom JetSpeed 500 and 520 and (2) Allied Data Technologies CopperJet 811 RouterPlus, allows remote attackers to access privileged information, such as user lists and configuration settings, via direct HTTP requests.ADV-2006-021818483http://blog.globalnetworks.gr/?p=4virata-emweb-unauth-access(24304)SQL injection vulnerability in viewcat.php in BitDamaged geoBlog MOD_1.0 allows remote attackers to execute arbitrary SQL commands, then steal credentials and upload files, via the cat parameter ($tmpCategory variable).1624922463ADV-2006-0191101549318504http://evuln.com/vulns/33/summary.htmlgeoBlog-viewcat-sql-injection(24146)Format string vulnerability in the snmp_input function in snmptrapd in CMU SNMP utilities (cmu-snmp) allows remote attackers to execute arbitrary code by sending crafted SNMP messages to UDP port 162.1626720060116 Digital Armaments Security Advisory 01.16.2006: CMU SNMP utilities snmptrad Format String VulnerabilityADV-2006-0234http://www.digitalarmaments.com/2006040164883273.html18525cmusnmp-snmpinput-format-string(24178)22493Cross-site scripting (XSS) vulnerability in fom.cgi in Faq-O-Matic 2.711 allows remote attackers to inject arbitrary web script or HTML via the (1) _duration, (2) file, and (3) cmd parameters.1625122439ADV-2006-018918468http://osvdb.org/ref/22/22439-faqomatic.txtfaqomatic-fom-xss(24165)SQL injection vulnerability in Benders Calendar 1.0 allows remote attackers to execute arbitrary SQL commands via multiple parameters, as demonstrated by the (1) year, (2) month, and (3) day parameters.1624220060115 [eVuln] Benders Calendar SQL Injection22449ADV-2006-0190101549118462http://evuln.com/vulns/30/summary.htmlbenderscalendar-sql-injection(24120)Buffer overflow in the Bluetooth OBEX Object Push service in "Blue Neighbors.EXE" in AmbiCom Blue Neighbors 2.50 Build 2500 and earlier allows remote attackers to execute arbitrary code via a long file name, as demonstrated via a long RFILE argument to ussp-push.20060120 DMA[2006-0115a] - 'AmbiCom Bluetooth Object Push Overflow'ADV-2006-0219http://www.digitalmunition.com/DMA%5B2006-0115a%5D.txt18466ambicom-bluetooth-objectpush-bo(24179)16258366Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12310181&styleName=Html&projectId=10220&Create=Createhttps://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12310181&styleName=Html&projectId=10220&Create=Create1626020060115 Apache Geronimo 1.0 - CSS and persistent HTML-Injectionvulnerabilitieshttp://www.oliverkarow.de/research/geronimo_css.txtADV-2006-021718485http://issues.apache.org/jira/browse/GERONIMO-1474geronimo-webaccesslog-viewer-xss(24159)geronimo-jspexamples-xss(24158)RHSA-2008:026131493RHSA-2008:0630Unquoted Windows search path vulnerability in Check Point VPN-1 SecureClient might allow local users to gain privileges via a malicious "program.exe" file in the C: folder, which is run when SecureClient attempts to launch the Sr_GUI.exe program.1629020060117 [ TZO-012006 ] Checkpoint VPN-1 SecureClient insecure usage of CreateProcess()ADV-2006-0258http://secdev.zoller.lu/research/checkpoint.txtUnspecified vulnerability in context.py in Albatross web application toolkit before 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the "handling of submitted form fields".ADV-2006-0196DSA-9421845716252http://www.object-craft.com.au/projects/albatross/news.htmlhttp://security.debian.org/pool/updates/main/a/albatross/albatross_1.20-2.diff.gzalbatross-context-command-execution(24130)2245118496Unspecified vulnerability in the Advanced Queuing component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.6, 10.1.0.3 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB01.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html16287ADV-2006-0323ADV-2006-024310154991860818493Unspecified vulnerability in the Change Data Capture component of Oracle Database server 9.2.0.7, 10.1.0.5, and 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB02. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the CDC_ALLOCATE_LOCK function of the DBMS_CDC_UTILITY package.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmlADV-2006-0323ADV-2006-02431015499oracle-january2006-update(24321)16287225401860818493Unspecified vulnerability in the Connection Manager component of Oracle Database server 8.1.7.4 and 9.0.1.5 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB03.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287ADV-2006-0323ADV-2006-024310154991860818493Multiple unspecified vulnerabilities in Oracle Database server 10.1.0.5 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB04 and (2) DB06 in the (a) Data Pump component; (3) DB10 in the (b) Net Listener component; and (4) DB16 in the (c) Oracle Text component. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that DB06 is SQL injection in the GENERATE_JOB_NAME, GET_WORKERSTATUSLIST1010, GET_PARAMVALUES1010, GET_DUMPFILESET1010, GET_JOBSTATUS1010, ATTACH, and ESTABLISH_REMOTE_CONTEXT functions in DBMS_DATAPUMP.VU#54580416287http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmlADV-2006-024318493oracle-january2006-update(24321)22544ADV-2006-0323101549918608Multiple unspecified vulnerabilities in Oracle Database server 9.2.0.7 and 10.1.0.5 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB05 in the (a) Data Pump component; (2) DB15 in the (b) Oracle Text component; (3) DB22 in the (c) Streams Apply component; (4) DB23 and (5) DB24 in the (d) Streams Capture component; and (6) DB26 in the (e) Streams Subcomponent. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that DB05 involves SQL injection in the (f) LONG2VARCHAR, LONG2VCMAX, LONG2VCNT, and LONG2CLOB functions in the DBMS_METADATA_UTIL package; (g) MAKE_FILTER, FETCH_VIEWS_ERROR, FETCH_FILTERS, FETCH_VIEWS, SET_FILTER_COMMON, DO_FILTER_SCRIPT, SET_TABLE_FILTERS, and MAKE_FILTER_TEXT functions in the DBMS_METADATA_INT package; and (h) GET_PREPOST_TABLE_ACT function in the DBMS_METADATA package.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmlADV-2006-0323ADV-2006-0243101549918608oracle-january2006-update(24321)1628722643226372254318493Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.5 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB07 in the Dictionary component and (2) DB14 in the Oracle Label Security component. NOTE: Oracle has not disputed reliable researcher claims that DB07 involves plaintext storage of the TDE wallet password in a trace file by event 10053.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)oracle-masterkey-plaintext(24168)1628720060117 Oracle Database 10g Rel. 2 - Event 10053 logs TDE wallet password in cleartexthttp://www.red-database-security.com/advisory/oracle_tde_wallet_password.htmlADV-2006-0323ADV-2006-024310154991860818493Unspecified vulnerability in the Net Foundation Layer component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.6, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB08.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287ADV-2006-0323ADV-2006-024310154991860818493Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, 10.1.0.5, and 10.2.0.1 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB09 in the (a) Net Listener component; and (2) DB12 and (3) DB13 in the Network Communications (RPC) component.TA06-018AVU#870172VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287225512255022547ADV-2006-0323ADV-2006-024310154991860818493** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-0259. Reason: This candidate is subsumed by CVE-2006-0259. An error during initial CVE analysis used the wrong set of affected versions for "DB10". Notes: All CVE users should reference CVE-2006-0259 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.1 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB17 in the Oracle Text component and (2) DB18 in the Program Interface Network component. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that DB17 involves SQL injection in the (a) VALIDATE_STATEMENT and BUILD_DML functions in CTXSYS.DRILOAD; (b) CLEAN_DML function in CTXSYS.DRIDML; (c) GET_ROWID function in CTXSYS.CTX_DOC; (d) BROWSE_WORDS function in CTXSYS.CTX_QUERY; and (e) ODCIINDEXTRUNCATE, ODCIINDEXDROP, and ODCIINDEXDELETE functions in CATINDEXMETHODS.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmlADV-2006-0323ADV-2006-0243101549918608oracle-january2006-update(24321)16287http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html226422264122640226392255518493Unspecified vulnerability in the Query Optimizer component of Oracle Database server 9.0.1.5, 9.2.0.7, and 10.1.0.5 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB19.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287ADV-2006-0323ADV-2006-024310154991860818493Unspecified vulnerability in the Query Optimizer component of Oracle Database server 9.2.0.6 and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB20.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287ADV-2006-0323ADV-2006-024310154991860818493Unspecified vulnerability in the Security component of Oracle Database server 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.6, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB21.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287ADV-2006-0323ADV-2006-024310154991860818493Unspecified vulnerability in the Streams Capture component of Oracle Database server 10.1.0.5 and 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB25. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the SET_DIRECTORY_ROOT function in the DBMS_CDC_PUBLISH package.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html22563ADV-2006-0323ADV-2006-024310154991860818493Unspecified vulnerability in the Transparent Data Encryption (TDE) Wallet component of Oracle Database server 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB27. NOTE: Oracle has not disputed a reliable researcher report that TDA stores the master key without encryption, which allows local users to obtain the key via the SGA.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)oracle-sga-masterkey-plaintext(24186)1628720060117 Oracle Database 10g Rel. 2- Transparent Data Encryption plaintext masterkey in SGAhttp://www.red-database-security.com/advisory/oracle_tde_unencrypted_sga.htmlADV-2006-0323ADV-2006-024310154991860818493Unspecified vulnerability in the Upgrade & Downgrade component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB28. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the DBMS_REGISTRY package in certain parameters to the (1) IS_COMPONENT, (2) GET_COMP_OPTION, (3) DISABLE_DDL_TRIGGERS, (4) SCRIPT_EXISTS, (5) COMP_PATH, (6) GATHER_STATS, (7) NOTHING_SCRIPT, and (8) VALIDATE_COMPONENTS functions.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html22566ADV-2006-0323ADV-2006-024310154991860818493Unspecified vulnerability in the XML Database component of Oracle Database server 9.2.0.7 and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB29. NOTE: based on mutual credits by the relevant sources, it is highly likely that this issue is a buffer overflow in the (a) DBMS_XMLSCHEMA and (b) DBMS_XMLSCHEMA_INT packages, as exploitable via long arguments to (1) XDB.DBMS_XMLSCHEMA.GENERATESCHEMA or (2) XDB.DBMS_XMLSCHEMA.GENERATESCHEMAS.TA06-018AVU#891644VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-xdbdbmx-xmlschema-bo(24376)oracle-january2006-update(24321)16287http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.htmlhttp://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdfADV-2006-0323ADV-2006-0243http://www.argeniss.com/research/ARGENISS-ADV-010601.txt1015499186081849320060126 [Argeniss] Oracle Database Buffer overflows vulnerabilities in public procedures of XDB.DBMS_XMLSCHEMA{_INT}Unspecified vulnerability in the Portal component of Oracle Application Server 9.0.4.2 and 10.1.2.0 has unspecified impact and attack vectors, as identified by Oracle Vuln# AS01.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287ADV-2006-0323ADV-2006-024310154991860818493Unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server 9.0.4.2 and 10.1.2.0.2 has unspecified impact and attack vectors, as identified by Oracle Vuln# REP03.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287ADV-2006-0323ADV-2006-024310154991860818493Unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server 9.0.4.2 has unspecified impact and attack vectors, as identified by Oracle Vuln# REP04. NOTE: Oracle has not disputed reliable researcher claims that this issue is related to directory traversal that allows reading of portions of arbitrary XML files via the customize parameter.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)1628720060117 Oracle Reports - Read parts of files via customize(fixed after 875 days)http://www.red-database-security.com/advisory/oracle_reports_read_any_xml_file.htmlADV-2006-0323ADV-2006-024310154991860818493Multiple unspecified vulnerabilities in Oracle Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i) have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) OCS01, 2) OCS02, 3) OCS03, 4) OCS04, 5) OCS05, 6) OCS06, 7) OCS07, (8) OCS08, and (9) OCS09 in the (a) Email Server component; 10) OCS10 (and (11) OCS11 in the (b) Oracle Collaboration Suite Wireless & Voice (component; 12) OCS12 and (13) OCS13 in the (c) Oracle Content (Management SDK component; 14) OCS14 and (15) OCS15 in the (d) Oracle (Content Services component.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmlADV-2006-0323ADV-2006-0243101549918608oracle-january2006-update(24321)1628718493Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) APPS01 in the (a) Application Install component; (2) APPS07 in the (b) Oracle Applications Framework component; (3) APPS08, (4) APPS09, (5) APPS10, and (6) APPS11 in the (c) Oracle Applications Technology Stack component; (7) APPS12 in the (d) Oracle Human Resources component; (8) APPS15 and (9) APPS16 in the (e) Oracle Marketing component; (10) APPS17 in the (f) Marketing Encyclopedia System component; (11) APPS18 in the (g) Oracle Trade Management component; and (12) APPS19 in the (h) Oracle Web Applications Desktop Integration component.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287ADV-2006-0323ADV-2006-024310154991860818493Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.9 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) APPS02 in the (a) CRM Technical Foundation component; (2) APPS03 in the (b) iProcurement component; and (3) APPS04, (4) APPS05, and (5) APPS06 in the Oracle Application Object Library component.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287ADV-2006-0323ADV-2006-024310154991860818493Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 4.3 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) APPS13 and (2) APPS14 in the Oracle iLearning component.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287ADV-2006-0323ADV-2006-024310154991860818493Unspecified vulnerability in Oracle PeopleSoft Enterprise Portal 8.4 Bundle 15, 8.8 Bundle 10, and 8.9 Bundle 2 has unspecified impact and attack vectors, as identified by Oracle Vuln# PSE01.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287ADV-2006-0323ADV-2006-024310154991860818493Unspecified vulnerability in Oracle JD Edwards HTML Server 8.95.F1 SP23_L1 has unspecified impact and attack vectors, as identified by Oracle Vuln# JDE01.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287ADV-2006-0323ADV-2006-024310154991860818493Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, and 10.1.0.5, Application Server 1.0.2.2, 9.0.4.2, and 10.1.2.0.2, and Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i) has unspecified impact and attack vectors, as identified by Oracle Vuln# DBC01 in the Protocol Support component.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287ADV-2006-0323ADV-2006-024310154991860818493Unspecified vulnerability in Oracle Database Server 10.1.0.4.2, Application Server 10.1.2.0.2, and Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i) has unspecified impact and attack vectors, as identified by Oracle Vuln# DBC02 in the Reorganize Objects & Convert Tablespace component.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmlADV-2006-0323ADV-2006-0243101549918608oracle-january2006-update(24321)1628718493Multiple unspecified vulnerabilities in Oracle Application Server 9.0.4.2 and 10.1.2.0.2, and E-Business Suite and Applications 11.5.10, have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) FORM01 and (2) FORM02 in the Oracle Forms component.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287ADV-2006-0323ADV-2006-024310154991860818493Unspecified vulnerability in the Java Net component of Oracle Database Server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, and 10.1.0.4, and Application Server 1.0.2.2, 9.0.4.2, and 10.1.2.0.2, has unspecified impact and attack vectors, as identified by Oracle Vuln# JN01.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287ADV-2006-0323ADV-2006-024310154991860818493Unspecified vulnerability in the Oracle HTTP Server component of Oracle Database Server 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, and 10.1.0.5, and Application Server 1.0.2.2, 9.0.4.2, and 10.1.2.0.2, has unspecified impact and attack vectors, as identified by Oracle Vuln# OHS01.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287ADV-2006-0323ADV-2006-024310154991860818493Unspecified vulnerability in the Oracle HTTP Server component of Oracle Database Server 10.1.0.5 and Application Server 10.1.2.0.2 has unspecified impact and attack vectors, as identified by Oracle Vuln# OHS02.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287ADV-2006-0323ADV-2006-024310154991860818493Multiple unspecified vulnerabilities in the Oracle Reports Developer component of Oracle Application Server 9.0.4.1 and E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) REP01 and (2) REP02.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmlADV-2006-0323ADV-2006-0243101549918608oracle-january2006-update(24321)1628718493Multiple unspecified vulnerabilities in Oracle Application Server 6.0.8.26(PS17) and E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) REP05 and (2) REP06 in the Oracle Reports Developer component. NOTE: Oracle has not disputed reliable researcher claims that REP05 is the same as CVE-2005-2378 and REP06 is the same as CVE-2005-2371, both of which involve directory traversal.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)1628720060117 Oracle Reports - Overwrite any application server file via desname (fixed after 889 days)20060117 Oracle Reports - Read parts of files via desname (fixed after 874 days)http://www.red-database-security.com/advisory/oracle_reports_read_any_file.htmlhttp://www.red-database-security.com/advisory/oracle_reports_overwrite_any_file.htmlADV-2006-0323ADV-2006-024310154991860818493Unspecified vulnerability in Oracle Database Server 9.2.0.7, Application Server 9.0.4.2 and 10.1.2.1, Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i), and E-Business Suite and Applications 11.5.10 has unspecified impact and attack vectors, as identified by Oracle Vuln# WF01 in the Oracle Workflow Cartridge component.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287ADV-2006-0323ADV-2006-024310154991860818493Multiple unspecified vulnerabilities in Oracle Database Server 10.2.0.1, Application Server 9.0.4.2 and 10.1.2.1, Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i), and E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) WF02 and (2) WF03 in the Oracle Workflow Cartridge component.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)16287ADV-2006-0323ADV-2006-024310154991860818493ZyXel P2000W VoIP 802.11b Wireless Phone running firmware WV.00.02 allows remote attackers to obtain sensitive information, such as MAC address and software version, by directly accessing UDP port 9090.162851851120060116 ZyXel P2000W (Version 2) VoIP wireless phone undocumented port UDP/9090zyxel-p2000w-default-port(24145)22516Multiple unspecified vulnerabilities in the (1) publishing component, (2) Contact Component, (3) TinyMCE Compressor, and (4) other components in Joomla! 1.0.5 and earlier have unknown impact and attack vectors.18513http://www.joomla.org/content/view/738/66/Buffer overflow in Dual DHCP DNS Server 1.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via the DHCP options field.18486http://aluigi.altervista.org/adv/dualsbof-adv.txtdualdhcpdns-options-field-bo(24191)16298ADV-2006-02451015495Clipcomm CPW-100E VoIP 802.11b Wireless Handset Phone running firmware 1.1.12 (051129) and CP-100E VoIP 802.11b Wireless Phone running firmware 1.1.60 allows remote attackers to gain unauthorized access via the debug service on TCP port 60023.162891850520060116 Clipcomm CP-100E VoIP wireless desktop phone open debug service TCP/6002320060116 Clipcomm CPW-100E VoIP wireless handset phone open debug service TCP/60023clipcomm-cp100e-default-port(24144)The DM Primer (dmprimer.exe) in the DM Deployment Common Component in Computer Associates (CA) BrightStor Mobile Backup r4.0, BrightStor ARCserve Backup for Laptops & Desktops r11.0, r11.1, r11.1 SP1, Unicenter Remote Control 6.0, 6.0 SP1, CA Desktop Protection Suite r2, CA Server Protection Suite r2, and CA Business Protection Suite r2 allows remote attackers to cause a denial of service (CPU consumption or application hang) via a large network packet, which causes a WSAEMESGSIZE error code that is not handled, leading to a thread exit.http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=337561627620060118 CAID 33756 - DM Deployment Common Component Vulnerabilities22529ADV-2006-0236http://www.designfolks.com.au/karma/DMPrimer/http://supportconnectw.ca.com/public/ca_common_docs/dmdeploysecurity_notice.asp101550418531The DM Primer in the DM Deployment Common Component in Computer Associates (CA) BrightStor Mobile Backup r4.0, BrightStor ARCserve Backup for Laptops & Desktops r11.0, r11.1, r11.1 SP1, Unicenter Remote Control 6.0, 6.0 SP1, CA Desktop Protection Suite r2, CA Server Protection Suite r2, and CA Business Protection Suite r2 allows remote attackers to cause a denial of service (CPU consumption and log file consumption) via unspecified "unrecognized network messages" that are not properly handled.1015504http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=337561627620060118 CAID 33756 - DM Deployment Common Component Vulnerabilities22529ADV-2006-0236http://supportconnectw.ca.com/public/ca_common_docs/dmdeploysecurity_notice.asp18531PHP remote file inclusion vulnerability in htmltonuke.php in the htmltonuke 2.0 alpha, and possibly other versions, module for PHP-Nuke allows remote attackers to execute arbitrary PHP code via a URL in the filnavn parameter.htmltonuke-htmltonuke-file-include(33092)162823524Linksys BEFVP41 VPN Router 2.0 with firmware 1.01.04 allows remote attackers on the local network, to cause a denial of service via IP packets with a null IP option length.20060116 Re: Linksys VPN Router (BEFVP41) DoS Vulnerability20060113 Linksys VPN Router (BEFVP41) DoS VulnerabilityADV-2006-0238101549018461linksys-null-length-dos(24125)1630720060117 Re: Linksys VPN Router (BEFVP41) DoS VulnerabilityCross-site scripting (XSS) vulnerability in aoblogger 2.3 allows remote attackers to inject arbitrary Javascript via a javascript URI in the BBcode url tag.16286ADV-2006-024016889http://evuln.com/vulns/37/summary.htmlaoblogger-url-xss(24141)22526http://mikeheltonisawesome.com/viewcomments.php?idd=4620060117 [eVuln] aoblogger Multiple VulnerabilitiesSQL injection vulnerability in login.php in aoblogger 2.3 allows remote attackers to execute arbitrary SQL commands via the username parameter.16286ADV-2006-024016889http://evuln.com/vulns/37/summary.htmlaoblogger-login-sql-injection(24142)22527http://mikeheltonisawesome.com/viewcomments.php?idd=4620060117 [eVuln] aoblogger Multiple Vulnerabilitiescreate.php in aoblogger 2.3 allows remote attackers to bypass authentication and create new blog entries by setting the uza parameter to 1.16286ADV-2006-024016889http://evuln.com/vulns/37/summary.htmlaoblogger-create-security-bypass(24143)http://mikeheltonisawesome.com/viewcomments.php?idd=4620060117 [eVuln] aoblogger Multiple Vulnerabilities