Stack-based buffer overflow in Microsoft Publisher 2000 through 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted PUB file, which causes an overflow when parsing fonts.TA06-255AVU#4062361995120060912 Computer Terrorism (UK) :: Incident Response Centre - Microsoft Publisher Font Parsing VulnerabilityMS06-054http://www.computerterrorism.com/research/ct12-09-2006-2.htm21863publisher-pub-code-execution(28648)ADV-2006-3565SSRT061187HPSBST0213410168251548oval:org.mitre.oval:def:590Unspecified vulnerability in Microsoft Outlook 2000 through 2003, Exchange 5.0 Server SP2 and 5.5 SP4, Exchange 2000 SP3, and Office allows remote attackers to execute arbitrary code via an e-mail message with a crafted Transport Neutral Encapsulation Format (TNEF) MIME attachment, related to message length validation.TA06-010AVU#2521461619720060110 Microsoft Outlook Critical Vulnerability20060110 Microsoft Exchange Critical VulnerabilityMS06-0031015461101546018368win-tnef-overflow(22878)ADV-2006-0119http://support.avaya.com/elmodocs2/security/ASA-2006-004.htm331330oval:org.mitre.oval:def:624oval:org.mitre.oval:def:1485oval:org.mitre.oval:def:1456oval:org.mitre.oval:def:1316oval:org.mitre.oval:def:1165oval:org.mitre.oval:def:1082Unspecified vulnerability in the RDS.Dataspace ActiveX control, which is contained in ActiveX Data Objects (ADO) and distributed in Microsoft Data Access Components (MDAC) 2.7 and 2.8, allows remote attackers to execute arbitrary code via unknown attack vectors.TA06-101AVU#234812MS06-014ie-wscriptshell-command-execution(29915)mdac-rdsdataspace-execute-code(25006)ADV-2006-2452ADV-2006-1319http://www.securityfocus.com/data/vulnerabilities/exploits/0day_ie.pdf207971746220080128 Re: Exploit in IE6,720080128 Exploit in IE6,720070731 Re: Exploit In Internet Explorer20070730 RE: Exploit In Internet Explorer20070730 Re: Exploit In Internet Explorer20070729 Exploit In Internet Explorer2451721642052http://www.hitachi-support.com/security_e/vuls_e/HS06-013_e/index-e.htmlhttp://www.hitachi-support.com/security_e/vuls_e/HS06-013_e/01-e.html10158942071919583oval:org.mitre.oval:def:1778oval:org.mitre.oval:def:1742oval:org.mitre.oval:def:1511oval:org.mitre.oval:def:1323oval:org.mitre.oval:def:1204Microsoft PowerPoint 2000 in Office 2000 SP3 has an interaction with Internet Explorer that allows remote attackers to obtain sensitive information via a PowerPoint presentation that attempts to access objects in the Temporary Internet Files Folder (TIFF).VU#963628MS06-010ADV-2006-0579powerpoint-tiff-information-disclosure(24490)16634101563218865oval:org.mitre.oval:def:1555Buffer overflow in the plug-in for Microsoft Windows Media Player (WMP) 9 and 10, when used in browsers other than Internet Explorer and set as the default application to handle media files, allows remote attackers to execute arbitrary code via HTML with an EMBED element containing a long src attribute.TA06-045AVU#692060win-mediaplayer-plugin-embed-bo(24493)ADV-2006-057516644MS06-00620060214 Microsoft Windows Media Player Plugin Buffer Overflow Vulnerability101562818852oval:org.mitre.oval:def:1559Heap-based buffer overflow in the bitmap processing routine in Microsoft Windows Media Player 7.1 on Windows 2000 SP4, Media Player 9 on Windows 2000 SP4 and XP SP1, and Media Player 10 on XP SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted bitmap (.BMP) file that specifies a size of 0 but contains additional data.TA06-045AVU#29139616633MS06-005http://www.eeye.com/html/research/advisories/AD20060214.html101562718835win-media-player-bmp-bo(24488)ADV-2006-057420060215 Windows Media Player BMP Heap Overflow (MS06-005)20060214 [EEYEB-20051017] Windows Media Player BMP Heap Overflow423oval:org.mitre.oval:def:1661oval:org.mitre.oval:def:1598oval:org.mitre.oval:def:1578oval:org.mitre.oval:def:1256Buffer overflow in GIFIMP32.FLT, as used in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via a crafted GIF image that triggers memory corruption when it is parsed.TA06-192AVU#668564MS06-039ADV-2006-27571891520060712 NSFOCUS SA2006-04 : Microsoft Office GIF Filter Buffer Overflow Vulnerability2714610164702101320060712 NSFOCUS SA2006-04 : Microsoft Office GIF Filter Buffer Overflow Vulnerabilityoval:org.mitre.oval:def:21The ShellAbout API call in Korean Input Method Editor (IME) in Korean versions of Microsoft Windows XP SP1 and SP2, Windows Server 2003 up to SP1, and Office 2003, allows local users to gain privileges by launching the "shell about dialog box" and clicking the "End-User License Agreement" link, which executes Notepad with the privileges of the program that displays the about box.VU#73984416643MS06-009101563118859win-korean-ime-privilege-elevation(24492)ADV-2006-057820060215 Security advisory: Windows IME Vulnerability (MS06-009)http://www.ryanstyle.com/alert/my/5/ms06_009_eng.htmloval:org.mitre.oval:def:727oval:org.mitre.oval:def:1688oval:org.mitre.oval:def:1664oval:org.mitre.oval:def:1650oval:org.mitre.oval:def:1595Buffer overflow in Microsoft Office 2000 SP3, XP SP3, and other versions and packages, allows user-assisted attackers to execute arbitrary code via a routing slip that is longer than specified by the provided length field, as exploited by malware such as TROJ_MDROPPER.BH and Trojan.PPDropper.E in attacks against PowerPoint.TA06-073AVU#6828201700020060314 SYMSA-2006-001: Buffer overflow in Microsoft Office 2000, Office XP (2002), and Office 2003 Routing Slip MetadataMS06-012101576619138powerpoint-presentation-code-execution(29009)office-routing-slip-bo(25009)ADV-2006-3678ADV-2006-0950http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ%5FMDROPPER%2EBHhttp://www.symantec.com/security_response/writeup.jsp?docid=2006-091810-5028-99http://www.symantec.com/enterprise/research/SYMSA-2006-001.txt2005920060919 Microsoft PowerPoint 0-day Vulnerability FAQ - September written20060919 New PowerPoint 0-day Trojan in the wild20060822 Major updates in PowerPoint FAQ document - not a 0-day issue20060819 New PowerPoint 0-day and Trojan - FAQ document ready20060422 PowerPoint Phishing Trojan23903http://www.darkreading.com/document.asp?doc_id=101970http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm101688610167201923820060919 New PowerPoint 0-day Trojan in the wildhttp://isc.sans.org/diary.php?storyid=1618http://blogs.securiteam.com/?p=559http://blogs.securiteam.com/?p=557http://blogs.securiteam.com/?author=2820060822 Major updates in PowerPoint FAQ document - not a 0-day issueoval:org.mitre.oval:def:798oval:org.mitre.oval:def:1653oval:org.mitre.oval:def:1553oval:org.mitre.oval:def:1504Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression.TA06-010AVU#91593016194MS06-00218365win-embedded-fonts-bo(23922)http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=375525ADV-2006-011820060110 [EEYEB-2000801] - Windows Embedded Open Type (EOT) Font Heap Overflow Vulnerability18829EEYEB20050801http://support.avaya.com/elmodocs2/security/ASA-2006-004.htm10154591839118311oval:org.mitre.oval:def:714oval:org.mitre.oval:def:698oval:org.mitre.oval:def:1491oval:org.mitre.oval:def:1462oval:org.mitre.oval:def:1185oval:org.mitre.oval:def:1126Unspecified vulnerability in Windows Explorer in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via attack vectors involving COM objects and "crafted files and directories," aka the "Windows Shell Vulnerability."TA06-101AVU#641460MS06-01519606win-explorer-com-code-execution(25554)ADV-2006-132017464245161015897oval:org.mitre.oval:def:1764oval:org.mitre.oval:def:1743oval:org.mitre.oval:def:1679oval:org.mitre.oval:def:1448oval:org.mitre.oval:def:1191Buffer overflow in the Web Client service (WebClnt.dll) for Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote authenticated users or Guests to execute arbitrary code via crafted RPC requests, a different vulnerability than CVE-2005-1207.VU#38890016636MS06-008101563018857msrpc-webclient-message-bo(24491)ADV-2006-0577oval:org.mitre.oval:def:716oval:org.mitre.oval:def:683oval:org.mitre.oval:def:1602oval:org.mitre.oval:def:1547oval:org.mitre.oval:def:1220Buffer overflow in Microsoft Outlook Express 5.5 and 6 allows remote attackers to execute arbitrary code via a crafted Windows Address Book (WAB) file containing "certain Unicode strings" and modified length values.MS06-01619617http://www.zerodayinitiative.com/advisories/ZDI-06-007.htmlADV-2006-13211745920060411 ZDI-06-007: Microsoft Windows Address Book (WAB) File Format Parsing Vulnerabilityoutlook-express-wab-bo(25535)101589869120060411 ZDI-06-007: Microsoft Windows Address Book (WAB) File Format Parsing Vulnerabilityoval:org.mitre.oval:def:812oval:org.mitre.oval:def:1791oval:org.mitre.oval:def:1780oval:org.mitre.oval:def:1771oval:org.mitre.oval:def:1769oval:org.mitre.oval:def:1682oval:org.mitre.oval:def:1611Cross-site scripting (XSS) vulnerability in _vti_bin/_vti_adm/fpadmdll.dll in Microsoft FrontPage Server Extensions 2002 and SharePoint Team Services allows remote attackers to inject arbitrary web script or HTML, then leverage the attack to execute arbitrary programs or create new accounts, via the (1) operation, (2) command, and (3) name parameters.17452MS06-017http://www.argeniss.com/research/ARGENISS-ADV-040602.txt1015896101589519623ADV-2006-132220060412 Vulnerability in Microsoft FrontPage Server Extensions Could Allow Cross-Site Scriptingfpse-html-xss(25537)704oval:org.mitre.oval:def:1748** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-3899. Reason: This candidate is a duplicate of CVE-2005-3899. Notes: All CVE users should reference CVE-2005-3899 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.Heap-based buffer overflow in the encodeURI and decodeURI functions in the kjs JavaScript interpreter engine in KDE 3.2.0 through 3.5.0 allows remote attackers to execute arbitrary code via a crafted, UTF-8 encoded URI.20060119 [KDE Security Advisory] kjs encodeuri/decodeuri heap overflowhttp://www.kde.org/info/security/advisory-20060119-1.txt18500ftp://ftp.kde.org/pub/kde/security_patches/post-3.4.3-kdelibs-kjs.diffADV-2006-0265USN-245-1SUSE-SA:2006:003RHSA-2006:0184GLSA-200601-11DSA-9481857018561185591855218540oval:org.mitre.oval:def:11858kde-kjs-bo(24242)16325FLSA:17860622659MDKSA-2006:019SSA:2006-045-0510155123641889918583An unspecified Microsoft WMF parsing application, as used in Internet Explorer 5.01 SP4 on Windows 2000 SP4, and 5.5 SP2 on Windows Millennium, and possibly other versions, allows attackers to cause a denial of service (crash) and possibly execute code via a crafted WMF file with a manipulated WMF header size, possibly involving an integer overflow, a different vulnerability than CVE-2005-4560, and aka "WMF Image Parsing Memory Corruption Vulnerability."VU#312956TA06-045A16516MS06-00418729ADV-2006-046922976http://www.microsoft.com/technet/security/advisory/913333.mspx18912[funsec] 20060110 Another WMF flaw without a Microsoft patchoval:org.mitre.oval:def:1638Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote attackers to cause a denial of service (hang) via an IGMP packet with an invalid IP option, aka the "IGMP v3 DoS Vulnerability."TA06-045AVU#83928416645MS06-00718853win-igmpv3-dos(24489)ADV-2006-057620071023 SYMSA-2007-012: Microsoft Windows CE IGMP Denial of Servicehttp://www.securiteam.com/exploits/5PP0T0KI0O.html15991015629oval:org.mitre.oval:def:678oval:org.mitre.oval:def:1662oval:org.mitre.oval:def:1647oval:org.mitre.oval:def:1425oval:org.mitre.oval:def:1310Unspecified vulnerability in Microsoft PowerPoint in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP1 and SP2, Office 2004 for Mac, and v. X for Mac allows user-assisted attackers to execute arbitrary code via a PowerPoint document with a malformed record, which triggers memory corruption.TA06-164AVU#19008918382MS06-028powerpoint-record-bo(26784)ADV-2006-232526435101628720633oval:org.mitre.oval:def:1984oval:org.mitre.oval:def:1836oval:org.mitre.oval:def:1069Microsoft Windows XP SP1 and SP2 before August 2004, and possibly other operating systems and versions, uses insecure default ACLs that allow the Authenticated Users group to gain privileges by modifying critical configuration information for the (1) Simple Service Discovery Protocol (SSDP), (2) Universal Plug and Play Device Host (UPnP), (3) NetBT, (4) SCardSvr, (5) DHCP, and (6) DnsCache services, aka "Permissive Windows Services DACLs." NOTE: the NetBT, SCardSvr, DHCP, DnsCache already require privileged access to exploit.VU#953860MS06-01118756win-auth-users-insecure-permissions(24463)http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=391523&RenditionID=ADV-2006-041720060131 Windows Access Control Demystifiedhttp://www.microsoft.com/technet/security/advisory/914457.mspxhttp://www.cs.princeton.edu/~sudhakar/papers/winval.pdfhttp://support.avaya.com/elmodocs2/security/ASA-2006-069.htm101576510155951931319238oval:org.mitre.oval:def:1696oval:org.mitre.oval:def:1671Multiple unspecified vulnerabilities in Adobe Flash Player 8.0.22.0 and earlier allow remote attackers to execute arbitrary code via a crafted SWF file.TA07-352ATA06-132ATA06-129ATA06-075AVU#945060http://www.macromedia.com/devnet/security/security_zone/apsb06-03.html19218macromedia-swf-code-execution(25005)ADV-2007-4238ADV-2006-1779ADV-2006-1744ADV-2006-1262ADV-2006-095217106RHSA-2006:02682390817951http://www.opera.com/docs/changelogs/windows/854/SUSE-SA:2006:015MS06-020GLSA-200603-201015770281362007720045193281925919198APPLE-SA-2007-12-17APPLE-SA-2006-05-11http://docs.info.apple.com/article.html?artnum=307179oval:org.mitre.oval:def:1922oval:org.mitre.oval:def:1894Stack-based buffer overflow in Microsoft Windows Media Player 9 and 10 allows remote attackers to execute arbitrary code via a PNG image with a large chunk size.TA06-164AVU#60802018385MS06-02420060613 Windows Media Player PNG Chunk Decoding Stack-Based Buffer Overflow20626win-media-player-png-bo(26788)ADV-2006-2322264301016284oval:org.mitre.oval:def:1974oval:org.mitre.oval:def:1820oval:org.mitre.oval:def:1807oval:org.mitre.oval:def:1805oval:org.mitre.oval:def:1729oval:org.mitre.oval:def:1230Buffer overflow in Microsoft Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows local and possibly remote attackers to execute arbitrary code via crafted Active Server Pages (ASP).VU#395588TA06-192Aiis-asp-bo(26796)18858MS06-034101646621006ADV-2006-27522715220060718 ASP.DLL Include File Buffer Overflowoval:org.mitre.oval:def:435Unspecified vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary code via e-mail messages with crafted (1) vCal or (2) iCal Calendar properties.TA06-129AVU#303452MS06-019exchange-calendar-code-execution(25556)ADV-2006-17431790825338101604820029oval:org.mitre.oval:def:2035oval:org.mitre.oval:def:1996oval:org.mitre.oval:def:1818Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via a BIFF parsing format file containing malformed BOOLERR records that lead to memory corruption, probably involving invalid pointers.TA06-073AVU#339878MS06-012101576619138excel-parsing-format-file-bo(25225)http://www.zerodayinitiative.com/advisories/ZDI-06-004.htmlADV-2006-095020060314 ZDI-06-004: Microsoft Excel File Format Parsing Vulnerability23899http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm58319238oval:org.mitre.oval:def:1635oval:org.mitre.oval:def:1509oval:org.mitre.oval:def:1411oval:org.mitre.oval:def:1158Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed description, which leads to memory corruption.TA06-073AVU#235774MS06-012101576619138excel-description-bo(25227)ADV-2006-095023900http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm58658519238oval:org.mitre.oval:def:1633oval:org.mitre.oval:def:1579oval:org.mitre.oval:def:1570oval:org.mitre.oval:def:1522Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed graphic, which leads to memory corruption.TA06-073AVU#123222MS06-012101576619138excel-graphic-bo(25229)ADV-2006-09501618123901http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm19238oval:org.mitre.oval:def:1666oval:org.mitre.oval:def:1630oval:org.mitre.oval:def:1510oval:org.mitre.oval:def:1401Stack-based buffer overflow in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed record with a modified length value, which leads to memory corruption.TA06-073AVU#10430217101MS06-012101576619138excel-record-bo(25228)ADV-2006-095020060315 [xfocus-SD-060314]Microsoft Office Excel Buffer Overflow Vulnerability23902http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm5891923820060314 [xfocus-SD-060314]Microsoft Office Excel Buffer Overflow Vulnerabilityoval:org.mitre.oval:def:763oval:org.mitre.oval:def:1750oval:org.mitre.oval:def:1525oval:org.mitre.oval:def:1327Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose charset is set to UTF-7.Successful exploitation requires that the Indexing service is accessible through IIS.TA06-255AVU#10888419927MS06-05321861ms-indexing-service-xss(28651)ADV-2006-356420061001 Microsoft Internet Information Services UTF-7 XSS Vulnerability [MS06-053]20061002 IE UXSS (Universal XSS in IE, was Re: Microsoft Internet Information Services UTF-7 XSS Vulnerability [MS06-053])SSRT061187HPSBST02134http://www.geocities.jp/ptrs_sec/advisory09e.html1016826oval:org.mitre.oval:def:535Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via a crafted PNG image that triggers memory corruption when it is parsed.TA06-192AVU#45938818913MS06-039ADV-2006-275727147http://www.fortinet.com/FortiGuardCenter/advisory/FG-2006-22.html101647021013oval:org.mitre.oval:def:163Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0 and Windows 2000 SP2 and SP3 allows remote attackers to execute arbitrary code via a long fifth argument to the BuildContextW or BuildContext opcode, which triggers a bug in the NdrAllocate function, aka the MSDTC Invalid Memory Access Vulnerability.1790620060509 [EEYEB20051011A] - Microsoft Distributed Transaction Coordinator Heap OverflowMS06-018http://www.eeye.com/html/research/advisories/AD20060509a.html20000msdtc-network-message-dos(25559)ADV-2006-174220060511 Microsoft MSDTC NdrAllocate Validation Vulnerability25335101604786320060510 Microsoft MSDTC NdrAllocate Validation Vulnerability20060509 [EEYEB20051011A] - Microsoft Distributed Transaction Coordinator Heap Overflowoval:org.mitre.oval:def:1908oval:org.mitre.oval:def:1477oval:org.mitre.oval:def:1222The netlink_rcv_skb function in af_netlink.c in Linux kernel 2.6.14 and 2.6.15 allows local users to cause a denial of service (infinite loop) via a nlmsg_len field of 0.2006-000418482kernel-afnetlink-dos(24202)ADV-2006-022016414http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ad8e4b75c8a7bed475d72ce09bf5267188621961388ip_nat_pptp in the PPTP NAT helper (netfilter/ip_nat_helper_pptp.c) in Linux kernel 2.6.14, and other versions, allows remote attackers to cause a denial of service (memory corruption or crash) via an inbound PPTP_IN_CALL_REQUEST packet that causes a null pointer to be used in an offset calculation.ADV-2006-0220http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=15db34702cfafd24acc60295cf14861e497502abkernel-pptpincallrequest-dos(24203)2006-00041641438818482ip_nat_pptp in the PPTP NAT helper (netfilter/ip_nat_helper_pptp.c) in Linux kernel 2.6.14, and other versions, allows local users to cause a denial of service (memory corruption or crash) via a crafted outbound packet that causes an incorrect offset to be calculated from pointer arithmetic when non-linear SKBs (socket buffers) are used.ADV-2006-0220http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=03b9feca89366952ae5dfe4ad8107b1ece50b710kernel-pptpnathelper-dos(24204)2006-00041641438818482Integer overflow in the do_replace function in netfilter for Linux before 2.6.16-rc3, when using "virtualization solutions" such as OpenVZ, allows local users with CAP_NET_ADMIN rights to cause a buffer overflow in the copy_from_user function.Linux kernel version 2.6.16 has been released to address this issue.17178https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=186295linux-netfilter-doreplace-overflow(25400)ADV-2006-2554ADV-2006-1046USN-302-1RHSA-2006:0575http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ee4bb818ae35f68d1f848eae0a7b150a38eb4168DSA-1103DSA-1097http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm224172146520914207162067119330oval:org.mitre.oval:def:10945Race condition in the do_add_counters function in netfilter for Linux kernel 2.6.16 allows local users with CAP_NET_ADMIN capabilities to read kernel memory by triggering the race condition in a way that produces a size value that is inconsistent with allocated memory, which leads to a buffer over-read in IPT_ENTRY_ITERATE.http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2722971cbe831117686039d5c334f2c0f560be13http://bugs.gentoo.org/show_bug.cgi?id=133465https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=191698linux-doaddcounters-race-condition(26583)ADV-2006-2554ADV-2006-1893USN-311-118113RHSA-2006:068925697DSA-1103DSA-1097http://support.avaya.com/elmodocs2/security/ASA-2006-249.htm22945222922147620991209142067120185oval:org.mitre.oval:def:10309http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.17GNOME Evolution 2.4.2.1 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a text e-mail with a large number of URLs, possibly due to unknown problems in gtkhtml.ADV-2006-080120060301 Evolution Emailer DoSevolution-email-dos(25050)1689919094Unspecified vulnerability in (1) apreq_parse_headers and (2) apreq_parse_urlencoded functions in Apache2::Request (Libapreq2) before 2.07 allows remote attackers cause a denial of service (CPU consumption) via unknown attack vectors that result in quadratic computational complexity.16710DSA-10001913918846libapreq2-parsing-dos(24917)ADV-2006-0645GLSA-200604-08http://svn.apache.org/viewcvs.cgi/httpd/apreq/tags/v2_07/CHANGES?rev=376998&view=markup73719658Buffer overflow in the realpath function in nfs-server rpc.mountd, as used in SUSE Linux 9.1 through 10.0, allows local users to execute arbitrary code via unspecified vectors involving mount requests and symlinks.18638SUSE-SA:2006:005nfs-rpcmountd-realpath-bo(24347)ADV-2006-03481638818614DSA-97518889http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=350020Unspecified vulnerability in context.py in Albatross web application toolkit before 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the "handling of submitted form fields".DSA-94218457ADV-2006-019616252http://www.object-craft.com.au/projects/albatross/news.htmlhttp://security.debian.org/pool/updates/main/a/albatross/albatross_1.20-2.diff.gzalbatross-context-command-execution(24130)2245118496crawl before 4.0.0 does not securely call programs when saving and loading games, which allows local users to gain privileges.DSA-949ADV-2006-03031633718545crawl-insecure-command-execution(24262)2269018573squid_redirect script in adzapper before 2006-01-29 allows remote attackers to cause a denial of service (CPU consumption) via a URL with a large number of trailing / (forward slashes), which might produce inefficient regular expressions.DSA-9661877718771ADV-2006-0491http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=350308http://bugs.debian.org/cgi-bin/bugreport.cgi/squid_redirect.diff?bug=350308;msg=5;att=1http://adzapper.sourceforge.net/cvslog.htmladzapper-squid-redirect-dos(24640)1655822900packets.c in Freeciv 2.0 before 2.0.8 allows remote attackers to cause a denial of service (server crash) via crafted packets with negative compressed size values.1697520060306 Out of memory crash in Freeciv 2.0.719120freeciv-packets-dos(25166)ADV-2006-0838MDKSA-2006:053GLSA-200603-11DSA-9941925319227http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=355211Francesco Stablum tcpick 0.2.1 allows remote attackers to cause a denial of service (segmentation fault) via certain fragmented packets, possibly involving invalid headers and an attacker-controlled payload length. NOTE: this issue might be a buffer overflow or overread.ADV-2006-146617665http://sourceforge.net/mailarchive/forum.php?thread_id=9989610&forum_id=37151tcpick-writec-dos(26090)gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455.1705820060309 GnuPG does not detect injection of unsigned data23790GLSA-200603-08DSA-993101574919173[gnupg-announce] 20060309 [Announce] GnuPG does not detect injection of unsigned dataADV-2006-0915USN-264-1oval:org.mitre.oval:def:10063gnupg-nondetached-sig-verification(25184)2006-0014SSA:2006-072-02FLSA-2006:185355RHSA-2006:0266FEDORA-2006-147MDKSA-2006:055568450195321928719249192441923419232192311920319197SUSE-SA:2006:01420060401-01-Usnmptrapfmt in Debian 3.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary log file.DSA-10131931817182snmptrapfmt-log-temprary-file(25442)Buffer overflow in playlistimport.cpp in Kaffeine Player 0.4.2 through 0.7.1 allows user-assisted attackers to execute arbitrary code via long HTTP request headers when Kaffeine is "fetching remote playlists", which triggers the overflow in the http_peek function.http://www.kde.org/info/security/advisory-20060404-1.txt19525kaffeine-http-peek-bo(25631)ADV-2006-1229USN-268-11737220060405 [Kaffeine Security Advisory] Heap based buffer overflow in http_peek()SUSE-SR:2006:008GLSA-200604-04DSA-102310158631957119557195491954219540MDKSA-2006:065The attachment scrubber (Scrubber.py) in Mailman 2.1.5 and earlier, when using Python's library email module 2.5, allows remote attackers to cause a denial of service (mailing list delivery failure) via a multipart MIME message with a single part that has two blank lines between the first boundary and the end boundary.17311http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=358892oval:org.mitre.oval:def:9475USN-267-1RHSA-2006:048624367SUSE-SR:2006:008MDKSA-2006:061DSA-10271015851207822062419571195451952220060602-01-UImager (libimager-perl) before 0.50 allows user-assisted attackers to cause a denial of service (segmentation fault) by writing a 2- or 4-channel JPEG image (or a 2-channel TGA image) to a scalar, which triggers a NULL pointer dereference.17415DSA-10281957719575imager-jpeg-tga-dos(25717)ADV-2006-1294http://rt.cpan.org/Public/Bug/Display.html?id=18397http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=359661The ipfw firewall in FreeBSD 6.0-RELEASE allows remote attackers to cause a denial of service (firewall crash) via ICMP IP fragments that match a reset, reject or unreach action, which leads to an access of an uninitialized pointer.1620918378FreeBSD-SA-06:04ipfw-icmp-fragment-dos(24073)223191015477The ispell_op function in ee on FreeBSD 4.10 to 6.0 uses predictable filenames and does not confirm which file is being written, which allows local users to overwrite arbitrary files via a symlink attack when ee invokes ispell.1620718404FreeBSD-SA-06:02ee-ispell-op-symlink(24074)223201015469Double free vulnerability in the authentication and authentication token alteration code in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted passwords, which lead to a double free of a pointer that was created by the pam_get_item function. NOTE: this issue only occurs in certain configurations in which there are multiple PAM modules, PAM-MySQL is not evaluated first, and there are no requisite modules before PAM-MySQL.VU#69390916564101560318598ADV-2006-04902299522994GLSA-200606-18http://sourceforge.net/forum/forum.php?forum_id=49939420690http://jvn.jp/cert/JVNVU%23693909/index.htmlMicrosoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to bypass the Kill bit settings for dangerous ActiveX controls via unknown vectors involving crafted HTML, which can expose the browser to attacks that would otherwise be prevented by the Kill bit setting. NOTE: CERT/CC claims that MS05-054 fixes this issue, but it is not described in MS05-054.VU#998297http://www.microsoft.com/technet/security/bulletin/ms05-054.mspxie-activex-killbit-bypass(24379)1640923657Signal handler race condition in Sendmail 8.13.x before 8.13.6 allows remote attackers to execute arbitrary code by triggering timeouts in a way that causes the setjmp and longjmp function calls to be interrupted and modify unexpected memory locations.TA06-081AVU#834865RHSA-2006:0265RHSA-2006:0264ADV-2006-2490ADV-2006-2189ADV-2006-1529ADV-2006-1157ADV-2006-1139ADV-2006-1072ADV-2006-1068ADV-2006-1051ADV-2006-1049http://www.sendmail.com/company/advisory/index.shtml20060322 sendmail vuln advisories (CVE-2006-0058)OpenPKG-SA-2006.00720060322 Sendmail Remote Signal Handling VulnerabilityGLSA-200603-21DSA-1015200494193671936319342oval:org.mitre.oval:def:11074HPSBTU02116HPSBUX02108smtp-timeout-bo(24584)http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=2751http://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v52.Readme.html#MH0068817192FLSA:186277FEDORA-2006-193FEDORA-2006-19424037[3.8] 006: SECURITY FIX: March 25, 2006SUSE-SA:2006:017MDKSA-2006:058http://www.f-secure.com/security/fsc-2006-2.shtmlQ-151IY82994IY82993IY82992http://support.avaya.com/elmodocs2/security/ASA-2006-078.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-074.htm102324102262SSA:2006-081-011015801743612207232024319774196761953319532194661945019407194041939419368193611936019356193491934619345HPSBTU02116HPSBUX0210820060401-01-U20060302-01-PSCOSA-2006.24NetBSD-SA2006-010FreeBSD-SA-06:13oval:org.mitre.oval:def:1689Heap-based buffer overflow in the ISO Transport Service over TCP (RFC 1006) implementation of LiveData ICCP Server before 5.00.035 allows remote attackers to cause a denial of service or execute arbitrary code via malformed packets.This vulnerability is addressed in the following product release:
LiveData, ICCP Server, 5.00.035VU#190617ADV-2006-1830http://www.kb.cert.org/vuls/id/JGEI-6MMS9Tlivedata-iccp-rfc1006-bo(26490)18010http://www.digitalbond.com/SCADA_Blog/2006/05/us-cert-livedata-iccp-vulnerability.html101611320146Cross-site scripting (XSS) vulnerability in phpBB 2.0.19, when "Allowed HTML tags" is enabled, allows remote attackers to inject arbitrary web script or HTML via a permitted HTML tag with ' (single quote) characters and active attributes such as onmouseover, a variant of CVE-2005-4357.ADV-2006-0051313http://securityreason.com/securityalert/31320060105 phpBB 2.0.19 XSS22672PHP remote file include vulnerability in includes/orderSuccess.inc.php in CubeCart allows remote attackers to execute arbitrary PHP code via a URL in the glob[rootDir] parameter.ADV-2006-00161398SQL injection vulnerability in (1) functions.php, (2) functions_update.php, and (3) functions_display.php in VEGO Web Forum 1.26 and earlier allows remote attackers to execute arbitrary SQL commands via the theme_id parameter in index.php.ADV-2006-000320060101 [eVuln] VEGO Web Forum SQL Injection Vulnerability18273http://evuln.com/vulns/1/summary.html1610722140315SQL injection vulnerability in index.php in PHPjournaler 1.0 allows remote attackers to execute arbitrary SQL commands via the readold parameter.ADV-2006-00061611120060101 [eVuln] PHPjournaler SQL Injection Vulnerability2214918265http://evuln.com/vulns/9/summary.htmlSQL injection vulnerability in login.php in VEGO Links Builder 2.00 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.ADV-2006-000418272http://evuln.com/vulns/2/summary.html1610822139SQL injection vulnerability in Primo Cart 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) q parameter to search.php and (2) email parameter to user.php.ADV-2006-000818264161252214722146http://pridels0.blogspot.com/2006/01/primo-cart-sql-inj.htmlCross-site scripting (XSS) vulnerability in addentry.php in Chipmunk Guestbook 1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the homepage parameter.190871611220060101 [eVuln] Chipmunk Guestbook XSS Vulnerability18270http://evuln.com/vulns/4/summary.html** DISPUTED ** Drupal allows remote attackers to conduct cross-site scripting (XSS) attacks via an IMG tag with an unusual encoded Javascript function name, as demonstrated using variations of the alert() function. NOTE: a followup by the vendor suggests that the issue does not exist in 4.5.6 or 4.6.4 when "Filtered HTML" is enabled, and since "Full HTML" would not filter HTML by design, perhaps this should not be included in CVE.20060103 Re: Drupal all versiyon xss cehennem.org20060102 Drupal all versiyon xss cehennem.orgThe ebuild for pinentry before 0.7.2-r2 on Gentoo Linux sets setgid bits for pinentry programs, which allows local users to read or overwrite arbitrary files as gid 0.16120GLSA-200601-012221118284Buffer overflow in termsh on SCO OpenServer 5.0.7 allows remote attackers to execute arbitrary code via a long -o command line argument. NOTE: this is probably a different vulnerability than CVE-2005-0351 since it involves a distinct attack vector.1612220060102 SCO Openserver 5.0.x exploithttp://downloads.securityfocus.com/vulnerabilities/exploits/Openserver_bof.cCross-site scripting (XSS) vulnerability in DiscusWare Discus Freeware 3.10.5 and Professional 3.10.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a URL, which is not properly sanitized from the resulting error message. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.161192215318283SQL injection vulnerability in profile.php in PHPenpals allows remote attackers to execute arbitrary SQL commands via the personalID parameter. NOTE: it was later reported that 1.1 and earlier are affected.ADV-2006-00051610920060101 [eVuln] PHPenpals SQL Injection Vulnerabilit22150870618269http://evuln.com/vulns/5/summary.htmlDirect static code injection vulnerability in phpBook 1.3.2 and earlier allows remote attackers to execute arbitrary PHP code via the e-mail field (mail variable) in a new message, which is written to a PHP file.1610620060101 [eVuln] phpBook PHP Code Executionhttp://evuln.com/vulns/6/summary.htmlADV-2006-000218268PHP remote file include vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter.1610520060531 Re: OaBoard 1.0 Remote File inclusion20060530 OaBoard 1.0 Remote File inclusion20060101 [eVuln] oaBoard PHP Code Execution1016211http://evuln.com/vulns/3/summary.htmlOff-by-one error in the getfattr function in File::ExtAttr before 0.03 allows attackers to trigger a buffer overflow via unspecified attack vectors.16118http://sourceforge.net/project/shownotes.php?release_id=382199&group_id=15311618253ADV-2006-001322160Multiple cross-site scripting (XSS) vulnerabilities in B-net Software 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) shout variables to (a) shout.php, or the (3) title and (4) message variables to (b) guestbook.php.ADV-2006-00181611420060102 [eVuln] B-net Software Multiple XSS Vulnerabilities18271http://evuln.com/vulns/10/summary.html20060825 Re: [eVuln] B-net Software Multiple XSS Vulnerabilities2219122190http://sourceforge.net/project/shownotes.php?release_id=442067&group_id=117067316SQL injection vulnerability in auth.php in ScozNet ScozBook BETA 1.1 allows remote attackers to execute arbitrary SQL commands via the username field (adminname variable).ADV-2006-00271611520060102 [eVuln] ScozBook "adminname" Authentication Bypasshttp://evuln.com/vulns/11/summary.html222213188476Cross-site scripting (XSS) vulnerability in vBulletin 3.5.2, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the title of an event, which is not properly filtered by (1) calendar.php and (2) reminder.php.ADV-2006-00331611620060108 Html_Injection in vBulletin 3.5.220060101 [KAPDA::#19] - Html Injection in vBulletin 3.5.2222202221018299http://kapda.ir/advisory-177.htmlialmnt5.sys in the ialmrnt5 display driver in Intel Graphics Accelerator Driver 6.14.10.4308 allows attackers to cause a denial of service (crash or screen resolution change) via a long text field, as demonstrated using a long window title.ADV-2006-001716127221961828620060103 Re: Buffer Overflow vulnerability in Windows Display Manager [Suspected]20060103 Re: Buffer Overflow vulnerability in Windows Display Manager [Suspected]20060102 Buffer Overflow vulnerability in Windows Display Manager [Suspected]Format string vulnerability in the SetImageInfo function in image.c for ImageMagick 6.2.3 and other versions, and GraphicsMagick, allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a numeric format string specifier such as %d in the file name, a variant of CVE-2005-0397, and as demonstrated using the convert program.12717GLSA-200602-13.xmlGLSA-200602-06SSA:2006-045-031918319030188511860720060301-01-Uhttps://issues.rpath.com/browse/RPL-389ADV-2008-0412USN-246-120061127 rPSA-2006-0218-1 ImageMagickSUSE-SR:2006:006MDKSA-2006:024DSA-12132313211015623500288002309022998194081887118261RHSA-2006:0178oval:org.mitre.oval:def:10717http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=345876Format string vulnerability in the logging code of SMS Server Tools (smstools) 1.14.8 and earlier allows local users to execute arbitrary code via unspecified attack vectors.18357smstools-logging-format-string(24034)1618822287DSA-93018343Cross-site scripting vulnerability in index.php in raSMP 2.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the $_SERVER[HTTP_USER_AGENT] variable (User-Agent header).ADV-2006-0030161382219818292http://evuln.com/vulns/13/summary.html101543220060116 vendor ack/fix: 22198: raSMP index.php User-Agent Field XSS (fwd)SQL injection vulnerability in Nkads 1.0 alfa 3 allows remote attackers to execute arbitrary SQL commands via the (1) usuario_nkads_admin or (2) password_nkads_admin parameters.ADV-2006-0040http://www.soulblack.com.ar/repo/papers/advisory/nkads_advisory.txt1830222206Cross-site scripting vulnerability in index.php in Next Generation Image Gallery 0.0.1 Lite Edition allows remote attackers to inject arbitrary web script or HTML via the page parameter.ADV-2006-00371830922202http://osvdb.org/ref/22/22202-nextgen.txtSQL injection vulnerability in (1) pages.php and (2) detail.php in Lizard Cart CMS 1.04 allows remote attackers to execute arbitrary SQL commands via the id parameter.ADV-2006-00291614020060104 [eVuln] Lizard Cart CMS SQL Injection Vulnerability182972220022199http://www.evuln.com/vulns/12/summary.html1015435314SQL injection vulnerability in intouch.lib.php in inTouch 0.5.1 Alpha allows remote attackers to execute arbitrary SQL commands via the user parameter.ADV-2006-00261611020060101 [eVuln] inTouch Authentication Bypasshttp://evuln.com/vulns/8/summary.htmlintouch-intouch-sql-injection(23954)22382Buffer overflow in ESRI ArcPad 7.0.0.156 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a .amp file with a COORDSYS tag with a long string attribute.ADV-2006-003216136http://users.pandora.be/bratax/advisories/b007.html1829422208Directory traversal vulnerability in index.php in IDV Directory Viewer before 2005.1 allows remote attackers to view arbitrary directory contents via a .. (dot dot) in the dir parameter.http://sourceforge.net/project/shownotes.php?release_id=382593&group_id=152499ADV-2006-00311829816137Cross-site scripting (XSS) vulnerability in webmail in Open-Xchange 0.8.1-6 and earlier, with "Inline HTML" enabled, allows remote attackers to inject arbitrary web script or HTML via e-mail attachments, which are rendered inline.ADV-2006-00341828520060103 Open Xchange XSS1015431** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-0992, CVE-2006-0158. Reason: this candidate was intended for one issue, but a typo caused it to be associated with a Novell/Groupwise issue. In addition, this issue was a duplicate of a SiteSuite issue that was also assigned CVE-2006-0158. Notes: All CVE users should consult CVE-2006-0992 and CVE-2006-0158 to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage.Cross-site scripting (XSS) vulnerability in index.php in @Card ME PHP allows remote attackers to inject arbitrary web script or HTML via the cat parameter.ADV-2006-00392220318306http://osvdb.org/ref/22/22203-ecardmax.txtPHP remote file include vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc_stat parameter, a different vulnerability than CVE-2006-0076. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-002817373dm-crypt in Linux kernel 2.6.15 and earlier does not clear a structure before it is freed, which leads to a memory disclosure that could allow local users to obtain sensitive information about a cryptographic key.[linux-kernel] 20060104 [Patch 2.6] dm-crypt: zero key before freeing itADV-2006-0235oval:org.mitre.oval:def:11192[linux-kernel] 20060104 [Patch 2.6] dm-crypt: Zero key material before free to avoid information leakkernel-dmcrypt-information-disclosure(24189)USN-244-12006-000416301FLSA:157459-4RHSA-2006:0132FEDORA-2006-10222418SUSE-SA:2006:028MDKSA-2006:040DSA-10171015740388203981937419160187741852718487wan/sdla.c in Linux kernel 2.6.x before 2.6.11 and 2.4.x before 2.4.29 does not require the CAP_SYS_RAWIO privilege for an SDLA firmware upgrade, with unknown impact and local attack vectors. NOTE: further investigation suggests that this issue requires root privileges to exploit, since it is protected by CAP_NET_ADMIN; thus it might not be a vulnerability, although capabilities provide finer distinctions between privilege levels.MDKSA-2006:044USN-244-116304http://www.kernel.org/git/?p=linux/kernel/git/tglx/history.git;a=commitdiff;h=0f1d4813a4a65296e1131f320a60741732bc068fDSA-1017193741897718527http://linux.bkbits.net:8080/linux-2.4/cset@1.1448.91.23?nav=index.html|src/|src/drivers|src/drivers/net|src/drivers/net/wan|related/drivers/net/wan/sdla.cStack-based buffer overflow in the create_named_pipe function in libmysql.c in PHP 4.3.10 and 4.4.x before 4.4.3 for Windows allows attackers to execute arbitrary code via a long (1) arg_host or (2) arg_unix_socket argument, as demonstrated by a long named pipe variable in the host argument to the mysql_connect function.ADV-2006-00461614520060105 Windows PHP 4.x http://www.php.net/ChangeLog-4.php#4.4.3222321827520060105 Windows PHP 4.x 20060108 RE: Windows PHP 4.x The dupfdopen function in sys/kern/kern_descrip.c in OpenBSD 3.7 and 3.8 allows local users to re-open arbitrary files by using setuid programs to access file descriptors using /dev/fd/.16144[3.7] 20060105 008: SECURITY FIX: January 5, 200618296ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/008_fd.patch222311015437PHP remote file include vulnerability in (1) include/templates/categories/default.php and (2) certain other include/templates/categories/ PHP scripts in Valdersoft Shopping Cart 3.0 allows remote attackers to execute arbitrary code via a URL in the catalogDocumentRoot parameter.16126http://downloads.securityfocus.com/vulnerabilities/exploits/cijfer-vscxpl.pl1401Buffer overflow in NicoFTP 3.0.1.19 and earlier might allow local users to execute arbitrary code via a long string in the "Name of site" field of an FTP account. NOTE: because this program executes with the privileges of the invoking user, and because remote programs do not normally have the ability to create or modify FTP accounts in this program, there may not be a typical attack vector for the issue that crosses privilege boundaries. Therefore this may not be a vulnerability.20060102 NicoFTP Stack Overflow317Multiple cross-site scripting (XSS) vulnerabilities in sBLOG 0.7.1 Beta 20051202 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) p and (2) keyword parameters in (a) index.php and (b) search.php.sblog-multiple-scripts-xss(23979)ADV-2006-00412237422373http://osvdb.org/ref/22/22373-sblog.txtCross-site scripting (XSS) vulnerability in TinyPHPForum (TPF) 3.6 and earlier allows remote attackers to inject arbitrary web script via a javascript: scheme in an "[a]" bbcode tag, possibly the txt parameter to action.php.ADV-2006-005420060105 [eVuln] TinyPHPForum Multiple Vulnerabilities22256101543618293http://evuln.com/vulns/14/summary.html320TinyPHPForum 3.6 and earlier stores the (1) users/[USERNAME].hash and (2) users/[USERNAME].email files under the web root with insufficient access control, which allows remote attackers to list all registered users and possibly obtain other sensitive information.tinyphpforum-users-information-disclosure(24016)ADV-2006-005420060417 Tiny PHP forum - vulns20060105 [eVuln] TinyPHPForum Multiple Vulnerabilities22257101543632018293http://evuln.com/vulns/14/summary.htmlDirectory traversal vulnerability in TinyPHPForum 3.6 and earlier allows remote attackers to create a new user account, create a new topic, or view the profile of a user account, as demonstrated via a .. (dot dot) in the uname parameter to profile.php.ADV-2006-005420060105 [eVuln] TinyPHPForum Multiple Vulnerabilities18293http://evuln.com/vulns/14/summary.htmlhttp://evuln.com/vulns/14/exploit.html16163222581015436320PostgreSQL 8.0.x before 8.0.6 and 8.1.x before 8.1.2, when running on Windows, allows remote attackers to cause a denial of service (postmaster exit and no new connections) via a large number of simultaneous connection requests.[pgsql-announce] 20060109 CRITICAL RELEASE: Minor Releases to Fix DoS VulnerabilityADV-2006-0114postgresql-connection-request-dos(24049)1620120060111 PostgreSQL security releases 8.0.6 and 8.1.2http://www.postgresql.org/about/news.456101548232718419gdi/driver.c and gdi/printdrv.c in Wine 20050930, and other versions, implement the SETABORTPROC GDI Escape function call for Windows Metafile (WMF) files, which allows attackers to execute arbitrary code, the same vulnerability as CVE-2005-4560 but in a different codebase.18323http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=346197ADV-2006-0098[Dailydave] 20060105 WMF goes away :<win-wmf-execute-code(23846)20060117 ERRATA: [ GLSA 200601-09 ] Wine: Windows Metafile SETABORTPROC vulnerabilitySUSE-SR:2006:002MDKSA-2006:014GLSA-200601-09DSA-954185781854918451SQL injection vulnerability in Timecan CMS allows remote attackers to execute arbitrary SQL commands via the viewID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Due to the unavailability of the original source, it cannot be determined if this is the same issue as identified by CVE-2006-0108.161592225218324timecancms-sql-injection(24014)SQL injection vulnerability in mcl_login.asp in Timecan CMS allows remote attackers to execute arbitrary SQL commands via the email parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Due to the unavailability of the original source, it cannot be determined if this is the same issue as identified by CVE-2006-0107.ADV-2006-00782225322252timecancms-sql-injection(24014)Cross-site scripting vulnerability in category.php in Modular Merchant Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the cat parameter.18320ADV-2006-00761616022243http://www.modularmerchant.com/forums/viewtopic.php?t=46http://osvdb.org/ref/22/22243-modular.txt20060214 vendor ack/fix 22243: Modular Merchant Marketplace Shopping Cart category.php cat Variable XSS (fwd)Cross-site scripting (XSS) vulnerability in escribir.php in Foro Domus 2.10 allows remote attackers to inject arbitrary web script via the email parameter.ADV-2006-00731615420060106 [eVuln] Proyecto Domus 'email' XSS Vulnerability2226318327http://evuln.com/vulns/16/summary.htmldomus-escribir-xss(24020)Cross-site scripting vulnerability in index.php in Boxcar Media Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the (1) parent or (2) pg parameter.boxcar-index-xss(24019)ADV-2006-008022360http://osvdb.org/ref/22/22360-boxcar.txtCross-site scripting (XSS) vulnerability in index.php in Enhanced Simple PHP Gallery 1.7 allows remote attackers to inject arbitrary web script or HTML via the dir parameter.ADV-2006-00362220118310http://osvdb.org/ref/22/22201-espg.txtEnhanced Simple PHP Gallery 1.7 allows remote attackers to obtain the full path of the application via a direct request to sp_helper_functions.php, which leaks the pathname in an error message.18310http://osvdb.org/ref/22/22201-espg.txt22417The vCard functions in Joomla! 1.0.5 use predictable sequential IDs for vcards and do not restrict access to them, which allows remote attackers to obtain valid e-mail addresses to conduct spam attacks by modifying the contact_id parameter to index2.php.joomla-vcard-information-disclosure(24042)ADV-2006-00971618518361http://forum.joomla.org/index.php/topic,29031.0.htmlhttp://forge.joomla.org/sf/go/artf2950Multiple SQL injection vulnerabilities in OnePlug Solutions OnePlug CMS allow remote attackers to execute arbitrary SQL commands via the (1) Press_Release_ID parameter in press/details.asp, (2) Service_ID parameter in services/details.asp, and (3) Product_ID parameter in products/details.asp.ADV-2006-00791615522250222492224818325http://osvdb.org/ref/22/22248-oneplug.txtCross-site scripting vulnerability search.inetstore in iNETstore Ebusiness Software 2.0 allows remote attackers to inject arbitrary web script or HTML via the searchterm parameter.ADV-2006-00751615620060126 Re: [OSVDB Mods] iNETstore E Commerce Solution - Cross Site Scripting2225120060127 vendor confirms versions: iNETstore E Commerce Solution - Cross Site Scripting (fwd)18322http://osvdb.org/ref/22/22251-inetstore.txtBuffer overflow in IBM Lotus Notes and Domino Server before 6.5.5 allows attackers to cause a denial of service (router crash or hang) via unspecified vectors involving "CD to MIME Conversion".1615818328ADV-2006-0081http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/21d8fd7989fdf78d852570e4001bae68?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/50c634bfe193efa5852570e4001baace?OpenDocumenthttp://www-1.ibm.com/support/docview.wss?uid=swg27007054lotus-cdtomime-dos(24205)Unspecified vulnerability in IBM Lotus Notes and Domino Server before 6.5.5, when running on AIX, allows attackers to cause a denial of service (deep recursion leading to stack overflow and crash) via long formulas.1615818328ADV-2006-0081http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/21d8fd7989fdf78d852570e4001bae68?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/50c634bfe193efa5852570e4001baace?OpenDocumenthttp://www-1.ibm.com/support/docview.wss?uid=swg27007054lotus-long-formula-bo(24206)Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before 6.5.5 have unknown impact and attack vectors, due to "potential security issues" as identified by SPR numbers (1) GPKS6C9J67 in Agents, (2) JGAN6B6TZ3 and (3) KSPR699NBP in the Router, (4) GPKS5YQGPT in Security, or (5) HSAO6BNL6Y in the Web Server. NOTE: vector 3 is related to an issue in NROUTER in IBM Lotus Notes and Domino Server before 6.5.4 FP1, 6.5.5, and 7.0, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted vCal meeting request sent via SMTP (aka SPR# KSPR699NBP).1615818328domino-smtp-nrouter-dos(27413)lotus-web-unspecified-xss(24211)lotus-multiple-unspecified(24207)ADV-2006-2564ADV-2006-00811802020060626 SYMSA-2006-006: Lotus Domino SMTP Based Denial of Servicehttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/f97fe7cfd9a8113b8525709200001db4?OpenDocument&Highlight=0,GPKS6C9J67http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/e4deb1cbb011c747852570e4001ba9bb?OpenDocument&Highlight=0,GPKS5YQGPThttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/de2ab57a5b9547848525701b00420c2c?OpenDocument&Highlight=0,KSPR699NBPhttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/d1150fc9c5dec8b18525709200001da6?OpenDocument&Highlight=0,GPKS6C9J67http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/9a1650d1a771f3078525702a00420def?OpenDocument&Highlight=0,HSAO6BNL6Yhttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/94a77eb898843aca8525709200001de1?OpenDocument&Highlight=0,JGAN6B6TZ3http://www-1.ibm.com/support/docview.wss?uid=swg27007054101639020855Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before 6.5.5 allow attackers to cause a denial of service (application crash) via multiple vectors, involving (1) a malformed message sent to an "Out Of Office" agent (SPR LPEE6DMQWJ), (2) the compact command (RTIN5U2SAJ), (3) malformed bitmap images (MYAA6FH5HW), (4) the "Delete Attachment" action (YPHG6844LD), (5) parsing certificates from a remote Certificate Table (AELE6DZFJW), and (6) creating a SSL key ring with the Domino Administration client (NSUA4FQPTN).1615818328ADV-2006-0081http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/ced5f873baea4e8b852570e4001baa6d?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/ad0dd14aa109f96b852570e4001bb08c?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/5f166a44ee743b2c852570e4001baf31?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/4118a1f266afb26c852570e4001baf5e?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/2bb4f466a9e986ae852570e4001babbb?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/040482aeb1416bb7852570e4001badd6?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/258394eaa824f2c08525708a004209d3?OpenDocumenthttp://www-1.ibm.com/support/docview.wss?uid=swg27007054lotus-ssl-keyring-dos(24217)lotus-certificate-parsing-dos(24216)lotus-delete-attachment-dos(24215)lotus-bmp-dos(24214)lotus-compact-dos(24213)lotus-outofoffice-dos(24212)Multiple memory leaks in IBM Lotus Notes and Domino Server before 6.5.5 allow attackers to cause a denial of service (memory consumption and crash) via unknown vectors related to (1) unspecified vectors during the SSL handshake (SPR# MKIN67MQVW), (2) the stash file during the SSL handshake (SPR# MKIN693QUT), and possibly other vectors. NOTE: due to insufficient information in the original vendor advisory, it is not clear whether there is an attacker role in other memory leaks that are specified in the advisory.1615818328ADV-2006-0081http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/2221243535d88a2b8525701b00420cd6?OpenDocument&Highlight=0,MKIN693QUThttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/20f66e356a76c90f8525702a00420e08?OpenDocument&Highlight=0,MKIN67MQVWhttp://www-1.ibm.com/support/docview.wss?uid=swg27007054lotus-ssl-handshake-dos(24223)Cross-site scripting (XSS) vulnerability in Public/Index.asp in Aquifer CMS allows remote attackers to inject arbitrary web script or HTML via the Keyword parameter.Vendor provided solution:
"Liquid Development has identified this vulnerability in all shipping versions of AquiferCMS and coded a software fix. The fix will be included in all releases of AquiferCMS built on or after January 24, 2006. Customers should contact Liquid Development to obtain the fix for this vulnerability. For more information visit www.aquifercms.com."
22247ADV-2006-00741616218326http://osvdb.org/ref/22/22247-aquifer.txt20060124 vendor ack/fix: Aquifer CMS Index.asp Keyword Variable XSS (fwd)Multiple SQL injection vulnerabilities in ADN Forum 1.0b allow remote attackers to execute arbitrary SQL commands via the (1) fid parameter in index.php and (2) pagid parameter in verpag.php, and possibly other vectors.ADV-2006-00771615720060105 [eVuln] ADNForum Multiple Vulnerabilities2224122240101544518300http://evuln.com/vulns/15/summary.htmlCross-site scripting (XSS) vulnerability in crear.php in ADN Forum 1.0b allows remote attackers to inject arbitrary web script or HTML via the titulo parameter, which is used by the "Topic name" field.ADV-2006-00771615720060105 [eVuln] ADNForum Multiple Vulnerabilities18300http://evuln.com/vulns/15/summary.html222421015445Unspecified vulnerability in appserv/main.php in AppServ 2.4.5 allows remote attackers to include arbitrary files via the appserv_root parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. There is not enough detail from these third party sources to know whether this is directory traversal, remote file include, or another issue.ADV-2006-0053222281816316166rxvt-unicode before 6.3, on certain platforms that use openpty and non-Unix pty devices such as Linux and most BSD platforms, does not maintain the intended permissions of tty devices, which allows local users to gain read and write access to the devices.2222318301ADV-2006-0052http://dist.schmorp.de/rxvt-unicode/ChangesDirectory traversal vulnerability in the IMAP service of Rockliffe MailSite before 6.1.22.1 allows remote authenticated users to rename the folders of other users via a .. (dot dot) in the RENAME command.http://zur.homelinux.com/Advisories/RockliffeMailsiteDirTransveral.txt222291831820060104 Rockliffe Directory Transversal VulnerabilityADV-2006-005520060105 Re: Rockliffe Directory Transversal VulnerabilityBuffer overflow in the IMAP service of Rockliffe MailSite before 6.1.22.1 allows remote attackers to have an unknown impact via unknown attack vectors.http://zur.homelinux.com/Advisories/RockliffeMailsiteDirTransveral.txt20060104 Rockliffe Directory Transversal Vulnerabilityrockliffe-imap-unspecified-bo(39991)Mail Management Agent (MAILMA) (aka Mail Management Server) in Rockliffe MailSite 7.0.3.1 and earlier generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames via user requests to TCP port 106.18318http://zur.homelinux.com/Advisories/RockliffeMailsiteUserEnum.txtADV-2006-00552223020060104 Rockliffe Mailsite User Enumeration FlawMail Management Agent (MAILMA) (aka Mail Management Server) in Rockliffe MailSite 7.0.3.1 and earlier allows remote attackers to attempt authentication with an unlimited number of user account names and passwords without denying connections, limiting the rate of connections, or locking out an account.http://zur.homelinux.com/Advisories/RockliffeMailsiteUserEnum.txt20060104 Rockliffe Mailsite User Enumeration FlawboastMachine 3.1 allows remote attackers to obtain sensitive information via a direct request to (1) footer.php and (2) side_menu.php, which reveals the path in an error message.20060105 [ECHO_ADV_25$2006] Full path disclosure on boastMachine v3.1http://echo.or.id/adv/adv26-K-159-2006.txtDirectory traversal vulnerability in webftp.php in SysCP WebFTP 1.2.6 and possibly earlier allows remote attackers to include and execute arbitrary local PHP scripts, and possibly read other types of files, via a .. (dot dot) and a trailing null in the webftp_language parameter.18355ADV-2006-00901617520060104 SysCP WebFTP local file inclusion vulnerabilitywebftp-language-file-include(24018)Multiple directory traversal vulnerabilities in AIX 5.3 ML03 allow local users to determine the existence of files and read partial contents of certain files via a .. (dot dot) in the argument to (1) getCommand.new (aka getCommand) and (2) getShell, a different vulnerability than CVE-2005-4273.161031610220060101 [xfocus-SD-060101]AIX getCommand&getShell two vulnerabilities1015429Cross-site scripting (XSS) vulnerability in register.php in TheWebForum (twf) 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the www parameter.ADV-2006-00931616120060106 [eVuln] TheWebForum Script Insertion and Authentication Bypass101545018392http://evuln.com/vulns/17/summary.htmlhttp://evuln.com/vulns/17/exploit.htmlthewebforum-register-xss(24007)22295SQL injection vulnerability in login.php in TheWebForum (twf) 1.2.1 allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the username parameter (aka the u variable).ADV-2006-00931616120060106 [eVuln] TheWebForum Script Insertion and Authentication Bypass101545018392http://evuln.com/vulns/17/summary.htmlhttp://evuln.com/vulns/17/exploit.htmlthewebforum-login-sql-injection(24027)22294321Multiple cross-site scripting (XSS) vulnerabilities in the guestbook module in modules.php in Phanatic Softwares Chimera Web Portal System 0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) comment_poster, (2) comment_poster_email, (3) comment_poster_homepage, and (4) comment_text parameters.ADV-2006-00251611320060101 [eVuln] Chimera Web Portal System Multiple Vulnerabilitieshttp://evuln.com/vulns/7/summary.htmlhttp://evuln.com/vulns/7/exploit.htmlSQL injection vulnerability in linkcategory.php in Phanatic Softwares Chimera Web Portal System 0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.ADV-2006-00251611320060101 [eVuln] Chimera Web Portal System Multiple Vulnerabilitieshttp://evuln.com/vulns/7/summary.htmlhttp://evuln.com/vulns/7/exploit.htmlchimera-linkcategory-sql-injection(23963)22420aMSN (aka Alvaro's Messenger) allows remote attackers to cause a denial of service (client hang and termination of client's instant-messaging session) by repeatedly sending crafted data to the default file-transfer port (TCP 6891).http://www.securiteam.com/exploits/5JP090KHFQ.html22186The send-private-message functionality (send-private-message.asp) in PD9 Software MegaBBS 2.1 allows remote attackers to read private messages of other users via a modified replyid parameter.16168http://www.pd9soft.com/megabbs/forums/thread-view.asp?tid=4924http://www.hamid.ir/security/megabbs.txt18342ADV-2006-0095megabbs-sendprivatemessage-disclosure(24050)1015452Cross-site scripting (XSS) vulnerability in post.php in NavBoard V16 Stable(2.6.0) and V17beta2 allows remote attackers to inject arbitrary web script or HTML via the (1) b, (2) textlarge, and (3) url bbcode tags.navboard-post-xss(24021)ADV-2006-00921616520060107 [eVuln] NavBoard BBcode XSS Vulnerability2227718345http://evuln.com/vulns/19/summary.htmlQualcomm Eudora Internet Mail Server (EIMS) before 3.2.8 allows remote attackers to cause a denial of service (crash) via (1) malformed NTLM authentication requests, or a malformed (2) Incoming Mail X or (3) Temporary Mail file.http://www.eudora.co.nz/updates.html18356ADV-2006-009916179eims-corrupted-mail-dos(24033)eims-ntlm-auth-dos(24032)Cross-site scripting (XSS) vulnerability in andromeda.php in Andromeda 1.9.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the s parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-00961618318359andromeda-script-xss(24031)Microsoft Windows Graphics Rendering Engine (GRE) allows remote attackers to corrupt memory and cause a denial of service (crash) via a WMF file containing (1) ExtCreateRegion or (2) ExtEscape function calls with arguments with inconsistent lengths.1015453win-gre-wmf-dos(24044)ADV-2006-01151616720060109 [UPDATE]Microsoft Windows GRE WMF Format Multiple Unauthorized Memory Access Vulnerabilities20060107 Microsoft Windows GRE WMF Format Multiple Memory Overrun Vulnerabilitieshttp://lostmon.blogspot.com/2007/08/windows-extended-file-attributes-buffer.htmlhttp://blogs.technet.com/msrc/archive/2006/01/09/417198.aspxThe proxy server feature in go-pear.php in PHP PEAR 0.2.2, as used in Apache2Triad, allows remote attackers to execute arbitrary PHP code by redirecting go-pear.php to a malicious proxy server that provides a modified version of Tar.php with a malicious extractModify function.18390gopear-proxy-redirection(24076)ADV-2006-01481617420060109 New PEAR / Apache2Triad Exploithttp://apache2triad.net/forums/viewtopic.php?p=14670The kernfs_xread function in kernfs in NetBSD 1.6 through 2.1, and OpenBSD 3.8, does not properly validate file offsets against negative 32-bit values that occur as a result of truncation, which allows local users to read arbitrary kernel memory and gain privileges via the lseek system call.16173http://www.securitylab.net/research/2006/02/advisory_netbsd_openbsd_kernfs.html20060202 [SLAB] NetBSD / OpenBSD kernfs_xread patch evasion222931871218388NetBSD-SA2006-001netbsd-kernfs-memory-disclosure(24035)405The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.http://www.xaraya.com/index.php/news/5691618720060202 Bug for libs in php link directory 2.022290GLSA-200604-07DSA-1031DSA-1030DSA-1029http://secunia.com/secunia_research/2005-64/advisory/19699195911959019563195551872018276182601823317418adodb-server-command-execution(24051)ADV-2006-1419ADV-2006-1305ADV-2006-1304ADV-2006-0447ADV-2006-0370ADV-2006-0105ADV-2006-0104ADV-2006-0103ADV-2006-0102ADV-2006-010120070418 MediaBeez Sql query Execution .. Wear isn't ?? :)20060409 PhpOpenChat 3.0.x ADODB Server.php http://www.maxdev.com/Article550.phtml7132495419691196001826718254http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.htmlDynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo.22291GLSA-200604-07DSA-1030DSA-1029http://secunia.com/secunia_research/2005-64/advisory/196281959119590195551827618260182541823317418ADV-2006-1332ADV-2006-1305ADV-2006-0104ADV-2006-0103ADV-2006-0102ADV-2006-010120060412 Simplog <=0.9.2 multiple vulnerabilities20060409 PhpOpenChat 3.0.x ADODB Server.php "sql" SQL injectionDSA-10311960018267http://retrogod.altervista.org/simplog_092_incl_xpl.htmlhttp://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html1663adodb-tmssql-command-execution(24052)19691NetSarang Xlpd 2.1 allows remote attackers to cause a denial of service (crash) via a large number of connections from the same IP address.16164http://www.ipomonis.com/advisories/xlpd.txt1015444xlpd-connection-dos(24041)Cross-site scripting (XSS) vulnerability in SimpBook 1.0, with html_enable on (the default), allows remote attackers to inject arbitrary web script or HTML via the message field.101545120060106 SimpBook "message" Remote Cross-Site Scripting VulnerabilityMultiple format string vulnerabilities in the auth_ldap_log_reason function in Apache auth_ldap 1.6.0 and earlier allows remote attackers to execute arbitrary code via various vectors, including the username.MDKSA-2006:01716177RHSA-2006:0179DSA-95218568184121840518382apache-authldap-format-string(24030)ADV-2006-011720060109 Digital Armaments Security Advisory 01.09.2006: Apache auth_ldap module Multiple Format Strings Vulnerabilityhttp://www.rudedog.org/auth_ldap/Changes.htmlhttp://www.digitalarmaments.com/2006090173928420.html1015456sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158.18363USN-235-216184183582006-0010SUSE-SR:2006:002MDKSA-2006:159DSA-946SSA:2006-045-082169219016189061855818549Cross-site scripting (XSS) in search_result.php in phpChamber 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the needle parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-00941618018360phpchamber-searchresult-xss(24029)22282427BB 2.2 and 2.2.1 verifies authentication credentials based on the username, authenticated, and usertype cookies, which allows remote attackers to bypass authentication by using a valid username and usertype and setting the authenticated cookie.ADV-2006-00911617820060107 [eVuln] 427BB Multiple Vulnerabilities (Cookie-based Authentication Bypass, SQL Injections, XSS)18354http://evuln.com/vulns/18/summary.html427bb-scripts-security-bypass(24038)22274SQL injection vulnerability in showthread.php in 427BB 2.2 and 2.2.1 allows remote attackers to execute arbitrary SQL commands via the ForumID parameter.ADV-2006-00911616920060107 [eVuln] 427BB Multiple Vulnerabilities (Cookie-based Authentication Bypass, SQL Injections, XSS)18354http://evuln.com/vulns/18/summary.html427bb-showthread-sql-injection(24039)22275Cross-site scripting (XSS) vulnerability in posts.php in 427BB 2.2 and 2.2.1 allows remote attackers to inject arbitrary Javascript via a new message with a url bbcode tag containing a javascript URI.ADV-2006-009120060107 [eVuln] 427BB Multiple Vulnerabilities (Cookie-based Authentication Bypass, SQL Injections, XSS)18354http://evuln.com/vulns/18/summary.html427bb-posts-xss(24040)22276Cross-site scripting (XSS) vulnerability in Foxrum 4.0.4f allows remote attackers to inject arbitrary Javascript via the javascript URI in bbcode url tags in (1) addpost1.php and (2) addtopic1.php.ADV-2006-01211617220060109 [eVuln] Foxrum BBCode XSS Vulnerabilty18386http://evuln.com/vulns/20foxrum-bbcode-xss(24043)325settings.php in Reamday Enterprises Magic News Plus 1.0.3 allows remote attackers to change the administrator password via a change action that specifies identical values for the passwd and admin_password parameters, then declares the new password string in the new_passwd and confirm_passwd parameters.16182http://downloads.securityfocus.com/vulnerabilities/exploits/MagicNewsPlus-pw-change.pl18601SQL injection vulnerability in index.php in CyberDoc SiteSuite CMS allows remote attackers to execute arbitrary SQL commands via the page parameter.ADV-2006-00382220518305http://osvdb.org/ref/22/22205-sitesuite.txtSQL injection vulnerability in escribir.php in Foro Domus 2.10 allows remote attackers to execute arbitrary SQL commands via the email parameter. NOTE: the provenance of this information is unknown, although it may be based on post-disclosure analysis of CVE-2006-0110; the details are obtained solely from third party information.ADV-2006-00732226418327domus-escribir-sql-injection(24017)SQL injection vulnerability in add_post.php3 in Venom Board 1.22 allows remote attackers to execute arbitrary SQL commands via the (1) parent, (2) root, and (3) topic_id parameters to post.php3.venomboard-addpost-sql-injection(24046)ADV-2006-012216176222973261838320060109 [eVuln] Venom Board SQL Injection Vulnerabilityhttp://evuln.com/vulns/21/summary.htmlUnspecified vulnerability in uucp in Sun Solaris 8 and 9 has unknown impact and attack vectors. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this is related to CVE-2004-0780.101933ADV-2006-0113http://support.avaya.com/elmodocs2/security/ASA-2006-056.htm10154551908718371oval:org.mitre.oval:def:1534Heap-based buffer overflow in libclamav/upx.c in Clam Antivirus (ClamAV) before 0.88 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted UPX files.VU#3859081619118379ADV-2006-0116http://www.clamav.net/doc/0.88/ChangeLogclamav-libclamav-upx-bo(24047)http://www.zerodayinitiative.com/advisories/ZDI-06-001.html2006-000222318MDKSA-2006:016GLSA-200601-07DSA-94710154573421854818478184631845320060112 ZDI-06-001: Clam AntiVirus UPX Unpacking Code Execution VulnerabilitySQL injection vulnerability in the search module (modules/Search/index.php) of PHPNuke EV 7.7 -R1 allows remote attackers to execute arbitrary SQL commands via the query parameter, which is used by the search field. NOTE: This is a different vulnerability than CVE-2005-3792.phpnukeev-search-sql-injection(44978)ADV-2006-0120161862231618394http://lostmon.blogspot.com/2006/01/phpnuke-ev-77-search-module-query.htmlphgstats.inc.php in phgstats before 0.5.1, if register_globals is enabled, allows remote attackers to include arbitrary files and execute arbitrary PHP code by modifying the PHGDIR variable.http://sourceforge.net/project/shownotes.php?release_id=38423218346ADV-2006-0123phgstats-php-file-include(24062)1746922302Cross-site scripting (XSS) vulnerability in the DataForm Entries functionality in Plain Black WebGUI before 6.8.4 (gamma) allows remote attackers to inject arbitrary Javascript via the (1) url and (2) name field of the default email form.http://sourceforge.net/project/shownotes.php?release_id=384153&group_id=5141718372ADV-2006-0126http://sourceforge.net/tracker/index.php?func=detail&aid=1395371&group_id=51417&atid=463213webgui-forms-xss(24053)Symantec Norton SystemWorks and SystemWorks Premier 2005 and 2006 stores temporary copies of files in the Norton Protected Recycle Bin NProtect directory, which is hidden from the FindFirst and FindNext Windows APIs and allows remote attackers to hide arbitrary files from virus scanners and other products.1015462http://securityresponse.symantec.com/avcenter/security/Content/2006.01.10.html18402systemworks-nprotect-hidden(24061)ADV-2006-0143SQL injection vulnerability in MyPhPim 01.05 allows remote attackers to execute arbitrary SQL commands via the (1) cal_id parameter in calendar.php3 and the (2) password field on the login page.myphpim-login-sql-injection(24075)myphpim-calendar-sql-injection(24066)ADV-2006-01471621020060111 [eVuln] MyPhPim Multiple SQL Injection and XSS Vulnerabilities223252232418399http://evuln.com/vulns/22/summary.htmlCross-site scripting (XSS) vulnerability in MyPhPim 01.05 allows remote attackers to inject arbitrary web script or HTML via the description field on the "Create New todo" page.myphpim-todo-xss(24071)ADV-2006-01471621020060111 [eVuln] MyPhPim Multiple SQL Injection and XSS Vulnerabilities2232618399http://evuln.com/vulns/22/summary.htmladdresses.php3 in MyPhPim 01.05 does not restrict uploaded files, which allows remote attackers to execute arbitrary PHP code via the pdbfile variable, then directly accessing those files from the uploads directory.myphpim-addresses-file-upload(24070)ADV-2006-01471620820060111 [eVuln] MyPhPim Arbitrary File Upload18399http://evuln.com/vulns/23/summary.html** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-0035. Reason: This candidate is a duplicate of CVE-2006-0035. Notes: All CVE users should reference CVE-2006-0035 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.PHP remote file include vulnerability in index.php in OrjinWeb E-commerce allows remote attackers to execute arbitrary code via a URL in the page parameter. NOTE: it is not clear, but OrjinWeb might be an application service, in which case it should not be included in CVE.1619920060106 Orjinweb E-commerceorjinweb-url-file-include(24097)22387Cross-site scripting (XSS) vulnerability in the file manager utility in Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to inject arbitrary web script or HTML in an uploaded page, which is published without a check for hostile scripting.ADV-2006-01451619520060110 Multiple Vulnerabilities in Hummingbird Collaborationhttp://www.securenetwork.it/advisories/sn-2006-01.html18411hummingbird-enterprise-xss(24067)Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to misrepresent the type and name of a file via modified doc_ext and id parameters, which might trick a user into downloading dangerous or unexpected content.ADV-2006-01451619520060110 Multiple Vulnerabilities in Hummingbird Collaborationhttp://www.securenetwork.it/advisories/sn-2006-01.html18411hummingbird-enterprise-file-download(24068)Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to obtain sensitive information (intranet IP addresses and enumerations of valid parameter values) via a direct request to hc, which reveals the information in an error message or a cookie.ADV-2006-01451619520060110 Multiple Vulnerabilities in Hummingbird Collaborationhttp://www.securenetwork.it/advisories/sn-2006-01.html18411hummingbird-enterprise-information-disclosure(24069)328Cross-site scripting (XSS) vulnerability in search_form.asp in Web Wiz Forums 6.34 allows remote attackers to inject arbitrary web script or HTML via the search parameter.1619620060111 Advisory:XSS vulnerability on WebWiz Forums <= 6.34(search_form.asp)20060109 Advisory:XSS vulnerability on WebWiz Forums <= 6.34 (search_form.asp)webwizforums-searchform-xss(24048)22398Buffer overflow in certain functions in src/fileio.c and src/unix/fileio.c in xmame before 11 January 2006 may allow local users to gain privileges via a long (1) -lang, (2) -ctrlr, (3) -pb, or (4) -rec argument on many operating systems, and via a long (5) -jdev argument on Ubuntu Linux.1620320060110 mysec.org Security Advisory : Xmame buffer overflow, with a possibility of privilege escalation20060110 mysec.org Security Advisory : Xmame buffer overflow, with a possibility of privilege escalation.xmame-multiple-parameters-bo(24102)http://x.mame.net/changes-unix.htmlMultiple buffer overflows in Cray UNICOS 9.0.2.2 might allow local users to gain privileges by (1) invoking /usr/bin/script with a long command line argument or (2) setting the -c option of /etc/nu to the name of a file containing a long line.1620520060110 SUID root overflows in UNICOS and partial shellcodeunicos-command-line-bo(24276)Format string vulnerability in /bin/ftp in UNICOS 9.0.2.2 allows local users to have an unknown impact via format string specifiers in the quote command. NOTE: because the program is not setuid and not normally called from remote programs, there may not be a typical attack vector for the issue that crosses privilege boundaries. Therefore this may not be a vulnerability.1620520060110 SUID root overflows in UNICOS and partial shellcodeunicos-ftp-format-string(24277)The Cisco IP Phone 7940 allows remote attackers to cause a denial of service (reboot) via a large amount of TCP SYN packets (syn flood) to arbitrary ports, as demonstrated to port 80.101548818479cisco-ipphone-synflood-dos(24117)ADV-2006-0202162002246920060113 Response to Cisco IP Phone 7940 DoS Exploit posted on milw0rm.comhttp://downloads.securityfocus.com/vulnerabilities/exploits/cisco_ip7940_dos.plCross-site scripting (XSS) vulnerability in CaLogic Calendars 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the Title field on the "Adding New Event" page, and possibly other vectors, involving iframe tags.ADV-2006-01491620618417http://evuln.com/vulns/24/summary.htmlcalogic-newevent-xss(24077)20060116 [eVuln] CaLogic Calendars Multiple XSS Vulnerabilities22322Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.1.3 has an undocumented administrative account with a default password, which allows local users to gain privileges via the expert command.1621120060111 Default Administrative Password in Cisco Security Monitoring, Analysis and Response System (CS-MARS)ADV-2006-0154cisco-csmars-default-password(24065)22346101547133518424login.php in ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside".ADV-2006-0152http://evuln.com/vulns/25/summary.htmlacal-login-auth-bypass(24104)20060112 [eVuln] ACal Authentication Bypass & PHP Code Insertion2234434318432Direct static code injection vulnerability in edit.php in ACal Calendar Project 2.2.5 allows authenticated users to execute arbitrary PHP code via (1) the edit=header value, which modifies header.php, or (2) the edit=footer value, which modifies footer.php. NOTE: this issue might be resultant from the poor authentication as identified by CVE-2006-0182. Since the design of the product allows the administrator to edit the code, perhaps this issue should not be included in CVE, except as a consequence of CVE-2006-0182.ADV-2006-0152http://evuln.com/vulns/25/summary.htmlacal-header-footer-code-execute(24107)20060112 [eVuln] ACal Authentication Bypass & PHP Code Insertion2234534318432Multiple SQL injection vulnerabilities in AspTopSites allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to goto.asp or (2) password parameter to includeloginuser.asp.ADV-2006-0146http://www.exploitlabs.com/files/advisories/EXPL-A-2006-001-asptopsites.txt18408asptopsites-goto-sql-injection(24072)2233020060110 AspTopSites SQL injectionMultiple cross-site scripting vulnerabilities in the (1) Pool or (2) News Modules in Php-Nuke allow remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of an IMG tag.ADV-2006-01251619220060107 Php-Nuke Pool and News Module IMG Tag Cross Site18374** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-4500. Reason: This candidate is a duplicate of CVE-2005-4500. Notes: All CVE users should reference CVE-2005-4500 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.By design, Microsoft Visual Studio 2005 automatically executes code in the Load event of a user-defined control (UserControl1_Load function), which allows user-assisted attackers to execute arbitrary code by tricking the user into opening a malicious Visual Studio project file.ADV-2006-01511622520060113 Visual Studio Remote Code Execution18409visualstudio-usercontrol-code-execution(24116)webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the right_frame parameter. NOTE: this has been called a cross-site scripting (XSS) issue, but it is different than what is normally identified as XSS.squirrelmail-webmail-xss(24847)ADV-2006-0689http://www.squirrelmail.org/security/issue/2006-02-0116756101566218985oval:org.mitre.oval:def:10419RHSA-2006:0283FEDORA-2006-133SUSE-SR:2006:005MDKSA-2006:049GLSA-200603-09DSA-98820210199601920519176191311913020060501-01-UBuffer overflow in eStara Softphone 3.0.1.14 through 3.0.1.46 allows remote attackers to execute arbitrary code via a long attribute (aka "a") field in the SDP data of a SIP packet on UDP port 5060.This is the vendor provided solution:
"eStara has released Softphone version 3.0.1.47 to resolve the buffer overflow demonstrated in parsing SDP with long "a=" lines. Licensed customers can download a new version via the email sent to them with purchase, customers testing may go back to http://www.estara.com/softphone/ to obtain a new free trial. Version information can be gathered by going to Help->About. eStara highly recommends all customers upgrade to avoid this issue. If there's further questions please email us: softphone@estara.com.
eStara would like to thank ZwelL for bringing the issue to our attention."estara-sip-sdp-bo(24090)ADV-2006-01671621320060111 eStara Softphone SIP stack Buffer Overflow Vulnerability10154811841022348Unspecified vulnerability in Sun Solaris 9 and 10 for the x86 platform allows local users to gain privileges or cause a denial of service (panic) via unspecified vectors, possibly involving functions from the mm driver.10206618421ADV-2006-0165solaris-unspecified-root-access(24084)16224http://support.avaya.com/elmodocs2/security/ASA-2006-056.htm101547819087oval:org.mitre.oval:def:702Unspecified vulnerability in Sun Solaris 10 allows local users to cause a denial of service (null dereference) via unspecified vectors involving the use of the find command on the "/proc" filesystem. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this is related to CVE-2005-3250.10210818420ADV-2006-0166solaris-find-proc-dos(24085)1622222347http://support.avaya.com/elmodocs2/security/ASA-2006-056.htm101547919087oval:org.mitre.oval:def:1608SQL injection vulnerability in Login_Validate.asp in ASPSurvey 1.10 allows remote attackers to execute arbitrary SQL commands via the Password parameter to login.asp.aspsurvey-loginvalidate-sql-injection(24087)ADV-2006-01641649620060204 sql injection in ASP Survey2234241418422Cross-site scripting (XSS) vulnerability in the Hosting Control Panel (psoft.hsphere.CP) in Positive Software H-Sphere 2.4.3 Patch 8 and earlier allows remote attackers to inject arbitrary web script or HTML via the login parameter in a login action.20060112 H-Sphere Security VulnerabilityADV-2006-0172http://www.psoft.net/HSdocumentation/versions/?v=all&p=rhsphere-login-xss(24096)http://www.psoft.net/HSdocumentation/versions/index.php?v=243p9&p=r2237218447Cross-site scripting (XSS) vulnerability in default.asp in FogBugz 4.029, and other versions before 4.0.33, allows remote attackers to inject arbitrary web script or HTML via the dest parameter in the pgLogon page.16216ADV-2006-017420060112 FogBugz Cross Site Scripting Vulnerabilityhttp://www.fogcreek.com/FogBugz/KB/releaseNotes/WhatsNewInFogBugz4.0.33.htmlfogbugz-login-xss(24103)2237018443Interpretation conflict in the MagicHTML filter in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via style sheet specifiers with invalid (1) "/*" and "*/" comments, or (2) a newline in a "url" specifier, which is processed by certain web browsers including Internet Explorer.squirrelmail-magichtml-xss(24848)ADV-2006-0689http://www.squirrelmail.org/security/issue/2006-02-1016756101566218985oval:org.mitre.oval:def:9548RHSA-2006:0283FEDORA-2006-133SUSE-SR:2006:005MDKSA-2006:049GLSA-200603-09DSA-98820210199601920519176191311913020060501-01-UUnspecified vulnerability in Serial line sniffer (aka slsnif) 0.4.4 allows local users to gain privileges via a long value of the HOME environment variable, possibly because of a buffer overflow.slsnif-home-bo(24082)ADV-2006-021220060111 Serial Line Sniffer 0.4.4 Buffer Overflowhttp://shellcoders.com/sintigan/slsnif-ploit.pl18497The XClientMessageEvent struct used in certain components of X.Org 6.8.2 and earlier, possibly including (1) the X server and (2) Xlib, uses a "long" specifier for elements of the l array, which results in inconsistent sizes in the struct on 32-bit versus 64-bit platforms, and might allow attackers to cause a denial of service (application crash) and possibly conduct other attacks.20060108 xorg server 6.8.2 and below on 64bit archCross-site scripting (XSS) vulnerability in a certain module, possibly poll or Pool, for XOOPS allows remote attackers to inject arbitrary web script or HTML via JavaScript in the SRC attribute of an IMG element in a comment.http://www.xoops.org/modules/newbb/viewtopic.php?topic_id=45637&forum=2&post_id=2004811618920060107 Xoops Pool Module IMG Tag Cross Site Scriptingxoops-pool-imagetag-xss(24091)SQL injection vulnerability in news.asp in Mini-Nuke CMS System 1.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the hid parameter.mininuke-news-sql-injection(24098)ADV-2006-017320060113 Advisory: MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injectionvulnerability22384http://www.nukedx.com/?viewdoc=73401843920060112 Advisory: MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injection vulnerabilityFormat string vulnerability in the error-reporting feature in the mysqli extension in PHP 5.1.0 and 5.1.1 might allow remote attackers to execute arbitrary code via format string specifiers in MySQL error messages.php-extmysqli-format-string(24095)16219http://www.php.net/release_5_1_2.php18431ADV-2006-0369ADV-2006-017720060112 Advisory 02/2006: PHP ext/mysqli Format String Vulnerabilityhttp://www.hardened-php.net/advisory_022006.113.html1015485337Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50, and possibly earlier versions, allows remote attackers to enter false payment entries into the log file via HTTP POST requests to ipn_success.php.ADV-2006-0183http://www.uinc.ru/articles/vuln/ptpaypal050.shtml1621820060112 Multiple PHP Toolkit for PayPal Vulnerabilities1844422378Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50 and possibly earlier has (1) world-readable permissions for ipn/logs/ipn_success.txt, which allows local users to view sensitive information (payment data), and (2) world-writable permissions for ipn/logs, which allows local users to delete or replace payment data.ADV-2006-0183http://www.uinc.ru/articles/vuln/ptpaypal050.shtml1621820060112 Multiple PHP Toolkit for PayPal Vulnerabilities1844422379membership.asp in Mini-Nuke CMS System 1.8.2 and earlier does not verify the old password when changing a password, which allows remote attackers to change the passwords of other members via a lostpassnew action with a modified x parameter.mininuke-membership-change-password(24101)ADV-2006-017320060113 Advisory: MiniNuke CMS System <= 1.8.2 (membership.asp) remoteuser password change exploit223853441843920060112 Advisory: MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injection vulnerability20060112 Advisory: MiniNuke CMS System <= 1.8.2 (membership.asp) remote user password change exploit20060129 [xpl#2] MiniNuke 1.8.2 - change member's passwrod < Perl >Multiple cross-site scripting (XSS) vulnerabilities in Wordcircle 2.17 allow remote attackers to inject arbitrary web script or HTML via (1) the "Course name" field in index.php when the frm parameter has the value "mine" and (2) possibly certain other fields in unspecified scripts.wordcircle-index-xss(24106)ADV-2006-01851622720060112 [eVuln] Wordcircle Multiple SQL Injection & XSS Vulnerabilities2235918440http://evuln.com/vulns/28/summary.html345Multiple SQL injection vulnerabilities in Wordcircle 2.17 allow remote attackers to (1) execute arbitrary SQL commands and bypass authentication via the password field in the login action to index.php (involving v_login.php and s_user.php) and (2) have other unknown impact via certain other fields in unspecified scripts.wordcircle-login-security-bypass(24108)wordcircle-sql-injection(24105)ADV-2006-01851622720060112 [eVuln] Wordcircle Multiple SQL Injection & XSS Vulnerabilities20060112 [eVuln] Wordcircle Authentication Bypass2235834634518440http://evuln.com/vulns/28/summary.htmlhttp://evuln.com/vulns/27/summary.htmlEval injection vulnerability in Light Weight Calendar (LWC) 1.0 (20040909) and earlier allows remote attackers to execute arbitrary PHP code via the date parameter in cal.php, which is included by index.php.1622918450http://evuln.com/vulns/29/summary.htmlhttp://evuln.com/vulns/29/exploit.htmllwc-cal-execute-code(24110)2237620060318 Source VERIFY - Light Weight Calendar issue is eval injectionMultiple HTTP response splitting vulnerabilities in PHP 5.1.1 allow remote attackers to inject arbitrary HTTP headers via a crafted Set-Cookie header, related to the (1) session extension (aka ext/session) and the (2) header function.php-session-response-splitting(24094)16220GLSA-200603-22101548419355191791869718431ADV-2006-0369ADV-2006-0177USN-261-1http://www.php.net/release_5_1_2.phpMDKSA-2006:028http://www.hardened-php.net/advisory_012006.112.htmlDSA-13312594519012SUSE-SR:2006:004Multiple cross-site scripting (XSS) vulnerabilities in PHP 4.4.1 and 5.1.1, when display_errors and html_errors are on, allow remote attackers to inject arbitrary web script or HTML via inputs to PHP applications that are not filtered when they are included in the resulting error message.16803http://www.php.net/release_5_1_2.phpGLSA-200603-2219355191791869718431https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178028ADV-2006-2685ADV-2006-0369ADV-2006-0177USN-261-1RHSA-2006:0501http://www.php.net/ChangeLog-4.php#4.4.2MDKSA-2006:028http://support.avaya.com/elmodocs2/security/ASA-2006-160.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-129.htm21564212522095120222202101983219012RHSA-2006:0549RHSA-2006:0276oval:org.mitre.oval:def:10064SUSE-SR:2006:00420060501-01-USQL injection vulnerability in general_functions.php in TankLogger 2.4 allows remote attackers to execute arbitrary SQL commands via the (1) livestock_id parameter to showInfo.php and (2) tank_id parameter, possibly to livestock.php.ADV-2006-0153http://evuln.com/vulns/26/summary.htmltanklogger-generalfunctions-sql-injection(24080)1622820060112 [eVuln] TankLogger SQL Injection Vulnerability22369223683411844120060113 Verified TankLogger SQl inject by source inspectionCross-site scripting (XSS) vulnerability in index.php in Interspire TrackPoint NX before 0.1 allows remote attackers to inject arbitrary web script or HTML via the username parameter when using the Login page.ADV-2006-017516214http://www.interspire.com/forum/showthread.php?p=29606trackpointnx-login-xss(24112)20060112 Interspire TrackPoint NX XSS Vulnerability2237718445Cross-site scripting (XSS) vulnerability in forgotPassword.asp in Helm Hosting Control Panel 3.2.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the txtEmailAddress parameter.ADV-2006-020320060112 Helm XSS Vulnerabilityhelm-forgotpassword-xss(24139)http://www.webhostautomation.com/webhost-301162342245418492Directory traversal vulnerability in OBEX Push services in Toshiba Bluetooth Stack 4.00.23(T) and earlier allows remote attackers to upload arbitrary files to arbitrary remote locations specified by .. (dot dot) sequences, as demonstrated by ..\\ sequences in the RFILE argument of ussp-push.ADV-2006-018416236http://www.digitalmunition.com/DMA%5B2006-0112a%5D.txt1843720060113 DMA[2006-0112a] - 'Toshiba Bluetooth Stack Directory Transversal'20060113 DMA[2006-0112a] - 'Toshiba Bluetooth Stack Directory Transversal'223801015486http://aps.toshiba-tro.de/bluetooth/pages/driverinfo.php?txt=sp2Kolab Server 2.0.1, 2.0.2 and development versions pre-2.1-20051215 and earlier, when authenticating users via secure SMTP, stores authentication credentials in plaintext in the postfix.log file, which allows local users to gain privileges.18438http://kolab.org/security/kolab-vendor-notice-08.txtADV-2006-0186kolab-smtp-logging(24123)22381Eval injection vulnerability in ezDatabase 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the db_id parameter to visitorupload.php, as demonstrated using phpinfo and include function calls.ezdatabase-visitorupload-file-include(24136)1623735118043http://pridels0.blogspot.com/2006/01/ezdatabase-20-and-below.htmlCross-site scripting (XSS) vulnerability in admin.php in QualityEBiz Quality PPC (QPPC) 1.0 build 1644 allows remote attackers to inject arbitrary web script or HTML via the cpage parameter. NOTE: this issue might be resultant from CVE-2006-0216.22352http://osvdb.org/ref/22/22352-qualityppc.txtadmin.php in QualityEBiz Quality PPC (QPPC) 1.0 build 1644 allows remote attackers to obtain sensitive information, possibly the installation path of the application, via unspecified "meta characters" to the cpage parameter.22353http://osvdb.org/ref/22/22353-qualityppc.txthttp://osvdb.org/ref/22/22352-qualityppc.txtMultiple cross-site scripting (XSS) vulnerabilities in Ultimate Auction 3.67 allow remote attackers to inject arbitrary web script or HTML via the (1) item parameter in item.pl and (2) category parameter in itemlist.pl, which reflects the XSS in an error message. NOTE: the affected version might be wrong since the current version as of 20060116 is 3.6.1.ADV-2006-01871623922444224431847720060115 Ultimate Auction <=3.67ultimate-auction-item-xss(24138)16254Multiple unspecified vulnerabilities in MyBulletinBoard (MyBB) before 1.0.2 have unspecified impact and attack vectors, related to (1) admin/moderate.php, (2) admin/themes.php, (3) inc/functions.php, (4) inc/functions_upload.php, (5) printthread.php, and (6) usercp.php, and probably related to SQL injection. NOTE: it is likely that this issue subsumes CVE-2005-4602 and CVE-2005-4603. However, since the vendor advisory is vague and additional files are mentioned, is is likely that this contains at least one distinct vulnerability from CVE-2005-4602 and CVE-2005-4603.http://community.mybboard.net/showthread.php?tid=5852The original distribution of MyBulletinBoard (MyBB) to update from older versions to 1.0.2 omits or includes older versions of certain critical files, which allows attackers to conduct (1) SQL injection attacks via an attachment name that is not properly handled by inc/functions_upload.php (CVE-2005-4602), and possibly (2) other attacks related to threadmode in usercp.php.http://community.mybboard.net/showthread.php?tid=596016230http://community.mybboard.net/showthread.php?tid=5853&pid=35151#pid35151http://community.mybboard.net/showthread.php?tid=5853&pid=35088#pid35088mybb-usercp-script-sql-injection(24115)Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 5.3 through 6.1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the day parameter in calendar.php and (2) the input form in search.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. It is possible that this issue is resultant from an SQL injection problem in CVE-2005-4227.3 and CVE-2005-4227.13.1623220060113 DCP Portal Cross-Site Scripting Vulnerabilitydcpportal-calendar-search-xss(24153)SQL injection vulnerability in index.asp in the Admin Panel in Dragon Design Services Network (DDSN) cm3 content manager (CM3CMS) allows remote attackers to execute arbitrary SQL commands via the (1) username or (2) password.cm3-login-sql-injection(24266)1623120060113 DDSN CMS Admin Panel SQL Injection Vulnerability22696Cross-site scripting (XSS) vulnerability in fullview.php in AlstraSoft Template Seller Pro allows remote attackers to inject arbitrary web script or HTML via the tempid parameter.template-seller-fullview-xss(24235)1623320060113 AlstraSoft Template Seller Pro Cross-Site Scripting Vulnerability22746Directory traversal vulnerability in Shanghai TopCMM 123 Flash Chat Server Software 5.1 allows attackers to create or overwrite arbitrary files on the server via ".." (dot dot) sequences in the username field.16235http://www.123flashchat.com/flash-chat-server-v512.html123flashchat-user-directory-traversal(24137)ADV-2006-01982244018455Buffer overflow in Library of Assorted Spiffy Things (LibAST) 0.6.1 and earlier, as used in Eterm and possibly other software, allows local users to execute arbitrary code as the utmp user via a long -X command line argument (alternative configuration file name).20060123 [ Rosiello Security ] Eterm-LibAST Advisory20060125 Rosiello Security - Eterm-LibAST Advisoryhttp://www.rosiello.org/en/read_bugs.php?id=25ADV-2006-03141635020060123 LibAST 0.7 Release Fixes Security Vulnerabilityhttp://freshmeat.net/projects/libast/?branch_id=17907&release_id=217840eterm-libast-filename-bo(24303)22735MDKSA-2006:029GLSA-200601-14DSA-976373189161863218586scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.TA07-072A18595https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=174026openssh-scp-command-execution(24305)ADV-2007-2120ADV-2007-0930ADV-2006-4869ADV-2006-2490ADV-2006-0306USN-255-12006-000416369FLSA-2006:168935RHSA-2006:004422692OpenPKG-SA-2006.003SUSE-SA:2006:008GLSA-200602-11SSA:2006-045-06101554019159189701896918964189101885018798187361865018579oval:org.mitre.oval:def:9962HPSBUX0217820060212 [3.8] 005: SECURITY FIX: February 12, 2006http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=2751http://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v52.Readme.html#MH00688http://www.vmware.com/support/vi3/doc/esx-9986131-patch.htmlhttp://www.vmware.com/support/vi3/doc/esx-3069097-patch.htmlRHSA-2006:0698RHSA-2006:0298MDKSA-2006:034http://support.avaya.com/elmodocs2/security/ASA-2007-246.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-262.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-174.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-158.htm102961462259362560724479236802334023241221962172421492212622112920723APPLE-SA-2007-03-13HPSBUX02178http://docs.info.apple.com/article.html?artnum=305214http://blogs.sun.com/security/entry/sun_alert_102961_security_vulnerability20060703-01-Poval:org.mitre.oval:def:1138Integer overflow in IEEE 802.11 network subsystem (ieee80211_ioctl.c) in FreeBSD before 6.0-STABLE, while scanning for wireless networks, allows remote attackers to execute arbitrary code by broadcasting crafted (1) beacon or (2) probe response frames.1629618353http://www.signedness.org/advisories/sps-0x1.txtFreeBSD-SA-06:05bsd-ieee80211-bo(24192)22537http://www.blackhat.com/html/bh-europe-07/bh-eu-07-speakers.html#Eriksson1015518http://kernelwars.blogspot.com/2007/01/alive.htmlMultiple unspecified vulnerabilities in lpsched in Sun Solaris 8, 9, and 10 allow local users to delete arbitrary files or disable the LP print service via unknown attack vectors.102033101549218498ADV-2006-0200solaris-lpsched-dos(24127)162452244222441http://support.avaya.com/elmodocs2/security/ASA-2006-056.htm19087oval:org.mitre.oval:def:662The RBAC functionality in grsecurity before 2.1.8 does not properly handle when the admin role creates a service and then exits the shell without unauthenticating, which causes the service to be restarted with the admin role still active.1626118458ADV-2006-0199http://www.grsecurity.org/news.php#grsec218grsecurity-rbac-admin-privileges(24156)Unquoted Windows search path vulnerability in Wehntrust might allow local users to gain privileges via a malicious "program.exe" file in the C: folder, which is run when Wehntrust creates the autostart key.20060116 Re: [Full-disclosure] WehnTrust - When you have to trust Wehntrust1626820060116 WehnTrust - When you have to trust Wehntrustwehntrust-service-start-file-execution(24315)http://www.wehnus.com/downloads.plSymantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a password, which allows remote attackers to gain administrator privileges via a modified client that sends certain XML requests.VU#11838820060421 Rapid7 Advisory R7-0021: Symantec Scan Engine Authentication Fundamental Design ErrorADV-2006-1464sse-unauth-admin-access(25972)http://www.symantec.com/avcenter/security/Content/2006.04.21.html1763720060421 [Symantec Security Advisor] Symantec Scan Engine Multiple Vulnerabilities20060421 Rapid7 Advisory R7-0021: Symantec Scan Engine Authentication Fundamental Design Error19734Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses the same private DSA key for each installation, which allows remote attackers to conduct man-in-the-middle attacks and decrypt communications.20060421 Rapid7 Advisory R7-0022: Symantec Scan Engine Known Immutable DSA Private KeyADV-2006-1464sse-insecure-private-key(25973)http://www.symantec.com/avcenter/security/Content/2006.04.21.html1763720060421 [Symantec Security Advisor] Symantec Scan Engine Multiple Vulnerabilities20060421 Rapid7 Advisory R7-0022: Symantec Scan Engine Known Immutable DSA Private Key101597419734Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, stores sensitive log and virus definition files under the web root with insufficient access control, which allows remote attackers to obtain the information via direct requests.20060421 Rapid7 Advisory R7-0023: Symantec Scan Engine File Disclosure VulnerabilityADV-2006-1464sse-unauth-file-access(25974)http://www.symantec.com/avcenter/security/Content/2006.04.21.html1763720060421 [Symantec Security Advisor] Symantec Scan Engine Multiple Vulnerabilities20060421 Rapid7 Advisory R7-0023: Symantec Scan Engine File Disclosure Vulnerability101597475975819734Cross-site scripting (XSS) vulnerability in functions.php in microBlog 2.0 RC-10 allows remote attackers to inject arbitrary web script and HTML via a javascript: URI in a [url] BBcode tag.microblog-functions-xss(24140)1627220060117 [eVuln] microBlog BBCode XSS Vulnerability1015496http://evuln.com/vulns/36/summary.htmlSQL injection vulnerability in index.php in microBlog 2.0 RC-10 allows remote attackers to execute arbitrary SQL commands via the (1) month and (2) year parameters.ADV-2006-02391627020060117 [eVuln] microBlog SQL Injection Vulnerabilitymicroblog-index-sql-injection(24132)22512101549618442http://evuln.com/vulns/35/summary.htmlSQL injection vulnerability in WhiteAlbum 2.5 allows remote attackers to execute arbitrary SQL commands via the dir parameter to pictures.php.ADV-2006-02411624720060116 White Album Sql İnjection biyosecurity.bewhitealbum-pictures-sql-injection(24271)22520http://www.biyosecurity.be/bugs/whitealbum.txt18460GUI display truncation vulnerability in Mozilla Thunderbird 1.0.2, 1.0.6, and 1.0.7 allows user-assisted attackers to execute arbitrary code via an attachment with a filename containing a large number of spaces ending with a dangerous extension that is not displayed by Thunderbird, along with an inconsistent Content-Type header, which could be used to trick a user into downloading dangerous content by dragging or saving the attachment.1627120060117 Secunia Research: Mozilla Thunderbird Attachment SpoofingVulnerabilityhttp://secunia.com/secunia_research/2005-22/advisory15907https://bugzilla.mozilla.org/show_bug.cgi?id=300246thunderbird-attachment-ext-spoofing(24164)ADV-2006-0230MDKSA-2006:021Cross-site scripting (XSS) vulnerability in index.php in GTP iCommerce allows remote attackers to inject arbitrary web script or HTML via the (1) cat and (2) subcat parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-02141625518470gtpicommerce-index-xss(24150)SQL injection vulnerability in wp-stats.php in GaMerZ WP-Stats 2.0 allows remote attackers to execute arbitrary SQL commands via the author parameter.http://www.lesterchan.net/blogs/18471ADV-2006-019216241wpstats-script-sql-injection(24163)22450http://www.lesterchan.net/blogs/archives/2006/01/18/wp-stats-sql-injection-vulnerabilityhttp://osvdb.org/ref/22/22450-wpstats.txtMultiple cross-site scripting (XSS) vulnerabilities in Simple Blog 2.1 allow remote attackers to inject arbitrary web script or HTML via (1) a comment to comments.asp and (2) possibly certain other fields in unspecified scripts.ADV-2006-01941624320060114 [HSC Security Group] Multiple SQL injection/XSS in SimpleBlog 2.118488simpleblog-comment-xss(24154)22448http://www.hackerscenter.com/archive/view.asp?id=21926Multiple SQL injection vulnerabilities in Simple Blog 2.1 allow remote attackers to execute arbitrary SQL commands via the month parameter in an archives view operation and possibly certain other parameters in unspecified scripts.simpleblog-month-sql-injection(24155)ADV-2006-01941624320060114 [HSC Security Group] Multiple SQL injection/XSS in SimpleBlog 2.122447http://www.hackerscenter.com/archive/view.asp?id=2192618488Cross-site scripting vulnerability in WBNews 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the Name field.ADV-2006-02371627720060117 XSS in WBNews < = v1.1.018499Cross-site scripting vulnerability in index.php in PHP Fusebox 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter.20060117 IndonesiaHack Advisory HTML injection in PHP Fusebox16274355Cross-site scripting (XSS) vulnerability in SMBCMS 2.1 allows remote attackers to inject arbitrary web script or HTML via the text parameter, which is used by the "Search Site" field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-02291628118454smbcms-sitesearch-xss(24187)22494** DISPUTED ** Directory traversal vulnerability in workspaces.php in phpXplorer 0.9.33 allows remote attackers to include arbitrary files via a .. (dot dot) and trailing null byte (%00) in the sShare parameter. NOTE: a followup post claims that this is not a vulnerability since the functionality of phpXplorer supports the upload of PHP files, which would not cross privilege boundaries since the PHP functionality would support read access outside the web root.ADV-2006-02321626320060116 Re: Directory traversal in phpXplorer20060116 Directory traversal in phpXplorerhttp://www.arrelnet.com/advisories/adv20060116.html18518phpxplorer-sshare-directory-traversal(39982)353Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.7-pl1 allow remote attackers to inject arbitrary web script or HTML via the (3) redir, (4) productId, (5) docId, (6) act, and (7) catId parameters in index.php; and the (8) username field in a login action in index.php. NOTE: the cart.php/redir and index.php/searchStr vectors are already covered by CVE-2005-3152.ADV-2006-0227162592247118519http://lostmon.blogspot.com/2006/01/cubecart-307-pl1-indexphp-multiple.htmlhttp://bugs.cubecart.com/?do=details&id=459cubecart-index-script-xss(24177)Cross-site scripting (XSS) vulnerability in down.pl in Widexl Download Tracker 1.06 allows remote attackers to inject arbitrary web script or HTML via the ID parameter.ADV-2006-0213162652246218472http://osvdb.org/ref/22/22462-widexl.txtdownloadtracker-down-xss(24161)Cross-site scripting (XSS) vulnerability in anyboard.cgi in Netbula Anyboard 9.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the tK parameter in a find command.ADV-2006-0188162642246118469http://osvdb.org/ref/22/22461-anyboard.txtnetbula-anyboard-script-xss(24167)Virata-EmWeb web server 6_1_0, as used in (1) Intracom JetSpeed 500 and 520 and (2) Allied Data Technologies CopperJet 811 RouterPlus, allows remote attackers to access privileged information, such as user lists and configuration settings, via direct HTTP requests.ADV-2006-021818483http://blog.globalnetworks.gr/?p=4virata-emweb-unauth-access(24304)SQL injection vulnerability in viewcat.php in BitDamaged geoBlog MOD_1.0 allows remote attackers to execute arbitrary SQL commands, then steal credentials and upload files, via the cat parameter ($tmpCategory variable).geoBlog-viewcat-sql-injection(24146)ADV-2006-01911624922463101549318504http://evuln.com/vulns/33/summary.htmlFormat string vulnerability in the snmp_input function in snmptrapd in CMU SNMP utilities (cmu-snmp) allows remote attackers to execute arbitrary code by sending crafted SNMP messages to UDP port 162.ADV-2006-02341626720060116 Digital Armaments Security Advisory 01.16.2006: CMU SNMP utilities snmptrad Format String Vulnerabilityhttp://www.digitalarmaments.com/2006040164883273.html18525cmusnmp-snmpinput-format-string(24178)22493Cross-site scripting (XSS) vulnerability in fom.cgi in Faq-O-Matic 2.711 allows remote attackers to inject arbitrary web script or HTML via the (1) _duration, (2) file, and (3) cmd parameters.ADV-2006-0189162512243918468http://osvdb.org/ref/22/22439-faqomatic.txtfaqomatic-fom-xss(24165)SQL injection vulnerability in Benders Calendar 1.0 allows remote attackers to execute arbitrary SQL commands via multiple parameters, as demonstrated by the (1) year, (2) month, and (3) day parameters.ADV-2006-01901624220060115 [eVuln] Benders Calendar SQL Injection22449101549118462http://evuln.com/vulns/30/summary.htmlbenderscalendar-sql-injection(24120)Buffer overflow in the Bluetooth OBEX Object Push service in "Blue Neighbors.EXE" in AmbiCom Blue Neighbors 2.50 Build 2500 and earlier allows remote attackers to execute arbitrary code via a long file name, as demonstrated via a long RFILE argument to ussp-push.ADV-2006-021920060120 DMA[2006-0115a] - 'AmbiCom Bluetooth Object Push Overflow'http://www.digitalmunition.com/DMA%5B2006-0115a%5D.txt18466ambicom-bluetooth-objectpush-bo(24179)16258366Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12310181&styleName=Html&projectId=10220&Create=CreateADV-2006-02171626020060115 Apache Geronimo 1.0 - CSS and persistent HTML-Injectionvulnerabilitieshttp://www.oliverkarow.de/research/geronimo_css.txt18485http://issues.apache.org/jira/browse/GERONIMO-1474geronimo-webaccesslog-viewer-xss(24159)geronimo-jspexamples-xss(24158)RHSA-2008:026131493RHSA-2008:0630Unquoted Windows search path vulnerability in Check Point VPN-1 SecureClient might allow local users to gain privileges via a malicious "program.exe" file in the C: folder, which is run when SecureClient attempts to launch the Sr_GUI.exe program.ADV-2006-02581629020060117 [ TZO-012006 ] Checkpoint VPN-1 SecureClient insecure usage of CreateProcess()http://secdev.zoller.lu/research/checkpoint.txtUnspecified vulnerability in the Advanced Queuing component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.6, 10.1.0.3 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB01.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmlADV-2006-0323ADV-2006-02431628710154991860818493Unspecified vulnerability in the Change Data Capture component of Oracle Database server 9.2.0.7, 10.1.0.5, and 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB02. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the CDC_ALLOCATE_LOCK function of the DBMS_CDC_UTILITY package.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html1015499oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287225401860818493Unspecified vulnerability in the Connection Manager component of Oracle Database server 8.1.7.4 and 9.0.1.5 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB03.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628710154991860818493Multiple unspecified vulnerabilities in Oracle Database server 10.1.0.5 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB04 and (2) DB06 in the (a) Data Pump component; (3) DB10 in the (b) Net Listener component; and (4) DB16 in the (c) Oracle Text component. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that DB06 is SQL injection in the GENERATE_JOB_NAME, GET_WORKERSTATUSLIST1010, GET_PARAMVALUES1010, GET_DUMPFILESET1010, GET_JOBSTATUS1010, ATTACH, and ESTABLISH_REMOTE_CONTEXT functions in DBMS_DATAPUMP.VU#54580416287http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html18493oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024322544101549918608Multiple unspecified vulnerabilities in Oracle Database server 9.2.0.7 and 10.1.0.5 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB05 in the (a) Data Pump component; (2) DB15 in the (b) Oracle Text component; (3) DB22 in the (c) Streams Apply component; (4) DB23 and (5) DB24 in the (d) Streams Capture component; and (6) DB26 in the (e) Streams Subcomponent. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that DB05 involves SQL injection in the (f) LONG2VARCHAR, LONG2VCMAX, LONG2VCNT, and LONG2CLOB functions in the DBMS_METADATA_UTIL package; (g) MAKE_FILTER, FETCH_VIEWS_ERROR, FETCH_FILTERS, FETCH_VIEWS, SET_FILTER_COMMON, DO_FILTER_SCRIPT, SET_TABLE_FILTERS, and MAKE_FILTER_TEXT functions in the DBMS_METADATA_INT package; and (h) GET_PREPOST_TABLE_ACT function in the DBMS_METADATA package.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html101549918608oracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628722643226372254318493Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.5 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB07 in the Dictionary component and (2) DB14 in the Oracle Label Security component. NOTE: Oracle has not disputed reliable researcher claims that DB07 involves plaintext storage of the TDE wallet password in a trace file by event 10053.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)oracle-masterkey-plaintext(24168)ADV-2006-0323ADV-2006-02431628720060117 Oracle Database 10g Rel. 2 - Event 10053 logs TDE wallet password in cleartexthttp://www.red-database-security.com/advisory/oracle_tde_wallet_password.html10154991860818493Unspecified vulnerability in the Net Foundation Layer component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.6, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB08.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628710154991860818493Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, 10.1.0.5, and 10.2.0.1 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB09 in the (a) Net Listener component; and (2) DB12 and (3) DB13 in the Network Communications (RPC) component.TA06-018AVU#870172VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628722551225502254710154991860818493** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-0259. Reason: This candidate is subsumed by CVE-2006-0259. An error during initial CVE analysis used the wrong set of affected versions for "DB10". Notes: All CVE users should reference CVE-2006-0259 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.1 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB17 in the Oracle Text component and (2) DB18 in the Program Interface Network component. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that DB17 involves SQL injection in the (a) VALIDATE_STATEMENT and BUILD_DML functions in CTXSYS.DRILOAD; (b) CLEAN_DML function in CTXSYS.DRIDML; (c) GET_ROWID function in CTXSYS.CTX_DOC; (d) BROWSE_WORDS function in CTXSYS.CTX_QUERY; and (e) ODCIINDEXTRUNCATE, ODCIINDEXDROP, and ODCIINDEXDELETE functions in CATINDEXMETHODS.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html101549918608oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html226422264122640226392255518493Unspecified vulnerability in the Query Optimizer component of Oracle Database server 9.0.1.5, 9.2.0.7, and 10.1.0.5 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB19.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628710154991860818493Unspecified vulnerability in the Query Optimizer component of Oracle Database server 9.2.0.6 and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB20.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628710154991860818493Unspecified vulnerability in the Security component of Oracle Database server 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.6, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB21.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628710154991860818493Unspecified vulnerability in the Streams Capture component of Oracle Database server 10.1.0.5 and 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB25. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the SET_DIRECTORY_ROOT function in the DBMS_CDC_PUBLISH package.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html2256310154991860818493Unspecified vulnerability in the Transparent Data Encryption (TDE) Wallet component of Oracle Database server 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB27. NOTE: Oracle has not disputed a reliable researcher report that TDA stores the master key without encryption, which allows local users to obtain the key via the SGA.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)oracle-sga-masterkey-plaintext(24186)ADV-2006-0323ADV-2006-02431628720060117 Oracle Database 10g Rel. 2- Transparent Data Encryption plaintext masterkey in SGAhttp://www.red-database-security.com/advisory/oracle_tde_unencrypted_sga.html10154991860818493Unspecified vulnerability in the Upgrade & Downgrade component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB28. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the DBMS_REGISTRY package in certain parameters to the (1) IS_COMPONENT, (2) GET_COMP_OPTION, (3) DISABLE_DDL_TRIGGERS, (4) SCRIPT_EXISTS, (5) COMP_PATH, (6) GATHER_STATS, (7) NOTHING_SCRIPT, and (8) VALIDATE_COMPONENTS functions.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html2256610154991860818493Unspecified vulnerability in the XML Database component of Oracle Database server 9.2.0.7 and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB29. NOTE: based on mutual credits by the relevant sources, it is highly likely that this issue is a buffer overflow in the (a) DBMS_XMLSCHEMA and (b) DBMS_XMLSCHEMA_INT packages, as exploitable via long arguments to (1) XDB.DBMS_XMLSCHEMA.GENERATESCHEMA or (2) XDB.DBMS_XMLSCHEMA.GENERATESCHEMAS.TA06-018AVU#891644VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-xdbdbmx-xmlschema-bo(24376)oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.htmlhttp://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdfhttp://www.argeniss.com/research/ARGENISS-ADV-010601.txt1015499186081849320060126 [Argeniss] Oracle Database Buffer overflows vulnerabilities in public procedures of XDB.DBMS_XMLSCHEMA{_INT}Unspecified vulnerability in the Portal component of Oracle Application Server 9.0.4.2 and 10.1.2.0 has unspecified impact and attack vectors, as identified by Oracle Vuln# AS01.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628710154991860818493Unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server 9.0.4.2 and 10.1.2.0.2 has unspecified impact and attack vectors, as identified by Oracle Vuln# REP03.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628710154991860818493Unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server 9.0.4.2 has unspecified impact and attack vectors, as identified by Oracle Vuln# REP04. NOTE: Oracle has not disputed reliable researcher claims that this issue is related to directory traversal that allows reading of portions of arbitrary XML files via the customize parameter.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628720060117 Oracle Reports - Read parts of files via customize(fixed after 875 days)http://www.red-database-security.com/advisory/oracle_reports_read_any_xml_file.html10154991860818493Multiple unspecified vulnerabilities in Oracle Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i) have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) OCS01, 2) OCS02, 3) OCS03, 4) OCS04, 5) OCS05, 6) OCS06, 7) OCS07, (8) OCS08, and (9) OCS09 in the (a) Email Server component; 10) OCS10 (and (11) OCS11 in the (b) Oracle Collaboration Suite Wireless & Voice (component; 12) OCS12 and (13) OCS13 in the (c) Oracle Content (Management SDK component; 14) OCS14 and (15) OCS15 in the (d) Oracle (Content Services component.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html101549918608oracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628718493Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) APPS01 in the (a) Application Install component; (2) APPS07 in the (b) Oracle Applications Framework component; (3) APPS08, (4) APPS09, (5) APPS10, and (6) APPS11 in the (c) Oracle Applications Technology Stack component; (7) APPS12 in the (d) Oracle Human Resources component; (8) APPS15 and (9) APPS16 in the (e) Oracle Marketing component; (10) APPS17 in the (f) Marketing Encyclopedia System component; (11) APPS18 in the (g) Oracle Trade Management component; and (12) APPS19 in the (h) Oracle Web Applications Desktop Integration component.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628710154991860818493Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.9 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) APPS02 in the (a) CRM Technical Foundation component; (2) APPS03 in the (b) iProcurement component; and (3) APPS04, (4) APPS05, and (5) APPS06 in the Oracle Application Object Library component.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628710154991860818493Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 4.3 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) APPS13 and (2) APPS14 in the Oracle iLearning component.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628710154991860818493Unspecified vulnerability in Oracle PeopleSoft Enterprise Portal 8.4 Bundle 15, 8.8 Bundle 10, and 8.9 Bundle 2 has unspecified impact and attack vectors, as identified by Oracle Vuln# PSE01.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628710154991860818493Unspecified vulnerability in Oracle JD Edwards HTML Server 8.95.F1 SP23_L1 has unspecified impact and attack vectors, as identified by Oracle Vuln# JDE01.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628710154991860818493Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, and 10.1.0.5, Application Server 1.0.2.2, 9.0.4.2, and 10.1.2.0.2, and Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i) has unspecified impact and attack vectors, as identified by Oracle Vuln# DBC01 in the Protocol Support component.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628710154991860818493Unspecified vulnerability in Oracle Database Server 10.1.0.4.2, Application Server 10.1.2.0.2, and Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i) has unspecified impact and attack vectors, as identified by Oracle Vuln# DBC02 in the Reorganize Objects & Convert Tablespace component.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html101549918608oracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628718493Multiple unspecified vulnerabilities in Oracle Application Server 9.0.4.2 and 10.1.2.0.2, and E-Business Suite and Applications 11.5.10, have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) FORM01 and (2) FORM02 in the Oracle Forms component.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628710154991860818493Unspecified vulnerability in the Java Net component of Oracle Database Server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, and 10.1.0.4, and Application Server 1.0.2.2, 9.0.4.2, and 10.1.2.0.2, has unspecified impact and attack vectors, as identified by Oracle Vuln# JN01.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628710154991860818493Unspecified vulnerability in the Oracle HTTP Server component of Oracle Database Server 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, and 10.1.0.5, and Application Server 1.0.2.2, 9.0.4.2, and 10.1.2.0.2, has unspecified impact and attack vectors, as identified by Oracle Vuln# OHS01.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628710154991860818493Unspecified vulnerability in the Oracle HTTP Server component of Oracle Database Server 10.1.0.5 and Application Server 10.1.2.0.2 has unspecified impact and attack vectors, as identified by Oracle Vuln# OHS02.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628710154991860818493Multiple unspecified vulnerabilities in the Oracle Reports Developer component of Oracle Application Server 9.0.4.1 and E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) REP01 and (2) REP02.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html101549918608oracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628718493Multiple unspecified vulnerabilities in Oracle Application Server 6.0.8.26(PS17) and E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) REP05 and (2) REP06 in the Oracle Reports Developer component. NOTE: Oracle has not disputed reliable researcher claims that REP05 is the same as CVE-2005-2378 and REP06 is the same as CVE-2005-2371, both of which involve directory traversal.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628720060117 Oracle Reports - Overwrite any application server file via desname (fixed after 889 days)20060117 Oracle Reports - Read parts of files via desname (fixed after 874 days)http://www.red-database-security.com/advisory/oracle_reports_read_any_file.htmlhttp://www.red-database-security.com/advisory/oracle_reports_overwrite_any_file.html10154991860818493Unspecified vulnerability in Oracle Database Server 9.2.0.7, Application Server 9.0.4.2 and 10.1.2.1, Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i), and E-Business Suite and Applications 11.5.10 has unspecified impact and attack vectors, as identified by Oracle Vuln# WF01 in the Oracle Workflow Cartridge component.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628710154991860818493Multiple unspecified vulnerabilities in Oracle Database Server 10.2.0.1, Application Server 9.0.4.2 and 10.1.2.1, Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i), and E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) WF02 and (2) WF03 in the Oracle Workflow Cartridge component.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmloracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628710154991860818493The Javascript interpreter (jsinterp.c) in Mozilla and Firefox before 1.5.1 does not properly dereference objects, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via unknown attack vectors related to garbage collection.https://bugzilla.mozilla.org/show_bug.cgi?id=316885ADV-2006-3749ADV-2006-3391ADV-2006-0413HPSBUX02156SSRT061158RHSA-2006:0200RHSA-2006:0199SUSE-SA:2006:004228526oval:org.mitre.oval:def:10016mozilla-javascript-memory-corruption(24430)USN-276-1USN-275-1USN-271-116476HPSBUX02156HPSBUX02122FLSA-2006:180036-2FLSA:180036-1RHSA-2006:0330FEDORA-2006-076FEDORA-2006-075SUSE-SA:2006:004http://www.mozilla.org/security/announce/2006/mfsa2006-01.htmlMDKSA-2006:078MDKSA-2006:037MDKSA-2006:036GLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm1025501015570220652162221033200511995019941199021986319862198521982319821197801975919746192301870918708187061870518704187031870020060201-01-USCOSA-2006.26oval:org.mitre.oval:def:670The function allocation code (js_NewFunction in jsfun.c) in Firefox 1.5 allows attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via user-defined methods that trigger garbage collection in a way that operates on freed objects.https://bugzilla.mozilla.org/show_bug.cgi?id=322045ADV-2006-3749ADV-2006-3391ADV-2006-0413SSRT061236SSRT061158228526firefox-function-allocation-code-execution(42654)mozilla-javascript-memory-corruption(24430)16476SSRT061236SSRT061158http://www.mozilla.org/security/announce/2006/mfsa2006-01.htmlGLSA-200604-18DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm10255010155702206521622199411990219863198621870418700oval:org.mitre.oval:def:1494Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 allow remote attackers to execute arbitrary code by changing an element's style from position:relative to position:static, which causes Gecko to operate on freed memory.https://bugzilla.mozilla.org/show_bug.cgi?id=317934ADV-2006-3749ADV-2006-0413SSRT061236mozilla-element-change-memory-corruption(24431)16476HPSBUX02156http://www.mozilla.org/security/announce/2006/mfsa2006-02.html1015570220651870418700oval:org.mitre.oval:def:1514Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code via the QueryInterface method of the built-in Location and Navigator objects, which leads to memory corruption.TA06-038AVU#759273https://bugzilla.mozilla.org/show_bug.cgi?id=319296ADV-2006-3749ADV-2006-0413SSRT061236mozilla-queryinterface-memory-corruption(24433)16476HPSBUX02156http://www.mozilla.org/security/announce/2006/mfsa2006-04.html1015570220651870418700oval:org.mitre.oval:def:1562The XULDocument.persist function in Mozilla, Firefox before 1.5.0.1, and SeaMonkey before 1.0 does not validate the attribute name, which allows remote attackers to execute arbitrary Javascript by injecting RDF data into the user's localstore.rdf file.TA06-038AVU#592425https://bugzilla.mozilla.org/show_bug.cgi?id=319847ADV-2006-3749ADV-2006-3391ADV-2006-0413SSRT061236SSRT061158RHSA-2006:0200RHSA-2006:0199SUSE-SA:2006:004228526oval:org.mitre.oval:def:11803mozilla-xuldocument-command-execution(24434)USN-276-1USN-275-1USN-271-116476HPSBUX02156SSRT061158FLSA-2006:180036-2FLSA:180036-1RHSA-2006:0330FEDORA-2006-076FEDORA-2006-075SUSE-SA:2006:004http://www.mozilla.org/security/announce/2006/mfsa2006-05.htmlMDKSA-2006:078MDKSA-2006:037MDKSA-2006:036GLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm1025501015570220652162221033200511995019941199021986319862198521982319821197801975919746192301870918708187061870518704187031870020060201-01-USCOSA-2006.26oval:org.mitre.oval:def:1493Multiple integer overflows in Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code via the (1) EscapeAttributeValue in jsxml.c for E4X, (2) nsSVGCairoSurface::Init in SVG, and (3) nsCanvasRenderingContext2D.cpp in Canvas.https://bugzilla.mozilla.org/show_bug.cgi?id=322215https://bugzilla.mozilla.org/show_bug.cgi?id=319872mozilla-component-integer-overflow(24435)ADV-2006-3749ADV-2006-041316476SSRT06123610155701870418700HPSBUX02156http://www.mozilla.org/security/announce/2006/mfsa2006-06.html22065oval:org.mitre.oval:def:1339The XML parser in Mozilla Firefox before 1.5.0.1 and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly read sensitive data via unknown attack vectors that trigger an out-of-bounds read.mozilla-xml-parser-dos(24436)1647610155701870418700ADV-2006-3749ADV-2006-0413SSRT061236SSRT061236http://www.mozilla.org/security/announce/2006/mfsa2006-07.html22065oval:org.mitre.oval:def:677The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes the internal "AnyName" object to external interfaces, which allows multiple cooperating domains to exchange information in violation of the same origin restrictions.https://bugzilla.mozilla.org/show_bug.cgi?id=322312ADV-2006-3749ADV-2006-0413SSRT061236mozilla-e4x-security-bypass(24437)16476SSRT061236http://www.mozilla.org/security/announce/2006/mfsa2006-08.html1015570220651870418700oval:org.mitre.oval:def:1625Buffer overflow in tar 1.14 through 1.15.90 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute code via unspecified vectors involving PAX extended headers.TA07-109ATA07-072AMDKSA-2006:046233711899918976gnu-tar-pax-headers-bo(24855)ADV-2008-2518ADV-2007-1470ADV-2007-0930ADV-2006-0684USN-257-12006-001016764FLSA:183571-2RHSA-2006:0232OpenPKG-SA-2006.006SUSE-SR:2006:005GLSA-200603-06DSA-9872416461015705192361915219130190931901618973oval:org.mitre.oval:def:9295oval:org.mitre.oval:def:6094oval:org.mitre.oval:def:5993oval:org.mitre.oval:def:5978oval:org.mitre.oval:def:5252[Bug-tar] 20060220 tar 1.15.90 released543480249662447920042APPLE-SA-2007-03-13APPLE-SA-2007-04-19http://docs.info.apple.com/article.html?artnum=305391http://docs.info.apple.com/article.html?artnum=305214Heap-based buffer overflow in Splash.cc in xpdf, as used in other products such as (1) poppler, (2) kdegraphics, (3) gpdf, (4) pdfkit.framework, and others, allows attackers to cause a denial of service and possibly execute arbitrary code via crafted splash images that produce certain values that exceed the width or height of the associated bitmap.xpdf-splash-bo(24391)USN-249-1FLSA:17540420060202 [KDE Security Advisory] kpdf/xpdf heap based buffer overflowRHSA-2006:0201FEDORA-2006-103http://www.kde.org/info/security/advisory-20060202-1.txtGLSA-200602-12GLSA-200602-05GLSA-200602-04DSA-974DSA-972DSA-971SSA:2006-045-04SSA:2006-045-09101557619377189831891318908188821886418862188601883918838188371883418826188251870718677RHSA-2006:0206SCOSA-2006.15https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179046https://bugzilla.novell.com/show_bug.cgi?id=141242ADV-2006-0422ADV-2006-0389MDKSA-2006:032MDKSA-2006:031MDKSA-2006:0304701887518274oval:org.mitre.oval:def:10850ZyXel P2000W VoIP 802.11b Wireless Phone running firmware WV.00.02 allows remote attackers to obtain sensitive information, such as MAC address and software version, by directly accessing UDP port 9090.162851851120060116 ZyXel P2000W (Version 2) VoIP wireless phone undocumented port UDP/9090zyxel-p2000w-default-port(24145)22516Multiple unspecified vulnerabilities in the (1) publishing component, (2) Contact Component, (3) TinyMCE Compressor, and (4) other components in Joomla! 1.0.5 and earlier have unknown impact and attack vectors.18513http://www.joomla.org/content/view/738/66/Buffer overflow in Dual DHCP DNS Server 1.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via the DHCP options field.18486http://aluigi.altervista.org/adv/dualsbof-adv.txtADV-2006-0245dualdhcpdns-options-field-bo(24191)162981015495Clipcomm CPW-100E VoIP 802.11b Wireless Handset Phone running firmware 1.1.12 (051129) and CP-100E VoIP 802.11b Wireless Phone running firmware 1.1.60 allows remote attackers to gain unauthorized access via the debug service on TCP port 60023.162891850520060116 Clipcomm CP-100E VoIP wireless desktop phone open debug service TCP/6002320060116 Clipcomm CPW-100E VoIP wireless handset phone open debug service TCP/60023clipcomm-cp100e-default-port(24144)The DM Primer (dmprimer.exe) in the DM Deployment Common Component in Computer Associates (CA) BrightStor Mobile Backup r4.0, BrightStor ARCserve Backup for Laptops & Desktops r11.0, r11.1, r11.1 SP1, Unicenter Remote Control 6.0, 6.0 SP1, CA Desktop Protection Suite r2, CA Server Protection Suite r2, and CA Business Protection Suite r2 allows remote attackers to cause a denial of service (CPU consumption or application hang) via a large network packet, which causes a WSAEMESGSIZE error code that is not handled, leading to a thread exit.http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33756ADV-2006-02361627620060118 CAID 33756 - DM Deployment Common Component Vulnerabilities22529http://www.designfolks.com.au/karma/DMPrimer/http://supportconnectw.ca.com/public/ca_common_docs/dmdeploysecurity_notice.asp101550418531The DM Primer in the DM Deployment Common Component in Computer Associates (CA) BrightStor Mobile Backup r4.0, BrightStor ARCserve Backup for Laptops & Desktops r11.0, r11.1, r11.1 SP1, Unicenter Remote Control 6.0, 6.0 SP1, CA Desktop Protection Suite r2, CA Server Protection Suite r2, and CA Business Protection Suite r2 allows remote attackers to cause a denial of service (CPU consumption and log file consumption) via unspecified "unrecognized network messages" that are not properly handled.1015504http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33756ADV-2006-02361627620060118 CAID 33756 - DM Deployment Common Component Vulnerabilities22529http://supportconnectw.ca.com/public/ca_common_docs/dmdeploysecurity_notice.asp18531PHP remote file inclusion vulnerability in htmltonuke.php in the htmltonuke 2.0 alpha, and possibly other versions, module for PHP-Nuke allows remote attackers to execute arbitrary PHP code via a URL in the filnavn parameter.htmltonuke-htmltonuke-file-include(33092)162823524Linksys BEFVP41 VPN Router 2.0 with firmware 1.01.04 allows remote attackers on the local network, to cause a denial of service via IP packets with a null IP option length.ADV-2006-023820060116 Re: Linksys VPN Router (BEFVP41) DoS Vulnerability20060113 Linksys VPN Router (BEFVP41) DoS Vulnerability101549018461linksys-null-length-dos(24125)1630720060117 Re: Linksys VPN Router (BEFVP41) DoS VulnerabilityCross-site scripting (XSS) vulnerability in aoblogger 2.3 allows remote attackers to inject arbitrary Javascript via a javascript URI in the BBcode url tag.ADV-2006-02401628616889http://evuln.com/vulns/37/summary.htmlaoblogger-url-xss(24141)22526http://mikeheltonisawesome.com/viewcomments.php?idd=4620060117 [eVuln] aoblogger Multiple VulnerabilitiesSQL injection vulnerability in login.php in aoblogger 2.3 allows remote attackers to execute arbitrary SQL commands via the username parameter.ADV-2006-02401628616889http://evuln.com/vulns/37/summary.htmlaoblogger-login-sql-injection(24142)22527http://mikeheltonisawesome.com/viewcomments.php?idd=4620060117 [eVuln] aoblogger Multiple Vulnerabilitiescreate.php in aoblogger 2.3 allows remote attackers to bypass authentication and create new blog entries by setting the uza parameter to 1.ADV-2006-02401628616889http://evuln.com/vulns/37/summary.htmlaoblogger-create-security-bypass(24143)http://mikeheltonisawesome.com/viewcomments.php?idd=4620060117 [eVuln] aoblogger Multiple VulnerabilitiesMultiple SQL injection vulnerabilities in PDFdirectory before 1.0 allow remote attackers to execute arbitrary SQL commands via multiple unspecified vectors involving (1) util.php, (2) userpref.php, (3) user.php, (4) uploadfrm.php, (5) title.php, (6) team.php, (7) stats.php, (8) page.php, (9) org.php, (10) member.php, (11) index.php, (12) group.php, or (13) anniv.php.1627322415224142241322412224112241022409224082240722406224052240422403http://sourceforge.net/project/shownotes.php?release_id=382411&group_id=12268218459ADV-2006-0231PDFdirectory before 1.0 stores sensitive data in plaintext, which allows remote attackers to obtain arbitrary users' passwords by direct queries to the database, possibly via one of the SQL injection vulnerabilities.22402http://sourceforge.net/project/shownotes.php?release_id=382411&group_id=122682index.php in EZDatabase before 2.1.2 does not properly cleanse the p parameter before constructing and including a .php filename, which allows remote attackers to conduct directory traversal attacks, and produces resultant cross-site scripting (XSS) and path disclosure.http://zur.homelinux.com/Advisories/ezdatabase_dir_trans.txt1625720060115 EZDatabase Directory Transversal, XSS and Path Disclosure Vulnerability1804320060115 EZDatabase Directory Transversal, XSS and Path Disclosure Vulnerabilityezdatabase-index-p-path-disclosure(24135)ezdatabase-index-p-xss(24134)22684Buffer overflow in YGPPicFinder.DLL in AOL You've Got Pictures (YGP) Picture Finder Tool ActiveX Control, as used in AOL 8.0, 8.0 Plus, and 9.0 Classic, allows remote attackers to execute arbitrary code via unspecified vectors.VU#7157301626218521aol-youvegotpictures-activex-bo(24160)ADV-2006-022122486http://www.kb.cert.org/vuls/id/MIMG-6KRSQP1015494http://news.com.com/2061-10789_3-6027865.html?part=rss&tag=6027865&subj=newsCross-site scripting (XSS) vulnerability in rkrt_stats.php in RedKernel Referrer Tracker 1.1.0-3 allows remote attackers to inject arbitrary web script or HTML via a query string value as a GET, which is stored in the $QUERY_STRING variable. NOTE: the provenance of this information is unknown; portions of the details are obtained from third party information.ADV-2006-01971626618473referertracker-rkrtstats-xss(24151)SQL injection vulnerability in index.php in BlogPHP 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter in a login action.blogphp-index-bypass-security(24131)ADV-2006-02041626920060117 [eVuln] BlogPHP Authentication Bypass2249518467http://evuln.com/vulns/34/summaryDirectory traversal vulnerability in the FTP server (port 22003/tcp) in Farmers WIFE 4.4 SP1 allows remote attackers to create arbitrary files via ".." (dot dot) sequences in a (1) PUT, (2) SIZE, and possibly other commands.22496http://www.lort.dk/DSR-farmerswife44sp1.pl1850820060113 Farmers wife 4.4 sp1 remote SYSTEM accessfarmerswife-ftp-directory-traversal(24190)16321SQL injection vulnerability in admin/processlogin.php in Bit 5 Blog 8.01 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username and (2) password parameter.ADV-2006-01951624420060115 [eVuln] Bit 5 Blog SQL Injection & Authentication Bypass Vulnerability18464http://evuln.com/vulns/31/summarybit5blog-processlogin-sql-injection(24124)22445fetchmail 6.3.0 and other versions before 6.3.2 allows remote attackers to cause a denial of service (crash) via crafted e-mail messages that cause a free of an invalid pointer when fetchmail bounces the message to the originator or local postmaster.TA06-214Ahttp://fetchmail.berlios.de/fetchmail-SA-2006-01.txtfetchmail-message-bounce-dos(24265)ADV-2006-3101ADV-2006-0300192891636520060122 fetchmail security announcement fetchmail-SA-2006-01 (CVE-2006-0321)22691SSA:2006-045-011015527212531889518571APPLE-SA-2006-08-01http://developer.berlios.de/project/shownotes.php?release_id=8784http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=348747Unspecified vulnerability the edit comment formatting functionality in MediaWiki 1.5.x before 1.5.6 and 1.4.x before 1.4.14 allows attackers to cause a denial of service (infinite loop) via "certain malformed links."http://sourceforge.net/project/shownotes.php?release_id=386609ADV-2006-0392mediawiki-comment-format-dos(24478)1871718711SUSE-SR:2006:003Buffer overflow in swfformat.dll in multiple RealNetworks products and versions including RealPlayer 10.x, RealOne Player, Rhapsody 3, and Helix Player allows remote attackers to execute arbitrary code via a crafted SWF (Flash) file with (1) a a size value that is less than the actual size, or (2) other unspecified manipulations.VU#231028http://www.service.real.com/realplayer/security/03162006_player/en/RHSA-2006:0257SUSE-SA:2006:018GLSA-200603-241936519362realnetworks-swf-bo(25408)ADV-2006-10571720220060411 Realplayer .SWF Multiple Remote Memory Corruption Vulnerabilities10158066901939019358SQL injection vulnerability in WebspotBlogging 3.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter to login.php.ADV-2006-02681631920060119 [eVuln] WebspotBlogging Authentication Bypass Vulnerabilityhttp://evuln.com/vulns/41/summary.htmlhttps://sourceforge.net/project/shownotes.php?release_id=387180&group_id=156586https://sourceforge.net/forum/forum.php?forum_id=532233webspotblogging-login-sql-injection(24222)22670101552235618560Etomite Content Management System 0.6, and possibly earlier versions, when downloaded from the web site in January 2006 after January 10, contains a back door in manager/includes/todo.inc.php, which allows remote attackers to execute arbitrary commands via the "cij" parameter.etomite-default-backdoor(24254)18556ADV-2006-02831633620060130 Etomite followup information20060127 Etomite CMS 22693http://www.lucaercoli.it/advs/etomite.txthttp://www.etomite.org/forums/index.php?showtopic=4291http://www.etomite.org/forums/index.php?showtopic=4185TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to (1) thumbs.php, (2) showpic.php, or (3) tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails.20060119 IRM 015: File system path disclosure on TYPO3 Web Content ManagerADV-2006-026920060119 Re: IRM 015: File system path disclosure on TYPO3 Web Content Manager20060119 Re: IRM 015: File system path disclosure on TYPO3 Web Content Managehttp://www.irmplc.com/advisory015.htm18546http://bugs.typo3.org/view.php?id=2248typo3-multiple-path-disclosure(24244)226672266622665361Format string vulnerability in Tftpd32 2.81 allows remote attackers to cause a denial of service via format string specifiers in a filename in a (1) GET or (2) SEND request.VU#632633ADV-2006-026320060119 Critical security advisory #006 tftpd32 Format stringhttp://www.critical.lt/research/tftpd32_281_dos.txthttp://www.critical.lt/?vulnerabilities/20018539tftpd32-request-format-string(24250)1633322661362SQL injection vulnerability in HITSENSER Data Mart Server BS, BS-S, BS-M, BS-L, and EX allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.18553ADV-2006-02661632622669http://www.hitachi-support.com/security_e/vuls_e/HS05-026_e/index-e.html1015519hitachi-hitsenser-sql-injection(24240)Cross-site scripting (XSS) vulnerability in Gallery before 1.5.2 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors, possibly involving the user name (fullname).gallery-unknown-xss(24247)1633422660GLSA-200601-131862718557ADV-2006-0282http://gallery.menalto.com/page/gallery_1_5_2_releaseDSA-114821502http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=325285Buffer overflow in Change passwd 3.1 (chpasswd) SquirrelMail plugin allows local users to execute arbitrary code via long command line arguments.http://www.squirrelmail.org/plugin_view.php?id=11720060119 Change passwd 3.1 (SquirrelMail plugin )changepassword-changepasswd-bo(24258)363Pantomime in Ecartis 1.0.0 snapshot 20050909 stores e-mail attachments in a publicly accessible directory, which may allow remote attackers to upload arbitrary files.1631718524ecartis-pantomime-bypass-security(24220)ADV-2006-0260[listar-dev] 20060119 [EDev] Re: Potential vulnerability -- who to contact?[listar-dev] 20060115 [EDev] Re: Potential vulnerability -- who to contact?Cross-site scripting (XSS) vulnerability in ar-blog 5.2 allows remote attackers to inject arbitrary web script or HTML via the (1) month or (2) year parameter to index.php.20060118 -2- [XSS] in ar-blog v 5.2arblog-index-xss(24246)20060527 Multiple Xss exploits in ar-blog v 5.2Cross-site scripting (XSS) vulnerability in search.php in My Amazon Store Manager 1.0 allows remote attackers to inject arbitrary web script or HTML via the Keywords parameter. NOTE: some sources claim that the affected parameter is "q", but the only public archive of the original researcher notification shows an XSS manipulation in "Keywords".masm-search-xss(24230)ADV-2006-0252163122262618535http://osvdb.org/ref/22/22626-my_amazon.txtMultiple unspecified vulnerabilities in Kerio WinRoute Firewall before 6.1.4 Patch 1 allow remote attackers to cause a denial of service via multiple unspecified vectors involving (1) long strings received from Active Directory and (2) the filtering of HTML.163142263118542kerio-winroute-activedirectory-dos(24233)kerio-winroute-html-dos(24232)ADV-2006-0247http://www.kerio.com/kwf_history.htmlKerio WinRoute Firewall before 6.1.4 Patch 2 allows attackers to cause a denial of service (CPU consumption and hang) via unknown vectors involving "browsing the web".ADV-2006-0324http://www.kerio.com/kwf_history.htmlkerio-winroute-browsing-dos(24317)163852263118589Buffer overflow in multiple F-Secure Anti-Virus products and versions for Windows and Linux, including Anti-Virus for Windows Servers 5.52 and earlier, Internet Security 2004, 2005 and 2006, and Anti-Virus for Linux Servers 4.64 and earlier, allows remote attackers to execute arbitrary code via crafted ZIP archives.http://www.f-secure.com/security/fsc-2006-1.shtml18529ADV-2006-025716309fsecure-zip-bo(24198)22632Q-1031015510101550910155081015507Multiple F-Secure Anti-Virus products and versions for Windows and Linux, including Anti-Virus for Windows Servers 5.52 and earlier, Internet Security 2004, 2005 and 2006, and Anti-Virus for Linux Servers 4.64 and earlier, allow remote attackers to hide arbitrary files and data via malformed (1) RAR and (2) ZIP archives, which are not properly scanned.16309http://www.f-secure.com/security/fsc-2006-1.shtml18529ADV-2006-025722633Q-1031015510101550910155081015507fsecure-rar-zip-scan-bypass(24199)Buffer overflow in BitComet Client 0.60 allows remote attackers to execute arbitrary code, when the publisher's name link is clicked, via a long publisher URI in a torrent file.1631118522ADV-2006-025120060118 Fortinet Advisory: BitComet URI Buffer Overflow Vulnerabilityhttp://www.fortinet.com/FortiGuardCenter/FSA-2006-07.htmlhttp://www.bitcomet.com/doc/changelog.htmbitcomet-torrent-publisher-bo(24229)2262535720060118 Fortinet Advisory: BitComet URI Buffer Overflow Vulnerability20060122 BitComet URI Proof of ConceptUnspecified vulnerability in Stack Group Bidding Protocol (SGBP) support in Cisco IOS 12.0 through 12.4 running on various Cisco products, when SGBP is enabled, allows remote attackers on the local network to cause a denial of service (device hang and network traffic loss) via a crafted UDP packet to port 9900.101550118490cisco-ios-sgbp-dos(24182)ADV-2006-0248163032262420060118 IOS Stack Group Bidding Protocol Crafted Packet DoS358Cross-site scripting (XSS) vulnerability in WCONSOLE.DLL in Rockliffe MailSite 5.x and 6.1.22 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string.1855120060120 RockLiffe MailSite wconsole.dll Denial of Service/Script Injection VulnerabilityADV-2006-0284mailsite-wconsole-xss(24256)1633022677RockLiffe MailSite HTTP Mail management agent (httpma) 7.0.3.1 allows remote attackers to cause a denial of service (CPU consumption and crash) via a malformed query string containing special characters such as "|".1855120060120 RockLiffe MailSite wconsole.dll Denial of Service/Script Injection Vulnerabilitymailsite-wconsole-dos(24255)ADV-2006-02841633122678Unspecified vulnerability in the Port Discovery Standard and Advanced features in Hitachi JP1/NetInsight II allows attackers to stop the Port Discovery service via unknown vectors involving "invalid format data".18538ADV-2006-02671632722676http://www.hitachi-support.com/security_e/vuls_e/HS05-027_e/index-e.html1015520hitachi-jp1netinsight-port-dos(24243)Directory traversal vulnerability in Intervations FileCOPA FTP Server 1.01 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the (1) STOR and (2) RETR commands.http://www.nii.co.in/vuln/filecopa.html18550filecopa-ftp-directory-traversal(24257)ADV-2006-02851633522694Multiple SQL injection vulnerabilities in SaralBlog 1.0 allow remote attackers to execute arbitrary SQL commands via the search parameter to search.php. NOTE: the id/viewprofile.php issue is already covered by CVE-2005-4058.16306http://evuln.com/vulns/40/summary.htmlsaralblog-search-sql-injection(24218)22740101551720060118 [eVuln] SaralBlog XSS & Multiple SQL Injection VulnerabilitiesCross-site scripting (XSS) vulnerability in SaralBlog 1.0 allows remote attackers to inject arbitrary web script or HTML via a website field in a new comment to view.php, which is not properly handled in the comment function in functions.php.16306http://evuln.com/vulns/40/summary.htmlsaralblog-view-xss(24219)27907101551720060118 [eVuln] SaralBlog XSS & Multiple SQL Injection VulnerabilitiesDirectory traversal vulnerability in ELOG before 2.6.1 allows remote attackers to access arbitrary files outside of the elog directory via "../" (dot dot) sequences in the URL.1631518533elog-dotdot-directory-traversal(24224)ADV-2006-0262http://midas.psi.ch/elog/download/ChangeLog22647DSA-96718783Format string vulnerability in the write_logfile function in ELOG before 2.6.1 allows remote attackers to cause a denial of service (server crash) via unknown attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.1631518533ADV-2006-0262http://midas.psi.ch/elog/download/ChangeLogelog-elogd-format-string(24221)22646DSA-96718783SQL injection vulnerability in eggblog 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to blog.php.16305101550518212http://evuln.com/vulns/39/summary.htmleggblog-blog-sql-injection(24210)2275120060118 [eVuln] eggblog Multiple SQL Injection & XSS VulnerabilitiesCross-site scripting (XSS) vulnerability in eggblog 2.0 allow remote attackers to inject arbitrary web script or HTML via the message field to topic.php.16305101550518212http://evuln.com/vulns/39/summary.htmleggblog-topic-xss(24209)2275220060118 [eVuln] eggblog Multiple SQL Injection & XSS VulnerabilitiesUnspecified "critical denial-of-service vulnerability" in MyDNS before 1.1.0 has unknown impact and attack vectors.2263618532ADV-2006-0256http://mydns.bboy.net/download/changelog.htmlmydns-query-dos(24228)16431GLSA-200601-16DSA-96310155211865318641The default configuration of Fluffington FLog 1.01 installs users.0.dat under the web document root with insufficient access control, which might allow remote attackers to obtain sensitive information (login credentials) via a direct request. NOTE: It was later reported that 1.1.2 is also affected.20070105 Flog 1.1.2 Remote Admin Password Disclosure20060117 [eVuln] Flog Information Disclosure Vulnerabilityhttp://evuln.com/vulns/38/summary/bt/flog-admin-info-disclosure(31307)flog-data-directory-insecure(24193)unix_random.c in lshd for lsh 2.0.1 leaks file descriptors related to the randomness generator, which allows local users to cause a denial of service by truncating the seed file, which prevents the server from starting, or obtain sensitive seed information that could be used to crack keys.16357DSA-9561862318564lsh-file-descriptor-leak(24263)ADV-2006-030122695[lsh-bugs] SECURITY: lshd leaks fd:s to user shellsCisco IOS before 12.3-7-JA2 on Aironet Wireless Access Points (WAP) allows remote authenticated users to cause a denial of service (termination of packet passing or termination of client connections) by sending the management interface a large number of spoofed ARP packets, which creates a large ARP table that exhausts memory, aka Bug ID CSCsc16644.101548318430cisco-aironet-arp-dos(24086)ADV-2006-0176162172237520060112 Access Point Memory Exhaustion from ARP Attacks339oval:org.mitre.oval:def:5680Helmsman Research (aka CoolUtils) HomeFtp 1.1 allows remote attackers to cause an unspecified denial of service via a long USER command combined with a long PASS command and an NLST command.20060114 [KAPDA::#21] - HomeFtp v1.1 Denial of Servicehttp://www.kapda.ir/advisory-202.htmlhomeftp-long-command-dos(24152)16238350Ari Pikivirta Home Ftp Server 1.0.7 allows remote attackers to cause an unspecified denial of service via a long USER command combined with a long PASS command.20060115 Homeftp r1.0.7 Denial of Servicehttp://www.kapda.ir/advisory-211.htmlhomeftpserver-long-command-dos(24227)Grant Averett Cerberus FTP Server 2.32, and possibly earlier versions, allows remote attackers to cause an unspecified denial of service via a long string that does not contain a valid FTP command.20060115 Cerberus FTP Server 2.32 Denial of Servicehttp://www.kapda.ir/advisory-210.htmlhttp://www.cerberusftp.com/cerberus-releasenotes.htmcerberus-long-command-dos(24226)Multiple SQL injection vulnerabilities in PowerPortal, possibly 1.1 beta through 1.3, allow remote attackers to execute arbitrary SQL commands via the search parameter in (1) index.php and (2) search.php. NOTE: This issue might overlap CVE-2004-0663.2.1627920060117 PowerPortal Cross-Site Scripting Vulnerabilityhttp://web.archive.org/web/20050303003128/http://powerportal.sourceforge.net/powerportal-search-index-xss(24196)279582795710172Buffer overflow in CounterPath eyeBeam SIP Softphone allows remote attackers to (1) cause a denial of service (device crash) via SIP INVITE commands with a long header field name sent during startup and (2) cause a denial of service (device hang or crash) via SIP INVITE commands with a long header field name sent during a call.eyebeam-sip-header-bo(24181)ADV-2006-02591625320060921 Re: CounterPath eyeBeam Handing SIP header Vulnerabilities20060116 CounterPath eyeBeam Handing SIP header Vulnerabilities35418516http://blog.donews.com/zwell/archive/2006/01/17/698810.aspxMPM SIP HP-180W Wireless IP Phone WE.00.17 allows remote attackers to obtain sensitive information and possibly cause a denial of service via a direct connection to UDP port 9090, which is undocumented and does not require authentication.162851851220060116 MPM HP-180W VoIP wireless desktop phone undocumented port UDP/9090mpn-hp180w-default-port(24147)Cross-site scripting (XSS) vulnerability in addcomment.php in Bit 5 Blog 8.01 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in an <a> tag in the comment parameter, which strips most tags but not <a>.ADV-2006-01951624620060115 [eVuln] Bit 5 Blog JavaScript Insertion Vulnerability2244618464http://evuln.com/vulns/32/summary/http://evuln.com/vulns/32/exploitbit5blog-addcomment-xss(24129)TippingPoint Intrusion Prevention System (IPS) TOS before 2.1.4.6324, and TOS 2.2.x before 2.2.1.6506, allow remote attackers to cause a denial of service (CPU consumption) via an unknown vector, probably involving an HTTP request with a negative number in the Content-Length header.22504http://www.eweek.com/article2/0,1759,1912048,00.asphttp://isc.sans.org/diary.php?storyid=1042tippingpoint-ips-http-traffic-dos(24200)16299101551118515The "Remember my Password" feature in MSN Messenger 7.5 stores passwords in an encrypted format under the HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Creds registry key, which might allow local users to obtain the original passwords via a program that calls CryptUnprotectData, as demonstrated by the "MSN Password Recovery.exe" program. NOTE: it could be argued that local-only password recovery is inherently insecure because the decryption methods and keys must be stored somewhere on the local system, and are thus inherently accessible with varying degrees of effort. Perhaps this issue should not be included in CVE.20060117 Re: MSN Messenger Password Decrypter for WinXP/200320060113 Re: MSN Messenger Password Decrypter for WinXP/2003http://www.msn-password-recovery.com/Cross-site scripting (XSS) vulnerability in MyBulletinBoard (MyBB) allows remote attackers to inject arbitrary web script or HTML via a signature containing a JavaScript URI in the SRC attribute of an IMG element, in which the URI uses SGML numeric character references without trailing semicolons, as demonstrated by "javascript".18544mybb-html-signature-xss(24225)ADV-2006-0255163082262820060118 MyBB Signature HTML Code InjectionCross-site scripting (XSS) vulnerability in XMB (aka extreme message board) allows remote attackers to inject arbitrary web script or HTML via JavaScript in the SRC attribute of an IMG element.20060118 XMB Forum HTML Code Injectionxmbforum-imgsrc-xss(24208)27920Cross-site scripting (XSS) vulnerability in Phpclanwebsite (aka PCW) allows remote attackers to inject arbitrary web script or HTML via a javascript URI in a BBCode img tag.A simple fix has been released on the Main PCW site available directly at <a href="http://www.phpclanwebsite.com/index.php?page=downloads&func=browselist&par=1">http://www.phpclanwebsite.com/index.php?page=downloads&func=browselist&par=1
</a>Please download and install imediately. 1630018541ADV-2006-025420060117 Phpclanwebsite BBCode IMG Tag XSS VulnerabilityUnspecified vulnerability in Cisco CallManager 3.2 and earlier, 3.3 before 3.3(5)SR1, 4.0 before 4.0(2a)SR2c, and 4.1 before 4.1(3)SR2 allows remote authenticated users with read-only administrative privileges to obtain full administrative privileges via a "crafted URL on the CCMAdmin web page."2262120060118 Cisco Call Manager Privilege Escalation101550218501cisco-callmanager-ccmadmin-gain-priv(24172)ADV-2006-025016293Cisco CallManager 3.2 and earlier, 3.3 before 3.3(5)SR1, 4.0 before 4.0(2a)SR2c, and 4.1 before 4.1(3)SR2 allow remote attackers to (1) cause a denial of service (CPU and memory consumption) via a large number of open TCP connections to port 2000 and (2) cause a denial of service (fill the Windows Service Manager communication queue) via a large number of TCP connections to port 2001, 2002, or 7727.18494ADV-2006-02491629520060118 Cisco Call Manager Denial of Servicecisco-callmanager-port-connection-dos(24180)22623226221015503359** DISPUTED ** MySQL 5.0.18 allows local users with access to a VIEW to obtain sensitive information via the "SELECT * FROM information_schema.views;" query, which returns the query that created the VIEW. NOTE: this issue has been disputed by third parties, saying that the availability of the schema is a normal and sometimes desired aspect of database access.20060128 Re: MySQL 5.0 information leak?20060123 RE: MySQL 5.0 information leak?20060124 Re: MySQL 5.0 information leak?20060122 Re: MySQL 5.0 information leak?20060120 MySQL 5.0 information leak?20060121 Re: MySQL 5.0 information leak?20060121 RE: MySQL 5.0 information leak?Noah Medling RCBlog 1.03 stores the data and config directories under the web root with insufficient access control, which allows remote attackers to view account names and MD5 password hashes.20060120 [eVuln] RCBlog Directory Traversal & Sensitive Information Disclosurehttp://www.fluffington.com/index.php?page=rcblog18547http://evuln.com/vulns/42/summary.htmlrcblog-data-config-insecure-directories(24249)226791015523Directory traversal vulnerability in index.php in Noah Medling RCBlog 1.03 allows remote attackers to read arbitrary .txt files, possibly including one that stores the administrator's account name and password, via a .. (dot dot) in the post parameter.1634220060120 [eVuln] RCBlog Directory Traversal & Sensitive Information Disclosurehttp://www.fluffington.com/index.php?page=rcblog18547http://evuln.com/vulns/42/summary.htmlrcblog-index-file-include(27042)rcblog-index-directory-traversal(24248)20060611 RCblog 1.03 Directory Traversal [index.php]20060218 RCblog exploit [fun]226801015523Multiple SQL injection vulnerabilities in config.php in Insane Visions BlogPHP, possibly 1.0, allow remote attackers to execute arbitrary SQL commands via the (1) blogphp_username or (2) blogphp_password parameter in a cookie.BlogPHP version 2.0 was released to fix the config.php exploit and is available for download at <a href="http://sourceforge.net/project/showfiles.php?group_id=156043">http://sourceforge.net/project/showfiles.php?group_id=156043</a>.1634020060121 BlogPHP config.php SQL injection login bypassed20060120 BlogPHP config.php SQL injection login bypass20060120 BlogPHP config.php SQL injection login bypass22738blogphp-index-bypass-security(24131)365Cross-site scripting (XSS) vulnerability in register.aspx in Douran FollowWeb allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.1630227918Advantage Century Telecommunication (ACT) P202S IP Phone 1.01.21 running firmware 1.1.21 has multiple undocumented ports available, which (1) might allow remote attackers to obtain sensitive information, such as memory contents and internal operating-system data, by directly accessing the VxWorks WDB remote debugging ONCRPC (aka wdbrpc) on UDP 17185, (2) reflect network data using echo (TCP 7), or (3) gain access without authentication using rlogin (TCP 513).act-p202s-default-port(24149)162881851420060116 ACT P202S VoIP wireless phone multiple undocumented ports/servicesAdvantage Century Telecommunication (ACT) P202S IP Phone 1.01.21 running firmware 1.1.21 on VxWorks uses a hardcoded Network Time Protocol (NTP) server in Taiwan, which could allow remote attackers to provide false time information, block access to time information, or conduct other attacks.1851420060116 ACT P202S VoIP wireless phone multiple undocumented ports/servicesact-p202s-default-port(24149)16288The 802.11 wireless client in certain operating systems including Windows 2000, Windows XP, and Windows Server 2003 does not warn the user when (1) it establishes an association with a station in ad hoc (aka peer-to-peer) mode or (2) a station in ad hoc mode establishes an association with it, which allows remote attackers to put unexpected wireless communication into place.http://www.theta44.org/karma/20060114 [NMRC Advisory] Microsoft Windows Wireless Exposure on Laptopshttp://www.securiteam.com/windowsntfocus/5YP0D2KHHO.htmlhttp://www.nmrc.org/pub/advise/20060114.txt1015489windows-wireless-adhoc-unauth-access(24157)349CRLF injection vulnerability in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMAP commands via newline characters in the mailbox parameter of the sqimap_mailbox_select command, aka "IMAP injection."http://www.squirrelmail.org/security/issue/2006-02-151015662squirrelmail-mailbox-imap-injection(24849)ADV-2006-06891675618985oval:org.mitre.oval:def:11470RHSA-2006:0283FEDORA-2006-133SUSE-SR:2006:005MDKSA-2006:049GLSA-200603-09DSA-98820210199601920519176191311913020060501-01-UCross-site scripting (XSS) vulnerability in Netrix X-Site Manager allows remote attackers to inject arbitrary web script or HTML via the product_id parameter, as originally demonstrated for a custom mp3players_details.php program. NOTE: the name of the affected program might be installation-dependent, but it has been identified as "product_details.php" by some sources.ADV-2006-0253163132263418537http://osvdb.org/ref/22/22634-x-site.txtxsitemanager-productdetails-xss(24234)FreeBSD kernel 5.4-STABLE and 6.0 does not completely initialize a buffer before making it available to userland, which could allow local users to read portions of kernel memory.1859916373FreeBSD-SA-06:06bsd-buffer-initialization-disclosure(24338)227301015541A logic error in FreeBSD kernel 5.4-STABLE and 6.0 causes the kernel to calculate an incorrect buffer length, which causes more data to be copied to userland than intended, which could allow local users to read portions of kernel memory.1859916373FreeBSD-SA-06:06bsd-buffer-length-disclosure(24340)227311015541A logic error in the IP fragment cache functionality in pf in FreeBSD 5.3, 5.4, and 6.0, and OpenBSD, when a 'scrub fragment crop' or 'scrub fragment drop-ovl' rule is being used, allows remote attackers to cause a denial of service (crash) via crafted packets that cause a packet fragment to be inserted twice.18609FreeBSD-SA-06:0716375http://www.openbsd.org/cgi-bin/cvsweb/src/sys/net/pf_norm.c.diff?r1=1.103&r2=1.104bsd-pf-fragment-dos(24337)227321015542NetBSD-SA2006-004Apple Mac OS X 10.4.5 and allows local users to cause a denial of service (crash) via an undocumented system call.ADV-2006-0597APPLE-SA-2006-02-14macosx-system-call-dos(24682)1665423190101563418907IPSec when used with VPN networks in Mac OS X 10.4 through 10.4.5 allows remote attackers to cause a denial of service (application crash) via unspecified vectors involving the "incorrect handling of error conditions".TA06-062A1690719064ADV-2006-0791APPLE-SA-2006-03-01macosx-vpn-dos(25025)23643http://docs.info.apple.com/article.html?artnum=303382automount in Mac OS X 10.4.5 and earlier allows remote file servers to cause a denial of service (unresponsiveness) or execute arbitrary code via unspecified vectors that cause automount to "mount file systems with reserved names".TA06-062A1690719064ADV-2006-0791APPLE-SA-2006-03-01macosx-automount-execute-code(25021)236401015709http://docs.info.apple.com/article.html?artnum=303382FileVault in Mac OS X 10.4.5 and earlier does not properly mount user directories when creating a FileVault image, which allows local users to access protected files when FileVault is enabled.TA06-062A1690719064APPLE-SA-2006-03-01ADV-2006-0791macosx-filevault-file-access(25024)23642http://docs.info.apple.com/article.html?artnum=303382Stack-based buffer overflow in Safari in Mac OS X 10.4.5 and earlier, and 10.3.9 and earlier, allows remote attackers to execute arbitrary code via unspecified vectors involving a web page with crafted JavaScript, a different vulnerability than CVE-2005-4504.TA06-062AVU#1767321690719064APPLE-SA-2006-03-01ADV-2006-0791macosx-safari-bo(25032)1015713http://docs.info.apple.com/article.html?artnum=303382Safari in Mac OS X 10.3 before 10.3.9 and 10.4 before 10.4.5 allows remote attackers to redirect users to local files and execute arbitrary JavaScript via unspecified vectors involving HTTP redirection to local resources.TA06-062A16907101571319064APPLE-SA-2006-03-01macosx-safari-http-redirect(25038)ADV-2006-0791http://docs.info.apple.com/article.html?artnum=303382Cross-site scripting (XSS) vulnerability in Syndication (Safari RSS) in Mac OS X 10.4 through 10.4.5 allows remote attackers to execute arbitrary JavaScript via unspecified vectors involving RSS feeds.TA06-062A1690719064APPLE-SA-2006-03-01ADV-2006-0791macosx-syndication-xss(25040)23649http://docs.info.apple.com/article.html?artnum=303382** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-4504. Reason: This candidate is a duplicate of CVE-2005-4504. Notes: All CVE users should reference CVE-2005-4504 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.Directory traversal vulnerability in the BOM framework in Mac OS X 10.x before 10.3.9 and 10.4 before 10.4.5 allows user-assisted attackers to overwrite or create arbitrary files via an archive that is handled by BOMArchiveHelper.TA06-062A20060302 Apple MacOS X BOMArchiveHelper Directory Traversal VulnerabilityAPPLE-SA-2006-03-01ADV-2006-0791169072364119064macosx-bom-directory-traversal(25023)http://docs.info.apple.com/article.html?artnum=303382Buffer overflow in Apple Mac OS X 10.4.7 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Canon RAW image.VU#527236TA06-214Amacosx-raw-image-bo(28142)ADV-2006-3101192892773921253APPLE-SA-2006-08-01OpenSSH in Apple Mac OS X 10.4.7 allows remote attackers to cause a denial of service or determine account existence by attempting to log in using an invalid user, which causes the server to hang.TA06-214Amacosx-openssh-nonexistent-user-dos(28147)ADV-2006-31011928927745101667221253APPLE-SA-2006-08-01** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-0848. Reason: This candidate is a duplicate of CVE-2006-0848. Notes: All CVE users should reference CVE-2006-0848 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.The Download Validation in Mail in Mac OS X 10.4 does not properly recognize attachment file types to warn a user of an unsafe type, which allows user-assisted remote attackers to execute arbitrary code via crafted file types.TA06-062AADV-2006-0791APPLE-SA-2006-03-01http://docs.info.apple.com/article.html?artnum=303382macosx-mail-bypass-security(25027)169072364519064Buffer overflow in Mail in Apple Mac OS X 10.4 up to 10.4.5, when patched with Security Update 2006-001, allows remote attackers to execute arbitrary code via a long Real Name value in an e-mail attachment sent in AppleDouble format, which triggers the overflow when the user double-clicks on an attachment.VU#98008417081101576219129ADV-2006-094920060314 DMA[2006-0313a] - 'Apple OSX Mail.app RFC1740 Real Name Buffer Overflow'http://www.digitalmunition.com/DMA%5B2006-0313a%5D.txtAPPLE-SA-2006-03-13http://docs.info.apple.com/article.html?artnum=303453macosx-mail-attachment-bo(25209)23872Unspecified vulnerability in Safari, LaunchServices, and/or CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows attackers to trick a user into opening an application that appears to be a safe file type. NOTE: due to the lack of specific information in the vendor advisory, it is not clear how CVE-2006-0397, CVE-2006-0398, and CVE-2006-0399 are different.Per Hyperlink 894663:
Vendor description specifies that the file is automatically opened by the application: Safari could automatically open a file which appears to be a safe file type.19129macosx-safefiletype-command-execution(25269)ADV-2006-0949238691015760APPLE-SA-2006-03-13http://docs.info.apple.com/article.html?artnum=303453Unspecified vulnerability in Safari, LaunchServices, and/or CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows attackers to trick a user into opening an application that appears to be a safe file type. NOTE: due to the lack of specific information in the vendor advisory, it is not clear how CVE-2006-0397, CVE-2006-0398, and CVE-2006-0399 are different.Hyperlink Record 894667 specifies: Safari could automatically open a file which appears to be a safe file type, such as an image or movie, but is actually an application.19129macosx-safefiletype-command-execution(25269)ADV-2006-0949238701015760APPLE-SA-2006-03-13http://docs.info.apple.com/article.html?artnum=303453Unspecified vulnerability in Safari, LaunchServices, and/or CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows attackers to trick a user into opening an application that appears to be a safe file type. NOTE: due to the lack of specific information in the vendor advisory, it is not clear how CVE-2006-0397, CVE-2006-0398, and CVE-2006-0399 are different.Per Hyperlink Record 894671:
Safari could automatically open a file which appears to be a safe file type, such as an image or movie, but is actually an application.19129macosx-safefiletype-command-execution(25269)ADV-2006-0949238711015760APPLE-SA-2006-03-13http://docs.info.apple.com/article.html?artnum=303453CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows remote attackers to bypass the same-origin policy and execute Javascript in other domains via unknown vectors involving "crafted archives."1708219129ADV-2006-0949APPLE-SA-2006-03-13http://docs.info.apple.com/article.html?artnum=303453macosx-sameorigin-policy-bypass(25208)238731015763Unspecified vulnerability in Mac OS X before 10.4.6, when running on an Intel-based computer, allows attackers with physical access to bypass the firmware password and log on in Single User Mode via unspecified vectors.19462ADV-2006-121517364http://docs.info.apple.com/article.html?artnum=303567macosx-firmware-password-bypass(25620)243991015859SQL injection vulnerability in Zoph before 0.5pre1 allows remote attackers to execute arbitrary SQL commands.zoph-sql-injection(24264)http://sourceforge.net/project/shownotes.php?group_id=69353&release_id=38732018563ADV-2006-02971634722743DSA-98919153Multiple SQL injection vulnerabilities in e-moBLOG 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) monthy parameter to index.php or (2) login parameter to admin/index.php. NOTE: some sources have reported item 1 as involving the "monthly" parameter, but this is incorrect.emoblog-index-sql-injection(24245)ADV-2006-02961634420060122 [eVuln] e-moBLOG SQL Injection Vulnerability2270122700101552437018567http://evuln.com/vulns/43/summary.html20060125 The parameter in e-moBLOG is Note-A-Day Weblog 2.2 stores sensitive data under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to archive/.phpass-admin, which contains encrypted passwords.noteaday-archive-directory-insecure(24270)noteaday-archive-information-disclosure(24270)ADV-2006-029918566http://evuln.com/vulns/44/summary.html22699101553937120060122 [eVuln] Note-A-Day Weblog Sensitive Information DisclosureThe TIFFFetchShortPair function in tif_dirread.c in libtiff 3.8.0 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers a NULL pointer dereference, possibly due to changes in type declarations and/or the TIFFVSetField function.Per: http://cwe.mitre.org/data/definitions/476.html
'CWE-476: NULL Pointer Dereference'libtiff-tiffvsetfield-dos(24275)ADV-2006-030218172GLSA-200605-172034518587http://bugzilla.remotesensing.org/show_bug.cgi?id=1034http://bugzilla.remotesensing.org/show_bug.cgi?id=1029search.php in MyBB 1.0.2 allows remote attackers to obtain sensitive information via a certain search request that reveals the table prefix in a SQL error message, possibly due to invalid parameters.mybb-search-information-disclosure(24272)20060114 MyBB 1.0.2 Sniffing table perfix bug in search.php2273618577Cross-site scripting (XSS) vulnerability in post.php in AZ Bulletin Board (AZbb) 1.1.00 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) nickname parameter and (2) an iframe tag in the topic parameter. NOTE: the original disclosure specified the name parameter, but a correction was later provided. NOTE: followup posts have both disputed and confirmed the original claim.azbulletinboard-post-xss(24274)ADV-2006-02981635120060309 Re: Re: [CORRECTIONS AND ADDITIONS ]Azbb v1.1.00 Cross-Site Scripting20060308 Re: [CORRECTIONS AND ADDITIONS ]Azbb v1.1.00 Cross-Site Scripting 20060128 [CORRECTIONS AND ADDITIONS ]Azbb v1.1.00 Cross-Site Scripting20060123 Azbb v1.1.00 Cross-Site Scripting18565http://kapda.ir/advisory-236.html20060308 Re: [CORRECTIONS AND ADDITIONS ]Azbb v1.1.00 Cross-Site Scriptingrsh utility in Sun Grid Engine (SGE) before 6.0u7_1 allows local users to gain privileges and execute arbitrary code via unspecified vectors, possibly involving command line arguments.18580ADV-2006-0308http://gridengine.sunsource.net/project/gridengine/60patches.txtsge-rsh-gain-privileges(24281)163661015531Cross-site scripting (XSS) vulnerability in index.php in Pixelpost Photoblog 1.4.3 allows remote attackers to inject arbitrary web script or HTML via the "Add Comment" field in a comment popup.pixelpost-index-xss(24261)ADV-2006-03091636218572http://evuln.com/vulns/45/summary.html20060123 [eVuln] Pixelpost Photoblog XSS Vulnerability1015529SQL injection vulnerability in ADOdb before 4.71, when using PostgreSQL, allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors involving binary strings.http://sourceforge.net/project/shownotes.php?release_id=387862&group_id=4271818575adodb-postgresql-sql-injection(24314)ADV-2006-0448ADV-2006-03151636422705GLSA-200604-07GLSA-200602-02DSA-1031DSA-1030DSA-1029195911959019555187451873219691claro_init_local.inc.php in Claroline 1.7.2 uses guessable session cookies (MD5 hash of connection time), which allows remote attackers to hijack sessions and possibly gain administrative privileges.ADV-2006-03201634120060120 Claroline 1.7.2, sso identification vulnerabilityclaroline-cookie-bypass-security(24326)18588SQL injection vulnerability in CyberShop allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter in a login action.cybershop-login-sql-injection(24005)2236520060105 CyberShop User Login Sql InjectionMultiple SQL injection vulnerabilities in index.php in NewsPHP allow remote attackers to execute arbitrary SQL commands via the (1) discuss, (2) tim, (3) id, (4) last, and (5) limit parameter.newsphp-index-sql-injection(24320)ADV-2006-03411633920060122 Newsphp Multiple SQL Injection Vulnerabilities2271718624Tor before 0.1.1.20 allows remote attackers to identify hidden services via a malicious Tor server that attempts a large number of accesses of the hidden service, which eventually causes a circuit to be built through the malicious server.18576http://archives.seul.org/or/announce/Jan-2006/msg00001.htmltor-service-information-disclosure(24285)1832322689http://tor.eff.org/cvs/tor/ChangeLogGLSA-200606-042051419795Cross-site scripting (XSS) vulnerability in index.php in SleeperChat 0.3f and earlier allows remote attackers to inject arbitrary web script or HTML via the pseudo parameter.163631015525sleeperchat-index-xss(24300)22784SleeperChat 0.3f and earlier allows remote attackers to bypass authentication and create new entries via the txt parameter to (1) chat_no.php and (2) chat_if.php.sleeperchat-txt-security-bypass(24357)1015525SQL injection vulnerability in login.php in miniBloggie 1.0 and earlier, when gpc_magic_quotes is disabled, allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username and (2) password parameters.ADV-2006-0310http://evuln.com/vulns/47/summary.htmlminibloggie-login-sql-injection(24280)1636720060124 [eVuln] miniBloggie Authentication Bypass22729101553418604Eval injection vulnerability in 123 Flash Chat Server 5.0 and 5.1 allows attackers to execute arbitrary code via a crafted username.1636020060124 [ISecAuditors Advisories] Arbitrary flash code remote execution in 123flashchatBEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6 allows anonymous binds to the embedded LDAP server, which allows remote attackers to read user entries or cause a denial of service (unspecified) via a large number of connections.1015528BEA06-81.01BEA WebLogic Server and WebLogic Express 8.1 through SP4 and 7.0 through SP6 does not properly handle when servlets use relative forwarding, which allows remote attackers to cause a denial of service (slowdown) via unknown attack vectors that cause "looping stack overflow errors."1015528BEA06-106.01By design, BEA WebLogic Server and WebLogic Express 7.0 and 6.1, when creating multiple domains from the same WebLogic instance on the same machine, allows administrators of any created domain to access other created domains, which could allow administrators to gain privileges that were not intended.101552818581BEA06-108.00weblogic-cross-domain-management(24286)ADV-2006-031316358Multiple unspecified vulnerabilities in BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allow remote attackers to access MBean attributes or cause an unspecified denial of service via unknown attack vectors.101552818592BEA06-109.00weblogic-java-mbean-access(24294)ADV-2006-031316358BEA WebLogic Portal 8.1 through SP3 stores the password for the RDBMS Authentication provider in cleartext in the config.xml file, which allows attackers to gain privileges.1015528BEA06-110.00weblogic-portal-config-info-disclosure(40705)weblogicportal-config-info-disclosure(24284)ADV-2008-0613ADV-2006-03121635818593BEA08-110.01BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allows remote authenticated guest users to read the server log and obtain sensitive configuration information.101552818592BEA06-111.00weblogic-server-log-disclosure(24295)ADV-2006-03131635822776BEA WebLogic Portal 8.1 through SP4 allows remote attackers to obtain the source for a deployment descriptor file via unknown vectors.1015528BEA06-112.00weblogic-deployment-descriptor-disclosure(24297)ADV-2006-03121635818593BEA WebLogic Server and WebLogic Express 8.1 through SP4, when configuration auditing is enabled and a password change occurs, stores the old and new passwords in cleartext in the DefaultAuditRecorder.log file, which could allow attackers to gain privileges.101552818592BEA06-113.00weblogic-password-information-disclosure(24290)ADV-2006-03131635822775Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious EJBs or servlet applications to decrypt system passwords, possibly by accessing functionality that should have been restricted.101552818592BEA06-114.00weblogic-servlets-obtain-information(24291)ADV-2006-03131635822774Unspecified vulnerability in BEA WebLogic Portal 8.1 SP3 through SP5, when using Web Services Remote Portlets (WSRP), allows remote attackers to access restricted web resources via crafted URLs.1015528BEA06-115.00weblogic-wsrp-gain-access(24293)ADV-2006-0312163582276718593BEA WebLogic Server and WebLogic Express 9.0 causes new security providers to appear active even if they have not been activated by a server reboot, which could cause an administrator to perform inappropriate, security-relevant actions.101552818592BEA06-116.00weblogic-security-provider-weakness(24298)ADV-2006-03131635822773Certain configurations of BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6, when connection filters are enabled, cause the server to run more slowly, which makes it easier for remote attackers to cause a denial of service (server slowdown).101552818592BEA06-117.00ADV-2006-031316358weblogic-connection-filter-dos(24301)Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP5 allows untrusted applications to obtain the server's SSL identity via unknown attack vectors.101552818592BEA06-118.00ADV-2006-031316358weblogic-ssl-identity-exposure(24302)Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0, when an Administrator uses the WebLogic Administration Console to add custom security policies, causes incorrect policies to be created, which prevents the server from properly protecting JNDI resources.101552818592BEA06-119.00weblogic-jdni-security-weakness(24299)ADV-2006-031316358Selective Acknowledgement (SACK) in FreeBSD 5.3 and 5.4 does not properly handle an incoming selective acknowledgement when there is insufficient memory, which might allow remote attackers to cause a denial of service (infinite loop).22861ADV-2006-040916466FreeBSD-SA-06:08bsd-sack-handling-dos(24453)101556639918696Directory traversal vulnerability in action.php in phpXplorer allows remote attackers to read arbitrary files via ".." (dot dot) sequences and null bytes in the sAction parameter, a different vulnerability than CVE-2006-0244. NOTE: if the functionality of phpXplorer supports the upload of PHP files, then this issue would not cross privilege boundaries and would not be a vulnerability.20060118 phpXplorer file inclusion biyosecurity.bephpxplorer-sshare-directory-traversal(39982)16292Unspecified vulnerability in Oracle PL/SQL (PLSQL), as used in Database Server DS 9.2.0.7 and 10.1.0.5, Application Server 1.0.2.2, 9.0.4.2, 10.1.2.0.2, 10.1.2.1.0, and 10.1.3.0.0, E-Business Suite and Applications 11.5.10, and Collaboration Suite 10.1.1, 10.1.2.0, 10.1.2.1, and 9.0.4.2, allows attackers to bypass the PLSQLExclusion list and access excluded packages and procedures, aka Vuln# PLSQL01.VU#16916420060125 Workaround for unpatched Oracle PLSQL Gateway flaw1015961oracle-plsql-command-execution(24363)ADV-2006-1571ADV-2006-1397ADV-2006-033816384HPSBMA02113HPSBMA0211320060208 Re: Workaround for unpatched Oracle PLSQL Gateway flaw20060202 More on the workaround for the unpatched Oracle PLSQL Gateway flaw20060202 The History of the Oracle PLSQL Gateway Flaw20060131 Re: Workaround for unpatched Oracle PLSQL Gateway flaw22719http://www.oracle.com/technology/deploy/security/pdf/public_vuln_to_advisory_mapping.htmlhttp://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html101554440340219859197121862120060125 Workaround for unpatched Oracle PLSQL Gateway flaw20060202 More on the workaround for the unpatched Oracle PLSQL Gateway flaw20060202 The History of the Oracle PLSQL Gateway FlawUnspecified vulnerability in HP HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain privileges via unknown attack vectors.1015530HPSBUX02091SSRT061099ADV-2006-0322hpux-unspecified-privilege-escalation(24318)http://support.avaya.com/elmodocs2/security/ASA-2006-025.htm1860018596oval:org.mitre.oval:def:1586oval:org.mitre.oval:def:1577oval:org.mitre.oval:def:1453Cross-site scripting (XSS) vulnerability in admin_smilies.php in phpBB 2.0.19 allows remote attackers to inject arbitrary web script or HTML via Javascript events such as "onmouseover" in the (1) smile_url or (2) smile_emotion parameters, which bypasses a check for "<" and ">" characters.phpbb-referer-header-http-xss(24497)ADV-2006-04452292820060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin1869320060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin406Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.19, when Link to off-site Avatar or bbcode (IMG) are enabled, allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag in a user profile, as demonstrated using links to (1) admin/admin_users.php and (2) modcp.php.ADV-2006-044520060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin18693phpbb-referer-header-http-xss(24497)2292940620060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS AdminText Rider 2.4 stores sensitive data in the data directory under the web document root with insufficient access control, which allows remote attackers to obtain usernames and password hashes by directly accessing data/userlist.txt.textrider-data-information-disclosure(24279)ADV-2006-032118605http://evuln.com/vulns/46/summary.html20060124 [eVuln] Text Rider Sensitive Information Disclosure1015533Text Rider 2.4 allows attackers to bypass authentication and upload files without providing a valid password by obtaining the MD5 hash of the password (possibly via another vulnerability that reads it from a data file), then including the hash in a cookie.http://evuln.com/vulns/46/summary.html20060124 [eVuln] Text Rider Sensitive Information Disclosure1015533Stack-based buffer overflow in Sami FTP Server 2.0.1 allows remote attackers to execute arbitrary code via a long USER command, which triggers the overflow when the log is viewed.ADV-2006-031716370http://www.critical.lt/?vulnerabilities/20818574samiftpserver-user-bo(24325)20060124 SamiFTPd buffer overflowhttp://www.karjasoft.com/samiftp/newshttp://downloads.securityfocus.com/vulnerabilities/exploits/sami_ftp_poc.plMultiple cross-site scripting (XSS) vulnerabilities in usercp.php in MyBulletinBoard (MyBB) 1.02 allow remote attackers to inject arbitrary web script or HTML via the (1) notepad parameter in a notepad action and (2) signature parameter in a editsig action. NOTE: These are different attack vectors, and probably a different vulnerability, than CVE-2006-0218 and CVE-2006-0219.ADV-2006-03161636120060124 [KAPDA::#25] - MyBB 1.x Cross_Site_Scripting101553518603http://kapda.ir/advisory-241.htmlCross-site scripting (XSS) vulnerability in archive.php in CheesyBlog 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) realname and (2) comment parameters, or (3) via a javascript URI in the url parameter, when adding a comment.ADV-2006-03261637620060125 [eVuln] CheesyBlog XSS Vulnerabilityhttp://evuln.com/vulns/49/summary.htmlcheesyblog-archive-xss(24292)2271636918610SQL injection vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.1 allows remote attackers to execute arbitrary SQL commands via the (1) par parameter in the post function on the forum page and possibly the (2) poll_id parameter on the poll page. NOTE: the poll_id vector can also allow resultant cross-site scripting (XSS) from an unquoted error message for invalid SQL syntax.A simple fix has been released on the Main PCW site available directly at <a href="http://www.phpclanwebsite.com/index.php?page=downloads&func=browselist&par=1">http://www.phpclanwebsite.com/index.php?page=downloads&func=browselist&par=1</a>
Please download and install imediately.
Tech note: Filters id number (par) to contain numbers only.
1639118597ADV-2006-034220060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities2272222720http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txtphpclanwebsite-index-sql-injection(24355)index.php in Phpclanwebsite 1.23.1 allows remote authenticated users to obtain the installation path by specifying an invalid file name to the uploader page, as demonstrated by "\", which will display the full path of uploader.php. NOTE: this might be the result of a file inclusion vulnerability.Please add the following to the config.php file to avoid all such exploits.
ini_set('display_errors', false);
1639120060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities22721http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txtUnspecified vulnerability in WeBWorK 2.1.3 and 2.2-pre1 allows remote privilged attackers to execute arbitrary commands as the web server via unknown attack vectors.18594http://devel.webwork.rochester.edu/twiki/bin/view/Webwork/WeBWorKRelease2pt1pt4ADV-2006-0319webwork-unknown-command-execution(24322)16371Multiple buffer overflows in E-Post Mail Server 4.10 and SPA-PRO Mail @Solomon 4.00 allow remote attackers to execute arbitrary code via a long username to the (1) AUTH PLAIN or (2) AUTH LOGIN SMTP commands, which is not properly handled by (a) EPSTRS.EXE or (b) SPA-RS.EXE; (3) a long username in the APOP POP3 command, which is not properly handled by (c) EPSTPOP4S.EXE or (d) SPA-POP3S.EXE; (4) a long IMAP DELETE command, which is not properly handled by (e) EPSTIMAP4S.EXE or (f) SPA-IMAP4S.EXE.http://secunia.com/secunia_research/2006-1/advisory/18480ADV-2006-0318epost-imap-mailbox-dos(24334)epost-pop3-username-bo(24333)epost-smtp-username-bo(24331)16379227632276222761Multiple directory traversal vulnerabilities in (1) EPSTIMAP4S.EXE and (2) SPA-IMAP4S.EXE in the IMAP service in E-Post Mail 4.05 and SPA-PRO Mail 4.05 allow remote attackers to (a) list arbitrary directories or cause a denial of service via the LIST command; or create arbitrary files via the (b) APPEND, (c) COPY, or (d) RENAME commands.http://secunia.com/secunia_research/2006-1/advisory/18480epost--append-copy-rename-file-creation(24336)ADV-2006-0318epost--append-copy-rename-file-creation(24336)epost-imap-list-directory-traversal(24335)163792276522764Early termination vulnerability in the IMAP service in E-Post Mail 4.05 and SPA-PRO Mail 4.05 allows remote attackers to cause a denial of service (infinite loop) by sending an APPEND command and disconnecting before the expected amount of data is sent.http://secunia.com/secunia_research/2006-1/advisory/18480ADV-2006-0318epost-imap-append-dos(24341)1637922766phpBB 2.0.19 and earlier allows remote attackers to cause a denial of service (application crash) by (1) registering many users through profile.php or (2) using search.php to search in a certain way that confuses the database.20060125 HYSA-2006-001 phpBB 2.0.19 search.php and profile.php DOS Vulnerabilityhttp://www.h4cky0u.org/advisories/HYSA-2006-001-phpbb.txthttp://h4cky0u.org/viewtopic.php?t=637phpbb-search-profile-dos(24327)368Multiple memory leaks in the LDAP component in Fedora Directory Server 1.0 allow remote attackers to cause a denial of service (memory consumption) via invalid BER packets that trigger an error, which might prevent memory from being freed if it was allocated during the ber_scanf call, as demonstrated using the ProtoVer LDAP test suite.http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179135fedora-ber-memory-leak-dos(24794)1667718960dn2ancestor in the LDAP component in Fedora Directory Server 1.0 allows remote attackers to cause a denial of service (CPU and memory consumption) via a ModDN operation with a DN that contains a large number of "," (comma) characters, which results in a large amount of recursion, as demonstrated using the ProtoVer LDAP test suite.http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179137fedora-dn2ancestor-dos(24796)1667718960The LDAP component in Fedora Directory Server 1.0 allow remote attackers to cause a denial of service (crash) via a certain "bad BER sequence" that results in a free of uninitialized memory, as demonstrated using the ProtoVer LDAP test suite.http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179135fedora-ber-bad-sequence-dos(24795)1667718960Linux kernel before 2.6.15.3 down to 2.6.12, while constructing an ICMP response in icmp_send, does not properly handle when the ip_options_echo function in icmp.c fails, which allows remote attackers to cause a denial of service (crash) via vectors such as (1) record-route and (2) timestamp IP options with the needaddr bit set and a truncated value.16532FLSA:157459-4FEDORA-2006-102SUSE-SA:2006:0061886118788187841877418766[dailydave] 20060207 Fun with Linux (2.6.12 -> 2.6.15.2)kernel-icmp-ipoptionsecho-dos(24575)ADV-2006-0464USN-250-12006-0006MDKSA-2006:040http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.15.3[linux-kernel] 20060207 Re: Linux 2.6.15.3[linux-kernel] 20060207 Linux 2.6.15.3gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded. Note: this also occurs when running the equivalent command "gpg --verify".DSA-978SSA:2006-072-0216663SUSE-SA:2006:009GLSA-200602-10189681895618955189421893418933[gnupg-devel] 20060215 [Announce] False positive signature verification in GnuPGgnupg-gpgv-improper-verification(24744)ADV-2006-0610USN-252-12006-0008FLSA-2006:18535520060215 False positive signature verification in GnuPGRHSA-2006:026623221OpenPKG-SA-2006.001SUSE-SA:2006:013SUSE-SR:2006:005MDKSA-2006:04319532192491913018845oval:org.mitre.oval:def:10084[gnupg-announce] 20060215 False positive signature verification in GnuPGFEDORA-2006-11620060401-01-UThe strnlen_user function in Linux kernel before 2.6.16 on IBM S/390 can return an incorrect value, which allows local users to cause a denial of service via unknown vectors.ADV-2006-2554http://www.mail-archive.com/kernel-svn-changes@lists.alioth.debian.org/msg01631.htmlhttp://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.16-rc6http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=331c46591414f7f92b1cec048009abe89892ee79http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=331c46591414f7f92b1cec048009abe89892ee79DSA-1103oval:org.mitre.oval:def:990918687RHSA-2006:0575http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm224172146520914Race condition in the (1) add_key, (2) request_key, and (3) keyctl functions in Linux kernel 2.6.x allows local users to cause a denial of service (crash) or read sensitive kernel memory by modifying the length of a string argument between the time that the kernel calculates the length and when it copies the data into kernel memory.USN-263-1oval:org.mitre.oval:def:9566kernel-addkey-dos(25354)17084RHSA-2006:057523894SUSE-SA:2006:028MDKSA-2006:059http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm22417214652039819220The DCC ACCEPT command handler in irssi before 0.8.9+0.8.10rc5-0ubuntu4.1 in Ubuntu Linux, and possibly other distributions, allows remote attackers to cause a denial of service (application crash) via certain crafted arguments in a DCC command.19090USN-259-116913irssi-dcc-accept-dos(25147)flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator (flex) before 2.5.33 does not allocate enough memory for grammars containing (1) REJECT statements or (2) trailing context rules, which causes flex to generate code that contains a buffer overflow that might allow context-dependent attackers to execute arbitrary code.flex-bypass-security(24995)DSA-102016896234401942419071ADV-2006-0770USN-260-1GLSA-200603-07[flex-announce] 20060222 flex 2.5.33 released5701922819126http://prdownloads.sourceforge.net/flex/flex-2.5.33.tar.bz2?downloadMultiple buffer overflows in BomberClone before 0.11.6.2 allow remote attackers to execute arbitrary code via long error messages.GLSA-200602-09ADV-2006-0643bomberclone-error-message-bo(24764)1669723263DSA-997192101891518914Cross-site scripting (XSS) vulnerability in core.input.php in ExpressionEngine 1.4.1 allows remote attackers to inject arbitrary web script or HTML via HTTP_REFERER (referer).http://evuln.com/vulns/48/summary.htmlADV-2006-0325expressionengine-coreinput-xss(24296)1637720060125 [eVuln] ExpressionEngine 'Referer' XSS Vulnerability37218602SQL injection vulnerability in comentarios.php in AndoNET Blog 2004.09.02 allows remote attackers to execute arbitrary SQL commands via the entrada parameter.ADV-2006-0327http://evuln.com/vulns/50/summary.htmlandonetblog-index-sql-injection(24309)1639320060126 [eVuln] AndoNET Blog SQL Injection Vulnerability2275537718633Cross-site scripting (XSS) vulnerability in IdeoContent Manager allows remote attackers to inject arbitrary web script or HTML via the (1) goto_id parameter to index.php or (2) page parameter to news_full.php.2271322712http://osvdb.org/ref/22/22712-ideocontent.txtMultiple SQL injection vulnerabilities in index.php in IdeoContent Manager allow remote attackers to execute arbitrary SQL commands via the (1) goto_id or (2) mid parameter.22714http://osvdb.org/ref/22/22712-ideocontent.txtCross-site scripting (XSS) vulnerability in risultati_ricerca.php in active121 Site Manager allows remote attackers to inject arbitrary web script or HTML via the cerca parameter.22715http://osvdb.org/ref/22/22715-active121.txtCross-site scripting (XSS) vulnerability in search.asp in Goldstag Content Management System allows remote attackers to inject arbitrary web script or HTML via the text parameter.22711http://osvdb.org/ref/22/22711-goldstag.txtgoldstag-search-xss(25198)Unspecified vulnerability in Pioneers (formerly gnocatan) before 0.9.49 allows remote attackers to cause a denial of service (application crash) via long chat messages.pioneers-chat-message-dos(24383)DSA-9641869218647ADV-2006-037616429http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=350237CommuniGate Pro Core Server before 5.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via LDAP messages with negative BER lengths, and possibly other vectors, as demonstrated by the ProtoVer LDAP test suite.1640720060128 Multiple vulnerabilities in CommuniGate Pro Serverhttp://www.gleg.net/advisory_cg.shtml18640ADV-2006-0364http://www.stalker.com/CommuniGatePro/History.htmlcommunigate-ldap-bo(24409)Cross-site scripting (XSS) vulnerability in UebiMiau 2.7.9, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG tag.uebimiau-html-xss(24375)ADV-2006-0388http://www.uebimiau.org/news.php1641320060129 UebiMiau Webmail System Security Vulnerability18655387Cross-site scripting (XSS) vulnerability in search.php in MyBulletinBoard (MyBB) 1.02 allows remote attackers to inject arbitrary web script or HTML via the (1) sortby and (2) sortordr parameters, which are not properly handled in a redirection.ADV-2006-035016387227501861720060125 MyBB 1.0.2 XSS attack in search.php redirectionhttp://community.mybboard.net/showthread.php?tid=6418http://community.mybboard.net/attachment.php?aid=2181mybb-search-xss(24466)374Cross-site scripting (XSS) vulnerability in the bbcode function in functions.php in my little homepage my little forum, as last modified in June 2005, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags.mylittlehomepage-link-tag-xss(24310)ADV-2006-03491639520060126 [eVuln] "my little homepage" products [link] BBCode XSS Vulnerability18628http://evuln.com/vulns/51/summary.html22856http://evuln.com/vulns/51/20060130 My Little Homepage - source verify of different productsCross-site scripting (XSS) vulnerability in guestbook.php in my little homepage my little guestbook, as last modified in March 2004, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags.mylittlehomepage-link-tag-xss(24310)ADV-2006-03491639520060126 [eVuln] "my little homepage" products [link] BBCode XSS Vulnerability18628http://evuln.com/vulns/51/summary.html22855http://evuln.com/vulns/51/20060130 My Little Homepage - source verify of different productsCross-site scripting (XSS) vulnerability in the bbcode function in weblog.php in my little homepage my little weblog, as last modified in April 2004, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags.mylittlehomepage-link-tag-xss(24310)ADV-2006-03491639520060126 [eVuln] "my little homepage" products [link] BBCode XSS Vulnerability18628http://evuln.com/vulns/51/summary.html22753378http://evuln.com/vulns/51/20060130 My Little Homepage - source verify of different productsMultiple integer overflows in Shareaza 2.2.1.0 allow remote attackers to execute arbitrary code via (1) a large packet length field, which causes an overflow in the ReadBuffer function in (a) BTPacket.cpp and (b) EDPacket.cpp, or (2) a large packet, which causes a heap-based overflow in the Write function in (c) Packet.h.1639920060127 Shareaza P2P Remote Vulnerabilityhttp://www.hustlelabs.com/shareaza_advisory.pdfhttp://cvs.sourceforge.net/viewcvs.py/shareaza/shareaza/EDPacket.cpp?r1=1.15&r2=1.15.2.1http://cvs.sourceforge.net/viewcvs.py/shareaza/shareaza/BTPacket.cpp?r1=1.5&r2=1.5.4.1shareaza-cpacket-bo(24344)shareaza-cedpacket-bo(24343)shareaza-btpacket-bo(24342)38220060126 Shareaza Remote VulnerabilityPHP-Ping 1.3 does not properly validate ping counts, which allows remote attackers to cause a denial of service (ping flood) via a negative count parameter.ADV-2006-0368http://www.kapda.ir/advisory-231.html18645phpping-negative-count-dos(24382)Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a playlist (pls) file with a long file name (File1 field).TA06-032AVU#60474518649winamp-playlist-filename-bo(24361)winamp-playlist-filename-bo(24361)http://www.winamp.com/player/version_history.phpADV-2006-03611641020060131 Re: Re: Winamp 5.12 - 0day exploit - code execution through playlist20060130 Winamp 5.12 - 0day exploit - code execution through playlist22789http://www.heise.de/newsticker/meldung/68981101555234223983861458oval:org.mitre.oval:def:1402Buffer overflow in git-checkout-index in GIT before 1.1.5 allows remote attackers to execute arbitrary code via an index file with a long symbolic link.18643http://lwn.net/Articles/169623/ADV-2006-0367git-gitcheckoutindex-bo(24360)16417CRE Loaded 6.15 allows remote attackers to perform privileged actions, including uploading and creating arbitrary files, via a direct request to files.php. NOTE: the vendor states "The initial announcement of this risk was made on our website... and it included a patch which will close the vulnerability on all known 6.0x and 6.1x releases. We strongly encourage users of CRE Loaded 6.x, osCMax, and other users of osCommerce who have installed HTMLArea based WYSIWYG editors and Admin Access with Levels to modify thier installations at the earliest possible moment."1641518648creloaded-files-auth-bypass(24377)ADV-2006-03732279320060203 vendor ack/fix: 22793: CRE Loaded files.php Unauthenticated Arbitrary File Upload (fwd)pmwiki.php in PmWiki 2.1 beta 20, with register_globals enabled, allows remote attackers to bypass protection mechanisms that deregister global variables by setting both a GPC variable and a GLOBALS[] variable with the same name, which causes PmWiki to unset the GLOBALS[] variable but not the GPC variable, which creates resultant vulnerabilities such as remote file inclusion and cross-site scripting (XSS).pmwiki-multiple-xss(24368)pmwiki-file-include(24367)pmwiki-path-disclosure(24366)ADV-2006-0375http://www.ush.it/2006/01/24/pmwiki-multiple-vulnerabilities/1642110155501863420060128 PmWiki Multiple VulnerabilitiesCross-site scripting (XSS) vulnerability in the Articles module in sPaiz-Nuke allows remote attackers to inject arbitrary web script or HTML via the query parameter in the search file.ADV-2006-03861641220060129 sPaiz-Nuke Cross-Site Scripting Vulnerabilityspaiznuke-modules-xss(24389)38418672Heap-based buffer overflow in the alpha strip capability in libpng 1.2.7 allows context-dependent attackers to cause a denial of service (crash) when the png_do_strip_filler function is used to strip alpha channels out of the image.16626RHSA-2006:0205101561710156151886318654https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179455libpng-pngsetstripalpha-bo(24396)ADV-2006-0393GLSA-200812-1533137oval:org.mitre.oval:def:10780ftp://ftp.simplesystems.org/pub/libpng/png/src/libpng-1.2.8-README.txtLinux kernel 2.6.15.1 and earlier, when running on SPARC architectures, allows local users to cause a denial of service (hang) via a "date -s" command, which causes invalid sign extended arguments to be provided to the get_compat_timespec function call.ADV-2006-0418[linux-sparc] 20060130 Re: Attempts to set date with 'date -s' hang the machine[linux-sparc] 20060130 Attempts to set date with 'date -s' hang the machine[debian-sparc] 20060128 `date -s' on sparc64kernel-date-s-dos(24475)17216DSA-101719374Cisco VPN 3000 series concentrators running software 4.7.0 through 4.7.2.A allow remote attackers to cause a denial of service (device reload or user disconnect) via a crafted HTTP packet.20060126 Cisco VPN 3000 Concentrator Vulnerable to Crafted HTTP Attack18629cisco-vpn-http-dos(24330)ADV-2006-034616394227541015546375Directory traversal vulnerability in Vis.pl, as part of the FACE CONTROL product, allows remote attackers to read arbitrary files via a .. (dot dot) in any parameter that opens a file, such as (1) s or (2) p.1015547facecontrol-vis-directory-traversal(24374)1640120060126 [HSC] Multiple transversal bug in vishttp://www.hackerscenter.com/archive/view.asp?id=22236376The TCL shell in Cisco IOS 12.2(14)S before 12.2(14)S16, 12.2(18)S before 12.2(18)S11, and certain other releases before 25 January 2006 does not perform Authentication, Authorization, and Accounting (AAA) command authorization checks, which may allow local users to execute IOS EXEC commands that were prohibited via the AAA configuration, aka Bug ID CSCeh73049.ADV-2006-03371638320060125 Response to AAA Command Authorization by-passoval:org.mitre.oval:def:5836cisco-aaa-tcl-auth-bypass(24308)34892101554318613Certain Cisco IOS releases in 12.2S based trains with maintenance release number 25 and later, 12.3T based trains, and 12.4 based trains reuse a Tcl Shell process across login sessions of different local users on the same terminal if the first user does not use tclquit before exiting, which may cause subsequent local users to execute unintended commands or bypass AAA command authorization checks, aka Bug ID CSCef77770.20060125 Response to AAA Command Authorization by-passoval:org.mitre.oval:def:4905cisco-aaa-tcl-auth-bypass(24308)22723101554318613Multiple unspecified vulnerabilities in Tumbleweed MailGate Email Firewall (EMF) 6.x allow remote attackers to (1) trigger temporarily incorrect processing of an e-mail message under "extremely heavy loads" and (2) cause an "increased number of missed spam" during "spam outbreaks."20060121 Tumbleweed EMF 6.x Processing IssuesThe VDM (Virtual DOS Machine) emulation environment for MS-DOS applications in Windows 2000, Windows XP SP2, and Windows Server 2003 allows local users to read the first megabyte of memory and possibly obtain sensitive information, as demonstrated by dumper.asm.20060124 Windows mem leakagewindows-vdm-obtain-information(24471)** DISPUTED ** Buffer overflow in the font command of mIRC, probably 6.16, allows local users to execute arbitrary code via a long string. NOTE: the original researcher claims that issue has been disputed by the vendor, and that the vendor stated "as far as I can tell, this is neither an exploit nor a vulnerability. The above report describes a local bug in mIRC." It could be that this is only exploitable by the user of the application, and thus would not cross privilege boundaries unless under an otherwise restrictive environment such as a kiosk.20060124 Buffer Overflow /Font on mIRC20060201 Re: Buffer Overflow /Font on mIRChttp://www.securiteam.com/windowsntfocus/5IP080AHPQ.html22942http://trout.snt.utwente.nl/ubbthreads/showflat.php?Cat=0&Board=bugreports&Number=118751383SQL injection vulnerability in login.asp in ASPThai.Net ASPThai Forums 8.0 and earlier allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the password field.ADV-2006-0372aspthai-login-sql-injection(24359)164042279010155483811863620060127 helloSQL injection vulnerability in SZUserMgnt.class.php in SZUserMgnt 1.4 allows remote attackers to execute arbitrary SQL commands via the username parameter.szusermgnt-username-sql-injection(24339)ADV-2006-0366http://www.evuln.com/vulns/53/summary.html1645420060201 [eVuln] SZUserMgnt Authentication Bypass22809101556939618666Multiple SQL injection vulnerabilities in Calendarix allow remote attackers to execute arbitrary SQL commands via (1) the catview parameter in cal_functions.inc.php and (2) the login parameter in cal_login.php. NOTE: the catview vector might overlap CVE-2005-1865.ADV-2006-0365http://www.evuln.com/vulns/52/summary.htmlcalendarix-multiple-sql-injection(24332)1645620060201 [eVuln] Calendarix SQL Injection & Authorization Bypass Vulnerabilities2281122810101556039418667Cross-site scripting (XSS) vulnerability in MG2 (formerly known as Minigal) 0.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field in a comment associated with a picture.1642820060130 XSS flaw in MG2 Image Gallery (v.0.5.1)mg2-name-xss(24378)38917374Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.02 allows local users with MyBB administrative privileges to include and possibly execute arbitrary local files via directory traversal sequences and a nul (%00) character in the plugin parameter.20060130 MyBB 1.2 Local File Incusionmybb-plugins-file-include(24461)Cross-site scripting (XSS) vulnerability in the Add Thread to Favorites feature in usercp2.php in MyBB (aka MyBulletinBoard) 1.02 allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer header ($url variable).mybb-usercp2-xss(24392)1641920060129 MyBB 1.2 usercp2.php [ $url ] CrossSiteScripting ( XSS )Cross-site scripting (XSS) vulnerability in Mozilla 1.7.12 and possibly earlier, Mozilla Firefox 1.0.7 and possibly earlier, and Netscape 8.1 and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the -moz-binding (Cascading Style Sheets) CSS property, which does not require that the style sheet have the same origin as the web page, as demonstrated by the compromise of a large number of LiveJournal accounts.https://bugzilla.mozilla.org/show_bug.cgi?id=324253mozilla-mozbinding-xss(24427)ADV-2006-04031642722924http://www.davidpashley.com/cgi/pyblosxom.cgi/computing/livejournal-mozilla-bug.html1015563101555320060128 -moz-binding CSS property: more XSS funhttp://community.livejournal.com/lj_dev/708069.htmlMultiple SQL injection vulnerabilities in PHP GEN before 1.4 allow remote attackers to inject arbitrary SQL commands via unknown attack vectors.ADV-2006-0408http://www.eyce.be/php_gen/NEWSphpgen-multiple-sql-injection(24441)154582288518715Multiple cross-site scripting (XSS) vulnerabilities in PHP GEN before 1.4 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.ADV-2006-0408http://www.eyce.be/php_gen/NEWSphpgen-parameters-xss(24443)2288418715Cross-site scripting (XSS) vulnerability in rlink.php in Rlink 1.0.0 module for phpBB allows remote attackers to inject arbitrary web script or HTML via the url parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-03901644818620phpbb-rlink-xss(24410)22818MyCO Guestbook 1.0 stores the admin directory under the web document root with insufficient access control, which allows remote attackers to perform unspecified privileged actions by directly accessing files via a URL.myco-admin-information-disclosure(24438)20060131 MyCO multiple vulnerabilitiesCross-site scripting (XSS) vulnerability in MyCO Guestbook 1.0 allows remote attackers to inject arbitrary web script or HTML via the Name field, when registering a user.20060131 MyCO multiple vulnerabilitiesmyco-name-xss(24439)1644420060201 Re: MyCO multiple vulnerabilitiesPHP remote file inclusion vulnerability in loginout.php in FarsiNews 2.1 Beta 2 and earlier, with register_globals enabled, allows remote attackers to include arbitrary files via a URL in the cutepath parameter.ADV-2006-04111644020060131 FarsiNews 2.1 PHP Remote File Inclusionhttp://www.hamid.ir/security/farsinews.txtfarsinews-loginout-file-include(24419)22878101555439018637IMAP service in MailEnable Professional Edition before 1.72 allows remote attackers to cause a denial of service (service crash) via unspecified vectors involving the EXAMINE command.http://www.mailenable.com/professionalhistory.aspmailenable-imap-examine-dos(24424)ADV-2006-039716457101555818668Unspecified vulnerability in MailEnable Enterprise Edition before 1.2 allows remote attackers to cause a denial of service (CPU utilization) by viewing "formatted quoted-printable emails" via webmail.mailenable-webmail-dos(24517)http://www.mailenable.com/enterprisehistory.asp18716zbattle.net Zbattle client 1.09 SR-1 beta allows remote attackers to cause an unspecified denial of service by rapidly creating and closing a game.zbattle-command-dos(24369)20060128 zbattle.netCross-site scripting (XSS) vulnerability in index.php in Nuked-klaN 1.7 allows remote attackers to inject arbitrary web script or HTML via the letter parameter.ADV-2006-038720060130 Nuked-klaN Cross-Site Scripting Vulnerabilitynukedklan-index-xss(24387)164242280538518670Multiple cross-site scripting (XSS) vulnerabilities in Easy CMS allow remote attackers to inject arbitrary web script or HTML via (1) unknown attack vectors in the administrative interface and (2) input fields of the contact form.easycms-xss(24371)ADV-2006-03851643020060131 Re: EasyCMS vulnerable to XSS injection.20060129 EasyCMS vulnerable to XSS injection.1867320060208 Re: Re: EasyCMS vulnerable to XSS injection.Easy CMS stores the images directory under the web document root with insufficient access control and browsing enabled, which allows remote attackers to list and possibly read images that are stored in that directory.easycms-insecure-directories(24373)20060129 EasyCMS vulnerable to XSS injection.1867320060208 Re: Re: EasyCMS vulnerable to XSS injection.Multiple cross-site scripting (XSS) vulnerabilities in clients.php in Cerberus Helpdesk, possibly 2.7, allow remote attackers to inject arbitrary web script or HTML via (1) the contact_search parameter and (2) unspecified url fields.cerberus-clients-xss(24388)ADV-2006-03951643920060130 Cerberus Helpdesk vulnerable to XSS2284318657391SQL injection vulnerability in userlogin.jsp in Daffodil CRM 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified parameters in a login action.daffodilcrm-userlogin-sql-injection(24450)ADV-2006-04121643320060130 Daffodil CRM - vulnerable to SQL-injection.2287918685** DISPUTED ** Blackboard Academic Suite 6.0 and earlier does not properly clear session information when de-authenticating a user who is idle, which allows subsequent users to log in as the previous user and gain privileges. NOTE: the vendor has disputed this issue, saying that "This is a customer specific issue related to their Kerberos authentication single sign-on application and not a vulnerability in the Blackboard product."1643820060202 Re: Blackboard Authentication Error20060201 Blackboard Authentication Error20060201 Re: Blackboard Authentication Error28023PADL MigrationTools 46 creates temporary files insecurely, which allows local users to overwrite arbitrary files via a symlink attack on the temporary files, which are not properly created by (1) migrate_all_online.sh, (2) migrate_all_offline.sh, (3) migrate_all_netinfo_online.sh, (4) migrate_all_netinfo_offline.sh, (5) migrate_all_nis_online.sh, (6) migrate_all_nis_offline.sh, (7) migrate_all_nisplus_online.sh, and (8) migrate_all_nisplus_offline.sh.ADV-2005-2427http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=33892022243DSA-1187Directory traversal vulnerability in pkmslogout in Tivoli Web Server Plug-in 5.1.0.10 in Tivoli Access Manager (TAM) 5.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.http://www.vsecurity.com/bulletins/advisories/2006/tam-file-retrieval.txt20060203 VSR Advisory: IBM Tivoli Access Manager - Web Server Plug-in File Retrieval VulnerabilityIY79724101558218725ADV-2006-0442tivoli-pkmslogout-directory-traversal(24485)1649441220060203 VSR Advisory: IBM Tivoli Access Manager - Web Server Plug-in File Retrieval VulnerabilityCisco PIX/ASA 7.1.x before 7.1(2) and 7.0.x before 7.0(5), PIX 6.3.x before 6.3.5(112), and FWSM 2.3.x before 2.3(4) and 3.x before 3.1(7), when used with Websense/N2H2, allows remote attackers to bypass HTTP access restrictions by splitting the GET method of an HTTP request into multiple packets, which prevents the request from being sent to Websense for inspection, aka bugs CSCsc67612, CSCsc68472, and CSCsd81734.http://www.vsecurity.com/bulletins/advisories/2006/cisco-websense-bypass.txt20060508 VSR Advisory: WebSense content filter bypass when deployed in conjunction with Cisco filtering devicesADV-2006-1738178831016040101603920044cisco-websense-content-filtering-bypass(26308)2545320060508 PIX/ASA/FWSM Websense/N2H2 Content Filter Bypass20060508 VSR Advisory: WebSense content filter bypass when deployed in conjunction with Cisco filtering devicesUnspecified vulnerability in the kernel processing in Solaris 10 64 bit platform, when running in 64-bit mode, allows local users to cause a denial of service (system panic) via unknown attack vectors.ADV-2006-039410214918671solaris-x64-kernel-dos(24395)164601015557oval:org.mitre.oval:def:219oval:org.mitre.oval:def:1163Multiple SQL injection vulnerabilities in formulaires/inc-formulaire_forum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id_forum, (2) id_article, or (3) id_breve parameters to forum.php3; (4) unspecified vectors related to "session handling"; and (5) when posting "petitions".http://www.zone-h.org/en/advisories/read/id=8650/ADV-2006-039818676spip-forum-sql-injection(24397)243971645820060131 ZRCSA-200601: SPIP - Multiple Vulnerabilities228482284522844101555639520060131 ZRCSA-200601: SPIP - Multiple VulnerabilitiesCross-site scripting (XSS) vulnerability in index.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter.http://www.zone-h.org/en/advisories/read/id=8650/ADV-2006-039818676spip-index-xss(24401)1646122849SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to obtain sensitive information via a direct request to inc-messforum.php3, which reveals the path in an error message.http://www.zone-h.org/en/advisories/read/id=8650/ADV-2006-039818676spip-incmessforum-path-disclosure(24399)SQL injection vulnerability index.php in Dragoran Portal module 1.3 for Invision Power Board (IPB) allows remote attackers to execute arbitrary SQL commands via the site parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.portal-index-sql-injection(24404)ADV-2006-0396186641644722851Cross-site scripting (XSS) vulnerability in results.php in BrowserCRM allows remote attackers to inject arbitrary web script or HTML via certain manipulations of the query parameter, as demonstrated using an IMG SRC tag.ADV-2006-039120060131 BrowserCRM vulnerable for XSS18658browsercrm-results-xss(24390)1643522841393SQL injection vulnerability in the Authentication Servlet in Symantec Sygate Management Server (SMS) version 4.1 build 1417 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via unknown attack vectors related to a URL.http://securityresponse.symantec.com/avcenter/security/Content/2006.02.01.htmlADV-2006-0402symantec-sms-sql-injection(24413)1645222883101556118689SQL injection vulnerability in global.php in MyBB before 1.03 allows remote attackers to execute arbitrary SQL commands via the templatelist variable.18678mybb-global-sql-injection(24416)ADV-2006-040022903http://community.mybboard.net/showthread.php?tid=6418Cross-site scripting (XSS) vulnerability in ashnews.php in Derek Ashauer ashNews 0.83 allows remote attackers to inject arbitrary web script or HTML via the id parameter.ashnews-ashnews-xss(24365)1642622934933120060131 Re: ashnews Cross-Site Scripting Vulnerability20060130 Re: ashnews Cross-Site Scripting Vulnerability20060130 ashnews Cross-Site Scripting VulnerabilityMultiple Adobe products, including (1) Photoshop CS2, (2) Illustrator CS2, and (3) Adobe Help Center, install a large number of .EXE and .DLL files with write-access permission for the Everyone group, which allows local users to gain privileges via Trojan horse programs.VU#953860adobe-insecure-default-permissions(24464)ADV-2006-04311645120060131 Windows Access Control Demystified22908http://www.cs.princeton.edu/~sudhakar/papers/winval.pdfhttp://www.adobe.com/support/techdocs/332644.html10155791015578101557718698The default configuration of the America Online (AOL) client software allows all users to modify a certain registry value that specifies a DLL file name, which might allow local users to gain privileges via a Trojan horse program.VU#9538601645320060131 Windows Access Control Demystifiedhttp://www.cs.princeton.edu/~sudhakar/papers/winval.pdfaol-insecure-default-permissions(24498)BIND 4 (BIND4) and BIND 8 (BIND8), if used as a target forwarder, allows remote attackers to gain privileged access via a "Kashpureff-style DNS cache corruption" attack.HPSBUX020971015606101555118690tru64-dns-bind-unauth-access(24414)HPSBTU02095SSRT051007ADV-2006-039916455HPSBUX0209722888748438http://computerworld.com/networkingtopics/networking/story/0,10801,103744,00.html20060216 Recent HP advisories outline BIND problemsThe cairo library (libcairo), as used in GNOME Evolution and possibly other products, allows remote attackers to cause a denial of service (persistent client crash) via an attached text file that contains "Content-Disposition: inline" in the header, and a very long line in the body, which causes the client to repeatedly crash until the e-mail message is manually removed, possibly due to a buffer overflow, as demonstrated using an XML attachment.USN-265-116408SUSE-SR:2006:0071950420060128 gnome evolution mail client inline text file DoS issueMDKSA-2006:057610Computer Associates (CA) Message Queuing (CAM / CAFT) before 1.07 Build 220_16 and 1.11 Build 29_20, as used in multiple CA products, allows remote attackers to cause a denial of service via a crafted message to TCP port 4105.http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=3358120060202 CAID 33581 - CA Message Queuing Denial of Service Vulnerabilities18681ADV-2006-0414ca-cam-port4105-dos(24448)1647521146http://supportconnectw.ca.com/public/ca_common_docs/camessagsecurity_notice.asp1015571Computer Associates (CA) Message Queuing (CAM / CAFT) before 1.07 Build 220_16 and 1.11 Build 29_20, as used in multiple CA products, allows remote attackers to cause a denial of service via spoofed CAM control messages.20060202 CAID 33581 - CA Message Queuing Denial of Service Vulnerabilities18681http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33581ADV-2006-0414ca-cam-spoofed-message-dos(24449)164751015571404Unspecified vulnerability in Sun Java System Access Manager 7.0 allows local users logged in as "root" to bypass authentication and gain top-level administrator privileges via the amadmin CLI tool.18699sun-jsam-admin-access(24423)ADV-2006-0430164741021401015567oval:org.mitre.oval:def:755oval:org.mitre.oval:def:360Cross-site scripting (XSS) vulnerability in resultat.asp in SoftMaker Shop allows remote attackers to inject arbitrary web script or HTML via a strSok parameter containing a javascript: URI in an IMG SRC attribute.softmakershop-image-xss(24451)ADV-2006-04341647120060201 SoftMaker Shop is vulnerable to XSS2291118683400Cross-site scripting (XSS) vulnerability in webmailaging.cgi in cPanel allows remote attackers to inject arbitrary web script or HTML via the numdays parameter.cpanel-scripts-xss(24468)ADV-2006-0433229061869120060203 Re: cPanel Multiple Cross Site ScriptingMultiple cross-site scripting (XSS) vulnerabilities in default.asp in CyberShop Ultimate E-commerce allow remote attackers to inject arbitrary web script or HTML via the (1) ortak or (2) kat parameter.1647320060202 CyberShop Ultimate E-commerce Script Cross Site Scriptingcybershop-xss(24454)40118730Multiple cross-site scripting (XSS) vulnerabilities in Community Server allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors. NOTE: this candidate does not contain any actionable or distinguishing information. Perhaps it should not be included in CVE. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.16478Cross-site scripting (XSS) vulnerability in neomail.pl in NeoMail 1.27 allows remote attackers to inject arbitrary web script or HTML via the sort parameter. NOTE: some sources say that the affected parameter is "date," but the demonstration URL shows that it is "sort".neomail-neomail-script-xss(24470)ADV-2006-044920060203 Neomail Cross Site Scripting Vulnerability229781015581Buffer overflow in the POP3 server in Kinesphere Corporation eXchange before 5.0.060125 allows remote attackers to execute arbitrary code via a long RCPT TO argument.exchangepop3-rcptto-bo(24477)ADV-2006-043716485229071466101558018687http://downloads.securityfocus.com/vulnerabilities/exploits/exchangepop3.pl20060203 Exchangepop3 rcpt buffer overflow vulnerability408CipherTrust IronMail 5.0.1, when "Denial of Service Protection" is enabled, allows remote attackers to cause a denial of service (possibly CPU consumption) via a SYN flood with malformed TCP packets from multiple connections.1646520060203 IronMail-5.0.1-Denial of-Service-Protection-Lets-Remote-Users-Deny-Service1015555ironmail-tcpsyn-flood-dos(24445)407The convert-fcrontab program in fcron 3.0.0 might allow local users to gain privileges via a long command-line argument, which causes Linux glibc to report heap memory corruption, possibly because a strcpy in the strdup2 function can "overwrite some data."ADV-2006-04351646720060201 Fcrontab - memory corruption on heap.18719https://bugs.trustix.org/show_bug.cgi?id=1754fcron-syslog-bo(24444)2006-0036http://fcron.free.fr/news.php#a20060206a.xmlhttp://fcron.free.fr/doc/en/changes.html20060201 Fcrontab - memory corruption on heap.Multiple SQL injection vulnerabilities in Tachyon Vanilla Guestbook 1.0 beta allow remote attackers to execute arbitrary SQL commands via unspecified vectors.16464http://www.evuln.com/vulns/54/summary.htmlvanillaguestbook-messages-sql-injection(24412)20060201 [eVuln] Vanilla Guestbook Multiple XSS & SQL Injection VulnerabilitiesMultiple cross-site scripting (XSS) vulnerabilities in Tachyon Vanilla Guestbook 1.0 beta allow remote attackers to inject arbitrary web script or HTML via unknown vectors related to "posting new messages."16464http://www.evuln.com/vulns/54/summary.htmlvanillaguestbook-name-xss(24411)20060227 Re: [eVuln] Vanilla Guestbook Multiple XSS & SQL Injection Vulnerabilities20060201 [eVuln] Vanilla Guestbook Multiple XSS & SQL Injection VulnerabilitiesMultiple SQL injection vulnerabilities in config.php in NukedWeb GuestBookHost 2005.04.25 allow remote attackers to execute arbitrary SQL commands via the (1) email and (2) password parameters.guestbookhost-login-sql-injection(24406)ADV-2006-0465http://www.evuln.com/vulns/56/summary.html1654520060209 [eVuln] GuestBookHost Authentication Bypass18761Cerulean Trillian 3.1.0.120 allows remote attackers to cause a denial of service (client crash) via an AIM message containing the Mac encoded Rich Text Format (RTF) escape sequences (1) \'d1, (2) \'d2, (3) \'d3, (4) \'d4, and (5) \'d5. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.22877urlmon.dll in Microsoft Internet Explorer 7.0 beta 2 (aka 7.0.5296.0) allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a BGSOUND element with its SRC attribute set to "file://" followed by a large number of "-" (dash of hyphen) characters.16463http://www.security-protocols.com/advisory/sp-x23-advisory.txtSQL injection vulnerability in showflat.php in Groupee (formerly known as Infopop) UBB.threads 6.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Number parameter.ubbthreads-showflat-sql-injection(24381)1652022808http://www.cyberlords.net/advisories/cl_ubb.txt101554920060325 UBBThreads<=5.5.1+6.0.2+6.0 br5+6.0.1 SQL injectionUnspecified vulnerability in index.php in a certain application available from /v1/tr/portfoy.php on www.egeinternet.com allows remote attackers to execute arbitrary code via "evilcode" in the key parameter, possibly a PHP remote file include vulnerability in which the attack vector is a URL in the key parameter. NOTE: it is not clear whether this vulnerability is associated with an online service or application service provider. If so, then it should not be included in CVE.20060128 Ege Internet Web Desing Remote Command ExucetionOracle Database 8i, 9i, and 10g allow remote authenticated users to execute arbitrary SQL statements in the context of the SYS user and bypass audit logging, including statements to create new privileged database accounts, via a modified AUTH_ALTER_SESSION attribute in the authentication phase of the Transparent Network Substrate (TNS) protocol. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle. It is possible that this is the same issue as Oracle Vuln# DB18 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0265.TA06-018AVU#871756http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.htmlhttp://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmlhttp://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdfhttp://www.imperva.com/application_defense_center/papers/oracle-dbms-01172006.htmloracle-login-command-execute(24184)20060117 Oracle DBMS - Access Control Bypass in LoginSQL injection vulnerability in the Oracle Text component of Oracle Database 10g, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle. It is possible that this is the same issue as Oracle Vuln# DB15 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0260.TA06-018AVU#150332http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.htmlhttp://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmlhttp://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdforacle-january2006-update(24321)SQL injection vulnerability in the SYS.DBMS_METADATA_UTIL package in Oracle Database 10g, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle. It is possible that this is the same issue as Oracle Vuln# DB05 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0260. However, there are some inconsistencies that make this unclear, and there is also a possibility that this is related to DB06, which is subsumed by CVE-2006-0259.TA06-018AVU#629316http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_metadata_util.htmlhttp://www.red-database-security.com/advisory/oracle_cpu_jan_2006.htmlhttp://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmlhttp://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdforacle-january2006-update(24321)Buffer overflow in an unspecified Oracle Client utility might allow remote attackers to execute arbitrary code or cause a denial of service. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle. It is possible that this is the same issue as Oracle Vuln# DBC02 from the January 2006 CPU, in which case this would be a duplicate of CVE-2006-0283. However, there are enough inconsistencies that the mapping can not be made authoritatively.TA06-018AVU#999268http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.htmlhttp://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmlhttp://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdforacle-january2006-update(24321)SQL injection vulnerability in the Data Pump Metadata API in Oracle Database 10g and possibly earlier might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle. It is possible that this is the same issue as Oracle Vuln# DB06 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0259 or, if it is DB05, subsumed by CVE-2006-0260.TA06-018AVU#983340http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.htmlhttp://www.oracle.com/technology/deploy/security/pdf/cpujan2006.htmlhttp://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdforacle-january2006-update(24321)Unspecified vulnerability in the Net Listener component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, and 9.2.0.7 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB11.VU#545804http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html18493ADV-2006-0323ADV-2006-02431628722549101549918608oracle-january2006-update(24321)PostgreSQL 8.1.0 through 8.1.2 allows authenticated database users to gain additional privileges via "knowledge of the backend protocol" using a crafted SET ROLE to other database users, a different vulnerability than CVE-2006-0678.VU#56745218890postgresql-setrole-privilege-elevation(24718)ADV-2006-06051664920060215 PostgreSQL security releases 8.1.3, 8.0.7, 7.4.12, 7.3.14http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-3OpenPKG-SA-2006.0041015636[pgsql-announce] 20060214 Minor Releases 7.3 thru 8.1 Available to Fix Security IssueLinux kernel 2.6 before 2.6.15.5 allows local users to obtain sensitive information via a crafted XFS ftruncate call, which may return stale data.http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.15.5ADV-2006-2554ADV-2006-0804kernel-ftruncate-information-disclosure(24999)USN-263-116921SUSE-SA:2006:028MDKSA-2006:150MDKSA-2006:059DSA-110320914203981922019083The Linux Kernel before 2.6.15.5 allows local users to cause a denial of service (NFS client panic) via unknown attack vectors related to the use of O_DIRECT (direct I/O).ADV-2006-2554ADV-2006-0804oval:org.mitre.oval:def:9932http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.15.5kernel-odirect-dos(25000)USN-263-116922RHSA-2006:0493FEDORA-2006-131SUSE-SA:2006:028MDKSA-2006:059DSA-1103http://support.avaya.com/elmodocs2/security/ASA-2006-161.htm21745209142039820237192201910819083sys_mbind in mempolicy.c in Linux kernel 2.6.16 and earlier does not sanity check the maxnod variable before making certain computations for the get_nodes function, which has unknown impact and attack vectors.16924http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=636f13c174dd7c84a437d3c3e8fa66f03f7fda63http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=636f13c174dd7c84a437d3c3e8fa66f03f7fda631015752http://lkml.org/lkml/2006/2/27/355https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=184510linux-get-nodes-dos(25204)ADV-2006-2554USN-281-123895SUSE-SA:2006:028MDKSA-2006:059DSA-1103209142039819955RHBA-2007-0304oval:org.mitre.oval:def:9674perfmon (perfmon.c) in Linux kernel on IA64 architectures allows local users to cause a denial of service (crash) by interrupting a task while another process is accessing the mm_struct, which triggers a BUG_ON action in the put_page_testzero function.https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=185082ADV-2006-2554ADV-2006-144417482oval:org.mitre.oval:def:10177[linux-ia64] [PATCH 1/1] ia64: perfmon.c trips BUG_ON in put_page_testzeroRHSA-2007:0774DSA-1103267092091419737Format string vulnerability in the SMTP server for McAfee WebShield 4.5 MR2 and earlier allows remote attackers to execute arbitrary code via format strings in the domain name portion of a destination address, which are not properly handled when a bounce message is constructed.The vendor has released a patch (P0803), along with version 4.5 MR2 to address this issue.1674219491ADV-2006-121920060404 SYMSA-2006-002: McAfee WebShield SMTP Format String Vulnerabilitywebshield-smtp-format-string(25621)243661015861671Cisco Secure Access Control Server (ACS) 3.x for Windows stores ACS administrator passwords and the master key in the registry with insecure permissions, which allows local users and remote administrators to decrypt the passwords by using Microsoft's cryptographic API functions to obtain the plaintext version of the master key.This vulnerability is addressed in the following product release:
Cisco, Secure Access Control Server, 4.0.1http://www.symantec.com/enterprise/research/SYMSA-2006-003.txt1674320060508 Re: SYMSA-2006-003: Cisco Secure ACS for Windows - Administrator Password Disclosure20060508 Response to Symantec SYMSA-2006-003 Cisco Secure ACS for Windows - Administrator Password Disclosure1016042ADV-2006-174120060508 SYMSA-2006-003: Cisco Secure ACS for Windows - Administrator Password Disclosurecisco-acs-admin-password-disclosure(26307)25892Cross-site scripting (XSS) vulnerability in problem.php in PluggedOut Blog 1.9.9c allows remote attackers to inject arbitrary web script or HTML via the data parameter.pluggedoutblog-problem-xss(24482)ADV-2006-044020060204 PluggedOut Blog SQL injection and XSS101558618726http://hamid.ir/security/pluggedoutblog.txt2292720060206 VERIFY Pluggedout Blog 1.9.9c problem.php XSSSQL injection vulnerability in exec.php in PluggedOut Blog 1.9.9c allows remote attackers to execute arbitrary SQL commands via the entryid parameter in a comment_add action.pluggedoutblog-exec-sql-injection(24480)ADV-2006-044020060204 PluggedOut Blog SQL injection and XSS101558618726http://hamid.ir/security/pluggedoutblog.txt2292641520060206 VERIFY Pluggedout Blog 1.9.9c exec.php SQL injectionStack-based buffer overflow in Microsoft HTML Help Workshop 4.74.8702.0, and possibly earlier versions, and as included in the Microsoft HTML Help 1.4 SDK, allows context-dependent attackers to execute arbitrary code via a .hhp file with a long Contents file field.VU#124460ADV-2006-0446http://users.pandora.be/bratax/advisories/b008.html101558518740mshtmlhelp-workshop-hhp-bo(24481)22941PHP remote file include vulnerability in inc/backend_settings.php in Loudblog 0.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the $GLOBALS[path] parameter.louadblog-backendsettings-file-include(24479)louadblog-backendsettings-file-include(24479)ADV-2006-04411649520060204 LoudBlog <= 0.4 arbitrary remote inclusion22921101558355641018722http://retrogod.altervista.org/loudblog_04_incl_xpl.htmlThe LDAP component in CommuniGate Pro Core Server 5.0.7 allows remote attackers to cause a denial of service (application crash) via LDAP messages that contain Distinguished Names (DN) fields with a large number of elements.ADV-2006-0444http://www.stalker.com/CommuniGatePro/History.html20060204 ProtoVer LDAP vs CommuniGate Pro 5.0.7http://www.gleg.net/advisory_cg2.shtml101558718701communigate-ldap-bo(24409)22932416Directory traversal vulnerability in Files Xaraya module before 0.5.1, when the Archive Directory field on the Modify Config page is blank, allows remote attackers to access files outside of the web root via ".." (dot dot) sequences.files-archive-directory-directory-traversal(24393)http://xaraya.curtisfarnham.com/articles/Files_0.5.1_-_Security_Fix_and_other_thingsADV-2006-0371Cross-site scripting (XSS) vulnerability in throw.main in Outblaze allows remote attackers to inject arbitrary web script or HTML via the file parameter.outblaze-email-thrownmain-xss(24476)ADV-2006-043920060203 Outblaze Cross Site Scripting Vulnerability22909http://www.morx.org/outblazeXSS.txt1871020060202 Outblaze Cross Site Scripting Vulnerability411Cross-site scripting (XSS) vulnerability in user_class.php in Papoo 2.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the username field during the registration of a new account. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.18721ADV-2006-043822913papoo-username-xss(24500)Multiple SQL injection vulnerabilities in phpstatus 1.0, when gpc_magic_quotes is disabled, allow remote attackers to execute arbitrary SQL commands and bypass authentication via (1) the username parameter in check.php and (2) unknown attack vectors in the administrative interface.ADV-2006-0450http://evuln.com/vulns/61/summary.html1658720060212 [eVuln] phpstatus Authentication Bypass42718791Multiple cross-site scripting (XSS) vulnerabilities in phpstatus 1.0 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in the administrative interface.ADV-2006-0450http://evuln.com/vulns/61/summary.html1658720060212 [eVuln] phpstatus Authentication Bypass42718791phpstatus 1.0 does not require passwords when using cookies to identify a user, which allows remote attackers to bypass authentication.http://evuln.com/vulns/61/summary.html1658720060212 [eVuln] phpstatus Authentication Bypass42718791Multiple cross-site scripting (XSS) vulnerabilies in cPanel 10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to (a) editquota.html or (b) dodelpop.html; (2) showtree parameter to (c) diskusage.html; or the (3) mon, (4) year, (5) target, or (6) domain parameter to (d) stats/detailbw.html.cpanel-scripts-xss(24468)ADV-2006-04331869520060203 cPanel Multiple Cross Site Scripting Vulnerability20060202 cPanel Multiple Cross Site Scripting Vulnerability22939229382293722936Cross-site scripting (XSS) vulnerability in mime/handle.html in cPanel 10 allows remote attackers to inject arbitrary web script or HTML via the (1) file extension or (2) mime-type.ADV-2006-043320060205 cPanel 10 handle.html XSS Vulnerability1869520060204 cPanel 10 mime/handle.html XSS Vulnerability229401015589convert-fcrontab in Fcron 2.9.5 and 3.0.0 allows remote attackers to create or overwrite arbitrary files via ".." sequences and a symlink attack on the temporary file that is used during conversion.fcron-dotdot-directory-traversal(24504)ADV-2006-04352006-0006229051871920060202 Re: Fcrontab - memory corruption on heap.25693Untrusted search path vulnerability in opcontrol in OProfile 0.9.1 and earlier allows local users to execute arbitrary commands via a modified PATH that references malicious (1) which or (2) dirname programs. NOTE: while opcontrol normally is not run setuid, a common configuration suggests accessing opcontrol using sudo. In such a context, this is a vulnerability.Per: http://cwe.mitre.org/data/definitions/426.html
'CWE-426: Untrusted Search Path'1653620060207 Arbitrary code execution via OProfilehttp://www.redhat.com/magazine/012oct05/features/oprofile/oval:org.mitre.oval:def:10890Lexmark X1185 printer allows local users to gain SYSTEM privileges by navigating to the "Appearance" dialog and selecting the "Additional styles (skins) are available on the Lexmark web site" option, which launches a web browser that is running with SYSTEM privileges.ADV-2006-048220060207 Re: High Risk Vulnerability in Lexmark Printer Sharing Servicelexmark-x1185-privilege-elevation(24596)1653418728Blue Coat Proxy Security Gateway OS (SGOS) 4.1.2.1 does not enforce CONNECT rules when using Deep Content Inspection, which allows remote attackers to bypass connection filters.ADV-2006-0401http://www.secumind.net/content/french/modules/news/article.php?storyid=818622proxysg-connect-bypass-security(24446)22853http://www.bluecoat.com/support/knowledge/advisory_connect_denial_ignore.html1015644Multiple integer overflows in (1) the new_demux_packet function in demuxer.h and (2) the demux_asf_read_packet function in demux_asf.c in MPlayer 1.0pre7try2 and earlier allow remote attackers to execute arbitrary code via an ASF file with a large packet length value. NOTE: the provenance of this information is unknown; portions of the details are obtained from third party information.ADV-2006-045718718mplayer-asf-integer-overflow(24531)MDKSA-2006:048GLSA-200603-0319114IBM Lotus Domino Server 7.0 allows remote attackers to cause a denial of service (segmentation fault) via a crafted packet to the LDAP port (389/TCP).ADV-2006-045818738[Dailydave] 20060203 ProtoVer vs Lotus Domino Server 7.0lotus-domino-ldap-dos(24518)165231015592SQL injection vulnerability in Hosting Controller 6.1 Hotfix 2.8 allows remote authenticated users to execute arbitrary SQL commands via the (1) GatewayID parameter in an add action in AddGatewaySettings.asp and (2) IP parameter in IPManager.asp.ADV-2006-0460101558418731hosting-controller-sql-injection(24537)2298322982Unspecified vulnerability in rshd in Heimdal 0.6.x before 0.6.6 and 0.7.x before 0.7.2, when storing forwarded credentials, allows attackers to overwrite arbitrary files and change file ownership via unknown vectors.heimdal-rshd-privilege-elevation(24532)16524SUSE-SA:2006:011http://www.pdc.kth.se/heimdal/advisory/2006-02-06/GLSA-200603-14DSA-9771930219005188941880618733ADV-2006-0628ADV-2006-0456USN-247-1USN-253-1[heimdal-discuss] 20060206 Heimdal 0.7.2 and 0.6.6229861015591SQL injection vulnerability in mailarticle.php in Clever Copy 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter.clevercopy-mailarticle-sql-injection(24545)ADV-2006-046222984101559018749http://retrogod.altervista.org/Clever_Copy_V3_sql_xpl.htmlThe PSCipher function in PeopleSoft People Tools 8.4x uses PKCS #5 with a fixed DES key to store user passwords, which makes it easier for local users to guess passwords using a dictionary attack that compares output strings.1650720060204 PeopleSoft (Oracle) PSCipher Encryption Weakness22952jscript.dll in Microsoft Internet Explorer 6.0 SP1 and earlier allows remote attackers to cause a denial of service (application crash) via a Shockwave Flash object that contains ActionScript code that calls VBScript, which in turn calls the Javascript document.write function, which triggers a null dereference.1644120060131 Internet Explorer remotely exploitable vulnerability in JScript's document.write() method101555920060217 Re: Internet Explorer remotely exploitable vulnerability in JScript's document.write() methodMultiple SQL injection vulnerabilities in Oracle 10g Release 1 before CPU Jan 2006 allow remote attackers to execute arbitrary SQL commands via multiple parameters in (1) ATTACH_JOB, (2) HAS_PRIVS, and (3) OPEN_JOB functions in the SYS.KUPV$FT package; and (4) UPDATE_JOB, (5) ACTIVE_JOB, (6) ATTACH_POSSIBLE, (7) ATTACH_TO_JOB, (8) CREATE_NEW_JOB, (9) DELETE_JOB, (10) DELETE_MASTER_TABLE, (11) DETACH_JOB, (12) GET_JOB_INFO, (13) GET_JOB_QUEUES, (14) GET_SOLE_JOBNAME, (15) MASTER_TBL_LOCK, and (16) VALID_HANDLE functions in the SYS.KUPV$FT_INT package. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that these issues has been addressed by Oracle. It is unclear which, if any, Oracle Vuln# identifiers apply to these issues.oracle-syskupvftint-sql-injection(24197)oracle-syskupv$ftint-sql-injection(24197)1629420060117 Oracle Database 10g Rel. 1 - SQL Injection in SYS.KUPV$FT_INT20060117 Oracle Database 10g Rel. 1 - SQL Injection in SYS.KUPV$FThttp://www.red-database-security.com/advisory/oracle_sql_injection_kupv$ft_int.htmlhttp://www.red-database-security.com/advisory/oracle_sql_injection_kupv$ft.htmlhttp://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html228402283920060118 Oracle Database 10g Rel. 1 - SQL Injection in SYS.KUPV$FT20060118 Oracle Database 10g Rel. 1 - SQL Injection in SYS.KUPV$FT_INTUnspecified vulnerability in util.php in Gallery before 1.5.2-pl2 allows remote authenticated users with trick an owner into modifying stored album data and possibly executing arbitrary code via unspecified vectors involving a crafted link to a crafted file.gallery-util-file-include(24768)1653322944101564118735http://gallery.menalto.com/gallery_1_5_2_pl2_security_releasegallery-album-data-modification(24538)23256http://www.digitalarmaments.com/2006140293402395.html20060216 Re: Digital Armaments Security Advisory 02.14.2006: Gallery web-based photo gallery remote file execution20060214 Digital Armaments Security Advisory 02.14.2006: Gallery web-based photo gallery remote file executionSQL injection vulnerability in search.php in MyTopix 1.2.3 allows remote attackers to execute arbitrary SQL commands via the (1) mid and (2) keywords parameters.20060204 [KAPDA::#26] - MyTopix Sql Injection & Path Disclosurehttp://kapda.ir/advisory-249.htmlmytopix-search-sql-injection(24502)413MyTopix 1.2.3 allows remote attackers to obtain the installation path via a direct request to logon.mod.php, which leaks the path in an error message.20060204 [KAPDA::#26] - MyTopix Sql Injection & Path Disclosurehttp://kapda.ir/advisory-249.html413MyTopix 1.2.3 allows remote attackers to obtain the installation path via an invalid hl parameter to index.php, which leads to path disclosure, possibly related to invalid SQL syntax.20060204 [KAPDA::#26] - MyTopix Sql Injection & Path Disclosurehttp://kapda.ir/advisory-249.html413The crypt_gensalt functions for BSDI-style extended DES-based and FreeBSD-sytle MD5-based password hashes in crypt_blowfish 0.4.7 and earlier do not evenly and randomly distribute salts, which makes it easier for attackers to guess passwords from a stolen password file due to the increased number of collisions.This vulnerability may only be exploited in conjunction with another vulnerability. The password file (normally shadowed) must first be stolen.cryptblowfish-salt-information-disclosure(24590)18772ADV-2006-047720060207 crypt_blowfish 1.0RHSA-2006:052623005http://support.avaya.com/elmodocs2/security/ASA-2006-113.htm207822065320232oval:org.mitre.oval:def:11502http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/glibc/crypt_blowfish/crypt_gensalt.c?only_with_tag=CRYPT_BLOWFISH_1_020060602-01-UUnspecified vulnerability in the Lexmark Printer Sharing LexBce Server Service (LexPPS), possibly 8.29 and 9.41, allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: This information is based on a vague initial disclosure; details will be updated after the grace period has ended.lexmark-lexpps-code-execution(24581)ADV-2006-048120060207 High Risk Vulnerability in Lexmark Printer Sharing Service101559318744Cross-site scripting (XSS) vulnerability in PHP-Fusion before 6.00.304 allows remote attackers to inject arbitrary web script or HTML via the (1) shout_name field in shoutbox_panel.php and the (2) comments field in comments_include.php.ADV-2006-0463http://www.php-fusion.co.uk/news.php?readmore=307phpfusion-multiple-xss(24548)16548http://www.php-fusion.co.uk/downloads.php?cat_id=3229812298018949Multiple stack-based buffer overflows in elogd.c in elog before 2.5.7 r1558-4 allow attackers to cause a denial of service (application crash) and possibly execute code via long "revision attributes".DSA-9671878316579http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=349528http://bugs.debian.org/cgi-bin/bugreport.cgi/0001-r1333-Fixed-crashes-with-very-long-revisions-attributes.txt?bug=349528;msg=15;att=1elog-elogd-bo(24704)Buffer overflow in elogd.c in elog before 2.5.7 r1558-4 allows attackers to execute code via unspecified variables, when writing to the log file.16579DSA-96718783http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=349528http://bugs.debian.org/cgi-bin/bugreport.cgi/0002-r1335-Applied-patch-from-Emiliano-to-fix-possible-buffer-overflow.txt?bug=349528;msg=15;att=2elog-elogd-log-bo(24705)The (1) elog.c and (2) elogd.c components in elog before 2.5.7 r1558-4 generate different responses depending on whether or not a username is valid, which allows remote attackers to determine valid usernames.DSA-9671878316579http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=349528http://bugs.debian.org/cgi-bin/bugreport.cgi/0003-r1472-Do-not-distinguish-between-invalid-user-name-and-invalid-password.txt?bug=349528;msg=15;att=3elog-elog-elogd-user-enumeration(24706)elog before 2.5.7 r1558-4 allows remote attackers to cause a denial of service (infinite redirection) via a request with the fail parameter set to 1, which redirects to the same request.DSA-9671878316579http://savannah.psi.ch/viewcvs/trunk/src/elogd.c?root=elog&rev=1487&view=diff&r1=1487&r2=1486&p1=trunk/src/elogd.c&p2=/trunk/src/elogd.chttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=349528elog-fail-redirect-dos(24707)Multiple SQL injection vulnerabilities in Hinton Design phphg Guestbook 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) username parameter to check.php or the id parameter to (2) admin/edit_smilie.php, (3) admin/add_theme.php, (4) admin/ban_ip.php, (5) admin/add_lang.php, or (6) admin/edit_filter.php.ADV-2006-04801654120060211 [eVuln] phphg Guestbook Multiple Vulnerabilities101562018758http://evuln.com/vulns/58/summary.htmlMultiple cross-site scripting vulnerabilities in signed.php in Hinton Design phphg Guestbook 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) location, (2) website, or (3) message parameter.18758ADV-2006-04801654120060211 [eVuln] phphg Guestbook Multiple Vulnerabilities1015620http://evuln.com/vulns/58/summary.htmlcheck.php in Hinton Design phphg Guestbook 1.2 does not check the user password when authenticating via cookies, which allows remote attackers to gain unauthorized access.ADV-2006-04801654120060211 [eVuln] phphg Guestbook Multiple Vulnerabilities101562018758http://evuln.com/vulns/58/description.htmlMultiple cross-site scripting (XSS) vulnerabilities in Unknown Domain Shoutbox 2005.07.21 allow remote attackers to inject arbitrary web script or HTML, possibly via the (1) Handle or (2) Message fields.ADV-2006-047618759http://evuln.com/vulns/55/summary.htmlshoutbox-multiple-xss(24440)1654320060209 [eVuln] Unknown Domain Shoutbox multiple XSS & SQL Injection VulnerabilitiesSQL injection vulnerability in Unknown Domain Shoutbox 2005.07.21 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.ADV-2006-047618759http://evuln.com/vulns/55/summary.html1654320060209 [eVuln] Unknown Domain Shoutbox multiple XSS & SQL Injection Vulnerabilitiescheck.php in Hinton Design phphd 1.0 does not check passwords when certain cookies are provided, which allows remote attackers to bypass authentication.phphd-check-security-bypass(24510)http://www.evuln.com/vulns/60/summary.html1658620060212 [eVuln] phphd Multiple Vulnerabilities2302618793Multiple SQL injection vulnerabilities in Hinton Design phphd 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the username parameter to check.php or (2) unknown attack vectors to scripts that display information from the database.phphd-multiple-sql-injection(24515)phphd-check-sql-injection(24508)http://www.evuln.com/vulns/60/summary.html1658620060212 [eVuln] phphd Multiple Vulnerabilities230282302518793Cross-site scripting (XSS) vulnerability in add.php in Hinton Design phphd 1.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.phphd-add-xss(24513)http://www.evuln.com/vulns/60/summary.html1658620060212 [eVuln] phphd Multiple Vulnerabilities2302718793Multiple SQL injection vulnerabilities in 2200net Calendar system 1.2, with gpc_magic_quotes disabled, allow remote attackers to execute arbitrary SQL commands and bypass authentication via (1) the fm_data[id] parameter to calendar.php and (2) the $ad['acc'] variable in adminlogin.php.2200net-adminlogin-sql-injection(24484)2200net-calendar-sql-injection(24483)ADV-2006-0486http://www.evuln.com/vulns/62/summary.html1656920060215 [eVuln] 2200net Calendar system SQL Injection and Authentication Bypass Vulnerabilities23038230371878120060215 [eVuln] 2200net Calendar system SQL Injection and AuthenticationDirectory traversal vulnerability in compose.pl in @Mail 4.3 and earlier for Windows allows remote attackers to upload arbitrary files to arbitrary locations via a .. (dot dot) in the unique parameter.18646http://kb.atmail.com/view_article.php?num=374ADV-2006-04151647022882Powersave daemon before 0.10.15.2 allows local users to gain privileges (unauthorized access to an X session) via unspecified vectors. NOTE: the provenance of this information is unknown; portions of the details are obtained from third party information.http://sourceforge.net/project/shownotes.php?release_id=379792&group_id=12457618651powersave-daemon-gain-privileges(24458)ADV-2006-041616469Unspecified vulnerability in Java Web Start after 1.0.1_02, as used in J2SE 5.0 Update 5 and earlier, allows remote attackers to obtain privileges via unspecified vectors involving untrusted applications.VU#65263610217018762ADV-2006-1398ADV-2006-0468javawebstart-jnlp-privilege-elevation(24568)165401015597http://docs.info.apple.com/article.html?artnum=303658Unspecified vulnerability in Sun Java JDK and JRE 5.0 Update 3 and earlier, SDK and JRE 1.3.x through 1.3.1_16 and 1.4.x through 1.4.2_08 allows remote attackers to bypass Java sandbox security and obtain privileges via unspecified vectors involving the reflection APIs, aka the "first issue."VU#75999610217118760ADV-2006-1398ADV-2006-0828ADV-2006-0467sun-jre-reflection-privilege-elevation(24561)GLSA-200602-07101559618884http://docs.info.apple.com/article.html?artnum=303658Multiple unspecified vulnerabilities in Sun Java JDK and JRE 5.0 Update 4 and earlier, SDK and JRE 1.4.x through 1.4.2_09 allow remote attackers to bypass Java sandbox security and obtain privileges via unspecified vectors involving the reflection APIs, aka the "second and third issues."VU#75999610217118760ADV-2006-1398ADV-2006-0828ADV-2006-0467sun-jre-reflection-privilege-elevation(24561)GLSA-200602-07101559618884http://docs.info.apple.com/article.html?artnum=303658Unspecified vulnerability in Sun Java JDK and JRE 5.0 Update 4 and earlier allows remote attackers to bypass Java sandbox security and obtain privileges via unspecified vectors involving the reflection APIs, aka the "fourth issue."VU#75999610217118760ADV-2006-1398ADV-2006-0828ADV-2006-0467sun-jre-reflection-privilege-elevation(24561)GLSA-200602-07101559618884http://docs.info.apple.com/article.html?artnum=303658Multiple unspecified vulnerabilities in Sun Java JDK and JRE 5.0 Update 5 and earlier allow remote attackers to bypass Java sandbox security and obtain privileges via unspecified vectors involving the reflection APIs, aka the "fifth, sixth, and seventh issues."VU#75999610217118760ADV-2006-1398ADV-2006-0828ADV-2006-0467sun-jre-reflection-privilege-elevation(24561)GLSA-200602-07101559618884http://docs.info.apple.com/article.html?artnum=303658Format string vulnerability in fontsleuth in QNX Neutrino RTOS 6.3.0 allows local users to execute arbitrary code via format string specifiers in the zeroth argument (program name).ADV-2006-047420060207 QNX Neutrino RTOS fontsleuth Command Format String Vulnerability18750qnx-fontsleuth-format-string(24559)16539229661015599Multiple stack-based buffer overflows in QNX Neutrino RTOS 6.3.0 allow local users to execute arbitrary code via long (1) ABLPATH or (2) ABLANG environment variables in the libAP library (libAp.so.2) or (3) a long PHOTON_PATH environment variable to the setitem function in the libph library.qnx-libap-bo(24558)qnx-libph-bo(24557)ADV-2006-047416539229652296420060207 QNX Neutrino RTOS libph PHOTON_PATH Buffer Overflow Vulnerability20060207 QNX Neutrino RTOS libAp ABLPATH Buffer Overflow Vulnerability101559918750Race condition in phfont in QNX Neutrino RTOS 6.2.1 allows local users to execute arbitrary code via unspecified manipulations of the PHFONT and PHOTON2_PATH environment variables.ADV-2006-047420060207 QNX Neutrino RTOS phfont Race Condition Vulnerability18750qnx-phfont-race-condition(24555)16539229631015599Multiple buffer overflows in QNX Neutrino RTOS 6.2.0 allow local users to execute arbitrary code via a long first argument to the (1) su or (2) passwd commands.ADV-2006-047420060207 QNX Neutrino RTOS passwd Command Buffer Overflow20060207 QNX Neutrino RTOS su Command Buffer Overflow18750qnx-su-bo(24554)qnx-passwd-bo(24551)1653922961229591015599QNX Neutrino RTOS 6.3.0 allows local users to cause a denial of service (hang) by supplying a "break *0xb032d59f" command to gdb.qnx-gdb-dos(24553)ADV-2006-0474165392296020060207 QNX RTOS 6.3.0 Local Denial of Service Vulnerability101559818750QNX Neutrino RTOS 6.3.0 ships /etc/rc.d/rc.local with world-writable permissions, which allows local users to modify the file and execute arbitrary code at system startup.ADV-2006-047420060207 QNX RTOS 6.3.0 rc.local Insecure File Permissions Vulnerability18750qnx-rclocal-root-privileges(24552)16539229581015598SQL injection vulnerability in check.asp in Whomp Real Estate Manager XP 2005 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.ADV-2006-04891654420060208 Whomp Real Estate Manager XP 2005 Sql Injectionwhomp-login-sql-injection(24592)2296941818780Directory traversal vulnerability in Spip_RSS.PHP in SPIP 1.8.2g and earlier allows remote attackers to read or include arbitrary files via ".." sequences in the GLOBALS[type_urls] parameter, which could then be used to execute arbitrary code via resultant direct static code injection in the file parameter to spip_acces_doc.php3.ADV-2006-048316556http://retrogod.altervista.org/spip_182g_shell_inj_xpl.htmlspip-rss-file-include(24600)23086101560218676SQL injection vulnerability in spip_acces_doc.php3 in SPIP 1.8.2g and earlier allows remote attackers to execute arbitrary SQL commands via the file parameter.ADV-2006-048316551http://retrogod.altervista.org/spip_182g_shell_inj_xpl.htmlspip-access-doc-sql-injection(24599)23087101560218676Cross-site scripting (XSS) vulnerability in Clever Copy 2.0, 2.0a, and 3.0 allows remote attackers to inject arbitrary web script or HTML via the (1) Referer or (2) X-Forwarded-For headers in an HTTP request, which are not properly handled when the administrator accesses Site Stats.clevercopy-script-xss(24524)ADV-2006-04951660720060212 [eVuln] Clever Copy 'Referer' & 'X-Forwarded-For' XSS Vulnerabilitieshttp://www.evuln.com/vulns/64/summary.html18790myquiz.pl in Dale Ray MyQuiz 1.01 allows remote attackers to execute arbitrary commands via shell metacharacters in the URL, which are not properly handled as part of the PATH_INFO environment variable.http://www.evuln.com/vulns/57/summary.htmlhttp://www.corantodemo.net/coranto/viewnews.cgi?id=EpApAAAVkyirPGThSf&style=dldetailsADV-2006-044320060203 [eVuln] MyQuiz Arbitrary Command Execution Vulnerabilitymyquiz-pathinfo-command-execution(24501)20060207 MyQuiz Arbitrary Command Execution Exploit (perl)229254091873720060209 Vendor ACK for MyQuizUnspecified vulnerability in AOL Instant Messenger (AIM) 5.9.3861 allows user-assisted remote attackers to cause a denial of service (client crash) and possibly execute arbitrary code by tricking the user into requesting Buddy Info about a long screen name, which might cause a buffer overflow.aim-buddy-info-bo(24362)20060203 Re: AOL Instant Messenger Version 5.9.3861 Local Buffer Overrun Vulnerability20060203 AOL Instant Messenger Version 5.9.3861 Local Buffer Overrun Vulnerability20060129 AOL Instant Messenger 5.9.3861 Local Buffer Overrun VulnerabilityRITLabs The Bat! before 3.0.0.15 displays certain important headers from encapsulated data in message/partial MIME messages, instead of the real headers, which is in violation of RFC2046 header merging rules and allows remote attackers to spoof the origin of e-mail by sending a fragmented message, as demonstrated using spoofed Received: and Message-ID: headers.https://www.ritlabs.com/bt/bug_view_advanced_page.php?bug_id=000302920060206 SECURITY.NNOV: The Bat! 2.x message headers spoofinghttp://www.security.nnov.ru/advisories/thebatspoof.aspthebat-message-header-spoofing(24535)165151871320060206 SECURITY.NNOV: The Bat! 2.x message headers spoofingCRLF injection vulnerability in mailback.pl in Erik C. Thauvin mailback allows remote attackers to use mailback as a "spam proxy" by modifying mail headers, including recipient e-mail addresses, via newline characters in the Subject field.2295518748mailback-mail-relay(24540)ADV-2006-0459http://vc.thauvin.net/cvs/cgi/mailback/mailback.pl?view=log20060210 Re: mailback script exploit20060205 mailback script exploitThe gen_rand_string function in phpBB 2.0.19 uses insufficiently random data (small value space) to create the activation key ("validation ID") that is sent by e-mail when establishing a password, which makes it easier for remote attackers to obtain the key and modify passwords for existing accounts or create new accounts.ADV-2006-046120060205 Easily exploitable Pseudo Random Number generator in phpbb version 2.0.19 and under.http://www.r-security.net/tutorials/view/readtutorial.php?id=4phpbb-weak-rnd(24573)2294918727The make_password function in ipsclass.php in Invision Power Board (IPB) 2.1.4 uses random data generated from partially predictable seeds to create the authentication code that is sent by e-mail to a user with a lost password, which might make it easier for remote attackers to guess the code and change the password for an IPB account, possibly involving millions of requests.http://www.r-security.net/tutorials/view/readtutorial.php?id=4http://forums.invisionpower.com/lofiversion/index.php/t200085.htmlBorland C++Builder 6 (BCB6) with Update Pack 4 Enterprise edition (ent_upd4) evaluates the "i>sizeof(int)" expression to false when i equals -1, which might introduce integer overflow vulnerabilities into applications that could be exploited by context-dependent attackers.bcb-compiler-integer-overflow(24514)http://www.xfocus.net/releases/200602/a849.html20060206 [xfocus-SD-060206]BCB compiler incorrect deal sizeof operator vulnerability229531015588Tiny C Compiler (TCC) 0.9.23 (aka TinyCC) evaluates the "i>sizeof(int)" expression to false when i equals -1, which might introduce integer overflow vulnerabilities into applications that could be exploited by context-dependent attackers.20060207 Re: [xfocus-SD-060206]BCB compiler incorrect deal sizeof operator vulnerability22956desktop.php in eyeOS 0.8.9 and earlier tests for the existence of the _SESSION variable before calling the session_start function, which allows remote attackers to execute arbitrary PHP code and possibly conduct other attacks by modifying critical assumed-immutable variables, as demonstrated using PHP code in the _SESSION[apps][eyeOptions.eyeapp][wrapup] variable.20060207 eyeOS <= 0.8.9 Remote Code Executionhttp://www.gulftech.org/?node=research&article_id=00096-02072006ADV-2006-0466eyeos-desktop-file-include(24569)16537101560941918757Buffer overflow in cram.dll in QUALCOMM Eudora WorldMail 3.0 allows remote attackers to execute arbitrary code via an IMAP APPEND command with a long message literal argument, as demonstrated by Worldmail.pl. NOTE: this is a different vector and a different manipulation than CVE-2005-4267, so it might be a different vulnerability than CVE-2005-4267.20060204 (OLD) Eudora WorldMail 3.0 Windows 2000 Remote System ExploitSQL injection vulnerability in moderation.php in MyBB (aka MyBulletinBoard) 1.0.3 allows remote authenticated users, with certain privileges for moderating and merging posts, to execute arbitrary SQL commands via the posts parameter.ADV-2006-04751653820060207 [myimei]MyBB1.0.3~moderation.php~SqlInject while merging posts2295718754http://myimei.com/security/2006-02-07/mybb103moderationphpsqlinject-while-merging-posts.htmlCross-site scripting (XSS) vulnerability in search.php in MyBB (aka MyBulletinBoard) 1.0.2 allows remote attackers with knowledge of the table prefix to inject arbitrary web script or HTML via a URL encoded value of the keywords parameter, as demonstrated by %3Cscript%3E.http://myimei.com/security/2006-01-14/mybb-102searchphpxss-attackandmore.html20060208 Re: [myimei]MyBB 1.0.2 XSS attack in search.php20060207 [myimei]MyBB 1.0.2 XSS attack in search.phpmybb-search-xss(24466)Orbicule Undercover allows attackers with physical or root access to disable the protection by using the chmod command to change the permissions of the /private/etc/uc.app/Contents/MacOS/uc file, which prevents the service from being started in LaunchDaemon.20060202 Issues with security software: orbicule.com "Undercover"Orbicule Undercover uses a third-party web server to determine the IP address through which the computer is accessing the Internet, but does not document this third-party disclosure, which leads to a potential privacy leak that might allow transmission of sensitive information to an unintended remote destination.20060202 Issues with security software: orbicule.com "Undercover"Trend Micro ServerProtect 5.58, and possibly InterScan Messaging Security Suite and InterScan Web Security Suite, have a default configuration setting of "Do not scan compressed files when Extracted file count exceeds 500 files," which may be too low in certain circumstances, which allows remote attackers to bypass anti-virus checks by sending compressed archives containing many small files. NOTE: since this is related to a configuration setting that has an operational impact that might vary depending on the environment, and the product is claimed to report a message when the compressed file exceeds specified limits, perhaps this should not be included in CVE.20060205 RE: Trend Micro ServerProtect version 5.58 can be easily circumvented via the mechanism that limits how many files to scan.20060203 Re: Trend Micro ServerProtect version 5.58 can be easily circumvented via the mechanism that limits how many files to scan.20060203 Re: Trend Micro ServerProtect version 5.58 can be easily circumvented via the mechanism that limits how many files to scan.20060203 Trend Micro ServerProtect version 5.58 can be easily circumvented via the mechanism that limits how many files to scan.http://www.packetstormsecurity.org/filedesc/Bypass.pdf.htmlhttp://www.packetstormsecurity.org/0602-advisories/Bypass.pdfserverprotect-file-scanning-bypass(24658)1648320060206 Fwd: Trend Micro ServerProtect version 5.58 can be easily circumvented via the mechanism that limits how many files to scan.Cross-site scripting (XSS) vulnerability in WiredRed e/pop Web Conferencing 4.1.0.755 allows remote authenticated users to inject arbitrary web script or HTML via the topic name of a conference.ADV-2006-05051654220060208 WiredRed EPOP XSS Vulnerabilityepop-topic-xss(24609)2299742118753Multiple directory traversal vulnerabilities in install.php in CPG-Nuke Dragonfly CMS (aka CPG Dragonfly CMS) 9.0.6.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in (1) the newlang parameter and (2) the installlang parameter in a cookie, as demonstrated by using error.php to insert malicious code into a log file, or uploading a malicious .png file, which is then included using install.php.1654620060208 CPGNuke Dragonfly 9.0.6.1 remote commands execution through arbitrary local inclusion230581015601http://retrogod.altervista.org/dragonfly9.0.6.1_incl_xpl.htmlhttp://dragonflycms.org/Forums/viewtopic/p=98034.html#98034http://dragonflycms.org/Forums/viewtopic/p=98034.htmlcpg-dragonfly-file-include(24660)Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via "out-of-bounds access" caused by invalid input, as demonstrated by the ProtoVer SSL test suite.ADV-2006-049620060209 ProtoVer SSL: GnuTLShttp://www.gleg.net/protover_ssl.shtmloval:org.mitre.oval:def:10540[gnutls-dev] 20060209 GnuTLS 1.3.4 - Experimental - Security release[gnutls-dev] 20060209 GnuTLS 1.2.10 - Security release[gnutls-dev] 20060209 Libtasn1 0.2.18 - Tiny ASN.1 Library - Security releasehttp://josefsson.org/gnutls/releases/libtasn1/libtasn1-0.2.18-from-0.2.17.patchhttp://josefsson.org/cgi-bin/viewcvs.cgi/libtasn1/NEWS?root=gnupg-mirror&view=markuphttp://josefsson.org/cgi-bin/viewcvs.cgi/gnutls/tests/certder.c?view=markupgnutls-libtasn1-der-dos(24606)USN-251-12006-000816568FEDORA-2006-10723054MDKSA-2006:039GLSA-200602-08DSA-986DSA-98510156124461909219080189181889818832188301881518794RHSA-2006:0207ld in SUSE Linux 9.1 through 10.0, and SLES 9, in certain circumstances when linking binaries, can leave an empty RPATH or RUNPATH, which allows local attackers to execute arbitrary code as other users via by running an ld-linked application from the current directory, which could contain an attacker-controlled library file.SUSE-SA:2006:0071658118811LDAP service in Sun Java System Directory Server 5.2, running on Linux and possibly other platforms, allows remote attackers to cause a denial of service (memory allocation error) via an LDAP packet with a crafted subtree search request, as demonstrated using the ProtoVer LDAP test suite.ADV-2006-049218769[Dailydave] 20060210 ??? Sun Directory Server 5.2 fun ???[Dailydave] 20060208 Sun Directory Server 5.2 funsun-java-ldap-dos(24605)165501022941015604Multiple directory traversal vulnerabilities in PHP iCalendar 2.0.1, 2.1, and 2.2 allow remote attackers to include arbitrary files via the (1) getdate and possibly other parameters used in the replace_files function in search.php and (2) $file variable as used in the parse function in functions/template.php.20060208 [eVuln] PHP iCalendar File Inclusion Vulnerability18778http://evuln.com/vulns/70/summary.htmlADV-2006-049316557http://phpicalendar.net/forums/viewtopic.php?t=396phpicalendar-template-search-file-include(24591)420Cross-site scripting (XSS) vulnerability in DataparkSearch before 4.37 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.18751ADV-2006-0488http://www.dataparksearch.org/ChangeLogdataparksearch-scripts-xss(24627)16572Cross-site scripting (XSS) vulnerability in cpaint2.inc.php in the CPAINT library before 2.0.3, as used in multiple scripts, allows remote attackers to inject arbitrary web script or HTML via the cpaint_response_type parameter, which is displayed in a resulting error message, as demonstrated using a hex-encoded IFRAME tag.cpaint-response-type-xss(24594)20060210 CPAINT AJAX Library Cross Site Scriptinghttp://www.gulftech.org/?node=research&article_id=00097-0209200618765ADV-2006-0487http://cpaint.booleansystems.com/forums/viewtopic.php?t=98165591015608SQL injection vulnerability in index.php in vwdev allows remote attackers to execute arbitrary SQL commands via the UID parameter in the definition Page.165471015594vwdev-uid-sql-injection(24583)22991WHMCompleteSolution (WHMCS) before 2.3 assigns incorrect permissions to "resellers", which allows remote authenticated users to perform privileged actions or obtain sensitive information. NOTE: this report is based on a vendor bug report that identified "incorrect permissions." However, the vendor did not label it a security issue, and there was no statement regarding whether or not the permissions were actually more permissive than intended. If in fact the permissions were more restrictive than intended, then this would be a functional problem but not a vulnerability.16560http://www.whmcs.com/changelog.phpADV-2006-0484whmcs-resellers-insecure-permissions(24597)Multiple SQL injection vulnerabilities in Hinton Design phpht Topsites 1.3 allow remote attackers to execute arbitrary SQL commands via multiple vectors including the username parameter.18782http://evuln.com/vulns/59/summary.html1656220060211 [eVuln] phpht Topsites Multiple Vulnerabilitiescheck.php in Hinton Design phpht Topsites 1.3 does not validate passwords when using cookies, which allows remote attackers to bypass authentication via unspecified cookies.18782http://evuln.com/vulns/59/summary.html1656220060211 [eVuln] phpht Topsites Multiple VulnerabilitiesMultiple cross-site scripting (XSS) vulnerabilities in (1) link_edited.php and (2) link_added.php in Hinton Design phpht Topsites 1.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.18782http://evuln.com/vulns/59/summary.html1656220060211 [eVuln] phpht Topsites Multiple VulnerabilitiesDirectory traversal vulnerability in HP Systems Insight Manager 4.2 through 5.0 SP3 for Windows allows remote attackers to access arbitrary files via unspecified vectors, a different vulnerability than CVE-2005-2006.HPSBMA02096SSRT061108ADV-2006-049716571187891015605Cross-site scripting (XSS) vulnerability in Softcomplex PHP Event Calendar 1.5 allows remote authenticated users to inject arbitrary web script or HTML, and corrupt data, via the (1) username and (2) password parameters, which are not sanitized before being written to users.php. NOTE: while this issue was originally reported as XSS, the primary issue might be direct static code injection with resultant XSS.ADV-2006-050718792http://evuln.com/vulns/63/summary.htmlphpeventcalendar-users-xss(24523)165882307223071442Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunCMS, allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions that are not listed in the Config[DeniedExtensions][File], such as .php.txt.Per: http://cwe.mitre.org/data/definitions/184.html
'CWE-184: Incomplete Blacklist'ADV-2006-050220060209 runCMS <= 1.3a2 possible remote code execution through the integrated FCKEditor package370218767http://retrogod.altervista.org/fckeditor_22_xpl.htmlMultiple PHP remote file include vulnerabilities in RunCMS 1.2 and earlier, with register_globals and allow_url_fopen enabled, allow remote attackers to execute arbitrary code via the bbPath[path] parameter in (1) class.forumposts.php and (2) forumpollrenderer.php.Successful exploitation requires that both "register_globals" and "allow_url_fopen" are enabled.1657818800ADV-2006-050320060209 runCMS <= 1.3a2 possible remote code execution through the integrated FCKEditor packagehttp://retrogod.altervista.org/runcms_13a_xpl.htmlMultiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to (1) read arbitrary files or trigger an error message path disclosure via ".." or invalid names in the archive parameter to index.php, or (2) include arbitrary files via the template parameter to show_archives.php.18768ADV-2006-050616580http://www.hamid.ir/security/farsinews2-5.txthttp://forum.farsinewsteam.com/index.php?showtopic=76http://forum.farsinewsteam.com/index.php?showtopic=71farsinews-index-directory-traversal(24602)farsinews-showarchives-file-include(24598)20060210 FarsiNews 2.5 Multiple Vulnerabilities230222302123020Cross-site scripting (XSS) vulnerability in Scriptme SmE GB Host 1.21 and SmE Blog Host allows remote attackers to inject arbitrary web script or HTML via the BBcode url tag.ADV-2006-05041658518786http://evuln.com/vulns/65/summary.htmlsme-bbcode-xss(24543)447Cross-site scripting (XSS) vulnerability in Lotus Domino iNotes Client 6.5.4 allows remote attackers to inject arbitrary web script or HTML via email with attached html files, which are directly rendered in the browser.http://secunia.com/secunia_research/2005-38/advisory/16340ADV-2006-0499domino-webaccess-subject-xss(24612)1657723077http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg212299191015610Multiple cross-site scripting (XSS) vulnerabilities in Lotus Domino iNotes Client 6.5.4 and 7.0 allow remote attackers to inject arbitrary web script or HTML via (1) an email subject; (2) an encoded javascript URI, as demonstrated using "java script:"; or (3) when the Domino Web Access ActiveX control is not installed, via an email attachment filename.This vulnerability is addressed in the following product releases:
IBM, Lotus Domino iNotes Client, 6.5.5
IBM, Lotus Domino iNotes Client, 7.0.1domino-webaccess-filename-xss(24614)domino-webaccess-javascript-xss(24613)domino-webaccess-attachment-xss(24611)16577230792307823077http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg212299191015610http://secunia.com/secunia_research/2005-38/advisory/16340ADV-2006-0499Cross-site scripting (XSS) vulnerability in config_defaults_inc.php in Mantis before 1.0 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. An original vendor bug report is referenced, but not accessible to the general public.16561ADV-2006-0485mantis-configdefaultsinc-xss(24585)DSA-113321400Unspecified vulnerability in (1) query_store.php and (2) manage_proj_create.php in Mantis before 1.0.0 has unknown impact and attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. An original vendor bug report is referenced, but not accessible to the general public.16561ADV-2006-0485DSA-113321400Unspecified vulnerability in the (1) unix_mp and (2) unix_64 kernels in IBM AIX 5.3 VRMF 5.3.0.30 through 5.3.0.33 allows local users to cause a denial of service (system crash) via unknown vectors related to EMULATE_VMX.1662418795ADV-2006-057323127IY79595aix-kernel-dos(24711)lscfg in IBM AIX 5.2 and 5.3 allows local users to modify arbitrary files via a symlink attack.1015622ADV-2005-2096IY77638IY77624SQL injection vulnerability in index.php in PwsPHP 1.2.3 allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly in message.php in the espace_membre module. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.19023http://www.securityfocus.com/bid/16567/exploit16567** DISPUTED ** Multiple SQL injection vulnerabilities in archive.asp in GA's Forum Light allow remote attackers to execute arbitrary SQL commands via the (1) Forum and (2) pages parameter. NOTE: SecurityTracker says that the vendor has disputed this issue, saying that GA Forum Light does not use an SQL database. SecurityTracker's research indicates that the original problem could be due to a vbscript parsing error based on invalid arguments.1656320060220 vendor dispute for CVE-2006-06691015600gasforumlight-archive-sql-injection(24616)23509Buffer overflow in l2cap.c in hcidump 1.29 allows remote attackers to caues a denial of service (crash) through a wireless Bluetooth connection via a malformed Logical Link Control and Adaptation Protocol (L2CAP) packet.hcidump-bluetooth-dos(24533)ADV-2006-047920060206 [ Secuobs - Advisory ] Bluetooth : DoS on hcidump 1.29 + PoChttp://www.secuobs.com/news/05022006-bluetooth9.shtml#english1874120060206 [ Secuobs - Advisory ] Bluetooth : DoS on hcidumpUSN-256-123056MDKSA-2006:041DSA-9904651912218971Buffer overflow in Sony Ericsson K600i, V600i, W800i, and T68i cell phone allows remote attackers to caues a denial of service (reboot or shutdown) through a wireless Bluetooth connection via a malformed Logical Link Control and Adaptation Protocol (L2CAP) packet whose length field is less than the actual length of the packet.sony-bluetooth-dos(24534)ADV-2006-0478http://www.secuobs.com/news/05022006-bluetooth7.shtml#english1874720060206 [Full-disclosure] [ Secuobs - Advisory ] Bluetooth : DoS on20060206 [ Secuobs - Advisory ] Bluetooth : DoS on Sony/Ericsson cell phones16512Unspecified vulnerability in HP PSC 1210 All-in-One Drivers before 1.0.06 has unknown impact and attack vectors.1658318770http://h10025.www1.hp.com/ewfrf/wc/softwareDownloadIndex?dlc=en&lc=en&os=228%20&product=90764&lang=en&cc=us&softwareitem=oj-37641-1ADV-2006-0498Multiple SQL injection vulnerabilities in cms/index.php in Magic Calendar Lite 1.02, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the (1) $total_login and (2) $total_password parameter.magiccalendar-index-sql-injection(24588)ADV-2006-0525http://evuln.com/vulns/71/summary.html167341664620060220 [eVuln] Magic Calendar Lite Authentication Bypass101565045918855Buffer overflow in the arp command of IBM AIX 5.3 L, 5.3, 5.2.2, 5.2 L, and 5.2 allows local users to cause a denial of service (crash) via a long iftype argument.16584ADV-2006-0531IY81476IY81424aix-arp-iftype-bo(24628)18773Cross-site scripting (XSS) vulnerability in search.php in Siteframe 5.0.1 allows remote attackers to inject arbitrary web script or HTML via the q parameter.ADV-2006-0533http://siteframe.org/p/xss_vulnerability_in_siteframe_50118804http://kiki91.altervista.org/exploit/siteframe5.0.1a_xss.txtsiteframe-search-request-xss(24649)1659620060212 Siteframe Beaumont 5.0.1a <== Cross-Site Scripting VulnerabilityCross-site scripting (XSS) vulnerability in header.php in PHP-Nuke 6.0 to 7.8 allows remote attackers to inject arbitrary web script or HTML via the pagetitle parameter.http://www.waraxe.us/advisory-44.htmlADV-2006-054218820phpnuke-header-xss(24650)1660820060214 [waraxe-2006-SA#044] - XSS in phpNuke 7.8 and older versions425telnetd in Heimdal 0.6.x before 0.6.6 and 0.7.x before 0.7.2 allows remote unauthenticated attackers to cause a denial of service (server crash) via unknown vectors that trigger a null dereference.[heimdal-discuss] 20060206 Heimdal 0.7.2 and 0.6.6ADV-2006-0653ADV-2006-0628ADV-2006-0456heimdal-telnetd-dos(24763)USN-253-116676SUSE-SA:2006:01123244DSA-977449190051896118894PostgreSQL 7.3.x before 7.3.14, 7.4.x before 7.4.12, 8.0.x before 8.0.7, and 8.1.x before 8.1.3, when compiled with Asserts enabled, allows local users to cause a denial of service (server crash) via a crafted SET SESSION AUTHORIZATION command, a different vulnerability than CVE-2006-0553.18890postgresql-setsessionauth-dos(24719)ADV-2006-0605USN-258-12006-0008166501015636http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-3OpenPKG-SA-2006.0044981903519015SQL injection vulnerability in index.php in the Your_Account module in PHP-Nuke 7.8 and earlier allows remote attackers to execute arbitrary SQL commands via the username variable (Nickname field).ADV-2006-063644044020060216 Critical SQL Injection PHPNuke <= 7.8 - Your_Account module20060216 Critical SQL Injection PHPNuke <= 7.8 - Your_Account modulephpnuke-youraccount-sql-injection(24769)1669120060216 Critical SQL Injection PHPNuke <= 7.8 - Your_Account module2325918931Unspecified vulnerability in WebGUI before 6.8.6-gamma allows remote attackers to create an account, when anonymous registration is disabled, via a certain URL.18819ADV-2006-0541http://www.plainblack.com/getwebgui/advisories/webgui-6.8.6-gamma-releasedwebgui-anonymous-bypass-security(24695)16612Format string vulnerability in powerd.c in Power Daemon (powerd) 2.0.2 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the WHATIDO variable.ADV-2006-054518841http://gotfault.net/research/advisory/gadv-powerd.txtpowerdaemon-syslog-format-string(24713)16582Multiple cross-site scripting (XSS) vulnerabilities in bbcodes system in e107 before 0.7.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.18816ADV-2006-0540http://e107.org/comment.php?comment.news.776e107-bbcode-xss(24625)16614Cross-site scripting (XSS) vulnerability in Virtual Hosting Control System (VHCS) 2.4.7.1 with v.1 patch and earlier allows remote attackers to inject arbitrary web script or HTML via the username, which is recorded in a log file but not properly handled when the administrator uses the admin log utility to read the log file.18799ADV-2006-05341660020060211 RS-2006-1: Multiple flaws in VHCS 2.xhttp://www.rs-labs.com/adv/RS-Labs-Advisory-2006-1.txtvhcs-admin-xss(24664)change_password.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not verify the old password when a user changes the password, which may allow remote attackers to gain unauthorized access.18799ADV-2006-05341660020060211 RS-2006-1: Multiple flaws in VHCS 2.xhttp://www.rs-labs.com/adv/RS-Labs-Advisory-2006-1.txtvhcs-change-password-weakness(24665)The check_login function in login.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not exit when authentication fails, which allows remote attackers to gain unauthorized access.18799ADV-2006-05341660020060211 RS-2006-1: Multiple flaws in VHCS 2.xhttp://www.rs-labs.com/adv/RS-Labs-Advisory-2006-1.txtvhcs-checklogin-auth-bypass(24666)add_user.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not check user privileges when adding a new administrative user, which allows remote attackers to gain unauthorized access.18799ADV-2006-05341660020060211 RS-2006-1: Multiple flaws in VHCS 2.xhttp://www.rs-labs.com/adv/RS-Labs-Advisory-2006-1.txtvhcs-adduser-privilege-escalation(24667)430process.php in DocMGR 0.54.2 does not initialize the $siteModInfo variable when a direct request is made, which allows remote attackers to include arbitrary local files or possibly remote files via a modified includeModule and siteModInfo variable.ADV-2006-054418803http://retrogod.altervista.org/docmgr_0542_incl_xpl.htmldocmgr-process-file-include(24694)1660120060212 DocMGR <= 0.54.2 arbitrary remote inclusion428PHP remote file include vulnerability in application.php in nicecoder.com indexu 5.0.0 and 5.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the base_path parameter.indexu-application-file-include(24603)ADV-2006-04941656520060209 [ECHO_ADV_27$2006] Indexu <= 5.0.1 Remote File Inclusion22989101560718752http://echo.or.id/adv/adv27-K-159-2006.txthttp://echo.or.id/adv/adv26-K-159-2006.txtCross-site scripting (XSS) vulnerability in the Registration Form in TTS Time Tracking Software 3.0 allows remote attackers to inject arbitrary web script or HTML via the UserName parameter.timetracking-registration-xss(24572)ADV-2006-0524http://www.evuln.com/vulns/69/summary.html1663020060219 [eVuln] Time Tracking Software Multiple Vulnerabilities18854Multiple SQL injection vulnerabilities in TTS Time Tracking Software 3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.timetracking-multiple-sql-injection(24571)ADV-2006-0524http://www.evuln.com/vulns/69/summary.html1663020060219 [eVuln] Time Tracking Software Multiple Vulnerabilities18854edituser.php in TTS Time Tracking Software 3.0 does not verify that the name and password are correct, which allows remote attackers to overwrite arbitrary data belonging to any account.timetracking-edituser-auth-bypass(24570)ADV-2006-0524http://www.evuln.com/vulns/69/summary.html167311663020060219 [eVuln] Time Tracking Software Multiple Vulnerabilities18854Multiple SQL injection vulnerabilities in Carey Briggs PHP/MYSQL Timesheet 1 and 2 allow remote attackers to execute arbitrary SQL commands via the (1) yr, (2) month, (3) day, and (4) job parameters in (a) index.php and (b) changehrs.php.The vendor has supplied a patch which is available at:
http://www.hotscripts.com/Detailed/51138.htmlphpmysqltimesheet-multiple-sql-injection(24567)ADV-2006-05221662020060217 [eVuln] PHP/MYSQL Timesheet Multiple SQL Injection Vulnerabilitieshttp://www.evuln.com/vulns/67/summary.html18822451Multiple SQL injection vulnerabilities in rb_auth.php in Roberto Butti CALimba 0.99.2 beta and earlier allow remote attackers to execute arbitrary SQL commands and bypass login authentication via the (1) login and (2) password parameters.calimba-rbauth-sql-injection(24578)ADV-2006-0523http://www.evuln.com/vulns/68/summary.html1663220060217 [eVuln] CALimba Authentication Bypass Vulnerability45318856Unspecified vulnerability in the loaders (load_*.php) in Ansilove before 1.03 allows remote attackers to read arbitrary files via unspecified vectors involving "converting files accessible by the webserver".http://sourceforge.net/project/shownotes.php?release_id=39282618810ADV-2006-0536ansilove-load-information-disclosure(24681)16603Ansilove before 1.03 does not filter uploaded file extensions, which allows remote attackers to execute arbitrary code by uploading arbitrary files with dangerous extensions, then accessing them directly in the upload directory.http://sourceforge.net/project/shownotes.php?release_id=39282618810ADV-2006-0536ansilove-filename-code-execution(24684)16603SQL injection vulnerability in Zen Cart before 1.2.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.http://sourceforge.net/project/shownotes.php?release_id=39288618801ADV-2006-0546zencart-multiple-sql-injection(24701)23110Zen Cart before 1.2.7 does not protect the admin/includes directory, which allows remote attackers to cause unknown impact via unspecified vectors, probably direct requests.http://sourceforge.net/project/shownotes.php?release_id=39288618801ADV-2006-0546Unspecified vulnerabilities in Zen Cart before 1.2.7 allow remote attackers to cause unknown impact via unspecified vectors related to "other attempted exploits" other than SQL injection.18801ADV-2006-0546http://sourceforge.net/project/shownotes.php?release_id=392886zencart-multiple-sql-injection(24701)Cross-site scripting (XSS) vulnerability in search.php in QWikiWiki 1.5, and possibly 1.5.1 and other versions, allows remote attackers to inject arbitrary web script or HTML via the query parameter.qwikiwiki-search-xss(24669)ADV-2006-05621663818814http://insecurity.altervista.org/index.php?m=02&y=06&entry=entry060213-221217imageVue 16.1 allows remote attackers to obtain folder permission settings via a direct request to dir.php, which returns an XML document that lists folders and their permissions.imagevue-multiple-information-disclosure(24641)ADV-2006-05701659420060211 imageVue16.1 upload vulnerability18802readfolder.php in imageVue 16.1 allows remote attackers to list directories via modified path and ext parameters.ADV-2006-05701659420060211 imageVue16.1 upload vulnerability18802imagevue-multiple-information-disclosure(24641)admin/upload.php in imageVue 16.1 allows remote attackers to upload arbitrary files to certain allowed folders via .. (dot dot) sequences in the path parameter. NOTE: due to the lack of details, the specific vulnerability type cannot be determined, although it might be due to directory traversal.ADV-2006-05701659420060211 imageVue16.1 upload vulnerability18802imagevue-upload-file-upload(24633)Unspecified vulnerability in index.php in imageVue 16.1 has unknown impact, probably a cross-site scripting (XSS) vulnerability involving the query string that is not quoted when inserted into style and body tags, as demonstrated using a bgcol parameter.ADV-2006-05701659420060211 imageVue16.1 upload vulnerability18802imagevue-index-sql-injection(24642)20061029 Re: imageVue16.1 upload vulnerability20060719 Re: imageVue16.1 upload vulnerability429iE Integrator 4.4.220114, when configured without a "bespoke error page" in acm.ini, allows remote attackers to obtain sensitive information via a URL that calls a non-existent .aspx script in the integrator/apps directory, which results in an error message that displays the installation path, web server name, IP, and port, session cookie information, and the IIS system username.ADV-2006-0568http://www.irmplc.com/advisory016.htm18813ieintegrator-error-information-disclosure(24714)Format string vulnerability in a logging function as used by various SFTP servers, including (1) AttachmateWRQ Reflection for Secure IT UNIX Server before 6.0.0.9, (2) Reflection for Secure IT Windows Server before 6.0 build 38, (3) F-Secure SSH Server for Windows before 5.3 build 35, (4) F-Secure SSH Server for UNIX 3.0 through 5.0.8, (5) SSH Tectia Server 4.3.6 and earlier and 4.4.0, and (6) SSH Shell Server 3.2.9 and earlier, allows remote authenticated users to execute arbitrary commands via unspecified vectors, involving crafted filenames and the stat command.VU#41924116625http://support.wrq.com/techdocs/1882.html10156191884318828sftp-logging-format-string(24651)ADV-2008-1008ADV-2006-0555ADV-2006-055416640GLSA-200703-132955224516SSRT080011SSRT080011Cross-site scripting vulnerability in eintrag.php in Gästebuch (Gastebuch) before 1.3.3 allows remote attackers to inject arbitrary web script or HTML via the URL, which is used in the homepage parameter.This vulnerability is addressed in the following product release:
Gastebuch, Gastebuch, 1.3.3gastebuch-homepage-xss(24670)166151884920060213 XSS vulnerability in guestbook-php-scriptADV-2006-0566http://www.php4scripte.de/index.phpPyBlosxom before 1.3.2, when running on certain webservers, allows remote attackers to read arbitrary files via an HTTP request with multiple leading / (slash) characters, which is accessed using the PATH_INFO variable.http://sourceforge.net/project/shownotes.php?release_id=39180018858ADV-2006-0571pyblosxom-pathinfo-information-disclosure(24730)16641Multiple buffer overflows in NullSoft Winamp 5.13 and earlier allow remote attackers to execute arbitrary code via (1) an m3u file containing a long URL ending in .wma, (2) a pls file containing a File1 field with a long URL ending in .wma, or (3) an m3u file with a long filename, variants of CVE-2005-3188 and CVE-2006-0476.ADV-2006-06131662320060213 New winamp m3u/pls .WMA & .M3U Extension overflows1015621winamp-m3u-filename-bo(24741)winamp-m3u-wma-bo(24740)winamp-pls-file1-bo(24739)492444http://forums.winamp.com/showthread.php?s=&threadid=238648Buffer overflow in Metamail 2.7-50 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via e-mail messages with a long boundary attribute, a different vulnerability than CVE-2004-0105.MDKSA-2006:04716611RHSA-2006:02171900018987ADV-2006-0565101565418796http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=352482metamail-boundary-bo(24702)SUSE-SR:2006:005GLSA-200603-16DSA-995193041922619130Double free vulnerability in isode.eddy in Isode M-Vault Server 11.3 allows remote attackers to execute arbitrary code via a crafted LDAP request, as demonstrated by ProtoVer Sample LDAP.isode-mvault-ldap-dos(24700)ADV-2006-05671663518818[Dailydave] 20060213 eddy 0dayThe (1) addfolder and (2) deletefolder functions in neomail-prefs.pl in NeoMail 1.28 do not validate the Session ID, which allows remote attackers to add and delete arbitrary files, when configured with homedirfolders and homedirspools disabled.http://sourceforge.net/project/shownotes.php?release_id=392562&group_id=287418785ADV-2006-0564http://secunia.com/secunia_research/2006-3/advisory/neomail-neomailprefs-bypass-security(24737)16651mail_html template in Squishdot 1.5.0 and earlier does not properly validate the (1) email and (2) title variables, which allows remote attackers to bypass spam filters by injecting SMTP headers, probably due to a CRLF injection vulnerability.ADV-2006-0551http://www.squishdot.org/1139510883squishdot-mailhtml-header-injection(24659)1666718868Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) lang parameter in docs/index.php and the language parameter in (2) install/install.php, (3) install/sec_stage_install.php, (4) install/third_stage_install.php, and (5) install/forth_stage_install.php. NOTE: direct static code injection is resultant from this issue, as demonstrated by inserting PHP code into the username, which is inserted into linpha.log, which is accessible from the directory traversal.ADV-2006-05351659220060211 Linpha <= 1.0 multiple arbitrary local inclusion18808http://retrogod.altervista.org/linpha_10_local.htmllinpha-index-file-include(24663)426Directory traversal vulnerability in the installation file (sql/install-0.9.7.php) in Flyspray 0.9.7 allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the adodbpath parameter.18847ADV-2006-05691661820060213 EGS Enterprise Groupware System 1.0 rc4 remote commands execution & FlySpray 0.9.7 remote commands executionhttp://retrogod.altervista.org/egs_10rc4_php5_incl_xpl.htmlflyspray-adodbpath-file-include(24735)432Cross-site scripting (XSS) vulnerability in sNews 1.3 allows remote attackers to inject arbitrary web script or HTML via the comment field.1664720060214 XSS bugs and SQL injection in sNewssnews-comment-xss(24674)20060214 XSS and SQL injection in sNewsSQL injection vulnerability in index.php in sNews 1.3 allows remote attackers to execute arbitrary SQL commands via the (1) category and (2) id parameters.1664720060214 XSS bugs and SQL injection in sNewssnews-index-sql-injection(24675)43120060214 XSS and SQL injection in sNewsIBM Tivoli Directory Server 6.0 allows remote attackers to cause a denial of service (crash) via a crafted LDAP request, as demonstrated by test 2532 in the ProtoVer Sample LDAP test suite.tivoli-directory-ldap-dos(24619)ADV-2006-05371659318779[Dailydave] 20060211 IBM Tivoli Directory Server 0dayhttp://www-1.ibm.com/support/docview.wss?uid=swg212308201015653The Internet Key Exchange version 1 (IKEv1) implementation in Avaya VSU 100, 2000, 7500, 10000, and CSU 5000, when running IPSec, allows remote attackers to cause a denial of service (crash) via certain IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the advisory, it is unclear which of CVE-2005-3666, CVE-2005-3667, and/or CVE-2005-3668 this issue applies to.VU#226364http://support.avaya.com/elmodocs2/security/ASA-2006-043.htm1661318836SQL injection vulnerability in member_login.php in PHP Classifieds 6.18 through 6.20 allows remote attackers to execute arbitrary SQL commands via the (1) username parameter, which is used by the E-mail address field, and (2) password parameter.ADV-2006-06001664220060214 SQL injection in PHP Classifieds 6.20http://www.deltascripts.com/board/viewtopic.php?id=723442418881Stack-based buffer overflow in Nullsoft Winamp 5.12 and 5.13 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted .m3u file that causes an incorrect strncpy function call when the player pauses or stops the file.16785101567520060223 NSFOCUS SA2006-01 : Winamp m3u File Processing Buffer Overflow Vulnerabilityhttp://www.nsfocus.com/english/homepage/research/0601.htmhttp://forums.winamp.com/showthread.php?threadid=238648winamp-m3u-wma-bo(24740)476SQL injection vulnerability in pmlite.php in RunCMS 1.2 and 1.3a allows remote attackers to execute arbitrary SQL commands via the to_userid parameter.18831runcms-pmlite-sql-injection(24676)ADV-2006-057216652http://www.runcms.org/public/modules/forum/viewtopic.php?topic_id=4003&forum=18http://hamid.ir/security/runcms.txtruncms-pmlite-sql-injection(24676)20060216 RUNCMS 1.3a SQL injection1015626settings.php in Reamday Enterprises Magic Downloads 1.1.3, when register_globals is enabled, allows remote attackers to modify program behavior, potentially bypassing authentication controls, via modified (1) action, (2) passwd, (3) admin_password, (4) new_passwd, and (5) confirm_passwd variables, which are not initialized.ADV-2006-060218877http://evuln.com/vulns/73/summary.htmlmagicdownloads-settings-access(24615)1666520060221 [eVuln] Magic Downloads Unauthorized Data Modification468PHP remote file inclusion vulnerability in preview.php in Reamday Enterprises Magic News Lite 1.2.3, when register_globals is enabled, allows remote attackers to include arbitrary files via a URL in the php_script_path parameter.magicnewslite-preview-file-include(24608)ADV-2006-0603166651666018878http://evuln.com/vulns/72/summary.htmlprofile.php in Reamday Enterprises Magic News Lite 1.2.3, when register_globals is enabled, allows remote attackers to modify program behavior, potentially bypassing authentication controls, via modified (1) action, (2) passwd, (3) admin_password, (4) new_passwd, and (5) confirm_passwd variables, which are not initialized.ADV-2006-060318878http://evuln.com/vulns/72/summary.htmlmagicnewslite-profile-access(24610)16665PHP remote file inclusion vulnerability in prepend.php in Plume CMS 1.0.2, when register_globals is enabled, allows remote attackers to include arbitrary files via a URL in the _PX_config[manager_path] parameter. NOTE: this is a different executable and affected version than CVE-2006-2645.plumecms-frontinc-prepend-file-include(27699)plumecms-prepend-file-include(24697)ADV-2006-05991666223204101562418883http://plume-cms.net/news/77-Security-Notice-Please-Update-Your-Prependphp-FileCross-site scripting (XSS) vulnerability in linking.php in CPG-Nuke Dragonfly CMS 9.0.6.1 allows remote attackers to inject arbitrary web script or HTML via a URI that is generated when creating a list of online users.ADV-2006-0688167812306018919http://dragonflycms.org/Forums/viewtopic/t=14877/postdays=0/postorder=asc/start=15.htmlhttp://dragonflycms.org/Forums/viewtopic/t=14751.htmlhttp://dragonflycms.org/cvs/html/includes/functions/linking.php?d=9.23-9.22http://dragonflycms.org/cvs/html/includes/functions/linking.php?b=9.19.2cpg-dragonfly-linking-xss(24842)SQL injection vulnerability in mstrack.php in MusOX DF MSAnalysis (DFMSA), as used in some environments that use CPG-Nuke Dragonfly CMS, allows remote attackers to trigger path disclosure from a SQL syntax error, and possibly execute arbitrary SQL commands, via certain query data, probably involving the profile name.ADV-2006-068823060http://dragonflycms.org/Forums/viewtopic/t=14877/postdays=0/postorder=asc/start=15.htmlhttp://dragonflycms.org/Forums/viewtopic/t=14751.htmlhttp://dragonflycms.org/cvs/html/includes/functions/linking.php?d=9.23-9.22http://dragonflycms.org/cvs/html/includes/functions/linking.php?b=9.19.21678323250SQL injection vulnerability in search.php in webSPELL 4.01.00 and earlier allows remote attackers to inject arbitrary SQL commands via the title_op parameter.http://www.webspell.org/index.php?site=news_comments&newsID=49&lang=en18885ADV-2006-0606webspell-search-sql-injection(24708)16673SQL injection vulnerability in functions.php in Teca Diary PE 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) yy, (2) mm, and (3) dd parameters.tecadiary-functions-sql-injection(24643)ADV-2006-0615http://www.evuln.com/vulns/75/summary.html1015674188761668620060223 [eVuln] Teca Diary PE SQL Injection Vulnerability477Multiple unspecified vulnerabilities in Dovecot before 1.0beta3 allow remote attackers to cause a denial of service (application crash or hang) via unspecified vectors involving (1) "potential hangs" in the APPEND command and "potential crashes" in (2) dovecot-auth and (3) imap/pop3-login. NOTE: vector 2 might be related to a double free vulnerability.dovecot-append-dos(24709)ADV-2006-054916672[Dovecot] 20060208 1.0beta3 released18870WmRoot/adapter-index.dsp in SAP Business Connector Core Fix 7 and earlier allows remote attackers to conduct spoofing (phishing) attacks via an absolute URL in the url parameter, which loads the URL inside a frame.sapbc-admin-spoofing(24751)ADV-2006-06111667120060515 CYBSEC - Security Advisory: Phishing Vector in SAP BC (BusinessConnector)20060215 CYBSEC - Security Pre-Advisory: Phishing Vector in SAP BChttp://www.cybsec.com/vuln/CYBSEC_Security_Pre-Advisory_Phishing_Vector_in_SAP_BC.pdf101563918880Directory traversal vulnerability in SAP Business Connector (BC) 4.6 and 4.7 allows remote attackers to read or delete arbitrary files via the fullName parameter to (1) sapbc/SAP/chopSAPLog.dsp or (2) invoke/sap.monitor.rfcTrace/deleteSingle. Details will be updated after the grace period has ended. NOTE: SAP Business Connector is an OEM version of webMethods Integration Server. webMethods states that this issue can only occur when the product is installed as root/admin, and if the attacker has access to a general purpose port; however, both are discouraged in the documentation. In addition, the attacker must already have acquired administrative privileges through other means.Apply patches (see SAP note 906401 and 908349).ADV-2006-06111666820060215 CYBSEC - Security Pre-Advisory: Arbitrary File Read/Delete in SAPBChttp://www.cybsec.com/vuln/CYBSEC_Security_Pre-Advisory_Arbitrary_File_Read_or_Delete_in_SAP_BC.pdfhttp://www.cybsec.com/vuln/CYBSEC_Security_Advisory_Arbitrary_File_Read_or_Delete_in_SAP_BC.pdf101612210156391888020060515 CYBSEC - Security Advisory: Arbitrary File Read/Delete in SAP BC(Business Connector)1016090** DISPUTED ** Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes such as (1) onfocus and (2) onblur in the "author's website" field. NOTE: followup comments to the researcher's web log suggest that this issue is only exploitable by the same user who injects the XSS, so this might not be a vulnerability.1665620060214 [myimei]WordPress2.0.0~autors?website~XSS attackhttp://myimei.com/security/2006-02-15/wordpress200autors-websitexss-attack.htmlwordpress-authorswebsite-xss(24736)The SV_CheckForDuplicateNames function in Valve Software Half-Life CSTRIKE Dedicated Server 1.6 and earlier allows remote authenticated users to cause a denial of service (infinite loop and daemon hang) via a backslash character at the end of a connection string to UDP port 27015.halflife-svcheckforduplicatenames-dos(33505)16619http://aluigi.altervista.org/adv/csdos.txtCross-site scripting (XSS) vulnerability in BBcode.pm in M. Blom HTML::BBCode 1.04 and earlier, as used in products such as My Blog before 1.65, allows remote attackers to inject arbitrary Javascript via a javascript URI in an (1) img or (2) url BBcode tag.1665920060215 [eVuln] M. Blom HTML::BBCode perl module XSS Vulnerabilities20060215 [eVuln] My Blog BBCode XSS Vulnerabilitieshttp://www.evuln.com/vulns/80/summary.html18905http://fuzzymonkey.net/forum/viewtopic.php?t=856http://www.evuln.com/vulns/80/summary.htmlhttp://evuln.com/vulns/79/summary.htmlmyblog-bbcode-xss(24668)ADV-2006-0642ADV-2006-061418925http://menno.b10m.net/perl/HTML-BBCode/Changeshttp://menno.b10m.net/perl/HTML-BBCode/Changeshttp://menno.b10m.net/perl/dists/HTML-BBCode-1.05.tar.gzStack-based buffer overflow in the pam_micasa PAM authentication module in CASA on Novell Linux Desktop 9 and Open Enterprise Server 1 allows remote attackers to execute arbitrary code via unspecified vectors.ADV-2006-0693SUSE-SA:2006:0101677918995eStara SIP softphone allows remote attackers to cause a denial of service (crash) via a SIP OPTIONS request with a negative Expires field.ADV-2006-060720060214 eStara SIP softphone several message-processing vulnerabilities18872estara-neg-integer-dos(24677)16629Multiple format string vulnerabilities in eStara SIP softphone allow remote attackers to cause a denial of service (hang) via SIP INVITE requests with format string specifiers in the SDP session description, as demonstrated using (1) the field name, (2) the o field (owner/creator and session identifier), or (3) the m field (media name and transport address).ADV-2006-060720060214 eStara SIP softphone several message-processing vulnerabilities18872estara-sdp-format-string(24678)16629eStara SIP softphone allows remote attackers to cause a denial of service (crash) via an INVITE request with a Content-Length field that has more than 9 digits.estara-content-length-dos(24679)ADV-2006-060720060214 eStara SIP softphone several message-processing vulnerabilities1887216629Linux kernel before 2.6.15.5, when running on Intel processors, allows local users to cause a denial of service ("endless recursive fault") via unknown attack vectors related to a "bad elf entry address."ADV-2006-2554ADV-2006-0804oval:org.mitre.oval:def:10518http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.15.5kernel-elf-dos(25001)USN-263-116925RHSA-2006:0493RHSA-2006:0437FEDORA-2006-13123607SUSE-SA:2006:028MDKSA-2007:025MDKSA-2006:059DSA-1103DSA-1097http://support.avaya.com/elmodocs2/security/ASA-2006-180.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-161.htm101572421983217452113620914206712039820237192201910819083The die_if_kernel function in arch/ia64/kernel/unaligned.c in Linux kernel 2.6.x before 2.6.15.6, possibly when compiled with certain versions of gcc, has the "noreturn" attribute set, which allows local users to cause a denial of service by causing user faults on Itanium systems.This vulnerability affects all verison of Linux kernel 2.6.x before 2.6.15.6, and may be exclusive to Itanium systems.19078ADV-2006-2554ADV-2006-0856http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.15.6oval:org.mitre.oval:def:10742kernel-dieifkernel-dos(25068)USN-263-116993RHSA-2006:0575RHSA-2006:043723660SUSE-SA:2006:028MDKSA-2006:059DSA-1103DSA-1097http://support.avaya.com/elmodocs2/security/ASA-2006-200.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-180.htm22417219832146521136209142067120398196071922020060402-01-UFormat string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory corruption and termination) via unknown vectors.19241http://issues.apache.org/jira/browse/LOG4NET-67log4net-localsyslogappender-dos(25196)ADV-2006-09551709523905SUSE-SR:2006:02622932Linux kernel before 2.6.16.5 does not properly handle uncanonical return addresses on Intel EM64T CPUs, which reports an exception in the SYSRET instead of the next instruction, which causes the kernel exception handler to run on the user stack with the wrong GS.linux-uncanonical-addr-dos(25869)ADV-2006-2554ADV-2006-1475ADV-2006-1390USN-302-117541RHSA-2006:0493RHSA-2006:043724639SUSE-SA:2006:047SUSE-SA:2006:042SUSE-SA:2006:028MDKSA-2006:150MDKSA-2006:086DSA-1103http://support.avaya.com/elmodocs2/security/ASA-2006-180.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-161.htm219832174521498211792113620914207162039820237201571973519639oval:org.mitre.oval:def:9732FEDORA-2006-423http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.5X.Org server (xorg-server) 1.0.0 and later, X11R6.9.0, and X11R7.0 inadvertently treats the address of the geteuid function as if it is the return value of a call to geteuid, which allows local users to bypass intended restrictions and (1) execute arbitrary code via the -modulepath command line option or (2) overwrite arbitrary files via -logfile.1716920060320 [CVE-2006-0745] X.Org Security Advisory: privilege escalation and DoS in X11R6.9, X11R7.0ADV-2006-1028ADV-2006-101720060320 Re: [CVE-2006-0745] X.Org Security Advisory: privilege escalation and DoS in X11R6.9, X11R7.0xorg-geteuid-privilege-escalation(25341)FEDORA-2006-1722400124000SUSE-SA:2006:016MDKSA-2006:056http://support.avaya.com/elmodocs2/security/ASA-2006-078.htm10225210157936061967619316193111930719256oval:org.mitre.oval:def:1697Certain patches for kpdf do not include all relevant patches from xpdf that were associated with CVE-2005-3627, which allows context-dependent attackers to exploit vulnerabilities that were present in CVE-2005-3627.kde-kpdf-patch-bo(25146)1703920060310 [KDE Security Advisory] kpdf of KDE 3.3.x heap based buffer overflowRHSA-2006:0262MDKSA-2006:054http://www.kde.org/info/security/advisory-20060202-1.txtDSA-10081015751566192641919019189oval:org.mitre.oval:def:11441Integer underflow in Freetype before 2.2 allows remote attackers to cause a denial of service (crash) via a font file with an odd number of blue values, which causes the underflow when decrementing by 2 in a context that assumes an even number of values.TA09-133Ahttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=183676https://issues.rpath.com/browse/RPL-429ADV-2009-1297ADV-2007-0381USN-291-11832620060612 rPSA-2006-0100-1 freetypeRHSA-2006:0500MDKSA-2006:099DSA-1095http://support.avaya.com/elmodocs2/security/ASA-2006-176.htmhttp://support.apple.com/kb/HT3549102705101652235074239392170121385211352106220791206382059120525oval:org.mitre.oval:def:9508SUSE-SA:2006:037APPLE-SA-2009-05-1220060701-01-UMozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via "an invalid and non-sensical ordering of table-related tags" that results in a negative array index.This vulnerability also affects Mozilla Suite before 1.7.13mozilla-table-rebuilding-code-execution(25985)http://www.zerodayinitiative.com/advisories/ZDI-06-011/ADV-2008-0083ADV-2006-3749ADV-2006-3748ADV-2006-3391ADV-2006-1356USN-276-1USN-275-117516SSRT061181SSRT061181SSRT061236SSRT061236HPSBUX02122HPSBUX02122FLSA:189137-2FLSA:189137-120060426 ZDI-06-011: Mozilla Firefox Table Rebuilding Code Execution VulnerabilityRHSA-2006:0330RHSA-2006:0329SUSE-SA:2006:004SUSE-SA:2006:004MDKSA-2006:078MDKSA-2006:076MDKSA-2006:075GLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm228526102550220652162221033200511995019941199021986319862198521982319821198111979419759oval:org.mitre.oval:def:1116420060404-01-USCOSA-2006.2622066oval:org.mitre.oval:def:1189nsHTMLContentSink.cpp in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors involving a "particular sequence of HTML tags" that leads to memory corruption.TA06-107AVU#736934http://www.zerodayinitiative.com/advisories/ZDI-06-009.htmlADV-2006-3391ADV-2006-1356USN-276-1USN-275-1USN-271-117516SSRT061158HPSBUX02122FLSA:189137-2FLSA:189137-1HPSBTU02118HPSBTU0211820060417 ZDI-06-009: Mozilla Firefox Tag Parsing Code Execution VulnerabilityRHSA-2006:0330RHSA-2006:0329RHSA-2006:0328FEDORA-2006-411FEDORA-2006-410SUSE-SA:2006:004SUSE-SA:2006:004http://www.mozilla.org/security/announce/2006/mfsa2006-18.htmlGLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm22852610255021622210331995019941199021986319862198521982319821198111979419759197461972919721197141969619631oval:org.mitre.oval:def:11704SUSE-SA:2006:02120060404-01-USCOSA-2006.26mozilla-nshtmlcontentsink-memory-corruption(25819)MDKSA-2006:078MDKSA-2006:076MDKSA-2006:0757292005119780oval:org.mitre.oval:def:1848SQL injection vulnerability in army.php in supersmashbrothers (SSB) Army System 2.1.0 for Invision Power Board (IPB) allows remote attackers to execute arbitrary SQL commands via the userstat parameter in an army action to index.php.ipb-armysystem-sql-injection(24654)ADV-2006-05611660620060212 Invision Power Board Army System Mod <= 2.1 SQL Injection Exploit18840http://secubox.shadock.net/Invision_Power_Board_Army_System_Mod_2.1_and_prior_SQL_Injection_Exploit.htmlMultiple unspecified vulnerabilities in the (1) Filesystem in USErspace (FUSE) client and (2) NOOFS daemon in in Network Object Oriented File System (NOOFS) before 0.9.0 have unspecified impact and attack vectors.2305323052http://freshmeat.net/projects/noofs/?branch_id=60557&release_id=218852[fm-news] 20060204 Newsletter for Friday, February 03rd 2006Niels Provos Honeyd before 1.5 replies to certain illegal IP packet fragments that other IP stack implementations would drop, which allows remote attackers to identify IP addresses that are being simulated using honeyd.16595ADV-2006-055220060212 honeyd security advisory: remote detectionhttp://www.honeyd.org/phpBB2/viewtopic.php?t=106http://www.honeyd.org/adv.2006-0118867honeyd-ipfrag-obtain-information(24728)Memory leak in Microsoft Internet Explorer 6 for Windows XP Service Pack 2 allows remote attackers to cause a denial of service (memory consumption) via JavaScript that uses setInterval to repeatedly call a function to set the value of window.status.ie-windowstatus-dos(24846)20060214 memory leak in IE?ie-windowsstatus-dos(24846)23307** DISPUTED ** dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error message. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignores the installation instructions as well as warnings generated by check.php.ADV-2006-06041664820060214 dotproject <= 2.0.1 remote code execution20060215 Re: dotproject <= 2.0.1 remote code execution2320618879dotproject-phpinfo-check-obtain-info(24745)** DISPUTED ** Multiple PHP remote file include vulnerabilities in dotProject 2.0.1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary commands via the baseDir parameter in (1) db_adodb.php, (2) db_connect.php, (3) session.php, (4) vw_usr_roles.php, (5) calendar.php, (6) date_format.php, and (7) tasks/gantt.php; and the dPconfig[root_dir] parameter in (8) projects/gantt.php, (9) gantt2.php, and (10) vw_files.php. NOTE: the vendor disputes this issue, stating that the product documentation clearly recommends that the system administrator disable register_globals, and that the check.php script warns against this setting. Also, the vendor says that the protection.php/siteurl vector is incorrect because protection.php does not exist in the product.dotproject-multiple-basedir-file-include(24738)ADV-2006-06041664820060214 dotproject <= 2.0.1 remote code execution20060215 Re: dotproject <= 2.0.1 remote code execution232192321823217232162321523214232132321223211232102320918879** DISPUTED ** dotProject 2.0.1 and earlier leaves (1) phpinfo.php and (2) check.php accessible under the /docs/ directory after installation, which allows remote attackers to obtain sensitive configuration information. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignores the installation instructions as well as warnings generated by check.php.ADV-2006-06041664820060214 dotproject <= 2.0.1 remote code execution20060215 Re: dotproject <= 2.0.1 remote code execution232082320718879dotproject-phpinfo-check-obtain-info(24745)434Multiple eval injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary PHP code via (1) the contactgroupid parameter in addressbook.update.php, (2) the messageid parameter in addressbook.add.php, (3) the folderid parameter in folders.update.php, and possibly certain parameters in (4) calendar.event.php, (5) index.php, (6) pop.download.php, (7) read.bounce.php, (8) rules.block.php, (9) language.php, and (10) certain other scripts, as demonstrated by an addressbook.update.php request with a contactgroupid value of phpinfo() preceded by facilitators.hivemail-multiple-file-include(24618)ADV-2006-0527http://www.gulftech.org/?node=research&article_id=00098-02102006http://forum.hivemail.com/showthread.php?p=2674520060210 HiveMail <= 1.3 Multiple Vulnerabilities1659118807Multiple cross-site scripting (XSS) vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via a URL encoded expression in the query string in (1) index.php and (2) possibly certain other scripts, which is not properly cleansed when accessed from the $_SERVER['PHP_SELF'] variable.hivemail-index-xss(24622)ADV-2006-0527http://www.gulftech.org/?node=research&article_id=00098-02102006http://forum.hivemail.com/showthread.php?p=2674520060210 HiveMail <= 1.3 Multiple Vulnerabilities1659118807Multiple SQL injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the contactgroupid parameter in addressbook.update.php, (2) the messageid parameter in addressbook.add.php, (3) the folderid parameter in folders.update.php, and possibly certain parameters in (4) calendar.event.php, (5) index.php, (6) pop.download.php, (7) read.bounce.php, (8) rules.block.php, (9) language.php, and (10) certain other scripts; and allow remote authenticated users to execute arbitrary SQL commands via (11) the folderid parameter in index.php and (12) possibly other parameters in certain other scripts, because $_SERVER['PHP_SELF'] is improperly handled.hivemail-index-sql-injection(24623)ADV-2006-0527http://www.gulftech.org/?node=research&article_id=00098-02102006http://forum.hivemail.com/showthread.php?p=2674520060210 HiveMail <= 1.3 Multiple Vulnerabilities1659142218807LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization, as demonstrated by a request for index.PHP when the configuration invokes the PHP interpreter only for ".php" names.18869ADV-2006-0550http://lighttpd.net/news/http://lighttpd.net/news/lighttpd-ext-source-disclosure(24699)23229Buffer overflow in BlackBerry Attachment Service in Research in Motion (RIM) BlackBerry Enterprise Server 2.2 and 4.0 before SP3 Hotfix 4 for IBM Lotus Domino, 3.6 before SP7 and 5.0 before SP3 Hotfix 3 for Microsoft Exchangem, and 4.0 for Novell GroupWise before SP3 Hotfix 1 might allow user-assisted remote attackers to execute arbitrary code on the server via a crafted Microsoft Word document that is opened on a wireless device.blackberry-attachment-word-bo(24629)ADV-2006-05301659020060210 Corrupt Word file may cause buffer overflow in the Blackberry Attachment Servicehttp://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8021/8149/8052/Support_-_Corrupt_Word_file_may_cause_buffer_overflow_in_the_BlackBerry_Attachment_Service.html?nodeid=1181753&vernum=2WinAbility Folder Guard 4.11 allows local users to gain unauthorized access to certain capabilities of the application by renaming or moving the password file (FGuard.FGP), which disables the password requirement.20060213 Re: Folder Guard password protection bypass20060213 Folder Guard password protection bypassfolderguard-fguard-bypass-authentication(24725)Cross-site scripting (XSS) vulnerability in dowebmailforward.cgi in cPanel allows remote attackers to inject arbitrary web script or HTML via a URL encoded value in the fwd parameter.2297120060207 Re: cPanel Multiple Cross Site Scripting Vulnerabilitycpanel-dowebmailforward-xss(24839)The Authentication, Authorization, and Accounting (AAA) capability in versions 5.0(1) and 5.0(3) of the software used by multiple Cisco Anomaly Detection and Mitigation products, when running with an incomplete TACACS+ configuration without a "tacacs-server host" command, allows remote attackers to bypass authentication and gain privileges, aka Bug ID CSCsd21455.cisco-tacacs-auth-bypass(24689)ADV-2006-06121666120060215 TACACS+ Authentication Bypass in Cisco Anomaly Detection and Mitigation Products232371015638101563743518904GUI display truncation vulnerability in ICQ Inc. (formerly Mirabilis) ICQ 2003a, 2003b, Lite 4.0, Lite 4.1, and possibly other Windows versions allows user-assisted remote attackers to hide malicious file extensions, bypass Windows security warnings via a filename that is all uppercase and of a specific length, which truncates the malicious extension from the display and could trick a user into executing arbitrary programs.1665520060215 Mirabiliz ICQ 2002/2003/ LITE 4.0/4.1 LONG (DIRECTORY + FILENAME) EXPLOITICQ Inc. (formerly Mirabilis) ICQ 2003a, 2003b, Lite 4.0, Lite 4.1, and possibly other Windows versions allows user-assisted remote attackers to hide malicious file extensions and bypass Windows security warnings via a filename that ends in an assumed-safe extension such as JPG, and possibly containing other modified properties such as company name, icon, and description, which could trick a user into executing arbitrary programs.1665520060215 Mirabiliz ICQ 2002/2003/ LITE 4.0/4.1 LONG (DIRECTORY + FILENAME) EXPLOITCGIWrap before 3.10 allows remote attackers to obtain sensitive information via unknown attack vectors that cause errors in scripts that reveal system information.http://sourceforge.net/project/shownotes.php?release_id=393274&group_id=820918797ADV-2006-0601http://sourceforge.net/project/showfiles.php?group_id=8209cgiwrap-error-information-disclosure(24717)16669Kadu 0.4.3 allows remote attackers to cause a denial of service (application crash) via a large number of image send requests.ADV-2006-0609http://www.piotrbania.com/all/adv/kadu-fun.txt1882420060215 Kadu Remote Denial Of Service Funkadu-image-request-dos(24720)20060215 Kadu Remote Denial Of Service FunUnspecified vulnerability in in.rexecd in Solaris 10 allows local users to gain privileges on Kerberos systems via unknown attack vectors.18891ADV-2006-06081021861015635solaris-kerberos-command-execution(24680)16658Q-126oval:org.mitre.oval:def:1580Cross-site scripting (XSS) vulnerability in calendar.php in MyBulletinBoard (MyBB) 1.0.4 allows remote attackers to inject arbitrary web script or HTML via a URL that is not sanitized before being returned as a link in "advanced details". NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.mybb-advanceddetails-xss(24748)ADV-2006-06352326418866Format string vulnerability in PunkBuster 1.180 and earlier, as used by Soldier of Fortune II and possibly other games, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in invalid cvar values, which are not properly handled when the server kicks the player and records the reason.punkbuster-cvars-format-string(24792)1670320060216 Soldier of Fortune II format string through PunkBuster 1.1804481891720060216 Soldier of Fortune II format string through PunkBuster 1.180http://aluigi.altervista.org/adv/sof2pbfs-adv.txtSQL injection vulnerability in Hitachi Business Logic - Container 02-03 through 03-00-/B on Windows, and 03-00 through 03-00-/B on Linux, allows remote attackers to execute arbitrary SQL commands via unspecified vectors in the extended receiving box function.18817hitachi-businesslogic-recbox-sql-injection(24621)hitachi-businesslogic-input-sql-injection(23877)ADV-2006-05321660223099http://www.hitachi-support.com/security_e/vuls_e/HS06-002_e/index-e.htmlCross-site scripting (XSS) vulnerability in Hitachi Business Logic - Container 02-03 through 03-00-/B on Windows, and 03-00 through 03-00-/B on Linux, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the extended receiving box function.18817hitachi-businesslogic-recbox-xss(24620)ADV-2006-053216602http://www.hitachi-support.com/security_e/vuls_e/HS06-002_e/index-e.htmlSQL injection vulnerability in deleteSession() in DB_eSession library 1.0.2 and earlier, as used in multiple products, allows remote attackers to execute arbitrary SQL commands via the $_sess_id_set variable, which is usually derived from PHPSESSID.ADV-2006-05281659820060211 DB_eSession deleteSession() SQL injection23104http://www.gulftech.org/?node=research&article_id=00099-0211200618805dbesession-deletesession-sql-injection(24673)20060501 Re: DB_eSession deleteSession() SQL injectionMultiple SQL injection vulnerabilities in show.php in BirthSys 3.1 allow remote attackers to execute arbitrary SQL commands via the $month variable. NOTE: a vector regarding the $date parameter and data.php (date.php) was originally reported, but this appears to be in error.birthsys-show-date-sql-injection(24617)ADV-2006-0621http://www.evuln.com/vulns/74/summary.html20060215 EV0074 BirthSys 3.1 SQL injection (fwd)166842318546718893Cross-site scripting (XSS) vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter.guestex-script-xss(24644)ADV-2006-064023182http://www.evuln.com/vulns/77/summary.html1671120060224 [eVuln] Guestex XSS Vulnerability101567849018927Unspecified vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to execute arbitrary shell commands via the email parameter, possibly involving shell metacharacters.guestex-script-execute-code(24645)ADV-2006-064023183http://www.evuln.com/vulns/76/summary.html1671120060224 [eVuln] Guestex Shell Command Execution Vulnerability48918927Multiple SQL injection vulnerabilities in XMB Forums 1.9.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) $u2u_select array parameter to u2u.inc.php and (2) $val variable (fidpw0 cookie value) in today.php.http://www.xmbforum.com/ADV-2006-052920060212 XMB Forums Multiple Vulnerabilities2311823117http://www.gulftech.org/?node=research&article_id=00100-0212200618821xmbforum-multiple-sql-injection(24646)16604Cross-site scripting (XSS) vulnerability in u2u.php in XMB Forums 1.9.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter, as demonstrated using a URL-encoded iframe tag.xmbforum-u2u-xss(24647)http://www.xmbforum.com/ADV-2006-05291660420060212 XMB Forums Multiple Vulnerabilities23119http://www.gulftech.org/?node=research&article_id=00100-02122006Multiple cross-site scripting (XSS) vulnerabilities in weblog.pl in PerlBlog 1.09b and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) email parameters.perlblog-weblog-xss(24691)http://evuln.com/vulns/81/summary.html1670720060227 [eVuln] PerlBlog Multiple Vulnerabilities50818924Directory traversal vulnerability in weblog.pl in PerlBlog 1.09b and earlier allows remote attackers to read certain files via the month parameter.perlblog-weblog-directory-traversal(24690)http://evuln.com/vulns/81/summary.html1670720060227 [eVuln] PerlBlog Multiple Vulnerabilities50818924Unspecified vulnerability in weblog.pl in PerlBlog 1.09b and earlier allows remote attackers to create arbitrary files and possibly execute arbitrary code via unspecified attack vectors related to improper handling of (1) the reply parameter, possibly involving injection of (2) the name parameter and (3) the body parameter.perlblog-weblog-command-execution(24692)http://evuln.com/vulns/81/summary.html1670720060227 [eVuln] PerlBlog Multiple Vulnerabilities50818924Cross-site scripting (XSS) vulnerability in page.php in in Siteframe Beaumont, possibly 5.0.2 or 5.0.1a, allows remote attackers to inject arbitrary web script or HTML via the comment_text parameter to the user comment page (/edit/Comment).1669520060216 Siteframe Beaumont 5.0.2 <== User Comment Cross-Site Scripting Vulnerabilitysiteframe-comment-xss(24836)2326744318892D-Link DWL-G700AP with firmware 2.00 and 2.01 allows remote attackers to cause a denial of service (CAMEO HTTP service crash) via a request composed of "GET" followed by a space and two newlines, possibly triggering the crash due to missing arguments.ADV-2006-06371669020060216 D-Link DWL-G700AP httpd DoSdlink-admin-interface-dos(24762)44118932Absolute path traversal vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier allows remote attackers to include and execute arbitrary local files via a direct request with a path parameter with a null character and beginning with (1) '/' (slash) for an absolute pathname or (2) a drive letter (such as "C:"), which bypasses checks for ".." sequences and trailing ".php" extensions.20060216 PHPKIT >= 1.6.1r2 arbitrary local/remote inclusion (unproperly patched in previous versions)http://retrogod.altervista.org/phpkit_161r2_incl_xpl.html1015640Incomplete blacklist vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier, with allow_url_fopen enabled, allows remote attackers to conduct PHP remote file include attacks via a path parameter that specifies a (1) UNC share or (2) ftps URL, which bypasses the check for "http://", "ftp://", and "https://" URLs.20060216 PHPKIT >= 1.6.1r2 arbitrary local/remote inclusion (unproperly patched in previous versions)http://retrogod.altervista.org/phpkit_161r2_incl_xpl.html1015640445wimpy_trackplays.php in Plaino Wimpy MP3 Player, possibly 5.2 and earlier, allows remote attackers to insert arbitrary strings into trackme.txt via the (1) trackFile, (2) trackArtist, and (3) trackTitle parameters, which can result in providing false information about songs, occupying excessive disk space with very long parameter values, and storing executable code that might be invoked through a different vulnerability. NOTE: since this issue, as described by the original researcher, is entirely dependent on the presence of another vulnerability, it could be argued that Wimpy cannot be responsible for how its data file is processed by applications outside of its control. Since this issue might only be useful as a facilitator manipulation in another vulnerability, perhaps it should not be included in CVE.http://www.xorcrew.net/xpa/XPA-WimpyMP3Player.txt1669618900wimpy-wimpytrackplays-no-auth(24770)Kyocera 3830 (aka FS-3830N) printers have a back door that allows remote attackers to read and alter configuration settings via strings that begin with "!R!SIOP0", as demonstrated using (1) a connection to to TCP port 9100 or (2) the UNIX lp command.ADV-2006-06201668518896http://evader.wordpress.com/2006/02/16/kyocera-printers/kyocera-fs3830n-no-auth(24772)2324520060215 Kyocera Network PrintersCertain unspecified Kyocera printers have a default "admin" account with a blank password, which allows remote attackers to access an administrative menu via a telnet session.ADV-2006-062018896http://evader.wordpress.com/2006/02/16/kyocera-printers/kyocera-fs3830n-blank-password(24774)2324620060215 Kyocera Network PrintersRockliffe MailSite 7.0 and earlier allows remote attackers to cause a denial of service by sending crafted LDAP packets to port 389/TCP, as demonstrated by the ProtoVer LDAP testsuite.mailsite-ldap-dos(24686)ADV-2006-05981667518888[Dailydave] 20060214 MailSite (WorldMail) funPHP remote file inclusion vulnerability in index.php in DreamCost HostAdmin allows remote attackers to include arbitrary files via the $path variable, which is not initialized before use.http://www.xorcrew.net/xpa/XPA-HostAdmin.txtADV-2006-06181668220081007 Re: HostAdmin 3.* Remote File Include Vulnerabilities20081007 HostAdmin 3.* Remote File Include Vulnerabilities18901hostadmin-path-file-include(24723)20060605 [MajorSecurity #9]HostAdmin <= 3.1 - Remote File Include Vulnerability23241101627320060215 HostAdmin - Remote Command Execution VulnerabilityCross-site scripting (XSS) vulnerability in preferences.personal.php in V-webmail 1.6.2 allows remote attackers to inject arbitrary web script or HTML via the newid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-063918776vwebmail-preferencespersonal-xss(24749)1670623260frameset.php in V-webmail 1.6.2 allows remote attackers to conduct phishing attacks by referencing arbitrary websites in the rframe parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-063918776vwebmail-frameset-spoofing(24753)1670623261help.php in V-webmail 1.6.2 allows remote attackers to obtain the installation path via unspecified invalid parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-063918776vwebmail-help-path-disclosure(24754)23262Absolute path traversal vulnerability in convert.cgi in Quirex 2.0.2 and earlier allows remote attackers to read arbitrary files, and possibly execute arbitrary code, via the (1) quiz_head, (2) quiz_foot, and (3) template variables.quirex-convert-information-disclosure(24672)ADV-2006-06411670920060226 [eVuln] Quirex Arbitrary File Disclosure Vulnerability18926http://evuln.com/vulns/78/summary.htmlCross-site scripting (XSS) vulnerability in default.php in Clever Copy 3.0 allows remote attackers to inject arbitrary web script or HTML via the Subject field when sending private messages (privatemessages.php). NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-0616166812323518873clevercopy-subject-xss(24747)Nokia N70 cell phone allows remote attackers to caues a denial of service (reboot or shutdown) through a wireless Bluetooth connection via a malformed Logical Link Control and Adaptation Protocol (L2CAP) packet whose length field is less than the actual length of the packet, possibly triggering a buffer overflow, as demonstrated using the Bluetooth Stack Smasher (BSS).nokia-bluetooth-l2cap-dos(24688)ADV-2006-053816666http://www.secuobs.com/news/15022006-nokia_n70.shtml#english2306120060215 [ Secuobs - Advisory ] Another kind of DoS on Nokia cell phones18724Multiple directory traversal vulnerabilities in the IMAP service in Macallan Mail Solution before 4.8.05.004 allow remote authenticated users to read e-mails of other users or create, modify, or delete directories via a .. (dot dot) in the argument to the (1) CREATE, (2) SELECT, (3) DELETE, or (4) RENAME commands.16704ADV-2006-0644http://secunia.com/secunia_research/2006-4/advisory/18775http://macallan.club.fr/MMS/index.htmlmacallan-imap-directory-traversal(24761)232691015647Microsoft Internet Explorer allows remote attackers to spoof a legitimate URL in the status bar and conduct a phishing attack via a web page with an anchor element with a legitimate "href" attribute, a form whose action points to a malicious URL, and an INPUT submit element that is modified to look like a legitimate URL. NOTE: this issue is very similar to CVE-2004-1104, although the manipulations are slightly different.20060223 Re: Internet Explorer Phishing mouseover issue20060218 Re: Internet Explorer Phishing mouseover issue20060216 Internet Explorer Phishing mouseover issueie-ahref-status-spoofing(17938)23609Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML tags with a trailing "<" character, which is interpreted as a ">" character by some web browsers but bypasses the blacklist protection in (1) the pnVarCleanFromInput function in pnAPI.php, (2) the pnSecureInput function in pnAntiCracker.php, and (3) the htmltext parameter in an edituser operation to user.php.postnuke-user-nslanguages-xss(24823)1675218937http://news.postnuke.com/index.php?name=News&file=article&sid=2754ADV-2006-0673454http://securityreason.com/securityalert/45420060219 Multiple vulnerabilities in PostNuke <= 0.761SQL injection vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic_quotes_gpc is off, allows remote attackers to execute arbitrary SQL commands via the language parameter to admin.php.Successful exploitation requires that the "magic_quotes_gpc" parameter is disabled.1675218937postnuke-nslanguages-sql-injection(24827)ADV-2006-0673454454http://news.postnuke.com/index.php?name=News&file=article&sid=275420060219 Multiple vulnerabilities in PostNuke <= 0.761Cross-site scripting (XSS) vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic_quotes_gpc is enabled, allows remote attackers to inject arbitrary web script or HTML via the language parameter in a missing or translation operation.Successful exploitation requires that the "magic_quotes_gpc" parameter is disabled.postnuke-user-nslanguages-xss(24823)ADV-2006-06731675245445418937http://news.postnuke.com/index.php?name=News&file=article&sid=275420060219 Multiple vulnerabilities in PostNuke <= 0.761The signature verification functionality in the YaST Online Update (YOU) script handling relies on a gpg feature that is not intended for signature verification, which prevents YOU from detecting malicious scripts or code that do not pass the signature check when gpg 1.4.x is being used.SUSE-SA:2006:00916889SUSE-SA:2006:013Off-by-one error in TIN 1.8.0 and earlier might allow attackers to execute arbitrary code via unknown vectors that trigger a buffer overflow.ADV-2006-070216728OpenPKG-SA-2006.005tin-offbyone-bo(24841)SUSE-SR:2006:005GLSA-200611-1819130The CAPTCHA functionality in php-Nuke 6.0 through 7.9 uses fixed challenge/response pairs that only vary once per day based on the User Agent (HTTP_USER_AGENT), which allows remote attackers to bypass CAPTCHA controls by fixing the User Agent, performing a valid challenge/response, then replaying that pair in the random_num and gfx_check parameters.http://www.waraxe.us/advisory-45.html1672220060218 [waraxe-2006-SA#045] - Bypassing CAPTCHA in phpNuke 6.x-7.945518936Multiple cross-site scripting (XSS) vulnerabilities in ADOdb 4.71, as used in multiple packages such as phpESP, allow remote attackers to inject arbitrary web script or HTML via (1) the next_page parameter in adodb-pager.inc.php and (2) other unspecified vectors related to PHP_SELF.ADV-2006-2021ADV-2006-06641672020060218 ADOdb Library Cross Site Scripting23362http://www.gulftech.org/?node=research&article_id=00101-02182006GLSA-200604-07DSA-1031DSA-1030DSA-1029http://sourceforge.net/project/shownotes.php?release_id=419843&group_id=89564521969119591195901955518928http://phpesp.cvs.sourceforge.net/phpesp/phpESP/admin/include/lib/adodb/adodb-pager.inc.php?r1=1.1&r2=1.2Stack-based buffer overflow in NJStar Chinese and Japanese Word Processor 4.x and 5.x before 5.10 allows user-assisted attackers to execute arbitrary code via font names in NJStar (.njx) documents.20060220 Secunia Research: NJStar Word Processor Font Name Buffer Overflowhttp://secunia.com/secunia_research/2006-5/advisory/18702njstar-font-name-bo(24773)ADV-2006-06701673723354http://www.njstar.com/njstar/japanese/http://www.njstar.com/njstar/chinese/1015649461MUTE 0.4 allows remote attackers to cause a denial of service (messages not forwarded) and obtain sensitive information about a target by filling a client's mWebCache cache with malicious "zombie" nodes.2333618980http://cvs.sourceforge.net/viewcvs.py/mute-net/MUTE/doc/notes/notes.txt?view=markupmute-mwebcache-security-bypass(24931)Multiple SQL injection vulnerabilities in Skate Board 0.9 allow remote attackers to execute arbitrary SQL commands via the (1) usern parameter in (a) sendpass.php, and the (2) usern and (3) passwd parameters and (4) sf_cookie cookie in (b) login.php and (c) logged.php.233032330223301http://evuln.com/vulns/84/summary.htmlskateboard-authentication-bypass(24779)skateboard-sendpass-sql-injection(24778)1693620060303 [eVuln] Skate Board Multimple Vulnerabilities54018978Unspecified vulnerability in config.php in Skate Board 0.9 allows remote authenticated administrators to execute arbitrary PHP code by causing certain variables in config.php to be modified, possibly due to XSS or direct static code injection.skateboard-config-file-include(24780)1693620060303 [eVuln] Skate Board Multimple Vulnerabilities2330418978http://evuln.com/vulns/84/summary.html540Cross-site scripting (XSS) vulnerability in reguser.php in Skate Board 0.9 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters involved with the registration form.23305http://evuln.com/vulns/84/summary.htmlskateboard-registration-xss(24781)1693620060303 [eVuln] Skate Board Multimple Vulnerabilities54018978The VisNetic AntiVirus Plug-in (DKAVUpSch.exe) for Mail Server 4.6.0.4, 4.6.1.1, and possibly other versions before 4.6.1.2, does not drop privileges before executing other programs, which allows local users to gain privileges.16583ADV-2006-07011678820060223 Secunia Research: Visnetic AntiVirus Plug-in for MailServerPrivilege Escalation1015670http://secunia.com/secunia_research/2005-65/advisory/visnetic-av-plugin-privilege-elevation(24928)Heap-based buffer overflow in WinACE 2.60 allows user-assisted attackers to execute arbitrary code via a large header block in an ARJ archive.winace-arj-header-bo(24872)ADV-2006-07091678620060223 Secunia Research: WinACE ARJ Archive Handling Buffer Overflow233831015672479http://secunia.com/secunia_research/2005-67/advisory/17251response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing (1) "." (dot) and (2) space characters, which are ignored by Windows, as demonstrated by PHP files.20060301 Secunia Research: Lighttpd Script Source Disclosure Vulnerabilityhttp://secunia.com/secunia_research/2006-9/advisory/18886lighttpd-source-code-disclosure(24976)ADV-2006-078223542http://trac.lighttpd.net/trac/changeset/1005168931015703523NetworkActiv Web Server 3.5.15 allows remote attackers to read script source code via a crafted URL with a "/" (forward slash) after the file extension.20060301 Secunia Research: NetworkActiv Web Server Script Source DisclosureVulnerabilityhttp://secunia.com/secunia_research/2006-10/advisory18947networkactiv-script-source-disclosure(24979)ADV-2006-078316895http://www.networkactiv.com/WebServer.htmlOrion Application Server before 2.0.7, when running on Windows, allows remote attackers to obtain the source code of JSP files via (1) . (dot) and (2) space characters in the extension of a URL.Update to version 2.0.7 or contact the vendor for a patch.ADV-2006-1055http://secunia.com/secunia_research/2006-11/advisory/18950orion-jsp-source-disclosure(25405)1720420060323 Secunia Research: Orion Application Server JSP Source DisclosureVulnerability24053101582320060323 Secunia Research: Orion Application Server JSP Source Disclosure VulnerabilityAbsolute path directory traversal vulnerability in (a) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (b) VisNetic MailServer before 8.5.0.5 allows remote attackers to include arbitrary files via a full Windows path and drive letter in the (1) language parameter in accounts/inc/include.php and (2) lang_settings parameter in admin/inc/include.php, which is not properly sanitized by the securepath function, a related issue to CVE-2005-4556.190021896618953ADV-2006-2825http://secunia.com/secunia_research/2006-14/advisory/http://secunia.com/secunia_research/2006-12/advisory/visnetic-include-file-include(27773)20060717 Secunia Research: VisNetic Mail Server Two File InclusionVulnerabilities20060717 Secunia Research: IceWarp Web Mail Two File InclusionVulnerabilities2732810165141016513Absolute path directory traversal vulnerability in (1) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (2) VisNetic MailServer before 8.5.0.5 allows remote authenticated users to include arbitrary files via a modified language parameter and a full Windows or UNC pathname in the lang_settings parameter to mail/index.html, which is not properly sanitized by the validatefolder PHP function, possibly due to an incomplete fix for CVE-2005-4558.19002http://secunia.com/secunia_research/2006-14/advisory/http://secunia.com/secunia_research/2006-12/advisory/1896618953ADV-2006-2825visnetic-language-file-include(27780)20060717 Secunia Research: VisNetic Mail Server Two File InclusionVulnerabilities20060717 Secunia Research: IceWarp Web Mail Two File InclusionVulnerabilities10165141016513Dwarf HTTP Server 1.3.2 allows remote attackers to obtain the source code of JSP files via (1) dot, (2) space, (3) slash, or (4) NULL characters in the filename extension of an HTTP request.20060313 Secunia Research: Dwarf HTTP Server Source Disclosure andCross-Site Scriptinghttp://secunia.com/secunia_research/2006-13/advisory18962ADV-2006-0937dwarfhttp-extension-information-disclosure(25178)17123238361015779576Cross-site scripting (XSS) vulnerability in Dwarf HTTP Server 1.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified error messages.20060313 Secunia Research: Dwarf HTTP Server Source Disclosure andCross-Site Scriptinghttp://secunia.com/secunia_research/2006-13/advisory18962ADV-2006-0937dwarfhttp-url-xss(25179)17123238371015779SQL injection vulnerability in index.php in BXCP 0.299 allows remote attackers to execute arbitrary SQL commands via the tid parameter.ADV-2006-066018929bxcp-tid-sql-injection(24783)1513Unspecified vulnerability in EmuLinker Kaillera Server before 0.99.17 allows remote attackers to cause a denial of service (probably resource consumption) via a crafted packet that causes a "ghost game" to be left on the server.http://sourceforge.net/project/shownotes.php?release_id=394690&group_id=12775418938ADV-2006-0665emulinker-packet-handling-dos(24784)16733Multiple SQL injection vulnerabilities in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to inject arbitrary SQL commands via the (1) userid variable to users.php or (2) sessid variable to lib-sessions.php.18920ADV-2006-0661http://www.gulftech.org/?node=research&article_id=00102-02192006http://www.geeklog.net/article.php/geeklog-1.4.0sr1geeklog-users-sessions-sql-injection(24775)1675520060219 Geeklog Remote Code Execution23348Multiple unspecified vulnerabilities in lib-common.php in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to include arbitrary local files and execute arbitrary code via (1) absolute paths in unspecified parameters and (2) the language cookie, as demonstrated for code execution using error.log.http://www.geeklog.net/article.php/geeklog-1.4.0sr118920ADV-2006-0661http://www.gulftech.org/?node=research&article_id=00102-021920061675520060219 Geeklog Remote Code Execution23349Multiple unspecified vulnerabilities in ESS/ Network Controller and MicroServer Web Server in Xerox WorkCentre Pro and Xerox WorkCentre running software 13.027.24.015 and 14.027.24.015 allow remote attackers to bypass authentication or gain "unauthorized network access" via unknown attack vectors.http://www.xerox.com/downloads/usa/en/c/cert_XRX06_001.pdfxerox-workcentre-auth-bypass(24804)ADV-2006-06681672623359101564818952Unspecified vulnerability in ESS/ Network Controller and MicroServer Web Server in Xerox WorkCentre Pro and Xerox WorkCentre running software 13.027.24.015 and 14.027.24.015 allows remote attackers to cause a denial of service via a crafted Postscript request.http://www.xerox.com/downloads/usa/en/c/cert_XRX06_001.pdfxerox-workcentre-postscript-dos(24805)ADV-2006-066816723101564818952Cross-site scripting vulnerability in ESS/ Network Controller and MicroServer Web Server in Xerox WorkCentre Pro and Xerox WorkCentre running software 13.027.24.015 and 14.027.24.015 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.http://www.xerox.com/downloads/usa/en/c/cert_XRX06_001.pdfxerox-workcentre-xss(24806)ADV-2006-06681672718952Unspecified vulnerability in ESS/ Network Controller and MicroServer Web Server in Xerox WorkCentre Pro and Xerox WorkCentre running software 13.027.24.015 and 14.027.24.015 allows remote attackers to "reduce effectiveness of security features" via unknown attack vectors.http://www.xerox.com/downloads/usa/en/c/cert_XRX06_001.pdfADV-2006-0668101564818952Cross-site scripting vulnerability in E-Blah Platinum 9.7 allows remote attackers to inject arbitrary web script or HTML via the referer (HTTP_REFERER), which is not sanitized when the log file is viewed by the administrator using "Click Log".http://www.eblah.com/forum/m-1140116897/http://evuln.com/vulns/83/summary.htmlADV-2006-063816713eblah-httpreferer-xss(24777)20060302 [eVuln] E-Blah Platinum 'Referer' XSS Vulnerability2329952818992The scripting engine in Internet Explorer allows remote attackers to cause a denial of service (resource consumption) and possibly execute arbitrary code via a web page that contains a recurrent call to an infinite loop in Javascript or VBscript, which consumes the stack, as demonstrated by resetting the "location" variable within the loop.20060216 Stack overflow vulnerability in Internet Explorer exploitable trough VBScript and JScript scripting engines.20060218 Re: Stack overflow vulnerability in Internet Explorer exploitable trough VBScript and JScript scripting engines.ie-script-engine-stack-dos(24788)16687PHP remote file include vulnerability in index.php in Tasarim Rehberi allows remote attackers to execute arbitrary PHP code via a URL in the (1) sayfaadi or (2) sayfa parameter. NOTE: this might be a site-specific issue. If so, it should not be included in CVE.20060218 Tasarim Rehberi Index.PHP Remote Command ExucetionMultiple SQL injection vulnerabilities in admin.asp in WPC.easy allow remote attackers to execute arbitrary SQL commands via the (1) uid and (2) pwd parameter.ADV-2006-066220060218 SLQ Injection vulnerability in WPCeasy1894516721456Multiple cross-site scripting (XSS) vulnerabilities in Barracuda Directory 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the (1) Add URL and (2) Suggest Category module. NOTE: the provenance of this information is unknown; portions of the details are obtained from third party information.ADV-2006-067418965barracuda-multiple-xss(24807)1674623372Uniden UIP1868P VoIP Telephone and Router has a default password of admin for the web-based configuration utility, which allows remote attackers to obtain sensitive information on the device such as telephone numbers called, and possibly connect to other hosts. NOTE: it is possible that this password was configured by a reseller, not the original vendor; if so, then this is not a vulnerability in the product.20060216 Uniden UIP1868P (VoIP phone/gateway) default easy-to-guess password vulnerabilityuniden-uip1868p-default-account(24786)SQL injection vulnerability in dropbase.php in MitriDAT Web Calendar Pro allows remote attackers to modify internal SQL queries and cause a denial of service (inaccessible database) via the tabls parameter.webcalendarpro-dropbase-sql-injection(24729)ADV-2006-070020060215 Web Calendar Pro - Denial of Service SQL Injection Vulnerabilityhttp://www.xorcrew.net/xpa/XPA-WebCalendarPro.txt1678918902Mozilla Thunderbird 1.5 allows user-assisted attackers to cause an unspecified denial of service by tricking the user into importing an LDIF file with a long field into the address book, as demonstrated by a long homePhone field.1671620060221 Mozila Thunderbird 1.5 Address Book DoS20060217 Mozila Thunderbird 1.5 Address Book DoSthunderbird-address-book-dos(24810)469IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 has world-readable permissions for (1) /etc/neusecure.conf, (2) /opt/NeuSecure/etc/cms-3.0.236.buildconf, and (3) /opt/NeuSecure/bin/ns_archiver.log, which allows local users to read sensitive information such as passwords. NOTE: IBM has privately confirmed to CVE that a fix is available for these issues.1670020060216 Password disclosure and remote access in Netcool/NeuSecure Security information management platform2327010156421892220060216 Password disclosure and remote access in Netcool/NeuSecure Security information management platformnetcool-neosecure-config-weak-permission(24785)166932391423271IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 stores cleartext passwords in the (1) CMS_DBPASS, (2) CMSM_DBPASS, and (3) RPT_DBPASS fields in /etc/neusecure.conf, and in (4) /opt/NeuSecure/bin/ns_archiver.log, which allows local users to gain privileges. NOTE: IBM has privately confirmed to CVE that a fix is available for these issues.1669820060216 Password disclosure and remote access in Netcool/NeuSecure Security information management platform232712327010156421892220060216 Password disclosure and remote access in Netcool/NeuSecure Security information management platformnetcool-neosecure-plaintext-password(24787)netcool-neosecure-config-weak-permission(24785)16693The frag3 preprocessor in Sourcefire Snort 2.4.3 does not properly reassemble certain fragmented packets with IP options, which allows remote attackers to evade detection of certain attacks, possibly related to IP option lengths.1670520060217 SNORT Incorrect fragmented packet reassembly18959snort-frag3-detection-bypass(24811)manage_user_page.php in Mantis 1.00rc4 and earlier does not properly handle a sort parameter containing a ' (quote) character, which allows remote attackers to trigger a SQL error that may be repeatedly reported to a user who makes subsequent web accesses with the MANTIS_MANAGE_COOKIE cookie. NOTE: this issue might be the same as vector 2 in CVE-2005-4519.20060215 [BuHa-Security] Multiple Vulnerabilities in Mantis 1.00rc4http://sourceforge.net/project/shownotes.php?release_id=386059&group_id=14963http://sourceforge.net/project/showfiles.php?group_id=14963&package_id=12175&release_id=386059http://morph3us.org/advisories/20060214-mantis-100rc4.txtmantis-manageuserpagesql-injection(24726)16657Multiple cross-site scripting (XSS) vulnerabilities in Mantis 1.00rc4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) hide_status, (2) handler_id, (3) user_monitor, (4) reporter_id, (5) view_type, (6) show_severity, (7) show_category, (8) show_status, (9) show_resolution, (10) show_build, (11) show_profile, (12) show_priority, (13) highlight_changed, (14) relationship_type, and (15) relationship_bug parameters in (a) view_all_set.php; the (16) sort parameter in (b) manage_user_page.php; the (17) view_type parameter in (c) view_filters_page.php; and the (18) title parameter in (d) proj_doc_delete.php. NOTE: item 17 might be subsumed by CVE-2005-4522.20060215 [BuHa-Security] Multiple Vulnerabilities in Mantis 1.00rc4http://sourceforge.net/project/shownotes.php?release_id=386059&group_id=14963http://morph3us.org/advisories/20060214-mantis-100rc4.txt23248http://sourceforge.net/project/showfiles.php?group_id=14963&package_id=12175&release_id=3860591665722487DSA-113321400Cross-site scripting (XSS) vulnerability in Calacode @Mail 4.3 allows remote attackers to inject arbitrary web script or HTML via a modified javascript: string in the SRC attribute of an IMG element in an e-mail message, as demonstrated by "java	script:." NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Successful exploitation of this issue requires a victim user has @Mail configured to display images in email messages.@mail-html-image-xss(24742)ADV-2006-0617166832323618874Leif M. Wright's Blog 3.5 stores the config file and other txt files under the web root with insufficient access control, which allows remote attackers to read the administrator's password.16712http://www.evuln.com/vulns/82/summary.html18923webblog-txt-obtain-information(24752)522Leif M. Wright's Blog 3.5 does not make a password comparison when authenticating an administrator via a cookie, which allows remote attackers to bypass login authentication, probably by setting the blogAdmin cookie.16714http://www.evuln.com/vulns/82/summary.html18923webblog-cookie-auth-bypass(24755)522Leif M. Wright's Blog 3.5 allows remote authenticated users with administrative privileges to execute arbitrary programs, including shell commands, by configuring the sendmail path to a malicious pathname.http://www.evuln.com/vulns/82/summary.html18923webblog-sendmail-command-execution(24757)522Multiple cross-site scripting (XSS) vulnerabilities in Leif M. Wright's Blog 3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) Referer and (2) User-Agent HTTP headers, which are stored in a log file and not sanitized when the administrator views the "Log" page, possibly using the ViewCommentsLog function.16715http://www.evuln.com/vulns/82/summary.html18923webblog-headers-xss(24758)522Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors.cherrypy-staticfilter-directory-traversal(24809)16760http://groups.google.com/group/cherrypy-announce/browse_thread/thread/92b2972f774fe6df/2f63afc9433dc306#2f63afc9433dc306ADV-2006-0677http://sourceforge.net/project/shownotes.php?release_id=384316&group_id=56099GLSA-200605-16http://www.cherrypy.org/2034418944The "Open 'safe' files after downloading" option in Safari on Apple Mac OS X allows remote user-assisted attackers to execute arbitrary commands by tricking a user into downloading a __MACOSX folder that contains metadata (resource fork) that invokes the Terminal, which automatically interprets the script using bash, as demonstrated using a ZIP file that contains a script with a safe file extension.TA06-062ATA06-053AVU#999708macosx-zip-command-execution(24808)ADV-2006-06711673623510http://www.mathematik.uni-ulm.de/numerik/staff/lehn/macosx.htmlhttp://www.heise.de/english/newsticker/news/69862http://www.frsirt.com/exploits/20060222.safari_safefiles_exec.pm.php101565218963http://docs.info.apple.com/article.html?artnum=303382SQL injection vulnerability in include/includes/user/login.php in ilchClan before 1.05g allows remote attackers to execute arbitrary SQL commands via the login_name parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-0676http://www.ilch.de/news-134.html18951ilchclan-login-sql-injection(24830)23370SQL injection vulnerability in the forum module of ilchClan 1.05g and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter, when creating a newpost.ADV-2006-067218951ilchclan-index-sql-injection(24829)16735233691516Direct static code injection vulnerability in write.php in Admbook 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via the X-Forwarded-For HTTP header field, which is inserted into content-data.php.admbook-index-command-execution(24771)ADV-2006-066318930167531512Buffer overflow in the IMAP service of TrueNorth Internet Anywhere (IA) eMailserver 5.3.4 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a long SEARCH argument.ia-emailserver-imap-bo(24812)ADV-2006-06861674420060220 [AJECT] TrueNorth IA eMailserver 5.3.4 buffer overflow vulnerability23377101566418986PHP remote file inclusion vulnerability in common.php in Intensive Point iUser Ecommerce allows remote attackers to include arbitrary files via a URL in the include_path variable, which is not initialized before being used.iuser-ecommerce-file-include(24724)http://www.xorcrew.net/xpa/XPA-iUser.txtADV-2006-069916787234291890320060215 iUser Ecommerce - Remote Command Execution VulnerabilityStack-based buffer overflow in the fullpath function in misc.c for zoo 2.10 and earlier, as used in products such as Barracuda Spam Firewall, allows user-assisted attackers to execute arbitrary code via a crafted ZOO file that causes the combine function to return a longer string than expected.GLSA-200603-05DSA-99110158661951419166zoo-misc-bo(24904)ADV-2006-1220ADV-2006-07051679020060223 zoo contains exploitable buffer overflowsSUSE-SR:2006:006SUSE-SR:2006:005http://www.guay-leroux.com/projects/zoo-advisory.txthttp://www.guay-leroux.com/projects/barracuda-advisory-ZOO.txt10156685461940819148191301900220060403 Barracuda ZOO archiver security bug leads to remote compromiseSQL injection vulnerability in login.php in Scriptme SmE GB Host 1.21 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the Username parameter.ADV-2006-05431660920060216 [eVuln] SmE GB Host Authentication Bypass Vulnerabilityhttp://www.evuln.com/vulns/66/summary.htmlsmegbhost-login-sql-injection(24544)18823Cross-site scripting (XSS) vulnerability in Chatbox Plugin 1.0 in e107 0.7.2 allows remote attackers to inject arbitrary HTML or web script via a Chatbox, as demonstrated using a SCRIPT element.20060218 e107 CMS 0.7.2 Chatbox plugin XSS vulnerabilitye107-chatbox-xss(24815)16719Unquoted Windows search path vulnerability in (1) snsmcon.exe, (2) the autostartup mechanism, and (3) an unspecified installation component in StarForce Safe'n'Sec Personal + Anti-Spyware 2.0 and earlier, and possibly other StarForce Safe'n'Sec products, might allow local users to gain privileges via a malicious "program" file in the C: folder.1676220060219 [TZO-062006] Safe'nVulnerablehttp://secdev.zoller.lu/research/safnsec.htmMichael Salzer Guestbox 0.6, and other versions before 0.8, allows remote attackers to post an admin comment to a guestbook entry via a certain modified form, possibly related to the nummer parameter.18946guestbox-admin-access(24797)ADV-2006-067520060302 Re: Guestbox XSS/an admin bypass20060220 Guestbox XSS/an admin bypass23374Multiple cross-site scripting (XSS) vulnerabilities in Michael Salzer Guestbox 0.6, and other versions before 0.8, allow remote attackers to inject arbitrary web script or HTML via (1) HTML tags that follow a "http://" string, which bypasses a regular expression check, and (2) other unspecified attack vectors.1675118946guestbox-gbshow-xss(24798)ADV-2006-067520060302 Re: Guestbox XSS/an admin bypass20060220 Guestbox XSS/an admin bypass23375Michael Salzer Guestbox 0.6, and other versoins before 0.8, allows remote attackers to obtain the source IP addresses of guestbook entries via a direct request to /gb/gblog.2337618946guestbox-gblog-obtain-information(24799)ADV-2006-067520060302 Re: Guestbox XSS/an admin bypass20060220 Guestbox XSS/an admin bypass460Unspecified vulnerability in InfoVista PortalSE 2.0 Build 20087 on Solaris 8 without the IV00038969 hotfix allows remote attackers to read arbitrary files via a crafted URL.ADV-2006-06951677620060222 IRM 017: Multiple Vulnerabilities in Infovista Portal SEhttp://www.irmplc.com/advisory017.htmvistaportal-parameter-directory-traversal(24893)101566918994InfoVista PortalSE 2.0 Build 20087 on Solaris 8 allows remote attackers to obtain sensitive information by specifying a nonexistent server in the server field, which reveals the path in an error message.ADV-2006-06951677620060222 IRM 017: Multiple Vulnerabilities in Infovista Portal SEhttp://www.irmplc.com/advisory017.htmvistaportal-server-path-disclosure(24894)101566947318994filescan in Global Hauri ViRobot 2.0 20050817 does not verify the Cookie HTTP header, which allows remote attackers to gain administrative privileges via an arbitrary cookie value.http://x82.inetcop.org/h0me/adv1sor1es/INCSA.2006-0x82-028-VIROBOT.txtADV-2006-06911676820060222 [INetCop Security Advisory] Global Hauri Virobot cookie exploit18974virobot-filescan-auth-bypass(24850)1015658PunBB 1.2.10 and earlier allows remote attackers to cause a denial of service (resource consumption) by registering many user accounts quickly.20060219 PunBB 1.2.10 Multiple DoS Vulnerabilitieshttp://www.neosecurityteam.net/advisories/Advisory-15.txtpunbb-register-ip-dos(24837)PunBB 1.2.10 and earlier allows remote attackers to conduct brute force guessing attacks for an account's password, which may be as short as 4 characters.20060219 PunBB 1.2.10 Multiple DoS Vulnerabilitieshttp://www.neosecurityteam.net/advisories/Advisory-15.txtpunbb-login-bruteforce(24838)Buffer overflow in certain versions of South River (aka SRT) WebDrive, possibly version 6.08 build 1131 and version 8, allows remote attackers to cause a denial of service (application crash and persistent erratic behavior) via a long string in the name entry field.20060222 South River WebDrive Buffer Overflow Vulnerabilitywebdrive-name-bo(24903)Multiple unspecified injection vulnerabilities in unspecified Auth Container back ends for PEAR::Auth before 1.2.4, and 1.3.x before 1.3.0r4, allow remote attackers to "falsify authentication credentials," related to the "underlying storage containers."16758http://pear.php.net/package/Auth/download/1.3.0r4http://pear.php.net/package/Auth/download/1.2.4ADV-2006-069620060222 Multiple Injection Vulnerabilities in PHP PEAR::Auth Moduleauth-multiple-injections(24854)GLSA-200603-1310156661930119008Directory traversal vulnerability in the "remember me" feature in liveuser.php in PHP Extension and Application Repository (PEAR) LiveUser 0.16.8 and earlier allows remote attackers to determine file existence, and possibly delete arbitrary files with short pathnames or possibly read arbitrary files, via a .. (dot dot) in the store_id value of a cookie.1015659http://pear.php.net/package/LiveUser/download/liveuser-liveuser-file-deletion(24853)liveuser-liveuser-file-access(24852)ADV-2006-06971676120060221 PEAR LiveUser File Access Vulnerabilitieshttp://www.gulftech.org/?node=research&article_id=00103-02212006466SQL injection vulnerability in pages.asp in Mini-Nuke CMS System 1.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: version 2.3 was later reported to be vulnerable as well.mininuke-pages-sql-injection(24803)176361673020060420 Mini-NUKE v2.3<<--- SQL Injection20060321 Mini-Nuke<=1.8.2 SQL injection (6)20060220 MiniNuke CMS System all versions (pages.asp) SQL Injection23438http://www.nukedx.com/?viewdoc=91843920060421 Re: Mini-NUKE v2.3<<--- SQL InjectionDirectory traversal vulnerability in the _setTemplate function in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to read and include arbitrary files via the mos_change_template parameter. NOTE: CVE-2006-1794 has been assigned to the SQL injection vector.http://source.mambo-foundation.org/view/news/Announcements/Security_Patch_Released/18935ADV-2006-071923505http://www.gulftech.org/?node=research&article_id=00104-0224200649320060224 Mambo Multiple VulnerabilitiesDirectory traversal vulnerability in init.inc.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the lang parameter.http://coppermine-gallery.net/forum/index.php?topic=28062.0ADV-2006-0669101564618941http://retrogod.altervista.org/cpg_143_incl_xpl.htmlhttp://retrogod.altervista.org/cpg_143_adv.htmlcoppermine-init-file-include(24814)1671820060218 Coppermine Photo Gallery <=1.4.3 remote code executionAbsolute path traversal vulnerability in docs/showdocs.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via the f parameter, and possibly remote files using UNC share pathnames.http://coppermine-gallery.net/forum/index.php?topic=28062.0ADV-2006-0669101564618941http://retrogod.altervista.org/cpg_143_adv.htmlcoppermine-showdoc-file-include(24816)1671820060218 Coppermine Photo Gallery <=1.4.3 remote code executionMultiple unspecified vulnerabilities in Intensive Point iUser Ecommerce before 2.2 have unspecified vectors and impact, as addressed by "Urgent secure fixes". NOTE: this might be a duplicate of CVE-2006-0854, but the vendor announcement for this issue (from January 8, 2005) is too vague to be sure, and CVE-2006-0854 does not provide version information.1678719003iuser-ecommerce-undisclosed(24906)http://www.intensivepoint.com/iuser-document.shtmlCross-site scripting vulnerability in ratefile.php in RunCMS 1.3a5 allows remote attackers to inject arbitrary web script or HTML via the lid parameter.ADV-2006-06941676920060222 [KAPDA::#27] - Runcms 1.x Cross_Site_Scripting vulnerability101566318997http://kapda.ir/advisory-267.htmlruncms-ratefile-xss(24871)23388POPFile before 0.22.4 allows remote attackers to cause a denial of service (application crash) via unspecified vectors involving character sets within e-mail messages.18975ADV-2006-0698http://popfile.sourceforge.net/cgi-bin/wiki.pl?ReleaseNotes/0.22.416792DSA-106120205Cross-site scripting vulnerability in Easy Forum 2.5 allows remote attackers to inject arbitrary web script or HTML via the image variable.easyforum-join-xss(24831)ADV-2006-070618996http://evuln.com/vulns/85/summary.html1695820060304 [eVuln] Easy Forum XSS Vulnerability23430http://hot-things.net/forum/show.php?f=2&topic=20060224080919Noah's Classifieds 1.3 allows remote attackers to obtain the installation path via a direct request to include files, as demonstrated by classifieds/gorum/category.php.ADV-2006-070320060222 [KAPDA::#29]Noah's classifieds multiple vulnerabilitieshttp://www.kapda.ir/advisory-268.htmlnoahs-category-path-disclosure(24898)1015667SQL injection vulnerability in the search tool in Noah's Classifieds 1.3 allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors.ADV-2006-07031677320060222 [KAPDA::#29]Noah's classifieds multiple vulnerabilitieshttp://www.kapda.ir/advisory-268.htmlnoahs-search-sql-injection(24896)1015667Multiple cross-site scripting (XSS) vulnerabilities in index.php in Noah's Classifieds 1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) inf parameter; or, when register_globals is enabled, the (2) upperTemplate and (3) lowerTemplate parameters.ADV-2006-07031677220060222 [KAPDA::#29]Noah's classifieds multiple vulnerabilitieshttp://www.kapda.ir/advisory-268.htmlnoahs-indexphp-xss(24895)1015667Multiple PHP remote file include vulnerabilities in gorum/gorumlib.php in Noah's Classifieds 1.3, when register_globals is enabled, allow remote attackers to include arbitrary PHP files via the (1) upperTemplate and (2) lowerTemplate parameters, as demonstrated using the lowerTemplate parameter to index.php.ADV-2006-07031678020060222 [KAPDA::#29]Noah's classifieds multiple vulnerabilitieshttp://www.kapda.ir/advisory-268.htmlnoahs-gorumlib-file-include(24899)1015667Directory traversal vulnerability in include.php in Noah's Classifieds 1.3 allows remote attackers to include arbitrary local files via the otherTemplate parameter to index.php.ADV-2006-07031677820060222 [KAPDA::#29]Noah's classifieds multiple vulnerabilitieshttp://www.kapda.ir/advisory-268.htmlnoahs-include-directory-traversal(24900)1015667OpenSSH on FreeBSD 5.3 and 5.4, when used with OpenPAM, does not properly handle when a forked child process terminates during PAM authentication, which allows remote attackers to cause a denial of service (client connection refusal) by connecting multiple times to the SSH server, waiting for the password prompt, then disconnecting.168921015706openssh-openpam-dos(25116)ADV-2006-080523797520http://bugzilla.mindrot.org/show_bug.cgi?id=839FreeBSD-SA-06:09The WYSIWYG rendering engine ("rich mail" editor) in Mozilla Thunderbird 1.0.7 and earlier allows user-assisted attackers to bypass javascript security settings and obtain sensitive information or cause a crash via an e-mail containing a javascript URI in the SRC attribute of an IFRAME tag, which is executed when the user edits the e-mail.16770DSA-1051DSA-1046mozilla-inline-fwd-code-execution(25983)ADV-2006-3749USN-276-1HPSBUX02156HPSBUX02156SSRT061158SSRT061158FLSA:189137-120060222 Mozilla Thunderbird : Remote Code Execution & Denial of ServiceRHSA-2006:0330RHSA-2006:032923653SUSE-SA:2006:022SUSE-SA:2006:004http://www.mozilla.org/security/announce/2006/mfsa2006-21.htmlMDKSA-2006:078MDKSA-2006:076MDKSA-2006:052GLSA-200605-09GLSA-200604-18http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm2285261025501015665220652162221033200511995019941199021986319823198211981119721oval:org.mitre.oval:def:10782SUSE-SA:2006:02120060404-01-USCOSA-2006.26oval:org.mitre.oval:def:2024Cross-site scripting (XSS) vulnerability in show_news.php in CuteNews 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the show parameter.ADV-2006-06852340018981http://myimei.com/security/2006-02-20/cutenews141addcommentforprotectedusernamesxss-attack.htmlcutenews-shownews-xss(24835)1674020060221 [myimei]CuteNews1.4.1~ Add Comment For Protected UserNames~ XSS AttackCross-site scripting (XSS) vulnerability in register.php in DEV web management system 1.5 allows remote attackers to inject arbitrary web script or HTML via the "City/Region" field (mesto variable). NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-072318714dev-cityregion-xss(24875)1681223468Eval injection vulnerability in sessions.inc in PHP Base Library (PHPLib) before 7.4a, when index.php3 from the PHPLib distribution is available on the server, allows remote attackers to execute arbitrary PHP code by including a base64-encoded representation of the code in a cookie. NOTE: this description was significantly updated on 20060605 to reflect new details after an initial vague advisory.http://sourceforge.net/project/shownotes.php?group_id=31885&release_id=39609116902phplib-code-execution(24873)ADV-2006-07201680123466http://www.gulftech.org/?node=research&article_id=00107-030520061016123index.php in Invision Power Board (IPB) 2.0.1, with Code Confirmation disabled, allows remote attackers to cause an unspecified denial of service by registering a large number of users.166161489Cross-site scripting (XSS) vulnerability in Calcium 3.10.1 allows remote attackers to inject arbitrary web script or HTML via the EventText parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-072419007calcium-eventtext-xss(24907)1685123471Directory traversal vulnerability in SpeedProject Squeez 5.1, as used in (1) ZipStar 5.1 and (2) SpeedCommander 11.01.4450, allows remote attackers to overwrite arbitrary files via unspecified manipulations in a (1) JAR or (2) ZIP archive.ADV-2006-073120060224 SpeedCommander 11.0 & ZipStar 5.1 & Squeez 5.1 Directory traversalspeedproject-zip-jar-directory-traversal(24909)168072346519006Multiple directory traversal vulnerabilities in NOCC Webmail 1.0 allow remote attackers to include arbitrary files via .. (dot dot) sequences and a trailing NULL (%00) byte in (1) the _SESSION['nocc_theme'] parameter in (a) html/footer.php; and (2) the lang and (3) theme parameters and the (4) Accept-Language HTTP header field, when force_default_lang is disabled, in (b) index.php, as demonstrated by injecting PHP code into a profile and accessing it using the lang parameter in index.php.1692120060223 NOCC Webmail <= 1.0 multiple vulnerabilitiesnocc-index-file-include(24934)16793234192341823417234161015671http://retrogod.altervista.org/noccw_10_incl_xpl.htmlNOCC Webmail 1.0 stores e-mail attachments in temporary files with predictable filenames, which makes it easier for remote attackers to execute arbitrary code by accessing the e-mail attachment via directory traversal vulnerabilities.1692120060223 NOCC Webmail <= 1.0 multiple vulnerabilities16793234201015671http://retrogod.altervista.org/noccw_10_incl_xpl.htmlNOCC Webmail 1.0 allows remote attackers to obtain sensitive information via a direct request to (1) the profiles directory, which leaks e-mail addresses contained in filenames of profiles, and (2) the tmp directory, which lists names of uploaded attachments.1692120060223 NOCC Webmail <= 1.0 multiple vulnerabilities1679323422234201015671http://retrogod.altervista.org/noccw_10_incl_xpl.htmlMultiple cross-site scripting (XSS) vulnerabilities in NOCC Webmail 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the html_error_occurred parameter in error.php, (2) html_filter_select parameter in filter_prefs.php, (3) html_no_mail parameter in no_mail.php, the (4) page_line, (5) prev, and (6) next parameters in html_bottom_table.php, and the (7) _SESSION['nocc_theme'] parameter in footer.php.1692120060223 NOCC Webmail <= 1.0 multiple vulnerabilities1679323427234262342523424234231015671http://retrogod.altervista.org/noccw_10_incl_xpl.htmlNOCC Webmail 1.0 allows remote attackers to obtain the installation path via a direct request to html/header.php.1692120060223 NOCC Webmail <= 1.0 multiple vulnerabilities167931015671478http://retrogod.altervista.org/noccw_10_incl_xpl.htmlCross-site scripting (XSS) vulnerability in Sources/Register.php in Simple Machine Forum (SMF) 1.0.6 allows remote attackers to inject arbitrary web script or HTML via the X-Forwarded-For HTTP header field.smf-register-xss(24915)ADV-2006-0726http://www.simplemachines.org/community/index.php?topic=78841.01684120060306 [eVuln] Simple Machines Forum - SMF 'X-Forwarded-For' XSS Vulnerability2348054519004http://evuln.com/vulns/86/summary.html20060410 VEndor ACK: Simple Machines Forum Register.php X-Forwarded-For XSS** DISPUTED ** SQL injection vulnerability in VCS Virtual Program Management Intranet (VPMi) Enterprise 3.3 allows remote attackers to execute arbitrary SQL commands via the UpdateID0 parameter to Service_Requests.asp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: the vendor has disputed this issue, saying that "[we] have a behind the scenes complex state management system that uses a combination of keys placed in JavaScript and Session State (server side) that protects against the type of SQL injection you describe. We have tested for many of the cases and have not found it to be an issue." Further investigation suggests that the original researcher might have triggered errors using invalid field values, which is not proof of SQL injection; however, the vendor did not receive a response from the original researcher.vpmi-servicerequests-sql-injection(24885)ADV-2006-0725167982347920060310 Re: vendor dispute: VCS20060310 vendor dispute: VCS18842Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector (IV) of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael.1680220060223 Vulnerability in Crypt::CBC Perl module, versions <= 2.1631493RHSA-2008:0630crypt-cbc-header-weak-encryption(24954)RHSA-2008:0261SUSE-SR:2006:015GLSA-200603-15DSA-99648820899193031918718755Directory traversal vulnerability in index.php in 4Images 1.7.1 and earlier allows remote attackers to read and include arbitrary files via ".." (dot dot) sequences in the template parameter.4images-template-file-include(24938)ADV-2006-07541685520060301 4images <=1.7.1 remote code execution2352919026http://retrogod.altervista.org/4images_171_adv.html1533518nfsd in FreeBSD 6.0 kernel allows remote attackers to cause a denial of service via a crafted NFS mount request, as demonstrated by the ProtoVer NFS test suite.19017[Dailydave] 20060226 fun with FreeBSD kernelfreebsd-nfsd-kernel-dos(24918)1683823511521FreeBSD-SA-06:10Unspecified vulnerability in the hsfs filesystem in Solaris 8, 9, and 10 allows unspecified attackers to cause a denial of service (panic) or execute arbitrary code.1682610216119042ADV-2006-0756solaris-hsfs-privilege-elevation(24911)1015680oval:org.mitre.oval:def:1628MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysql_real_query function. NOTE: this issue was originally reported for the mysql_query function, but the vendor states that since mysql_query expects a null character, this is not an issue for mysql_query.ADV-2006-075216850RHSA-2008:036410156933035119034http://rst.void.ru/papers/advisory39.txtoval:org.mitre.oval:def:9915mysql-query-log-bypass-security(24966)USN-274-1USN-274-2RHSA-2007:0083RHSA-2006:0544MDKSA-2006:064DSA-1079DSA-1073DSA-1071206252033320253202411981419502http://bugs.mysql.com/bug.php?id=1766720060225 mysql <= 5.0.18A "programming error" in fast_ipsec in FreeBSD 4.8-RELEASE through 6.1-STABLE and NetBSD 2 through 3 does not properly update the sequence number associated with a Security Association, which allows packets to pass sequence number checks and allows remote attackers to capture IPSec packets and conduct replay attacks.1719119366FreeBSD-SA-06:11bsd-ipsec-replay(25398)240681015809NetBSD-SA2006-011SQL injection vulnerability in D3Jeeb Pro 3 allows remote attackers to execute arbitrary SQL commands via the catid parameter in (1) fastlinks.php and (2) catogary.php.ADV-2006-075720060226 2 SQL Injection in d3jeebd3jeeb-catid-sql-injection(24941)16853101568719062SQL injection vulnerability in PHP-Nuke before 7.8 Patched 3.2 allows remote attackers to execute arbitrary SQL commands via encoded /%2a (/*) sequences in the query string, which bypasses regular expressions that are intended to protect against SQL injection, as demonstrated via the kala parameter.http://www.waraxe.us/advisory-47.html20060225 [waraxe-2006-SA#047] - Evading sql-injection filters in phpNuke 7.8PHP-Nuke 7.8 Patched 3.2 allows remote attackers to bypass SQL injection protection mechanisms via /%2a (/*) sequences with the "ad_click" word in the query string, as demonstrated via the kala parameter.http://www.waraxe.us/advisory-47.html20060225 [waraxe-2006-SA#047] - Evading sql-injection filters in phpNuke 7.8497Invision Power Board (IPB) 2.1.4 and earlier allows remote attackers to view sensitive information via a direct request to multiple PHP scripts that include the full path in error messages, including (1) PEAR/Text/Diff/Renderer/inline.php, (2) PEAR/Text/Diff/Renderer/unified.php, (3) PEAR/Text/Diff3.php, (4) class_db.php, (5) class_db_mysql.php, and (6) class_xml.php in the ips_kernel/ directory; (7) mysql_admin_queries.php, (8) mysql_extra_queries.php, (9) mysql_queries.php, and (10) mysql_subsm_queries.php in the sources/sql directory; (11) sources/acp_loaders/acp_pages_components.php; (12) sources/action_admin/member.php and (13) sources/action_admin/paysubscriptions.php; (14) login.php, (15) messenger.php, (16) moderate.php, (17) paysubscriptions.php, (18) register.php, (19) search.php, (20) topics.php, (21) and usercp.php in the sources/action_public directory; (22) bbcode/class_bbcode.php, (23) bbcode/class_bbcode_legacy.php, (24) editor/class_editor_rte.php, (25) editor/class_editor_std.php, (26) post/class_post.php, (27) post/class_post_edit.php, (28) post/class_post_new.php, (29) and post/class_post_reply.php in the sources/classes directory; (30) sources/components_acp/registration_DEPR.php; (31) sources/handlers/han_paysubscriptions.php; (32) func_usercp.php; (33) search_mysql_ftext.php, and (34) search_mysql_man.php in the sources/lib/ directory; and (35) convert/auth.php.bak, (36) external/auth.php, and (37) ldap/auth.php in the sources/loginauth directory.invisionpowerboard-multiple-info-disclosure(24840)20060221 Invision Power Board 2.1.4 Multiple Vulnerabilitieshttp://neosecurityteam.net/index.php?action=advisories&id=16http://neosecurityteam.net/advisories/Advisory-16.txt20070419 IPB (Invision Power Board) Full Path DisclusureInvision Power Board (IPB) 2.1.4 and earlier allows remote attackers to list directory contents via a direct request to multiple directories, including (1) sources/loginauth/convert/, (2) sources/portal_plugins/, (3) cache/skin_cache/cacheid_2/, (4) ips_kernel/PEAR/, (5) ips_kernel/PEAR/Text/, (6) ips_kernel/PEAR/Text/Diff/, (7) ips_kernel/PEAR/Text/Diff/Renderer/, (8) style_images/1/folder_rte_files/, (9) style_images/1/folder_js_skin/, (10) style_images/1/folder_rte_images/, and (11) upgrade/ and its subdirectories.invisionpowerboard-multiple-info-disclosure(24840)20060221 Invision Power Board 2.1.4 Multiple Vulnerabilitieshttp://neosecurityteam.net/index.php?action=advisories&id=16http://neosecurityteam.net/advisories/Advisory-16.txtNmService.exe in Ipswitch WhatsUp Professional 2006 allows remote attackers to cause a denial of service (CPU consumption) via crafted requests to Login.asp, possibly involving the (1) "In]" and (2) "b;tnLogIn" parameters, or (3) malformed btnLogIn parameters, possibly involving missing "[" (open bracket) or "[" (closing bracket) characters, as demonstrated by "&btnLogIn=[Log&In]=&" or "&b;tnLogIn=[Log&In]=&" in the URL. NOTE: due to the lack of diagnosis by the original researcher, the precise nature of the vulnerability is unclear.http://zur.homelinux.com/Advisories/ipswitch_dos.txtwhatsup-nmservice-dos(24864)ADV-2006-07041677120060222 IpSwitch WhatsUp Professional 2006 DoS23494472Oreka before 0.5 allows remote attackers to cause a denial of service (application crash) via a "certain RTP sequence."ADV-2006-081223300http://oreka.sourceforge.net/1693719095SQL injection vulnerability in whineatnews.pl in Bugzilla 2.17 through 2.18.4 and 2.20 allows remote authenticated users with administrative privileges to execute arbitrary SQL commands via the whinedays parameter, as accessible from editparams.cgi.https://bugzilla.mozilla.org/show_bug.cgi?id=312498bugzilla-editparams-sql-injection(24819)ADV-2006-06921673820060221 [BUGZILLA] Security Advisory for Bugzilla 2.20, 2.21.1, and 2.18.41897923378Bugzilla 2.16.10, 2.17 through 2.18.4, and 2.20 does not properly handle certain characters in the mostfreqthreshold parameter in duplicates.cgi, which allows remote attackers to trigger a SQL error.https://bugzilla.mozilla.org/show_bug.cgi?id=312498bugzilla-duplicates-sql-injection(42802)ADV-2006-069220060221 [BUGZILLA] Security Advisory for Bugzilla 2.20, 2.21.1, and 2.18.4Bugzilla 2.16.10 does not properly handle certain characters in the (1) maxpatchsize and (2) maxattachmentsize parameters in attachment.cgi, which allows remote attackers to trigger a SQL error.https://bugzilla.mozilla.org/show_bug.cgi?id=313441ADV-2006-0692Bugzilla 2.19.3 through 2.20 does not properly handle "//" sequences in URLs when redirecting a user from the login form, which could cause it to generate a partial URL in a form action that causes the user's browser to send the form data to another domain.https://bugzilla.mozilla.org/show_bug.cgi?id=325079bugzilla-login-data-redirection(24821)ADV-2006-06921674520060221 [BUGZILLA] Security Advisory for Bugzilla 2.20, 2.21.1, and 2.18.418979464Melange Chat Server (aka M-Chat), when accessed via a web browser, automatically sends cookies and other sensitive information for a server to any port specified in the associated link, which allows local users on that server to read the cookies from HTTP headers and possibly gain sensitive information, such as credentials, by setting up a listening port and reading the credentials when the victim clicks on the link.melange-chat-command-information-disclosure(24868)1674720060221 grab cookie information with Melange Chat Server 1.10http://www.oh2600.com/forum/viewtopic.php?t=4318984463Buffer overflow in RITLabs The Bat! 3.60.07 allows remote attackers to execute arbitrary code via a long Subject field.18989ADV-2006-07171679720060223 NSA Group Security Advisory NSAG-¹198-23.02.2006 Vulnerability The Bat v. 3.60.07http://www.nsag.ru/vuln/953.htmlthebat-subject-bo(24882)485SQL injection vulnerability in index.php (aka the login page) in Oi! Email Marketing System 3.0 (aka Oi! 3) allows remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.ADV-2006-071820060223 HYSA-2006-003 Oi! Email Marketing 3.0 SQL Injectionhttp://www.h4cky0u.org/advisories/HYSA-2006-003-oi-email.txt2346218993Oi! Email Marketing System 3.0 (aka Oi! 3) stores the server's FTP password in cleartext on a Configuration web page, which allows local users with superadministrator privileges, or attackers who have obtained access to the web page, to view the password.20060223 HYSA-2006-003 Oi! Email Marketing 3.0 SQL Injectionhttp://www.h4cky0u.org/advisories/HYSA-2006-003-oi-email.txt16794483Multiple directory traversal vulnerabilities in connector.php in FCKeditor 2.0 FC, as used in products such as RunCMS, allow remote attackers to list and create arbitrary directories via a .. (dot dot) in the CurrentFolder parameter to (1) GetFoldersAndFiles and (2) CreateFolder.20060223 NSA Group Security Advisory NSAG-¹195-23.02.2006 Vulnerability FCKeditor 2.0 FChttp://www.nsag.ru/vuln/952.htmlfckeditor-connector-obtain-information(24878)20060519 Re: NSA Group Security Advisory NSAG-¹195-23.02.2006 Vulnerability FCKeditor 2.0 FC484CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php (aka upload.php) that allows remote attackers to upload arbitrary files via a modified CurrentFolder parameter in a direct request to admin/filemanager/upload.php.http://www.cubecart.com/site/forums/index.php?showtopic=14972http://www.cubecart.com/site/forums/index.php?showtopic=14825cubecart-connector-file-include(24883)1679620060223 NSA Group Security Advisory NSAG-¹197-23.02.2006 Vulnerability CubeCart 3.0.0 ? 3.0.6http://www.nsag.ru/vuln/892.htmlhttp://www.cubecart.com/site/forums/index.php?showtopic=14960http://www.cubecart.com/site/forums/index.php?showtopic=14817http://www.cubecart.com/site/forums/index.php?showtopic=14704482Multiple cross-site scripting (XSS) vulnerabilities in MyPHPNuke (MPN) 1.88 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the letter parameter in reviews.php and (2) the dcategory parameter in download.php.ADV-2006-075020060224 Advisory: MyPHPNuke <= 1.8.8 multiple XSS vulnerabilitieshttp://www.nukedx.com/?viewdoc=12myphpnuke-reviews-download-xss(24887)16815http://www.myphpnuke.com/article.php?sid=1035&mode=thread&order=049119052Cross-site scripting (XSS) vulnerability in Brown Bear iCal 3.10 allows remote attackers to inject arbitrary web script or HTML via the Calendar Text field when a new event is added. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.This vulnerability affects Brown Bear iCal version 3.10 and previous.ADV-2006-0727168452347219001ical-calendartext-xss(24919)Format string vulnerability in the IMAP4rev1 server in Alt-N MDaemon 8.1.1 and possibly 8.1.4 allows remote attackers to cause a denial of service (CPU consumption) by creating and then listing folders whose names contain format string specifiers.ADV-2006-0729http://www.nsag.ru/vuln/888.html18921mdaemon-imap-foldername-dos(24916)16854Multiple directory traversal vulnerabilities in Allume StuffIt Standard and Deluxe 9.0, ZipMagic Deluxe 9.0, and StuffIt Expander 9.0.0.21 Engine 9.0.0.21 allow remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a (1) zip or (2) tar archive.ADV-2006-07321680620060224 StuffIt and ZipMagic Family of products Directory traversalhttp://www.hamid.ir/security/stuffit.txt19010stuffit-zipmagic-archive-directory-traversal(24886)23463Multiple cross-site scripting (XSS) vulnerabilities in the JGS-XA JGS-Gallery Addon 4.0.0 and earlier for Woltlab Burning Board (wBB) 2.x allow remote attackers to inject arbitrary web script or HTML via the (1) userid parameter in (a) jgs_galerie_slideshow.php and (b) jgs_galerie_scroll.php, and the (2) katid parameter in (c) jgs_galerie_slideshow.php.Vulnerability affects JGS-XA, JGS-Gallery Addon versions 4.0.0 and previous.1681020060224 Advisory: Woltlab Burning Board 2.x (JGS-Gallery MOD <= 4.0)multiple XSS vulnerabilitieshttp://www.nukedx.com/?viewdoc=11wbb-jgsgallerymod-xss(24888)1684320060224 Advisory: Woltlab Burning Board 2.x (JGS-Gallery MOD <= 4.0) multiple XSS vulnerabilitiesThe POP3 Server in ArGoSoft Mail Server Pro 1.8 allows remote attackers to obtain sensitive information via the _DUMP command, which reveals the operating system, registered user, and registration code.ADV-2006-07331680820060224 NSA Group Security Advisory NSAG-¹198-23.02.2006 Vulnerability ArGoSoft Mail Server Prohttp://www.nsag.ru/vuln/879.html18990Directory traversal vulnerability in the IMAP server in ArGoSoft Mail Server Pro 1.8.8.1 allows remote authenticated users to create arbitrary folders via a .. (dot dot) in the RENAME command.ADV-2006-07331680920060224 NSA Group Security Advisory NSAG-¹200-24.02.2006 Vulnerability ArGoSoft Mail Server Pro IMAPhttp://www.nsag.ru/vuln/878.html18990Directory traversal vulnerability in Webmail in ArGoSoft Mail Server Pro 1.8 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the UIDL parameter.ADV-2006-0733http://www.nsag.ru/vuln/877.html18990487Directory traversal vulnerability in PEAR::Archive_Tar 1.2, and other versions before 1.3.2, allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a TAR archive.ADV-2006-07281680520060224 Archive_Tar v 1.2(Tested) (Tar file management class) Directory traversal23481http://www.hamid.ir/security/phptar.txt19011http://pear.php.net/package/Archive_Tar/download/http://pear.php.net/bugs/bug.php?id=6933Directory traversal vulnerability in zip.lib.php 0.1.1 in PEAR::Archive_Zip allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a ZIP archive.20060224 Archive_Tar v 1.2(Tested) (Tar file management class) Directory traversalhttp://www.hamid.ir/security/phpzip.txtziplib-directory-traversal(24972)20060225 Archive_Zip (Zip file management class) Directory traversal486Cross-site scripting (XSS) vulnerability in PHPX 3.5.9 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in a url XCode tag in a posted message. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.phpx-xcode-tag-xss(24874)ADV-2006-07221679918688Cross-site scripting (XSS) vulnerability in webinsta Limbo 1.0.4.2 allows remote attackers to inject arbitrary web script or HTML via the message field in the Contact Form.webinsta-limbo-contact-form-xss(24877)ADV-2006-0721168112346918723http://osvdb.org/ref/23/23469-limbo.txtMicrosoft Word 2003 allows remote attackers to cause a denial of service (application crash) via a crafted file, as demonstrated by 101_filefuzz.16782[Dailydave] 20060221 word dos 4funFree Host Shop Website Generator 3.3 allows remote authenticated users with administrative privileges to upload and execute arbitrary files via a formname parameter with a filename containing a dangerous file extension and a trailing %00.19014http://nsag.ru/vuln/894.html1682320060225 NSA Group Security Advisory NSAG-¹202-25.02.2006 Vulnerability WEBSITE GENERATOR 3.3U.N.U. Mailgust 1.9 allows remote attackers to obtain sensitive information via a direct request to index.php with method=showfullcsv, which reveals the POP3 server configuration, including account name and password.18998http://nsag.ru/vuln/890.htmlmailgust-index-info-disclosure(24890)Cross-site scripting (XSS) vulnerability in eZ publish 3.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the RefererURL parameter.1681720060225 Advisory: eZ publish <= 3.7.3 (imagecatalogue module) XSSvulnerabilityhttp://www.nukedx.com/?viewdoc=16ezpublish-referrerurl-xss(24956)1015683SQL injection vulnerability in DCI-Taskeen 1.03 allows remote attackers to execute arbitrary SQL commands via the (1) id or (2) action parameter to (a) basket.php, or (3) id or (4) page parameter to (b) cat.php.1682820060225 SQL Injection in DCI-Taskeen1015685dci-taskeen-multiple-scripts-sql-injection(24963)495Multiple direct static code injection vulnerabilities in savesettings.php in ShoutLIVE 1.1.0 allow remote attackers to execute arbitrary PHP code via variables that are written to settings.php.ADV-2006-07552348219047http://evuln.com/vulns/87/summary.htmlshoutlive-savesettings-file-include(24897)1685720060307 [eVuln] ShoutLIVE PHP Code Execution & Multiple XSS Vulnerabilities557Multiple cross-site scripting (XSS) vulnerabilities in post.php in ShoutLIVE 1.1.0 allow remote attackers to inject arbitrary web script or HTML via certain variables when posting new messages.ADV-2006-07552348319047http://evuln.com/vulns/87/summary.htmlshoutlive-post-xss(24901)1685720060307 [eVuln] ShoutLIVE PHP Code Execution & Multiple XSS Vulnerabilities557SQL injection vulnerability in profil.php in PwsPHP 1.2.3, and possibly earlier versions, allows remote attackers to execute arbitrary SQL commands via the aff_news_form parameter, a different vulnerability than CVE-2005-1509.16567http://downloads.securityfocus.com/vulnerabilities/exploits/PwsPHP_SQL_Inj.php28444SQL injection vulnerability in the sondages module in index.php in PwsPHP 1.2.3 allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.ADV-2006-074820060226 Re: PwsPHP Injection SQL on Index.php20060225 PwsPHP Injection SQL on Index.phphttp://www.pwsphp.com/index.php?mod=news&ac=commentaires&id=2781015684496Archangel Weblog 0.90.02 allows remote attackers to bypass authentication by setting the ba_admin cookie to 1.archangel-admin-auth-bypass(24984)20060226 Archangel Weblog 0.90.02 Admin Authentication Bypass & Remote File Inclusionarchangel-admin-auth-bypass(24984)168482362038591015689PHP remote file include vulnerability in admin/index.php in Archangel Weblog 0.90.02 allows remote authenticated administrators to execute arbitrary PHP code via a URL ending in a NULL (%00) in the index parameter.archangel-index-file-include(25142)archangel-admin-auth-bypass(24984)archangel-admin-auth-bypass(24984)1684820060226 Archangel Weblog 0.90.02 Admin Authentication Bypass & Remote File Inclusion236211015689Cross-site scripting (XSS) vulnerability in Thomson SpeedTouch modems running firmware 5.3.2.6.0 allows remote attackers to inject arbitrary web script or HTML via the name parameter to the LocalNetwork page.ADV-2006-07651683920060226 Thomson SpeedTouch 500 modems vulnerable to XSSspeedtouch-localnetwork-xss(24977)23527101568819069Thomson SpeedTouch modem running firmware 5.3.2.6.0 allows remote attackers to create users that cannot be deleted via scripting code in the "31" parameter in a NewUser function, which is not filtered by the modem when creating the account, but cannot be deleted by the administrator, possibly due to cleansing that occurs in the administrator interface.ADV-2006-07651683920060226 Thomson SpeedTouch 500 modems vulnerable to XSS101568819069AOL 9.0 Security Edition revision 4184.2340, and probably other versions, uses insecure permissions (Everyone/Full Control) for the "America Online 9.0" directory, which allows local users to gain privileges by replacing critical files.AOL has released fixes to address this issue. These fixes can be automatically applied by logging in to the service.aol-default-insecure-permissions(28445)19583101671718734ADV-2006-331720060818 Secunia Research: AOL Insecure Default Directory Permissions279951416http://secunia.com/secunia_research/2006-08RaidenHTTPD 1.1.47 allows remote attackers to obtain source code of script files, including PHP, via crafted requests involving (1) "." (dot), (2) space, and (3) "/" (slash) characters.This vulnerability affects RaidenHTTPD, RaidenHTTPD version 1.1.47 and may affect all previous versions.23616http://secunia.com/secunia_research/2006-15/advisory/19032ADV-2006-0807raidenhttpd-extension-obtain-information(25037)16934unalz 0.53 allows user-assisted attackers to overwrite arbitrary files via an ALZ archive with ".." (dot dot) sequences in a filename.20060313 Secunia Research: unalz Filename Handling Directory TraversalVulnerability19063unalz-archive-directory-traversal(25171)ADV-2006-093817105238351015780575http://secunia.com/secunia_research/2006-16/20060313 Secunia Research: unalz Filename HandlingThe GUI (nod32.exe) in NOD32 2.5 runs with SYSTEM privileges when the scheduler runs a scheduled on-demand scan, which allows local users to execute arbitrary code during a scheduled scan via unspecified attack vectors.19054ADV-2006-1242http://secunia.com/secunia_research/2006-17/advisory/24394nuauth in NuFW before 1.0.21 does not properly handle blocking TLS sockets, which allows remote authenticated users to cause a denial of service (service hang) by flooding packets at the authentication server.This vulnerability affects NuFW, NuFW Firewall versions 1.0.20 and previous.http://www.nufw.org/+NuFW-1-21-minor-security-fix+.html19046ADV-2006-076216868Direct static code injection vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to execute arbitrary PHP code via the (1) X-Forwarded-For and (2) Client-Ip HTTP headers, which are stored in Data/flood.db.php.19020http://evuln.com/vulns/89/summary.htmlADV-2006-0759http://soft.zoneo.net/freeForum/changes.php1687120060310 [eVuln] FreeForum PHP Code Execution & Multiple XSS VulnerabilitiesCross-site scripting (XSS) vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the (1) name and (2) subject parameters.19020http://evuln.com/vulns/89/summary.htmlADV-2006-0759http://soft.zoneo.net/freeForum/changes.phpfreeforum-func-xss(24925)1687720060310 [eVuln] FreeForum PHP Code Execution & Multiple XSS VulnerabilitiesSQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands by setting the comma variable value via the comma parameter in a cookie. NOTE: 1.04 has also been reported to be affected.mybb-misc-sql-injection(24953)ADV-2006-07741663120060303 MyBB 1.04 Perl Exploit20060228 MyBB 1.3 NewSQL Injection23554512190611539uConfig agent in Compex NetPassage WPE54G router allows remote attackers to cause a denial of service (unresposiveness) via crafted datagrams to UDP port 7778.ADV-2006-078016894http://www.security.nnov.ru/Ldocument605.html101569019037netpassage-udp-dos(24968)SQL injection vulnerability in yazdir.asp in Cilem Hiber 1.1 allows remote attackers to execute arbitrary SQL commands via the haber_id parameter. NOTE: this product has also been referred to as "Cilem News," although that does not appear to be the proper name.cilemnews-sql-injection(24920)ADV-2006-08811681323618http://www.nukedx.com/?viewdoc=10101567719157156220060224 Advisory: CilemNews System <= 1.1 Remote SQL20060224 Advisory: CilemNews System <= 1.1 Remote SQL Injection VulnerabilitySQL injection vulnerability in vuBB 0.2 allows remote attackers to execute arbitrary SQL commands via the pass parameter in a cookie.ADV-2006-079919084vubb-index-sql-injection(25019)169301543Multiple buffer overflows in STLport 5.0.2 might allow local users to execute arbitrary code via (1) long locale environment variables to a strcpy function call in c_locale_glibc2.c and (2) long arguments to unspecified functions in num_put_float.cpp.19051ADV-2006-0800http://sourceforge.net/project/shownotes.php?release_id=397543stlport-strcpy-local-bo(25159)16928Client Firewall in NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to bypass firewall program execution rules by replacing an allowed program with an arbitrary program.1690620060301 NCP VPN/PKI Client - various Bugsncp-client-firewall-bypass-security(25242)1908220060301 NCP VPN/PKI Client - various BugsNCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to bypass security protections and configure privileged options via a long argument to ncpmon.exe, which provides access to alternate privileged menus, possibly due to a buffer overflow.1690620060301 NCP VPN/PKI Client - various Bugsncp-ncpmon-bo(25243)1908220060301 NCP VPN/PKI Client - various BugsNCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users cause a denial of service (CPU consumption) via a large number of arguments to ncprwsnt.exe, possibly due to a buffer overflow.1690620060301 NCP VPN/PKI Client - various Bugsncp-ncprwsnt-dos(25248)1908220060301 NCP VPN/PKI Client - various BugsNCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users cause a denial of service (memory usage and cpu utilization) via a flood of arbitrary UDP datagrams to ports 0 to 65000. NOTE: this issue was reported as a buffer overflow, but that term usually does not apply in flooding attacks.1690620060301 NCP VPN/PKI Client - various Bugsncp-udp-dos(25249)1908220060301 NCP VPN/PKI Client - various BugsThe ncprwsnt service in NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to execute arbitrary code by modifying the connect.bat script, which is automatically executed by the service after a connection is established.1690620060301 NCP VPN/PKI Client - various Bugsncp-connect-command-execution(25251)5241908220060301 NCP VPN/PKI Client - various BugsPHP remote file inclusion vulnerability in index.php in Top sites de PixelArtKingdom allows remote attackers to include and execute arbitrary files via the page parameter.20060227 PixelArtKingdom TopSites Remote Command Exucetion507PHP remote file inclusion vulnerability in index.php in one or more ActiveCampaign products, possibly SupportTrio, allows remote attackers to include and execute arbitrary files via the page parameter.20060227 Knowledgebases Remote Command Exucetionactivecampaign-index-command-execution(24989)3228505Directory traversal vulnerability in Lionel Reyero DirectContact 0.3b allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.ADV-2006-076120060227 directory traversal in DirectContact 0.3bdirectcontact-dotdot-dir-traversal(24930)http://www3.autistici.org/fdonato/advisory/DirectContact0.3b-adv.txt1684920060312 directory traversal Fixed in DirectContact 0.3c2351910156865061905320060227 directory traversal in DirectContact 0.3bSQL injection vulnerability in news.php in Tony Baird Fantastic News 2.1.1 allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the category vector is already covered by CVE-2005-3846.20060226 2 SQL Injection in Fantastic Newsfantasticnews-news-sql-injection(24943)16842501SQL injection vulnerability in topics.php in Appalachian State University phpWebSite 0.10.2 and earlier allows remote attackers to execute arbitrary SQL commands via the topic parameter.http://www.securityfocus.com/data/vulnerabilities/exploits/phpWebSite-topic-sql-inj.pl16825phpwebsite-topics-sql-injection(25799)20060523 sql injection in phpWebSite 0.8.320060412 phpWebSite 0.10.? (topics.php) Remote SQL Injection Exploit1525Cross-site scripting (XSS) vulnerability in failure.asp in Battleaxe bttlxeForum 2.0 allows remote attackers to inject arbitrary web script or HTML via the err_txt parameter.This vulnerability affects Battleaxe Software, bttlxeForum versions 2.0 and previousbttlxeforum-failure-xss(24981)ADV-2006-077616821235401904320060226 bttlxeForum 2.* XSS Vulnerability** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-0459. Reason: This candidate is a reservation duplicate of CVE-2006-0459. Notes: All CVE users should reference CVE-2006-0459 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.Directory traversal vulnerability in scan_lang_insert.php in Boris Herbiniere-Seve SPiD 1.3.1 allows remote attackers to read arbitrary files via the lang parameter.spid-scanlanginsert-file-include(24955)ADV-2006-07661682220060225 NSA Group Security Advisory NSAG-¹201-25.02.2006 Vulnerability SPiD v1.3.1http://www.nsag.ru/vuln/955.html19033Craig Morrison Mail Transport System Professional (aka MTS Pro) acts as an open relay when configured to relay all mail through an external SMTP server, which allows remote attackers to relay mail by connecting to the MTS Pro server, then sending a MAIL FROM that specifies a domain that is local to the server.ADV-2006-078620060225 Mail Transport System Professional--Open Relay Holemts-mail-relay(24985)1684019067Multiple cross-site scripting (XSS) vulnerabilities in the View Headers (aka viewheaders) functionality in ArGoSoft Mail Server Pro 1.8.8.5 allow remote attackers to inject arbitrary web script or HTML via (1) the Subject header, (2) the From header, and (3) certain other unspecified headers.This vulnerability affects ArGoSoft, Mail Server Pro version 1.8.8.5, and may affect all previous versions.ADV-2006-07511683420060227 Secunia Research: ArGoSoft Mail Server Pro viewheaders ScriptInsertion23512http://secunia.com/secunia_research/2006-6/advisory/18991argosoft-mailserverpro-viewheaders-xss(24945)504Unspecified vulnerability in the local weblog publisher in Nidelven IT Issue Dealer before 0.9.96 has unknown impact and attack vectors.This vulnerability affects Nidelven IT, Issue Dealer versions 0.9.95 and previous.23502http://issuedealer.com/changes/issuedealer-unpublished-issue-disclosure(24929)1688419018Multiple cross-site scripting (XSS) vulnerabilities in Jay Eckles CGI Calendar 2.7 allow remote attackers to inject arbitrary web script or HTML via the year parameter in (1) index.cgi and (2) viewday.cgi.ADV-2006-076420060226 CGI Calendar XSS Vulnerabilitycgicalendar-index-viewday-xss(24946)19066Directory traversal vulnerability in e-merge WinAce 2.6 and earlier allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a (1) zip or (2) tar archive.This vulnerability affects e-merge, WinAce versions 2.6 and previous.winace-rar-tar-directory-traversal(24902)ADV-2006-07301680020060224 WinAce Archiver v2.6 Directory traversal23464http://www.hamid.ir/security/winace.txt19013The on-access scanner for McAfee Virex 7.7 for Macintosh, in some circumstances, might not activate when malicious content is accessed from the web browser, and might not prevent the content from being saved, which allows remote attackers to bypass virus protection, as demonstrated using the EICAR test file.20060228 Virex on-access scanning unreliableCross-site scripting (XSS) vulnerability in index.php in QwikiWiki 1.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter.http://sourceforge.net/forum/forum.php?forum_id=4385261687420060228 QwikiWiki v1.4 XSS Vulnerabilityqwikiwiki-index-xss(24950)23700510Cross-site scripting (XSS) vulnerability in inc_header.php in EJ3 TOPo 2.2.178 allows remote attackers to inject arbitrary web script or HTML via the gTopNombre parameter.This vulnerability affects EJ3, TOPo version 2.2.178, and possibly all previous versions.ADV-2006-07751687920060228 EJ3 TOPo - Cross Site Scripting Vulnerabilitytopo-incheader-xss(24980)2354151119070Multiple cross-site scripting (XSS) vulnerabilities in the "post comment" functionality of WordPress 2.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) website, and (3) comment parameters.20060227 WordPress 2.0.1 Multiple Vulnerabilitieshttp://NeoSecurityTeam.net/advisories/Advisory-17.txtADV-2006-0777wordpress-wpcommentspost-xss(24957)20060302 Re: FW: WordPress 2.0.1 Multiple Vulnerabilities20060228 FW: WordPress 2.0.1 Multiple Vulnerabilities19050WordPress 2.0.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) default-filters.php, (2) template-loader.php, (3) rss-functions.php, (4) locale.php, (5) wp-db.php, and (6) kses.php in the wp-includes/ directory; and (7) edit-form-advanced.php, (8) admin-functions.php, (9) edit-link-form.php, (10) edit-page-form.php, (11) admin-footer.php, and (12) menu.php in the wp-admin directory; and possibly (13) list directory contents of the wp-includes directory. NOTE: the vars.php, edit-form.php, wp-settings.php, and edit-form-comment.php vectors are already covered by CVE-2005-4463. The menu-header.php vector is already covered by CVE-2005-2110. Other vectors might be covered by CVE-2005-1688. NOTE: if the typical installation of WordPress does not list any site-specific files to wp-includes, then vector [13] is not an exposure.20060227 WordPress 2.0.1 Multiple Vulnerabilitieshttp://NeoSecurityTeam.net/advisories/Advisory-17.txtADV-2006-077720060302 Re: FW: WordPress 2.0.1 Multiple Vulnerabilities20060228 FW: WordPress 2.0.1 Multiple Vulnerabilities19050The default configuration of ISC BIND, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.This vulnerability affects ISC, BIND versions 9.3.2 and previous.http://www.us-cert.gov/reading_room/DNS-recursion121605.pdf20060228 recursive DNS servers DDoS as a growing DDoS problemhttp://dns.measurement-factory.com/surveys/sum1.htmlThe default configuration of the DNS Server service on Windows Server 2003 and Windows 2000, and the Microsoft DNS Server service on Windows NT 4.0, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.This vulnerability affects all versions of Windows 2000 -and- Windows Server 2003.http://www.us-cert.gov/reading_room/DNS-recursion121605.pdf20060228 recursive DNS servers DDoS as a growing DDoS problemhttp://dns.measurement-factory.com/surveys/sum1.htmlStack-based buffer overflow in the volume manager daemon (vmd) in Veritas NetBackup Enterprise Server 5.0 through 6.0 and DataCenter and BusinesServer 4.5FP and 4.5MP allows attackers to execute arbitrary code via unknown vectors.VU#880801http://www.zerodayinitiative.com/advisories/ZDI-06-005.htmlADV-2006-1124http://seer.support.veritas.com/docs/281521.htmhttp://securityresponse.symantec.com/avcenter/security/Content/2006.03.27.htmlnetbackup-vmd-sscanf-bo(25471)1726420060327 ZDI-06-005: Symantec VERITAS NetBackup Volume Manager Buffer Overflow241721015832639Stack-based buffer overflow in the NetBackup Catalog daemon (bpdbm) in Veritas NetBackup Enterprise Server 5.0 through 6.0 and DataCenter and BusinesServer 4.5FP and 4.5MP allows attackers to execute arbitrary code via unknown vectors.VU#744137http://securityresponse.symantec.com/avcenter/security/Content/2006.03.27.htmlhttp://www.zerodayinitiative.com/advisories/ZDI-06-006.htmlADV-2006-1124http://seer.support.veritas.com/docs/281521.htmnetbackup-bpdbm-sprintf-bo(25472)1726420060327 SYM06-006, Veritas NetBackup: Multiple Overflow Vulnerabilities in NetBackup Daemons20060327 ZDI-06-006: Symantec VERITAS NetBackup Database Manager Buffer Overflow101583264219417Buffer overflow in the NetBackup Sharepoint Services server daemon (bpspsserver) on NetBackup 6.0 for Windows allows remote attackers to execute arbitrary code via crafted "Request Service" packets to the vnetd service (TCP port 13724).VU#377441http://securityresponse.symantec.com/avcenter/security/Content/2006.03.27.htmlnetbackup-vnetd-bo(25473)ADV-2006-1124http://www.tippingpoint.com/security/advisories/TSRT-06-01.html1726420060327 TSRT-06-01: Symantec VERITAS NetBackup vnetd Buffer Overflow Vulnerabilityhttp://seer.support.veritas.com/docs/281521.htm101583219417Stack-based buffer overflow in Novell GroupWise Messenger before 2.0 Public Beta 2 allows remote attackers to execute arbitrary code via a long Accept-Language value without a comma or semicolon. NOTE: due to a typo, the original ZDI advisory accidentally referenced CVE-2006-0092. This is the correct identifier.Upgrade to GroupWise Messenger, 2.0 Public Beta 2 to fix this issue.http://www.zerodayinitiative.com/advisories/ZDI-06-008.html17503http://support.novell.com/cgi-bin/search/searchtid.cgi?10100861.htmADV-2006-135520060413 ZDI-06-008: Novell GroupWise Messenger Accept-Language Buffer Overflowgroupwise-accept-language-bo(25828)246171679101591119663http://metasploit.blogspot.com/2006/04/exploit-development-groupwise_14.htmlhttp://cirt.dk/advisories/cirt-42-advisory.txtThe web management interface in 3Com TippingPoint SMS Server before 2.2.1.4478 does not restrict access to certain directories, which might allow remote attackers to obtain potentially sensitive information such as configuration settings.Upgrade to 3Com TippingPoint SMS Server version 2.2.1.4478http://www.zerodayinitiative.com/advisories/ZDI-06-013.htmlADV-2006-175220060509 ZDI-06-013: 3Com TippingPoint SMS Server Information Disclosure Vulnerabilitytippingpoint-sms-information-disclosure(26338)1793525360http://www.3com.com/securityalert/alerts/3COM-06-002.html101605187020058Multiple Sophos Anti-Virus products, including Anti-Virus for Windows 5.x before 5.2.1 and 4.x before 4.05, when cabinet file inspection is enabled, allows remote attackers to execute arbitrary code via a CAB file with "invalid folder count values," which leads to heap corruption.The vendor has issued a fixed versionhttp://www.zerodayinitiative.com/advisories/ZDI-06-012.htmlADV-2006-17301787620060508 ZDI-06-012: Sophos Anti-Virus CAB Unpacking Code Execution Vulnerability101604120028sophos-cab-parsing-bo(26305)86920060508 ZDI-06-012: Sophos Anti-Virus CAB Unpacking Code Execution VulnerabilityEMC Dantz Retrospect 7 backup client 7.0.107, and other versions before 7.0.109, and 6.5 before 6.5.138 allows remote attackers to cause a denial of service (client termination and loss of backup service) via a malformed packet to TCP port 497, which triggers an assert error.This vulnerability affects EMC Dantz, Retrospect versions 7.0.x (all 7.0.x versions previous to 7.0.109) as well as versions 6.5.x (all 6.5.x versions previous to 6.5.138)20060302 EMC Dantz Retrospect 7 Backup client DoS Vulnerabilityhttp://kb.dantz.com/article.asp?article=8361&p=2ADV-2006-0811retrospect-backup-packet-dos(25143)16933101571419097Cross-site scripting (XSS) vulnerability in phpinfo (info.c) in PHP 5.1.2 and 4.4.2 allows remote attackers to inject arbitrary web script or HTML via long array variables, including (1) a large number of dimensions or (2) long values, which prevents HTML tags from being removed.[php-cvs] 20060330 cvs: php-src /ext/standard info.chttp://cvs.php.net/viewcvs.cgi/php-src/ext/standard/info.c?r1=1.260&r2=1.261php-phpinfo-long-array-xss(25702)ADV-2006-2685ADV-2006-1290USN-320-117362RHSA-2006:0501http://www.php.net/ChangeLog-4.php#4.4.324484SUSE-SA:2006:024MDKSA-2006:074http://support.avaya.com/elmodocs2/security/ASA-2006-160.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-129.htm101587967520060408 phpinfo() Cross Site Scripting PHP 5.1.2 and 4.4.2GLSA-200605-082156421252211252095120222202102005219979198321977519599RHSA-2006:0549RHSA-2006:0276oval:org.mitre.oval:def:10997http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/info.c20060501-01-UThe SSL server implementation in NILE.NLM in Novell NetWare 6.5 and Novell Open Enterprise Server (OES) permits encryption with a NULL key, which results in cleartext communication that allows remote attackers to read an SSL protected session by sniffing network traffic.ADV-2006-104317176http://support.novell.com/cgi-bin/search/searchtid.cgi?10100633.htmnetware-nile-ssl-cleartext(25380)24046101579919324The SSL server implementation in NILE.NLM in Novell NetWare 6.5 and Novell Open Enterprise Server (OES) sometimes selects a weak cipher instead of an available stronger cipher, which makes it easier for remote attackers to sniff and decrypt an SSL protected session.ADV-2006-1043http://support.novell.com/cgi-bin/search/searchtid.cgi?10100633.htmnetware-nile-weak-encryption(25381)24047101579919324The SSL server implementation in NILE.NLM in Novell NetWare 6.5 and Novell Open Enterprise Server (OES) allows a client to force the server to use weak encryption by stating that a weak cipher is required for client compatibility, which might allow remote attackers to decrypt contents of an SSL protected session.ADV-2006-1043http://support.novell.com/cgi-bin/search/searchtid.cgi?10100633.htmnetware-nile-forced-weak-encryption(25382)24048101579919324Multiple SQL injection vulnerabilities in Pentacle In-Out Board 3.0 and earlier allow remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) newsid parameter to newsdetailsview.asp and (2) password parameter to login.asp.ADV-2006-07491681820060225 Advisory: Pentacle In-Out Board <= 6.03 (newsdetailsview.aspnewsid) Remote SQL Injection Vulnerability20060225 Advisory: Pentacle In-Out Board <= 6.03 (login.asp) AuthencationByPass Vulnerabilityhttp://www.nukedx.com/?viewdoc=14http://www.nukedx.com/?viewdoc=1310156821902420060225 Advisory: Pentacle In-Out Board <= 6.03 (newsdetailsview.asp newsid) Remote SQL Injection Vulnerability20060225 Advisory: Pentacle In-Out Board <= 6.03 (login.asp) Authencation ByPass VulnerabilitySQL injection vulnerability in the board module in LanSuite LanParty Intranet System 2.0.6 and 2.1.0 beta allows remote attackers to execute arbitrary SQL commands via the fid parameter.This vulnerability affects Lansuite, LanParty Intranet System version 2.1 (Beta) & LanSuite, LanParty Intranet System versions 2.0.6 and previous.ADV-2006-07471683619048lansuite-fid-sql-injection(24940)235331526NETGEAR WGT624 Wireless DSL router has a default account of super_username "Gearguy" and super_passwd "Geardog", which allows remote attackers to modify the configuration. NOTE: followup posts have suggested that this might not occur with all WGT624 routers.netgear-wgt624-default-account(24926)1683520071220 Re: Re: NETGEAR WGT624 Wireless DSL router default user name/password vulnerability20060413 Re: Re: NETGEAR WGT624 Wireless DSL router default user name/password vulnerability20060227 Re: NETGEAR WGT624 Wireless DSL router default user name/password vulnerability20060226 NETGEAR WGT624 ? Wireless DSL router default user name/password vulnerabilityThe backup configuration option in NETGEAR WGT624 Wireless Firewall Router stores sensitive information in cleartext, which allows remote attackers to obtain passwords and gain privileges.1683720060227 NETGEAR WGT624 ? Wireless DSL Firewall/Router vulnerabilitynetgear-wgt624-cleartext-config(24927)Cross-site scripting (XSS) vulnerability in agencyprofile.asp in Parodia 6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the AG_ID parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.ADV-2006-076319025parodia-agencyprofile-xss(24971)1686523548agencyprofile.asp in Parodia 6.2 and earlier might allow remote attackers to obtain sensitive information by triggering an SQL error via an invalid AG_ID parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.This vulnerability affects CactuSoft, Parodia version 6.2, and may affect all previous versions as well.19025Multiple SQL injection vulnerabilities in sendcard.php in sendcard before 3.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified parameters.sendcard-unspecified-sql-injection(24978)16900http://sourceforge.net/forum/forum.php?forum_id=54474919056ADV-2006-0778Multiple SQL injection vulnerabilities in N8cms 1.1 and 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) dir and (2) page_id parameter to index.php.n8cms-index-sql-injection(24974)ADV-2006-077920060309 n8cms 1.1 & 1.2 version Sql İnjection And XSS19068http://biyosecurity.be/bugs/n8cms.txt16858Multiple cross-site scripting (XSS) vulnerabilities in N8cms 1.1 and 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) dir and (2) page_id parameter to (a) index.php and (3) userid parameter to (b) mailto.php. NOTE: it is possible that issues 1 and 2 are resultant from SQL injection.This vulnerability may affect all versions of Nathan Landry, n8cms.n8cms--xss(25126)n8cms-mailto-xss(24975)ADV-2006-077920060309 n8cms 1.1 & 1.2 version Sql İnjection And XSS19068http://biyosecurity.be/bugs/n8cms.txt16858562M4 Project enigma-suite before 0.73.3 (Windows) has a default password of "nominal" for the "enigma-client" account, which allows local users to gain access.ADV-2006-078723572http://www.bytereef.org/m4-project-blog.html19077enigma-suite-default-acoount(24993)Buffer overflow in socket/request.c in CrossFire before 1.9.0, when oldsocketmode is enabled, allows remote attackers to cause a denial of service (segmentation fault) and possibly execute code by sending the server a large request.This vulnerability affects CrossFire versions 1.8.0 and previous.crossfire-oldsocketmode-bo(24932)19044http://cvs.sourceforge.net/viewcvs.py/crossfire/crossfire/socket/request.c?r1=1.80&r2=1.81ADV-2006-0760http://aluigi.altervista.org/poc/crossfirebof.zip1688323549GLSA-200604-11DSA-10011978519194LetterMerger 1.2 stores user information in Access database files with insecure permissions, which allows local users to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.lettermerger-files-disclose-information(25020)169172359919074SQL injection vulnerability in WordPress 1.5.2, and possibly other versions before 2.0, allows remote attackers to execute arbitrary SQL commands via the User-Agent field in an HTTP header for a comment.GLSA-200603-011910916950wordpress-comment-sql-injection(25321)19123PHP remote file include vulnerability in index.php in SMartBlog (aka SMBlog) 1.2 allows remote attackers to include and execute arbitrary PHP files via (1) the pg parameter and (2) a query string without a parameter.20060301 SMBlog Remote Command Exucetionsmartblog-index-file-include(25220)16905Argument injection vulnerability in certain PHP 4.x and 5.x applications, when used with sendmail and when accepting remote input for the additional_parameters argument to the mb_send_mail function, allows context-dependent attackers to read and create arbitrary files by providing extra -C and -X arguments to sendmail. NOTE: it could be argued that this is a class of technology-specific vulnerability, instead of a particular instance; if so, then this should not be included in CVE.This vulnerability affects all versions of PHP from 4.0.x through 5.1.x 20060228 (PHP) mb_send_mail security bypass18694ADV-2006-07721687823534SUSE-SA:2006:02419979Argument injection vulnerability in certain PHP 3.x, 4.x, and 5.x applications, when used with sendmail and when accepting remote input for the additional_parameters argument to the mail function, allows remote attackers to read and create arbitrary files via the sendmail -C and -X arguments. NOTE: it could be argued that this is a class of technology-specific vulnerability, instead of a particular instance; if so, then this should not be included in CVE.20060301 Re: (PHP) mb_send_mail security bypass16878SUSE-SA:2006:02451719979Buffer overflow in the IsComponentInstalled method in Internet Explorer 6.0, when used on Windows 2000 before SP4 or Windows XP before SP1, allows remote attackers to execute arbitrary code via JavaScript that calls IsComponentInstalled with a long first argument.ie-iscomponentinstalled-bo(24923)http://www.metasploit.com/projects/Framework/modules/exploits/ie_iscomponentinstalled.pmhttp://metasploit.com/projects/Framework/exploits.html#ie_iscomponentinstalled16870The c-client library 2000, 2001, or 2004 for PHP before 4.4.4 and 5.x before 5.1.5 do not check the (1) safe_mode or (2) open_basedir functions, and when used in applications that accept user-controlled input for the mailbox argument to the imap_open function, allow remote attackers to obtain access to an IMAP stream data structure and conduct unauthorized IMAP actions.php-imap-restriction-bypass(24964)ADV-2006-077220060228 (PHP) imap functions bypass safemode and open_basedir restrictionshttp://www.php.net/release_5_1_5.phphttp://www.php.net/ChangeLog-5.php#5.1.523535MDKSA-2006:122516215462105018694http://bugs.php.net/bug.php?id=37265SQL injection vulnerability in poems.php in DCI-Designs Dawaween 1.03 allows remote attackers to execute arbitrary SQL commands via the id parameter in a diwan view action.dawaween-poems-sql-injection(25163)1690920060302 sql in Dawaween V 1.0323827Cross-site scripting (XSS) vulnerability in fce.php in UKiBoard 3.0.1 allows remote attackers to inject arbitrary web script or HTML via a BBCode url tag when using the show_post function. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information, some of which reference a source URL that appears to be for an unrelated issue.ukiboard-fce-xss(24990)16912SQL injection vulnerability in forumlib.php in Johnny_Vegas Vegas Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the postid parameter.ADV-2006-0790http://evuln.com/vulns/90/summary.htmlvegasforum-forumlib-sql-injection(25167)1707920060313 [eVuln] Vegas Forum SQL Injection Vulnerability57419219Cross-site scripting (XSS) vulnerability in sol_menu.php in PeHePe Uyelik Sistemi (aka PeHePe MemberShip Management System) 3 allows remote attackers to inject arbitrary web script or HTML via the kuladi parameter ($kul_adi variable).http://yns.zaxaz.com/2006/02/28/pehepe-membership-management-system-multiple-vulnerabilities/ADV-2006-078120060228 PEHEPE Membership Management System Multiple Vulnerabilities1905516885PHP remote file include vulnerability in sol_menu.php in PeHePe Uyelik Sistemi (aka PeHePe MemberShip Management System) 3 allows remote attackers to include and execute arbitrary PHP code via a URL in the uye_klasor parameter, along with a misafir[] parameter that is set to UYE_SEVIYE.This vulnerability affects PeHePe, Membership Management System (a.k.a Uyelik Sistemi) versions 3.0 and previous.http://yns.zaxaz.com/2006/02/28/pehepe-membership-management-system-multiple-vulnerabilities/ADV-2006-078120060228 PEHEPE Membership Management System Multiple Vulnerabilities19055pehepe-uyeklasor-command-execution(24970)1688723567515Directory traversal vulnerability in HP System Management Homepage (SMH) 2.0.0 through 2.1.4 on Windows allows remote attackers to access certain files via unspecified vectors.This vulnerability affects all versions of HP, System Management Homepage from 2.0.0 through 2.1.4. This vulnarebility is only present in the following Windows OS environments: Microsoft Windows 2000, 2003, 2003 for x64, 2003 for Itanium and also Windows XP.HPSBMA02099SSRT061118101569219059ADV-2006-0769hp-system-managemenet-homepage-dir-traversal(24996)16876SQL injection vulnerability in MgrLogin.asp in Addsoft StoreBot 2005 Professional allows remote attackers to execute arbitrary SQL commands via the Pwd parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.This vulnerability affects all versions of AddSoft, StoreBot 2005 Professional Edition.storebot-mgrlogin-sql-injection(24987)ADV-2006-0784168972357519019Cross-site scripting (XSS) vulnerability in manage.asp in Addsoft StoreBot 2002 Standard allows remote attackers to inject arbitrary web script or HTML via the ShipMethod parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.storebot-manage-xss(24986)ADV-2006-0785168982357419060JFacets before 0.2 allows remote attackers to gain privileges as any account via a GET request with a modified account profileID.This vulnerability affects JFacets versions prior to 0.2.jfacets-auth-authentication-bypass(24958)http://sourceforge.net/project/shownotes.php?group_id=154666&release_id=39682419031ADV-2006-0767http://sourceforge.net/tracker/index.php?func=detail&aid=1439037&group_id=154666&atid=792697feedcreator.class.php (aka the syndication component) in Joomla! 1.0.7 allows remote attackers to obtain sensitive information via a "/" (slash) in the feed parameter to index.php, which reveals the path in an error message.http://www.joomla.org/content/view/938/78/20060302 JOOMLA CMS 1.0.7 DoS & path disclosingjoomla-multiple-disclose-path(25028)23815527feedcreator.class.php (aka the syndication component) in Joomla! 1.0.7 allows remote attackers to cause a denial of service (stressed file cache) by creating many files via filenames in the feed parameter to index.php.http://www.joomla.org/content/view/938/78/20060302 JOOMLA CMS 1.0.7 DoS & path disclosing2381752719105The cross-site scripting (XSS) countermeasures in class.inputfilter.php in Joomla! 1.0.7 allow remote attackers to cause a denial of service via a crafted mosmsg parameter to index.php with a malformed sequence of multiple tags, as demonstrated using "<<>AAA<><>", possibly due to nested or empty tags.20060302 JOOMLA CMS 1.0.7 DoS & path disclosing23816http://www.joomla.org/content/view/938/78/Unspecified vulnerability in mod_templatechooser in Joomla! 1.0.7 allows remote attackers to obtain sensitive information via an unspecified attack vector that reveals the path.http://www.joomla.org/content/view/938/78/ADV-2006-0818joomla-multiple-disclose-path(25028)2381819105config/config_inc.php in iGENUS Webmail 2.02 and earlier allows remote attackers to include arbitrary local files via the SG_HOME parameter.igenus-sg-home-file-include(24935)ADV-2006-0753168292353019036http://retrogod.altervista.org/igenus_202_xpl_pl.htmlEval injection vulnerability in the decode function in rpc_decoder.php for phpRPC 0.7 and earlier, as used by runcms, exoops, and possibly other programs, allows remote attackers to execute arbitrary PHP code via the base64 tag.ADV-2006-07451683320060226 phpRPC Library Remote Code Executionhttp://www.gulftech.org/?node=research&article_id=00105-0226200610156915021905819028Multiple cross-site scripting (XSS) vulnerabilities in Dragonfly CMS before 9.0.6.1 allow remote attackers to inject arbitrary web script or HTML via (1) uname, (2) error, (3) profile or (4) the username filed parameter to the (a) Your_Account module, (5) catid, (6) sid, (7) Story Text or (8) Extended text text fields in the (b) News module, (9) month, (10) year or (11) sa parameter to the (c) Stories_Archive module, (12) show, (13) cid, (14) ratetype, or (15) orderby parameter to the (d) Web_Links module, (16) op, or (17) pollid parameter to the (e) Surveys module, (18) c parameter to the (f) Downloads module, (19) meta, or (20) album parameter to the (g) coppermine module, or the search box in the (21) Search, (22) Stories_Archive, (23) Downloads, and (24) Topics module.ADV-2006-068816784101566118940http://lostmon.blogspot.com/2006/02/multiple-cross-site-scripting-in.htmlcpg-dragonfly-multiple-xss(24843)Multiple cross-site scripting (XSS) vulnerabilities in Woltlab Burning Board (wBB) allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to galerie_index.php and possibly (2) galerie_onfly.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. The second vector might not be XSS.16843Unspecified vulnerability in the Oracle Diagnostics module 2.2 and earlier allows remote attackers to access diagnostics tests via unknown attack vectors.VU#29895816844http://www.integrigy.com/info/IntegrigySecurityAnalysis-OracleDiag0206.pdf19076Multiple unspecified vulnerabilities in the Oracle Diagnostics module 2.2 and earlier have unknown impact and attack vectors, related to "permissions."16844http://www.integrigy.com/info/IntegrigySecurityAnalysis-OracleDiag0206.pdf19076SQL injection vulnerability in the Oracle Diagnostics module 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via uknown attack vectors.16844http://www.integrigy.com/info/IntegrigySecurityAnalysis-OracleDiag0206.pdforacle-diagnostics-sql-injection(25259)19076Buffer overflow in SecureCRT 5.0.4 and earlier and SecureFX 3.0.4 and earlier allows remote attackers to have an unknown impact when a Unicode string is converted to a "narrow" string.19040ADV-2006-0806http://www.vandyke.com/products/securecrt/history.txtsecurecrt-securefx-string-bo(25092)http://www.vandyke.com/products/securefx/history.txt16935SAP Web Application Server (WebAS) Kernel before 7.0 allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information, or have other impacts, via a ";%20" followed by encoded HTTP headers.sap-was-url-obtain-information(25003)ADV-2006-08101800620060301 SAP Web Application Server http request url parsing vulnerability101570219085Cross-site scripting (XSS) vulnerability in vBulletin 3.0.12 and 3.5.3 allows remote attackers to inject arbitrary web script or HTML via the email field, which is injected in profile.php but not sanitized in sendmsg.php.This vulnerability affects all versions of Jelsoft, vBulletin between 3.0.12 and 3.5.3http://www.kapda.ir/advisory-266.htmlADV-2006-0808http://www.vbulletin.com/forum/showthread.php?postid=107903020060302 vBulletin3.0.12&3.5.3~is_valid_email()~XSS Attack20060301 [KAPDA::#26]vBulletin.3.5.3~3.0.12-XSS236141910016919Multiple cross-site scripting (XSS) vulnerabilities in Gregarius 0.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) rss_query parameter to search.php or (2) tag parameter to tags.php.20060303 Gregarius 0.5.2 XSS and SQL Injection VulnerabilitiesADV-2006-0819gregarius-multiple-xss(25058)16939236792367819102Multiple SQL injection vulnerabilities in Gregarius 0.5.2 allow remote attackers to execute arbitrary SQL commands via the (1) folder parameter to feed.php or (2) rss_query parameter to search.php.20060303 Gregarius 0.5.2 XSS and SQL Injection VulnerabilitiesADV-2006-0819gregarius-feed-sql-injection(25059)16939236812368053719102Stack-based buffer overflow in Microsoft Visual Studio 6.0 and Microsoft Visual InterDev 6.0 allows user-assisted attackers to execute arbitrary code via a long DataProject field in a (1) Visual Studio Database Project File (.dbp) or (2) Visual Studio Solution (.sln).visualstudio-dataproject-bo(25148)ADV-2006-08251695320060305 Microsoft Visual Studio 6.0 Sp6 Malformed .dbp File BoF Exploit20060304 Visual Studio 6.0 Buffer Overflow Vulnerability23711http://www.frsirt.com/exploits/20060305.ms-visual-dbp.c.php101572119081Multiple buffer overflows in LISTSERV 14.3 and 14.4, including LISTSERV Lite and HPO, with the web archive interface enabled, allow remote attackers to execute arbitrary code via unknown attack vectors related to the WA CGI. NOTE: technical details will be released after the grace period has ended on 20060603.This vulnerability affects L-Soft, Listserv (LITE and HPO) 14.4 and all prior versions that are installed with the web archive interface.VU#8411321695120060304 Critical Risk Vulnerability in L-Soft Listservhttp://www.lsoft.com/manuals/1.8e/relnotes/LISTSERV14.5-Release-Notes.html#wasecurityalert1015722ADV-2006-0824listserv-wa-cgi-bo(25168)http://www.ngssoftware.com/advisories/listserv_3.txt19106The HTML rendering engine in Mozilla Thunderbird 1.5, when "Block loading of remote images in mail messages" is enabled, does not properly block external images from inline HTML attachments, which could allow remote attackers to obtain sensitive information, such as application version or IP address, when the user reads the email and the external image is accessed.ADV-2006-3749ADV-2006-135616881SSRT06123620060228 Mozilla Thunderbird : Multiple Information Disclosure VulnerabilitiesSUSE-SA:2006:004oval:org.mitre.oval:def:10254thunderbird-inline-information-disclosure(24959)USN-276-117516SSRT061236RHSA-2006:0330SUSE-SA:2006:022http://www.mozilla.org/security/announce/2006/mfsa2006-26.htmlMDKSA-2006:078GLSA-200605-09GLSA-200604-18DSA-1051DSA-10465142206520051199501994119902198631982319821oval:org.mitre.oval:def:1975server.cpp in Monopd 0.9.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via a string containing a large number of characters that are escaped when Monopd produces XML output.19133http://aluigi.altervista.org/adv/monopdx-adv.txtADV-2006-084416981http://www.robertjohnkaper.com/downloads/atlantik/monopd-0.9.3-dosfix.diffmonopd-string-dos(25161)Unspecified vulnerability in the "Remember Me login functionality" in Joomla! 1.0.7 and earlier has unknown impact and attack vectors.http://www.joomla.org/content/view/938/78/Joomla! 1.0.7 and earlier allows attackers to bypass intended access restrictions and gain certain privileges via certain attack vectors related to the (1) Weblink, (2) Polls, (3) Newsfeeds, (4) Weblinks, (5) Content, (6) Content Section, (7) Content Category, (8) Contact items, or (9) Contact Search, (10) Content Search, (11) Newsfeed Search, or (12) Weblink Search.This vulnerability affects Joomla! versions 1.0.7 and previous.joomla-multiple-bypass-security(25033)http://www.joomla.org/content/view/938/78/19105ADV-2006-081823822Multiple SQL injection vulnerabilities in the Admin functionality in Joomla! 1.0.7 and earlier allow remote authenticated administrators to execute arbitrary SQL commands via unknown attack vectors.19105ADV-2006-081823819http://www.joomla.org/content/view/938/78/** DISPUTED ** Kwik-Pay Payroll 4.2.20, and possibly other versions, stores the KwikPay.mdb database file with insecure permissions, which allows local users to obtain sensitive information such as employment and payment data. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: the vendor has disputed this vulnerability, stating that "The kwikpay.mdb file supplied with kwikpay is a template for the database structure of user databases created by kwikpay and to store a demonstration payroll. It does not contain any sensitive user information. When a user payroll database is opened, the encryption of the database is checked and if the database is not encrypted, the user is prompted to encrypt the database, but the choice is the customers."kwikpay-payroll-insecure-permissions(25114)2361719075SQL injection vulnerability in Akarru Social BookMarking Engine before 0.4.3.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors, possibly involving the username parameter to akarru.lib/users.php.1698919112ADV-2006-0841http://sourceforge.net/project/shownotes.php?release_id=398713&group_id=155783akarru-users-sql-injection(25115)The selinux_ptrace logic in hooks.c in SELinux for Linux 2.6.6 allows local users with ptrace permissions to change the tracer SID to an SID of another process.1783019955[selinux] 20060313 [SECURITY] SELinux ptrace bug (CVE-2006-1052)USN-281-1http://selinuxnews.org/wp/index.php/2006/03/13/security-ptrace-bug-cve-2006-1052/oval:org.mitre.oval:def:10102[git-commits-head] 20060311 [PATCH] selinux: tracer SID fixRHSA-2006:057525232MDKSA-2006:086DSA-1184http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm22417220932146520157** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-1861. Reason: This candidate is a reservation duplicate of CVE-2006-1861. Notes: All CVE users should reference CVE-2006-1861 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.The fill_write_buffer function in sysfs/file.c in Linux kernel 2.6.12 up to versions before 2.6.17-rc1 does not zero terminate a buffer when a length of PAGE_SIZE or more is requested, which might allow local users to cause a denial of service (crash) by causing an out-of-bounds read.http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=6e0dd741a89be35defa05bd79f4211c5a2762825;hp=597a7679dd83691be2f3a53e1f3f915b4a7f6ebahttp://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6e0dd741a89be35defa05bd79f4211c5a2762825ADV-2006-1475ADV-2006-1273linux-fillwritebuffer-dos(25693)USN-281-1USN-302-12006-00201740224443SUSE-SA:2006:0282071620398199551973519495FEDORA-2006-423The Linux kernel before 2.6.16.9 and the FreeBSD kernel, when running on AMD64 and other 7th and 8th generation AuthenticAMD processors, only save/restore the FOP, FIP, and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending, which allows one process to determine portions of the state of floating point instructions of other processes, which can be leveraged to obtain sensitive information such as cryptographic keys. NOTE: this is the documented behavior of AMD64 processors, but it is inconsistent with Intel processers in a security-relevant fashion that was not addressed by the kernels.Upgrade to Linux Kernel version 2.6.16.9 :
http://www.kernel.org/176001972419715https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=187911https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=187910amd-fpu-information-disclosure(25871)ADV-2006-4502ADV-2006-4353ADV-2006-2554ADV-2006-1475ADV-2006-1426http://www.vmware.com/download/esx/esx-254-200610-patch.htmlhttp://www.vmware.com/download/esx/esx-213-200610-patch.htmlUSN-302-120061113 VMSA-2006-0009 - VMware ESX Server 3.0.0 AMD fxsave/restore issue20061113 VMSA-2006-0005 - VMware ESX Server 2.5.4 Upgrade Patch 120061113 VMSA-2006-0007 - VMware ESX Server 2.1.3 Upgrade Patch 220061113 VMSA-2006-0006 - VMware ESX Server 2.5.3 Upgrade Patch 4RHSA-2006:0579RHSA-2006:0575RHSA-2006:04372480724746SUSE-SA:2006:028DSA-1103DSA-1097http://support.avaya.com/elmodocs2/security/ASA-2006-200.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-180.htm1015966http://security.freebsd.org/advisories/FreeBSD-SA-06:14-amd.txt228762287522417219832146521136210352091420716206712039819735oval:org.mitre.oval:def:9995[linux-kernel] 20060419 RE: Linux 2.6.16.9FEDORA-2006-423http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.9http://kb.vmware.com/kb/2533126FreeBSD-SA-06:14Race condition in daemon/slave.c in gdm before 2.14.1 allows local users to gain privileges via a symlink attack when gdm performs chown and chgrp operations on the .ICEauthority file.FEDORA-2006-338DSA-1040https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=188303gdm-slavec-symlink(26092)ADV-2006-1465USN-278-117635RHSA-2007:0286MDKSA-2006:083oval:org.mitre.oval:def:10092http://cvs.gnome.org/viewcvs/gdm2/daemon/slave.c?r1=1.260&r2=1.261BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables.busybox-passwd-weak-security(25569)1733019477oval:org.mitre.oval:def:9483http://bugs.busybox.net/view.php?id=604RHSA-2007:0244http://support.avaya.com/elmodocs2/security/ASA-2007-250.htm2584825098The winbindd daemon in Samba 3.0.21 to 3.0.21c writes the machine trust account password in cleartext in log files, which allows local users to obtain the password and spoof the server in the domain.20060330 [SECURITY] Samba 3.0.21-3.0.21c: Exposure of machine account credentials in winbindd log fileshttp://us1.samba.org/samba/security/CAN-2006-1059.html19455samba-logfile-account-cleartext(25575)ADV-2006-11792006-001817314FEDORA-2006-2592426310158501953919468Heap-based buffer overflow in zgv before 5.8 and xzgv before 0.8 might allow user-assisted attackers to execute arbitrary code via a JPEG image with more than 3 output components, such as a CMYK or YCCK color space, which causes less memory to be allocated than required.1977919757xzgv-jpeg-bo(25718)ADV-2006-128817409SUSE-SR:2006:008DSA-1038DSA-103775619790197311957219571Heap-based buffer overflow in cURL and libcURL 7.15.0 through 7.15.2 allows remote attackers to execute arbitrary commands via a TFTP URL (tftp://) with a valid hostname and a long path.Update to version 7.15.3.19271ADV-2006-1008http://curl.haxx.se/docs/adv_20060320.htmlcurl-tftp-bo(25318)2006-001617154FEDORA-2006-18923982GLSA-200603-1919371193441933520060320 [SSAG#001] :: cURL tftp:// URL Buffer OverflowUnspecified vulnerability in lurker.cgi for Lurker 2.0 and earlier allows attackers to read arbitrary files via unknown vectors.This vulnerability affects all versions of Lurker from 0.1a through 0.2http://sourceforge.net/project/shownotes.php?release_id=399034&group_id=816819136ADV-2006-0850[Lurker-users] 20060302 Serious security vulnerabilities foundlurker-lurker-information-disclosure(25149)1700323694DSA-99919145Unspecified vulnerability in Lurker 2.0 and earlier allows remote attackers to create or overwrite files in any writable directory that is named "mbox".This vulnarability affects all verions of Lurker from 0.1a through 0.2
http://sourceforge.net/project/shownotes.php?release_id=399034&group_id=816819136ADV-2006-0850[Lurker-users] 20060302 Serious security vulnerabilities foundlurker-mbox-error(25153)1700323695DSA-99919145Multiple cross-site scripting (XSS) vulnerabilities in Lurker 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.This vulnerability affects all verions of Lurker from 0.1a through 2.0http://sourceforge.net/project/shownotes.php?release_id=399034&group_id=816819136ADV-2006-0850[Lurker-users] 20060302 Serious security vulnerabilities foundlurker-unspecified-xss(25154)1700323696DSA-99919145SQL injection vulnerability in search.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to execute arbitrary SQL commands via the forums[] parameter.mybb-search-sql-injection(25018)20060302 MyBB 1.0.4 New SQL Injection19061Linux kernel 2.6.16-rc2 and earlier, when running on x86_64 systems with preemption enabled, allows local users to cause a denial of service (oops) via multiple ptrace tasks that perform single steps, which can cause corruption of the DEBUG_STACK stack during the do_debug function call.172162409819374DSA-1017[linux-kernel] 20060207 [PATCH] arch/x86_64/kernel/traps.c PTRACE_SINGLESTEP oopsUSN-281-1MDKSA-2006:1512161419955Linksys WRT54G routers version 5 (running VXWorks) allow remote attackers to cause a denial of service by sending a malformed DCC SEND string to an IRC channel, which causes an IRC connection reset, possibly related to the masquerading code for NAT environments, and as demonstrated via (1) a DCC SEND with a single long argument, or (2) a DCC SEND with IP, port, and filesize arguments with a 0 value.20060306 RE: linksys router + irc DoS20060303 linksys router + irc DoS20060304 Various router DoS20060306 Re: linksys router + irc DoShttp://www.hm2k.org/news/1141413208.html multiple-vendor-dccsend-dos(25230)16954Netgear 614 and 624 routers, possibly running VXWorks, allow remote attackers to cause a denial of service by sending a malformed DCC SEND string to an IRC channel, which causes an IRC connection reset, possibly related to the masquerading code for NAT environments, and as demonstrated via (1) a DCC SEND with a single long argument, or (2) a DCC SEND with IP, port, and filesize arguments with a 0 value.This vulnerability may affects NetGear Router models 614 and 624 (including WGR614, WGT624, WGT624SC, WGU624, and possibly others) and is most likely related to VXWorks.20060306 RE: linksys router + irc DoS20060303 linksys router + irc DoS20060304 Various router DoS20060306 Re: linksys router + irc DoShttp://www.hm2k.org/news/1141413208.html multiple-vendor-dccsend-dos(25230)16954Unspecified vulnerability in the session handling for Geeklog 1.4.x before 1.4.0sr2, 1.3.11 before 1.3.11sr5, 1.3.9 before 1.3.9sr5, and possibly earlier versions allows attackers to gain privileges as arbitrary users via unknown vectors.http://www.geeklog.net/article.php/geeklog-1.4.0sr2ADV-2006-085117010Cross-site scripting (XSS) vulnerability in dv_gbook.php in DVguestbook 1.0 allows remote attackers to inject arbitrary web script or HTML via the f parameter.ADV-2006-08421696819098http://biyosecurity.be/bugs/dvguestbook.txtdvguestbook-index-dvgbook-xss(25049)20060309 DVguestbook 1.0 And 1.2.2 Cross Site ScriptingCross-site scripting (XSS) vulnerability in index.php in DVguestbook 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the page parameter.ADV-2006-084316968http://biyosecurity.be/bugs/dvguestbook.txtdvguestbook-index-dvgbook-xss(25049)20060309 DVguestbook 1.0 And 1.2.2 Cross Site Scripting19099Cross-site scripting (XSS) vulnerability in Daverave Simplog 1.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a blog post.1696520060304 Simplog <= 1.0.2 Vulnerabilitieshttp://notlegal.ws/simplogsploit.txtsimplog-post-xss(25066)Directory traversal vulnerability in index.php in Daverave Simplog 1.0.2 and earlier allows remote attackers to include or read arbitrary .txt files via the (1) act and (2) blogid parameters.ADV-2006-08391696520060304 Simplog <= 1.0.2 Vulnerabilities19115http://notlegal.ws/simplogsploit.txtsimplog-index-traverse-directories(25067)542Jason Boettcher Liero Xtreme 0.62b and earlier allow remote attackers to cause a denial of service (application crash or hang) via a long argument to the connect command.ADV-2006-084920060306 Multiple vulnerabilities in Liero Xtreme 0.62bhttp://aluigi.altervista.org/adv/lieroxxx-adv.txtliero-connect-dos(25185)1699219079Format string vulnerability in the visualization function in Jason Boettcher Liero Xtreme 0.62b and earlier allows remote attackers to execute arbitrary code via format string specifiers in (1) a nickname, (2) a dedicated server name, or (3) a mapname in a level (aka .lxl) file.ADV-2006-084920060306 Multiple vulnerabilities in Liero Xtreme 0.62bhttp://aluigi.altervista.org/adv/lieroxxx-adv.txtliero-visualization-format-string(25187)1699054919079SQL injection vulnerability in index.php, possibly during a showtopic operation, in Invision Power Board (IPB) 2.1.5 allows remote attackers to execute arbitrary SQL commands via the st parameter.1697120060306 SQL injection in Invision Power Board v2.1.5invision-index-sql-injection(25254)20060405 Re: SQL injection in Invision Power Board v2.1.5Multiple cross-site scripting (XSS) vulnerabilities in the commentary in Evo-Dev evoBlog allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter and (2) other unspecified parameters.1698320060306 evoBlog Remote Name tag Script injection20060423 Re: evoBlog Remote Name tag Script injection23826544Multiple buffer overflows in htpasswd, as used in Acme thttpd 2.25b, and possibly other products such as Apache, might allow local users to gain privileges via (1) a long command line argument and (2) a long line in a file. NOTE: since htpasswd is normally installed as a non-setuid program, and the exploit is through command line options, perhaps this issue should not be included in CVE. However, if there are some typical or recommended configurations that use htpasswd with sudo privileges, or common products that access htpasswd remotely, then perhaps it should be included.1697220060305 htpasswd bufferoverflow and command execution in thttpd-2.25b.[thttpd] 20060305 Re: htpasswd.c security issues[thttpd] 20060305 htpasswd.c security issuesapache-htpasswd-strcpy-bo(31236)thttpd-command-file-bo(25216)20041029 Apache 1.3.33 local buffer overflow in apache 1.3.31 not fixed in .33?20041029 Re: local buffer overflow in htpasswd for apache 1.3.31 not fixed in .33?20070102 Apache 1.3.37 htpasswd buffer overflow vulnerabilityhttp://issues.apache.org/bugzilla/show_bug.cgi?id=41279http://issues.apache.org/bugzilla/show_bug.cgi?id=3197520040916 FlowSecurity.org: Local Stack Overflow on htpasswd apache 1.3.31 advsory.htpasswd, as used in Acme thttpd 2.25b and possibly other products such as Apache, might allow local users to gain privileges via shell metacharacters in a command line argument, which is used in a call to the system function. NOTE: since htpasswd is normally installed as a non-setuid program, and the exploit is through command line options, perhaps this issue should not be included in CVE. However, if there are some typical or recommended configurations that use htpasswd with sudo privileges, or common products that access htpasswd remotely, then perhaps it should be included.1697220060305 htpasswd bufferoverflow and command execution in thttpd-2.25b.23828[thttpd] 20060305 Re: htpasswd.c security issues[thttpd] 20060305 htpasswd.c security issuesthttpd-command-line-bo(25217)Cross-site scripting (XSS) vulnerability in login.php in Game-Panel 2.6.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the message parameter, possibly requiring a URL encoded value.ADV-2006-08641697920060304 Game-Panel <= 2.1.6 XSShttp://notlegal.ws/gamepanel.txtgamepanel-login-xss(25144)19143SQL injection vulnerability in forgotten_password.php in Jonathan Beckett PluggedOut Nexus 0.1 allows remote attackers to execute arbitrary SQL commands via the email parameter.nexus-forgottenpassword-sql-injection(25017)ADV-2006-080920060302 PluggedOut Nexus SQL injection19089http://hamid.ir/security/nexus.txt169151015715536Multiple cross-site scripting (XSS) vulnerabilities in phpArcadeScript 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the gamename parameter in tellafriend.php, (2) the login_status parameter in loginbox.php, (3) the submissionstatus parameter in index.php, the (4) cell_title_background_color and (5) browse_cat_name parameters in browse.php, the (6) gamefile parameter in displaygame.php, and (7) possibly other parameters in unspecified PHP scripts.ADV-2006-08211695720060304 phpArcadeScript XSS Injections19124533Multiple directory traversal vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to read and possibly execute arbitrary files via a .. (dot dot) in the (1) option[language] and (2) option[template] parameters, and (3) possibly other parameters, to (a) admin.php and (b) other unspecified scripts. NOTE: the admin.php/option[language] vector can be used by remote unauthenticated attackers to include arbitrary files in conjunction with CVE-2006-1085.ADV-2006-08221696320060304 PHP-Stats <= 0.1.9.1 remote commands executionhttp://www.phpstats.net/forum/viewtopic.php?t=14019116http://retrogod.altervista.org/php_stats_0191_adv.html20060327 Re: PHP-Stats <= 0.1.9.1 remote commands execution20060322 Re: PHP-Stats <= 0.1.9.1 remote commands executionMultiple SQL injection vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the option[prefix] parameter in admin.php and other unspecified PHP scripts, and (2) the PC_REMOTE_ADDR HTTP header to click.php.ADV-2006-08221696320060304 PHP-Stats <= 0.1.9.1 remote commands executionhttp://www.phpstats.net/forum/viewtopic.php?t=14019116http://retrogod.altervista.org/php_stats_0191_adv.html20060327 Re: PHP-Stats <= 0.1.9.1 remote commands execution20060322 Re: PHP-Stats <= 0.1.9.1 remote commands executionadmin.php in PHP-Stats 0.1.9.1 and earlier allows remote attackers to bypass authentication, gain administrator privileges, and execute arbitrary PHP code by modifying the option[admin_pass] parameter and setting the pass_cookie to the MD5 hash of the specified password.ADV-2006-08221696320060304 PHP-Stats <= 0.1.9.1 remote commands executionhttp://www.phpstats.net/forum/viewtopic.php?t=14019116http://retrogod.altervista.org/php_stats_0191_adv.html20060327 Re: PHP-Stats <= 0.1.9.1 remote commands execution20060322 Re: PHP-Stats <= 0.1.9.1 remote commands execution** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-1083. Reason: This candidate is a duplicate of CVE-2006-1083. Notes: All CVE users should reference CVE-2006-1083 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.Direct static code injection vulnerability in the modify_config action in admin.php for PHP-Stats 0.1.9.1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the option_new[compatibility_mode] parameter, which is not filtered before being stored in config.php. NOTE: this vulnerability can be exploited by remote unauthenticated attackers in conjunction with the option[admin_pass] authentication bypass vulnerability.ADV-2006-08221696320060304 PHP-Stats <= 0.1.9.1 remote commands executionhttp://www.phpstats.net/forum/viewtopic.php?t=14019116http://retrogod.altervista.org/php_stats_0191_adv.html20060327 Re: PHP-Stats <= 0.1.9.1 remote commands execution20060322 Re: PHP-Stats <= 0.1.9.1 remote commands executionPHP-Stats 0.1.9.1 and earlier allows remote attackers to obtain potentially sensitive information via a direct request to checktables.php, which lists the database table_prefix.ADV-2006-08221696320060304 PHP-Stats <= 0.1.9.1 remote commands executionhttp://www.phpstats.net/forum/viewtopic.php?t=14019116http://retrogod.altervista.org/php_stats_0191_adv.html20060327 Re: PHP-Stats <= 0.1.9.1 remote commands execution20060322 Re: PHP-Stats <= 0.1.9.1 remote commands executionCross-site scripting (XSS) vulnerability in header.php in PunBB 1.2.10 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly handled when the PHP_SELF variable is used to handle a pun_page tag.http://www.punbb.org/download/patch/punbb-1.2.10_to_1.2.11.patch19039ADV-2006-0773http://www.punbb.org/changelogs/1.2.10_to_1.2.11.txtpunbb-header-xss(24982)16891register.php in PunBB 1.2.10 allows remote attackers to cause an unspecified denial of service via a flood of new user registrations.This vulnerability affects PunBB version 1.2.10, and may affect all previous versions.http://www.punbb.org/download/patch/punbb-1.2.10_to_1.2.11.patchADV-2006-0773http://www.punbb.org/changelogs/1.2.10_to_1.2.11.txtpunbb-register-ip-dos(24837)Kaspersky Antivirus 5.0.5 and 5.5.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via unknown attack vectors.1694220060303 Kaspersky Memory/CPU Usage Leak by designkaspersky-unspecified-dos(25221)535Unspecified vulnerability in the pagedata subsystem of the process file system (/proc) in Solaris 8 through 10 allows local users to cause a denial of service (system hang or panic) via unknown attack vectors that cause cause the kmem_oversize arena to allocate a large amount of system memory that does not get freed.This vulnerability affects all versions of Sun, Solaris 8.x through 10.xADV-2006-0829102159solaris-proc-pagedata-dos(25152)16966http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm10157231971619128oval:org.mitre.oval:def:1618Unspecified vulnerability in IBM WebSphere 5.0.2.10 through 5.0.2.15 and 5.1.1.4 through 5.1.1.9 allows remote attackers to obtain sensitive information via unknown attack vectors, which causes JSP source code to be revealed.ADV-2006-0788101571616908SQL injection vulnerability in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allows remote attackers to execute arbitrary SQL commands via the fileid parameter to (1) info_db.php or (2) database.php.1691420060301 Woltlab Burning Board 2.x (Datenbank MOD fileid) MultipleVulnerabilitieshttp://www.nukedx.com/?viewdoc=172381023808Directory traversal vulnerability in the FileSession object in Mod_python module 3.2.7 for Apache allows local users to execute arbitrary code via a crafted session cookie.16916http://www.cgisecurity.com/2006/02/07101576419239modpython-filesession-command-execution(24965)ADV-2006-0768http://www.modpython.org/fs_sec_warn.htmlhttp://svn.apache.org/viewcvs.cgi/httpd/mod_python/branches/3.2.x/NEWS?rev=378945** DISPUTED ** Cross-site scripting (XSS) vulnerability in index.php in NZ Ecommerce allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem.This vulnerability most likely affects all versions of Digital Builder, NZ Ecommerce.ADV-2006-0803169312360019088http://pridels0.blogspot.com/2006/03/nz-ecommerce-sqlxss-vuln.htmlMultiple cross-site scripting (XSS) vulnerabilities in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allow remote attackers to inject arbitrary web script or HTML via the fileid parameter to (1) info_db.php or (2) database.php.This vulnerability may only affect Datenbank MOD 2.7 and earlier versions in a Woltlab Burning Board environment. 20060301 Woltlab Burning Board 2.x (Datenbank MOD fileid) MultipleVulnerabilitieshttp://www.nukedx.com/?viewdoc=17wbb-multiple-xss(25004)238112380920060301 Woltlab Burning Board 2.x (Datenbank MOD fileid) MultipleVulnerabilities** DISPUTED ** Multiple SQL injection vulnerabilities in NZ Ecommerce allow remote attackers execute arbitrary SQL commands via the (1) informationID or (2) ParentCategory parameter to index.php. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem.ADV-2006-0803169312360119088http://pridels0.blogspot.com/2006/03/nz-ecommerce-sqlxss-vuln.htmlPHP remote file include vulnerability in logIT 1.3 and 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.16932Buffer overflow in the sgetstr function in shared/cube.h in Sauerbraten 2006_02_28 and earlier, as derived from the Cube engine, allows remote attackers to execute arbitrary code via long streams of input data.sauerbraten-sgetstr-bo(25083)ADV-2006-0848ADV-2006-08471698620060306 Multiple vulnerabilities in Cube engine 2005_08_2920060306 Multiple vulnerabilities in Sauerbraten engine 2006_02_281911119110http://cvs.sourceforge.net/viewcvs.py/sauerbraten/sauerbraten/src/shared/cube.h?r1=1.7&r2=1.8http://aluigi.altervista.org/adv/evilcube-adv.txtGLSA-200603-1019199The (1) sgetstr and (2) getint functions in Sauerbraten 2006_02_28, as derived from the Cube engine, allow remote attackers to cause a denial of service (segmentation fault) via long streams of input data that trigger an out-of-bounds read, as demonstrated using SV_EXT tag data in the Cube engine, which is not properly handled by getint.sauerbraten-multiple-dos(25085)ADV-2006-0848ADV-2006-08471698620060306 Multiple vulnerabilities in Cube engine 2005_08_2920060306 Multiple vulnerabilities in Sauerbraten engine 2006_02_281911119110http://aluigi.altervista.org/adv/evilcube-adv.txtGLSA-200603-1019199Sauerbraten 2006_02_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (client exit) by forcing the server to change to a map (ogz) file whose name contains ".." sequences and has a certain length that prevents the addition of the ".ogz" extension.ADV-2006-0848ADV-2006-08471698620060306 Multiple vulnerabilities in Cube engine 2005_08_2920060306 Multiple vulnerabilities in Sauerbraten engine 2006_02_281911119110http://aluigi.altervista.org/adv/evilcube-adv.txtsauerbraten-sprintf-dos(25086)GLSA-200603-1054819199engine/server.cpp in Sauerbraten 2006_02_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (segmentation fault) via a client that does not completely join the game and times out, which results in a null pointer dereference.sauerbraten-engineserver-dos(25087)ADV-2006-08481698620060306 Multiple vulnerabilities in Sauerbraten engine 2006_02_28550Multiple SQL injection vulnerabilities in Pixelpost 1.5 beta 1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the showimage parameter in index.php; and the (2) USER_AGENT, (3) HTTP_REFERER, and (4) HTTP_HOST HTTP header fields as used in the book_vistor function in includes/functions.php. NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue.These vulnerabilities may affect all versions of Pixelpost.pixelpost-functions-sql-injection(25046)pixelpost-index-sql-injection(25044)ADV-2006-08231696420060304 Pixel Post Multiple Vulnerabilitieshttp://www.neosecurityteam.net/index.php?action=advisories&id=19http://forum.pixelpost.org/showthread.php?t=3535Pixelpost 1.5 beta 1 and earlier allows remote attackers to obtain configuration information via a direct request to includes/phpinfo.php, which calls the phpinfo function. NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue.This vulnerability may affect all versions of Pixelpost.pixelpost-phpinfo-obtain-information(25048)ADV-2006-08231696420060304 Pixel Post Multiple Vulnerabilitieshttp://www.neosecurityteam.net/index.php?action=advisories&id=19http://forum.pixelpost.org/showthread.php?t=3535Cross-site scripting (XSS) vulnerability in Pixelpost 1.5 beta 1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) message, (2) name, (3) url, and (4) email parameters when commenting on a post. NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue.pixelpost-functions-xss(25047)ADV-2006-08231696420060304 Pixel Post Multiple Vulnerabilitieshttp://www.neosecurityteam.net/index.php?action=advisories&id=19http://forum.pixelpost.org/showthread.php?t=3535Cross-site scripting (XSS) vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the nick parameter.This vulnerability affects NMDeluxe versions 1.0 and previous.
nmdeluxe-news-xss(25069)19117http://nmdeluxe.com/index.phphttp://evuln.com/vulns/93/summary.htmlADV-2006-08601701720060317 [eVuln] NMDeluxe XSS & SQL Injection Vulnerabilities595SQL injection vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.This vulnerability affcts NMDeluxe versions 1.0 and previous.nmdeluxe-news-sql-injection(25070)19117http://nmdeluxe.com/index.phphttp://evuln.com/vulns/93/summary.htmlADV-2006-08601701720060317 [eVuln] NMDeluxe XSS & SQL Injection Vulnerabilities595SQL injection vulnerability in index.asp in Total Ecommerce 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: it is not clear whether this report is associated with a specific product. If not, then it should not be included in CVE.totalecommerce-index-sql-injection(25045)ADV-2006-08401696020060304 Advisory: TotalECommerce (index.asp id) Remote SQL InjectionVulnerability.http://www.nukedx.com/?viewdoc=1819103530Cross-site scripting (XSS) vulnerability in Aztek Forum 4.0 allows remote attackers to inject arbitrary web script or HTML via the message body in a new message.1693820060302 AZTEK forums 4.0 multiple vulnerabilities (PoC)2361019096aztekforum-multiple-xss(25035)1547Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a "*/*" in the msg parameter to index.php, which reveals usernames and passwords in a MySQL error message, possibly due to a forced SQL error or SQL injection.1693820060302 AZTEK forums 4.0 multiple vulnerabilities (PoC)23611aztekforum-info-disclosure(25036)1547Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a long login value in a register form, which displays the installation path in a MySQL error message.1693820060302 AZTEK forums 4.0 multiple vulnerabilities (PoC)236125391547SQL injection vulnerability in podcast.php in Loudblog before 0.42 allows remote attackers to execute arbitrary SQL commands via the id parameter.This vulnerability affects Loudblog versions 0.41 and previous.19172ADV-2006-08781702320060307 Loudblog 0.41 SQL Injection, Local file read/includehttp://loudblog.de/forum/viewtopic.php?id=590loudblog-podcast-sql-injection(25101)Multiple directory traversal vulnerabilities in Loudblog before 0.42 allow remote attackers to read or include arbitrary files via a .. (dot dot) and trailing %00 (NULL) byte in the (1) template and (2) page parameters in (a) index.php, and the (3) language parameter in (b) inc/backend_settings.php.This vulnerability affects Loudblog versions 0.41 and previous.19172ADV-2006-08781702320060307 Loudblog 0.41 SQL Injection, Local file read/includehttp://loudblog.de/forum/viewtopic.php?id=590loudblog-index-directory-traversal(25103)nCipher HSM before 2.22.6, when generating a Diffie-Hellman public/private key pair without any specified DiscreteLogGroup parameters, chooses random parameters that could allow an attacker to crack the private key in significantly less time than a brute force attack.ncipher-hsm-weak-key(25060)17006http://www.ncipher.com/resources/95/sa12_insecure_generation_of_diffiehellman_keys101571919137ADV-2006-086220060308 nCipher Advisory #12: Insecure Generation of Diffie-Hellman keysThe CBC-MAC integrity functions in the nCipher nCore API before 2.18 transmit the initialization vector IV as part of a message when the implementation uses a non-zero IV, which allows remote attackers to bypass integrity checks and modify messages without being detected.17011http://www.ncipher.com/resources/96/sa13_cbcmac_iv_misleading_programming_interface101571819137ADV-2006-0862ncipher-ncore-bypass-security(25062)20060308 nCipher Advisory #13: CBC-MAC IV misleading programming interfacenCipher firmware before V10, as used by (1) nShield, (2) nForce, (3) netHSM, (4) payShield, (5) SecureDB, (6) DSE200 Document Sealing Engine, (7) Time Source Master Clock (TSMC), and possibly other products, contains certain options that were only intended for testing and not production, which might allow remote attackers to obtain information about encryption keys and crack those keys with less effort than brute force.17012http://www.ncipher.com/resources/97/sa14_presence_of_flaws_in_firmware_security101571819137ADV-2006-0862ncipher-firmware-weak-security(25063)20060309 nCipher Advisory #14: Presence of flaws in firmware securitySQL injection vulnerability in bmail before Aardvark PR9.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving GBK character sets.bmail-gbkcharacterset-sql-injection(25073)http://sourceforge.net/project/shownotes.php?group_id=144412&release_id=39925619147ADV-2006-0863fantastico in Cpanel does not properly handle when it has insufficient permissions to perform certain file operations, which allows remote authenticated users to obtain the full pathname, which is leaked in a PHP error message.cpanel-fantastico-path-disclosure(25277)20060307 Cpanel Path Disclosure VulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 6.1.1 and earlier, with register_globals enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) its_url parameter in the documents page and (2) url parameter in the send_write page of (a) index.php; (3) subject, and (4) images parameters to (b) calendar.php; (5) bid, (6) replying_msg, (7) subject, (8) body, and (9) mid parameters to (c) forums.php; (10) subject and (11) message parameters to (d) inbox.php; (12) subject_color and (13) email parameters to (e) lostpassword.php; and the (14) c_name, (15) content_inicial, and (16) cid parameters to (f) mycontents.php. NOTE: the calendar.php/day vector is already subsumed by CVE-2006-0220, and the calendar.php/month, calendar.php/year, and search.php/q parameters for calendar.php are already subsumed by CVE-2004-2511.20060309 DCP Portal: Multiple XSS Vulnerabilitieshttp://www.seclab.tuwien.ac.at/advisories/TUVSA-0603-001.txtdcpportal-multiple-scripts-xss(25279)17050239812398023979239782397723976392Cross-site scripting (XSS) vulnerability in CuteNews 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the query string to index.php.1696120060304 [KAPDA::#30] - CuteNews1.4.1 Cross_Site_Scripting Vulnerability1015726http://kapda.ir/advisory-277.htmlcutenews-index-script-xss(25052)531Cross-site scripting (XSS) vulnerability in Default.asp in D2KBlog 1.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter.d2kblog-default-msg-xss(25214)ADV-2006-08961703520060308 [KAPDA::#32] - d2kBlog 1.0.3 Multiple Vulnerabilities2377119177559SQL injection vulnerability in D2KBlog 1.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the memName parameter in a cookie.ADV-2006-089620060308 [KAPDA::#32] - d2kBlog 1.0.3 Multiple Vulnerabilities19177d2kblog-memname-sql-injection(25215)1703523770559Buffer overflow in RevilloC MailServer and Proxy 1.21 allows remote attackers to execute arbitrary code via a long USER command.revilloc-user-bo(25072)ADV-2006-08671699720060309 RevilloC MailServer 1.x "USER" Command Handling Remote Buffer Overflow Exploit23735http://www.morx.org/rev.txt10157391911920060307 RevilloC mail server USER command heap overflowGrisoft AVG Free 7.1, and other versions including 7.0.308, sets Everyone/Full Control permissions for certain update files including (1) upd_vers.cfg, (2) incavi.avm, and (3) unspecified drivers, which might allow local users to gain privileges.1695219118ADV-2006-0845http://www.dslreports.com/forum/remark,156014041015728avg-update-gain-privilieges(25139)20060303 AVG 7 granting Everyone Full Control to updated files... even its driversGallery 2 up to 2.0.2 allows remote attackers to spoof their IP address via a modified X-Forwarded-For (X_FORWARDED_FOR) HTTP header, which is checked by Gallery before other more reliable sources of IP address information, such as REMOTE_ADDR.http://www.gulftech.org/?node=research&article_id=00106-0302200610157171910420060303 Gallery 2 Multiple VulnerabilitiesADV-2006-0813gallery-header-spoofing(25120)http://gallery.menalto.com/gallery_2.0.3_releasedCross-site scripting (XSS) vulnerability in Gallery 2 up to 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the X-Forwarded-For (X_FORWARDED_FOR) HTTP header, which is not properly handled when adding a comment to an album.16940101571719104ADV-2006-081323596http://www.gulftech.org/?node=research&article_id=00106-0302200620060303 Gallery 2 Multiple Vulnerabilitiesgallery-getremotehostaddress-xss(25117)http://gallery.menalto.com/gallery_2.0.3_releasedDirectory traversal vulnerability in the session handling class (GallerySession.class) in Gallery 2 up to 2.0.2 allows remote attackers to access and delete files by specifying the session in a cookie, which is used in constructing file paths before the session value is sanitized.101571719104ADV-2006-081323597http://www.gulftech.org/?node=research&article_id=00106-0302200620060303 Gallery 2 Multiple Vulnerabilitiesgallery-sessionid-bypass-security(25118)16948http://gallery.menalto.com/gallery_2.0.3_releasedSQL injection vulnerability in config.php in EKINboard 1.0.3 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username cookie.16861http://www.ekinboard.com/patch_for_1.0.3.txt19045http://evuln.com/vulns/88/summary.htmlekinboard-config-sql-injection(24922)ADV-2006-075823547http://www.ekinboard.com/forums/v1/viewtopic.php?id=46920060308 [eVuln] EKINboard 'img' BBCode XSS & Cookie 'username' SQL Injection VulnerabilitiesCross-site scripting (XSS) vulnerability in EKINboard 1.0.3 allows remote attackers to inject arbitrary web script or HTML via a Javascript URI in a BBCode img tag.16861http://www.ekinboard.com/patch_for_1.0.3.txthttp://www.ekinboard.com/forums/v1/viewtopic.php?id=46919045http://evuln.com/vulns/88/summary.htmlekinboard-bbcode-xss(24921)ADV-2006-07582354620060308 [eVuln] EKINboard 'img' BBCode XSS & Cookie 'username' SQL Injection Vulnerabilities558Cross-site scripting (XSS) vulnerability in read.php in bitweaver CMS 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the comment_title parameter.ADV-2006-083719101http://kiki91.altervista.org/exploit/bitweaver_1.2.1_XSS.txtbitweaver-titlefield-xss(25053)16973SQL injection vulnerability in show.php in vbzoom 1.11 allow remote attackers to execute arbitrary SQL commands via the MainID parameter. NOTE: the SubjectID vector is already covered by CVE-2005-4729.1695520060306 SQL injection & XSS IN vbzoom v1.11552Multiple cross-site scripting (XSS) vulnerabilities in vbzoom 1.11 allow remote attackers to inject arbitrary web script or HTML via the UserID parameter to (1) comment.php or (2) contact.php. NOTE: the profile.php/UserName vector is already covered by CVE-2005-2441.20060306 SQL injection & XSS IN vbzoom v1.11vbzoom-comment-contact-xss(25090)16969169562381323812552SQL injection vulnerability in CyBoards PHP Lite 1.25, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the parent parameter to (1) post.php and possibly (2) process_post.php.Successful exploitation requires that the "magic_quotes_gpc" parameter is disabled.ADV-2006-08201710720060314 [eVuln] CyBoards PHP Lite SQL Injection Vulnerability23692http://www.gold-sonata.com/forums/read.php?board=1&id=1727119135http://evuln.com/vulns/91/description.htmlcyboards-processpost-sql-injection(25061)16987582Multiple cross-site scripting (XSS) vulnerabilities in sBlog 0.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword parameter to search.php or (2) username parameter to comments_do.php.ADV-2006-088319151http://kiki91.altervista.org/exploit/sBlog_0.72_xss.txtsblog-username-xss(25111)170442376023759Buffer overflow in the PostScript file interpreter code for Xerox CopyCentre and Xerox WorkCentre Pro, running software 1.001.02.073 or earlier, or 1.001.02.074 before 1.001.02.715, allows attackers to cause a denial of service via unknown vectors.http://www.xerox.com/downloads/usa/en/c/cert_XRX06_002.pdfADV-2006-085723724101573819146xerox-postscript-interpreter-dos(25172)17014Multiple unspecified vulnerabilities in Xerox CopyCentre and Xerox WorkCentre Pro, running software 1.001.02.073 or earlier, or 1.001.02.074 before 1.001.02.715, allow remote attackers to cause an unspecified denial of service via a crafted PostScript file that will (1) "navigate through the directory" or (2) a "file sent to expose TCP/IP ports".http://www.xerox.com/downloads/usa/en/c/cert_XRX06_002.pdfADV-2006-08572372623725101573819146xerox-postscript-tcpip-dos(25174)xerox-postscript-navigate-dos(25173)17014Unspecified vulnerability in the web server code in Xerox CopyCentre and Xerox WorkCentre Pro, running software 1.001.02.073 or earlier, or 1.001.02.074 before 1.001.02.715, allows remote attackers to cause a denial of service (memory corruption) via unknown vectors.http://www.xerox.com/downloads/usa/en/c/cert_XRX06_002.pdfADV-2006-085723727101573819146xerox-web-corruption-dos(25175)17014Unspecified vulnerability in the ESS/ Network Controller in Xerox CopyCentre and Xerox WorkCentre Pro, running software 1.001.02.073 or earlier, or 1.001.02.074 before 1.001.02.715, causes the Immediate Image Overwrite feature to fail after a power loss, which could leave data exposed to attack.http://www.xerox.com/downloads/usa/en/c/cert_XRX06_002.pdfADV-2006-085723728101573819146xerox-image-overwrite-dos(25176)SQL injection vulnerability in rss.php in RedBLoG 0.5 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.http://www.x128.net/redblog-05-remote-sql-injection.txtADV-2006-089419181redblog-catid-sql-injection(25122)17041Buffer overflow in qmailadmin.c in QmailAdmin before 1.2.10 allows remote attackers to execute arbitrary code via a long PATH_INFO environment variable.qmialadmin-qmailadmin-bo(25065)16994http://sourceforge.net/project/shownotes.php?group_id=6691&release_id=395211ADV-2006-0852http://cvs.sourceforge.net/viewcvs.py/qmailadmin/qmailadmin/qmailadmin.c?r1=1.6.2.10&r2=1.6.2.1123705GLSA-200611-152301919262Unspecified vulnerability in Ravenous Web Server before 0.7.1 allows remote attackers to access arbitrary rvplg files, with unknown impact.http://sourceforge.net/project/shownotes.php?group_id=131871&release_id=399092ADV-2006-0859ravenous-rvplg-unauth-access(25191)1701323706Cross-site scripting (XSS) vulnerability in FTPoed Blog Engine 1.1 allows remote attackers to inject arbitrary web script or HTML via the comment_body parameter, as used by the comment field, when posting a comment.20060305 FTPoed Blog Engine =>v1.1 HTML Injection Vulnerability1015725ftpoed-comment-xss(25138)Cross-site scripting (XSS) vulnerability in HitHost 1.0.0 allows remote attackers to inject arbitrary web script or HTML via (1) the user parameter in deleteuser.php and (2) the hits parameter in viewuser.php.ADV-2006-088620060306 histhost v1.0.0 xss and possible rmdir19155hithost-viewuser-deleteuser-xss(25105)170252375823757Format string vulnerability in the safe_cprintf function in acebot_cmds.c in Alien Arena 2006 Gold Edition 5.00 allows remote attackers (possibly authenticated) to execute arbitrary code via unspecified vectors when the server sends crafted messages to the clients.ADV-2006-08821702820060307 Multiple vulnerabilities in Alien Arena 2006 GE 5.002374719144http://aluigi.altervista.org/adv/aa2k6x-adv.txtalien-safe-cprintf-format-string(25199)20060307 Multiple vulnerabilities in Alien Arena 2006 GE 5.00Stack-based buffer overflow in the Cmd_Say_f function in g_cmds.c in Alien Arena 2006 Gold Edition 5.00 allows remote attackers (possibly authenticated) to execute arbitrary code by sending a long message to the server.ADV-2006-08821702820060307 Multiple vulnerabilities in Alien Arena 2006 GE 5.002374819144http://aluigi.altervista.org/adv/aa2k6x-adv.txtalien-cmd-sa-f-bo(25200)20060307 Multiple vulnerabilities in Alien Arena 2006 GE 5.00The Com_sprintf function in q_shared.c in Alien Arena 2006 Gold Edition 5.00 does not properly NULL terminate certain long strings, which allows remote attackers (possibly authenticated) to cause a denial of service (application crash) via a long skin, weapon, or model name.ADV-2006-08821702820060307 Multiple vulnerabilities in Alien Arena 2006 GE 5.002374919144http://aluigi.altervista.org/adv/aa2k6x-adv.txtalien-com-sprintf-dos(25201)20060307 Multiple vulnerabilities in Alien Arena 2006 GE 5.00Multiple stack-based buffer overflows in the procConnectArgs function in servmgr.cpp in PeerCast before 0.1217 allow remote attackers to execute arbitrary code via an HTTP GET request with a long (1) parameter name or (2) value in a URL, which triggers the overflow in the nextCGIarg function in servhs.cpp.1704020060309 INFIGO-2006-03-01: PeerCast streaming server remote buffer overflowhttp://www.infigo.hr/in_focus/INFIGO-2006-03-01peercast-url-bo(25113)ADV-2006-0900http://www.peercast.org/forum/viewtopic.php?t=334623777GLSA-200603-171929119169PHP remote file inclusion vulnerability in lib/OWL_API.php in OWL Intranet Engine 0.82, when register_globals is enabled, allows remote attackers to include arbitrary files via a URL in the xrms_file_root parameter, which is not initialized before use.owl-intranet-owlapi-file-include(25082)ADV-2006-08682373419142156117021Buffer overflow in Tenes Empanadas Graciela (TEG) 0.11.1, automatically appends an _ (underscore) to the end of duplicate nicknames, which allows remote attackers to cause a denial of service (application crash) by creating multiple users with long, identical nicknames, which triggers an off-by-one error.ADV-2006-08461698219134http://aluigi.altervista.org/adv/tegob1-adv.txtteg-nickname-offbyone-dos(25165)Cross-site scripting vulnerability in index.php in M-Phorum 0.2 allows remote attackers to inject arbitrary web script or HTML via the go parameter.20060309 M-Phorum Cross Site Scripting19121http://biyosecurity.be/bugs/mphorum.txtmphorum-index-xss(25312)2539420070821 Vulnerabilities digest23951http://securityvulns.com/source13951.htmlhttp://securityvulns.com/Ldocument750.htmlPHP remote file inclusion vulnerability in index.php in M-Phorum 0.2 allows remote attackers to include arbitrary files via the go parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-08271697719121mphorum-index-file-include(25102)23740SQL injection vulnerability in D2-Shoutbox 4.2 allows remote attackers to execute arbitrary SQL commands via the load parameter, when performing a Shoutbox action through Invision Power Board (IPB).d2shoutbox-index-sql-injection(25074)ADV-2006-086516984191321556PHP remote file inclusion vulnerability in archive.php in Fantastic News 2.1.2 allows remote attackers to include arbitrary files via the CONFIG[script_path] variable. NOTE: 2.1.4 was also reported to be vulnerable.fantasticnews-configscriptpath-file-include(31121)fantasticnews-archive-file-include(25064)ADV-2006-3513ADV-2006-082621796169853027http://sx02.coresec.de/advisories/152.txt2351921807Cross-site scripting (XSS) vulnerability in manas tungare Site Membership Script before 8 March, 2006 allows remote attackers to inject arbitrary web script or HTML via the Error parameter in (1) login.asp and (2) default.asp.http://www.manastungare.com/projects/site-membership/ADV-2006-088419156manas-tungare-login-default-xss(25109)170452375423753SQL injection vulnerability in manas tungare Site Membership Script before 8 March, 2006 allows remote attackers to execute arbitrary SQL commands via the Username parameter in login.asp.http://www.manastungare.com/projects/site-membership/ADV-2006-088419156manas-tungare-login-sql-injection(25110)1704523755Cross-site scripting (XSS) vulnerability in Vz Scripts ADP Forum 2.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the Subject field (possibly messaggio parameter) when posting a new message in post.php.ADV-2006-090120060309 ADP Forum 2.0,* script İnjectionhttp://biyosecurity.be/bugs/adpforum2.txtadp-forum-subject-xss(25189)1704723961Kerio MailServer before 6.1.3 Patch 1 allows remote attackers to cause a denial of service (application crash) via a crafted IMAP LOGIN command.http://www.kerio.com/kms_history.html19150kerio-mailserver-imap-dos(25150)ADV-2006-08981704320060313 Kerio MailServer bugfun237721015748Format string vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in the query string argument in an HTTP GET request.easyfilesharing-logging-dos(25135)ADV-2006-09121704620060309 Easy File Sharing Web Server Multiple Vulnerablilities2379219178Cross-site scripting (XSS) vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote attackers to inject arbitrary web script or HTML via the Description field in creating a folder or uploading a file.easyfilesharing-description-xss(25136)ADV-2006-09121704620060309 Easy File Sharing Web Server Multiple Vulnerablilities2379319178Absolute path traversal vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote registered users to execute arbitrary code by uploading a malicious file to the Windows startup folder.1704620060309 Easy File Sharing Web Server Multiple Vulnerablilities23791easyfilesharing-startup-file-upload(39994)Directory traversal vulnerability in Nodez 4.6.1.1 and earlier allows remote attackers to read or include arbitrary PHP files via a .. (dot dot) in the op parameter, as demonstrated by inserting malicious Email parameters into list.gtdat, then accessing list.gtdat using the op parameter.ADV-2006-089919165http://hamid.ir/security/nodez.txtnodez-op-file-include(25119)17066237741015747Cross-site scripting (XSS) vulnerability in Nodez 4.6.1.1 allows remote attackers to inject arbitrary web script or HTML via the op parameter. NOTE: it is possible that this issue is resultant from the directory traversal vulnerability.ADV-2006-089919165http://hamid.ir/security/nodez.txtnodez-op-xss(25121)17066237761015747Nodez 4.6.1.1 and earlier stores sensitive data in the list.gtdat file under the web document root with insufficient access control, which allows remote attackers to obtain usernames and password hashes by directly accessing list.gtdat.http://hamid.ir/security/nodez.txt1706623775Cross-site scripting (XSS) vulnerability in the mediamanager module in DokuWiki before 2006-03-05 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors relating to "handling EXIF data."19186ADV-2006-0909http://wiki.splitbrain.org/wiki%3Achangesdokuwiki-mediamanger-xss(25137)17065Monotone 0.25 and earlier, when a user creates a file in a directory called "mt", and when checking out that file on a case-insensitive file system such as Windows or Mac OS X, places the file into the "MT" bookkeeping directory, which could allow context-dependent attackers to execute arbitrary Lua programs as the user running monotone.[Monotone-devel] 20060308 [ANNOUNCE] Monotone 0.25.2 -- security fix releaseADV-2006-0990monotone-mt-lua-code-execution(25294)1713919260SGI ProPack 3 SP6 kernel displays the frame buffer contents of the last session after a reboot, which might allow local users to obtain sensitive information.The attacker must read the contents of the screen after a reboot and before the screen contents can be cleared by anything.20060402-01-U2457119607The decompress function in compress42.c in (1) ncompress 4.2.4 and (2) liblzw allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code, via crafted data that leads to a buffer underflow.DSA-11492143721434ADV-2006-323421427oval:org.mitre.oval:def:9373http://bugs.gentoo.org/show_bug.cgi?id=141728ncompress-decompress-underflow(28315)19455RHSA-2006:0663SUSE-SR:2006:020MDKSA-2006:140http://support.avaya.com/elmodocs2/security/ASA-2006-226.htm1016836GLSA-200610-03223772229622036218802146720060901-01-PStack-based buffer overflow in the createPKCS10 function in Cryptomathic Cenroll ActiveX Control 1.1.0.0 allows remote attackers to execute arbitrary code via vectors related to the TDC Digital signature.25282101603419968ADV-2006-16751785220060505 Cryptomathic ActiveX Buffer Overflow (TDC Digital signature)http://cirt.dk/advisories/cirt-43-advisory.pdfcryptomathic-primeink-createpkcs10-bo(26255)Sendmail before 8.13.7 allows remote attackers to cause a denial of service via deeply nested, malformed multipart MIME messages that exhaust the stack during the recursive mime8to7 function for performing 8-bit to 7-bit conversion, which prevents Sendmail from delivering queued messages and might lead to disk consumption by core dump files.VU#146718http://www.sendmail.com/security/advisories/SA-200605-01.txt.asc184331024602047315779https://issues.rpath.com/browse/RPL-526sendmail-multipart-mime-dos(27128)ADV-2006-3135ADV-2006-2798ADV-2006-2390ADV-2006-2389ADV-2006-2388ADV-2006-2351ADV-2006-2189HPSBUX02124SSRT06115920060721 rPSA-2006-0134-1 sendmail sendmail-cf20060624 Re: Sendmail MIME DoS vulnerability20060621 Re: Sendmail MIME DoS vulnerability20060620 Sendmail MIME DoS vulnerabilityRHSA-2006:051526197[3.8] 008: SECURITY FIX: June 15, 2006MDKSA-2006:104GLSA-200606-19http://www.fortinet.com/FortiGuardCenter/advisory/FG-2006-18.htmlhttp://www.f-secure.com/security/fsc-2006-5.shtmlDSA-1155IY85930IY85415http://support.avaya.com/elmodocs2/security/ASA-2006-148.htmSSA:2006-166-0110162952164721612213272116021042207822072620694206842068320679206752067320654206512065020641oval:org.mitre.oval:def:11253SUSE-SA:2006:032SSRT061135HPSBTU0211620060602-01-U20060601-01-PFreeBSD-SA-06:17.sendmailuseradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a required argument to the open function when creating a new user mailbox, which causes the mailbox to be created with unpredictable permissions and possibly allows attackers to read or modify the mailbox.VU#3126921811120370https://issues.rpath.com/browse/RPL-1357shadow-utils-useradd-file-permission(26958)ADV-2007-3229ADV-2006-2006101822120070511 rPSA-2007-0096-1 shadowRHSA-2007:0431RHSA-2007:0276MDKSA-2006:090GLSA-200606-02http://support.avaya.com/elmodocs2/security/ASA-2007-249.htm2770626909258962589425629252672509820506oval:org.mitre.oval:def:1080720070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Playerhttp://cvs.pld.org.pl/shadow/NEWS?rev=1.10920070602-01-PThe WeOnlyDo! SFTP (wodSFTP) ActiveX control is marked as safe for scripting, which allows remote attackers to read and write files in arbitrary locations by accessing the control from a web page.VU#378604ADV-2006-2064wodsftp-activex-unauth-access(26752)1819220361Buffer overflow in eBay Enhanced Picture Services (aka EPUImageControl Class) in EUPWALcontrol.dll before 1.0.3.48, as used in Sell Your Item (SYI), Setup & Test eBay Enhanced Picture Services, Picture Manager Enhanced Uploader, and CARad.com Add Vehicle, allows remote attackers to execute arbitrary code via a crafted HTML document.VU#597721ebay-epuimagecontrol-bo(27631)ADV-2006-269818921http://www.kb.cert.org/vuls/id/MIMG-6QKPVH101644520969Tamarack MMSd before 7.992 allows remote attackers to cause a denial of service (crash) via malformed RFC1006 (OSI over TCP/IP) packets.VU#372878tamarack-mmsd-packet-dos(28053)ADV-2006-3080http://www.kb.cert.org/vuls/id/JGEI-6RZPUT192021016734Adobe Graphics Server 2.0 and 2.1 (formerly AlterCast) and Adobe Document Server (ADS) 5.0 and 6.0 allows local users to read files with certain extensions or overwrite arbitrary files and execute code via a crafted SOAP request to the AlterCast web service in which the request uses the (1) saveContent or (2) saveOptimized ADS commands, or the (3) loadContent command.1711320060315 Secunia Research: Adobe Document/Graphics Server File URI ResourceAccesshttp://www.adobe.com/support/techdocs/332989.html101576919229adobe-unauth-command-access(25247)ADV-2006-0956239241015768588The Ubuntu 5.10 installer does not properly clear passwords from the installer log file (questions.dat), and leaves the log file with world-readable permissions, which allows local users to gain privileges.USN-262-1https://launchpad.net/distros/ubuntu/+source/shadow/+bug/34606ADV-2006-0927ubuntu-installer-password-disclosure(25170)1708623868101576119200Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to cause a denial of service (crash) via a BuildContextW request with a large (1) UuidString or (2) GuidIn of a certain length, which causes an out-of-range memory access, aka the MSDTC Denial of Service Vulnerability. NOTE: this is a variant of CVE-2005-2119.1790520060509 [EEYEB20051011B] - Microsoft Distributed Transaction Coordinator Denial of ServiceMS06-018http://www.eeye.com/html/research/advisories/AD20060509b.html20000ADV-2006-1742msdtc-message-dos(25558)253361016047864oval:org.mitre.oval:def:1990oval:org.mitre.oval:def:1912oval:org.mitre.oval:def:1779oval:org.mitre.oval:def:1295Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invalid HTML that causes memory corruption.VU#503124TA06-101AMS06-013ADV-2006-1318ie-html-execute-code(25542)17450101590018957oval:org.mitre.oval:def:787oval:org.mitre.oval:def:1711oval:org.mitre.oval:def:1677Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via by instantiating the (1) Mdt2gddr.dll, (2) Mdt2dd.dll, and (3) Mdt2gddo.dll COM objects as ActiveX controls, which leads to memory corruption.TA06-101AVU#95904918957ADV-2006-131817453MS06-013ie-com-activex-execute-code(25545)1015900oval:org.mitre.oval:def:791oval:org.mitre.oval:def:1704oval:org.mitre.oval:def:1651oval:org.mitre.oval:def:1589oval:org.mitre.oval:def:1446Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via HTML elements with a certain crafted tag, which leads to memory corruption.VU#824324TA06-101AMS06-013ADV-2006-131820060525 [BuHa-Security] MS06-013: HTML Tag Memory Corruption Vulnerability in MS IE 6 SP2101590018957oval:org.mitre.oval:def:1773oval:org.mitre.oval:def:1296oval:org.mitre.oval:def:1290oval:org.mitre.oval:def:1144Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via a crafted URL with an International Domain Name (IDN) using double-byte character sets (DBCS), aka the "Double Byte Character Parsing Memory Corruption Vulnerability."Customers should apply the update immediately.TA06-101AVU#341028ie-double-byte-execute-code(25551)ADV-2006-131817454MS06-01310159001895720060411 Microsoft Internet Explorer DBCS Remote Memory Corruption Vulnerabilityoval:org.mitre.oval:def:792oval:org.mitre.oval:def:1484oval:org.mitre.oval:def:1020Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedded object, which could cause Internet Explorer to run the object in the wrong security context or zone, and allow remote attackers to execute arbitrary code.VU#959649ADV-2006-1318MS06-013ie-ioleclientsite-execute-code(25552)17455101590018957oval:org.mitre.oval:def:965oval:org.mitre.oval:def:1783oval:org.mitre.oval:def:1735oval:org.mitre.oval:def:1541Microsoft Internet Explorer 5.01 through 6 does not always correctly identify the domain that is associated with a browser window, which allows remote attackers to obtain sensitive cross-domain information and spoof sites by running script after the user has navigated to another site.ADV-2006-1318MS06-013ie-popup-zone-bypass(25555)17457101589218957oval:org.mitre.oval:def:1710oval:org.mitre.oval:def:1251Microsoft Internet Explorer 5.01 through 6 allows remote attackers to conduct phishing attacks by spoofing the address bar and other parts of the trust UI via unknown methods that allow "window content to persist" after the user has navigated to another site, aka the "Address Bar Spoofing Vulnerability." NOTE: this is a different vulnerability than CVE-2006-1626.17460MS06-013101589918957ie-browser-window-spoofing(25557)ADV-2006-1318670oval:org.mitre.oval:def:1740oval:org.mitre.oval:def:1725oval:org.mitre.oval:def:1645oval:org.mitre.oval:def:1498oval:org.mitre.oval:def:1336Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access (OWA), allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing."TA06-164AVU#13818818381MS06-029101628020634ADV-2006-2326http://www.sec-consult.com/fileadmin/Advisories/20060613-0_owa_xss_noexploit.txt26441exchange-owa-xss(25550)20060614 SEC Consult SA-20060613-0 :: Outlook Web Access Cross Site Scripting Vulnerabilityoval:org.mitre.oval:def:1315oval:org.mitre.oval:def:1161oval:org.mitre.oval:def:1070Integer signedness error in the enet_protocol_handle_incoming_commands function in protocol.c for ENet library CVS version Jul 2005 and earlier, as used in products including (1) Cube, (2) Sauerbraten, and (3) Duke3d_w32, allows remote attackers to cause a denial of service (application crash) via a packet with a large command length value, which leads to an invalid memory access.ADV-2006-094020060312 Multiple vulnerabilities in ENet library (Jul 2005)19208http://aluigi.altervista.org/adv/enetx-adv.txtenet-signedness-dos(25157)1708723844101576720060312 Multiple vulnerabilities in ENet library (Jul 2005)The enet_protocol_handle_send_fragment function in protocol.c for ENet library CVS version Jul 2005 and earlier, as used in products including (1) Cube, (2) Sauerbraten, and (3) Duke3d_w32, allows remote attackers to cause a denial of service (application crash) via a packet fragment with a large total data size, which triggers an application abort when memory allocation fails.ADV-2006-094020060312 Multiple vulnerabilities in ENet library (Jul 2005)19208http://aluigi.altervista.org/adv/enetx-adv.txtenet-packet-dos(25158)1708723845101576720060312 Multiple vulnerabilities in ENet library (Jul 2005)Multiple cross-site scripting (XSS) vulnerabilities in QwikiWiki 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) from and (2) help parameters to (a) index.php; (3) action, (4) page, (5) debug, (6) help, (7) username, or (8) password parameters to (b) login.php; the (7) help parameter to (c) pageindex.php; or (8) help parameter to (d) recentchanges.php.qwikiwiki-multiple-scripts-xss(25128)ADV-2006-09101706419182http://kiki91.altervista.org/exploit/qwikiwiki_1.0.5_xss.txt23789237882378723786SafeDisc installs the driver service for the secdrv.sys driver with insecure permissions, which allows local users to gain privileges by changing the configuration to reference a malicious program.1707020060311 Copy protection scheme SafeDisc allows privilege escalationsafedisk-secdrv-gain-privileges(25162)Comvigo IM Lock 2006 uses a simple substitution cipher to encrypt a password stored in the msnvs\prc registry value, for which all users have Read permission, which allows local users to bypass the product's blocking functionality by decrypting the password.ADV-2006-086620060306 IM Lock 2006 - Insecure Registry Permission Vulnerability19140imlock-password-weak-encryption(25219)16988Cross-site scripting (XSS) vulnerability in iframe.php in daverave Link Bank allows remote attackers to inject arbitrary web script or HTML via the site parameter.ADV-2006-088520060306 link bank code execution and xss19154linkbank-iframe-xss(25107)1700123751Direct static code injection vulnerability in add_link.txt in daverave Link Bank allows remote attackers to execute arbitrary PHP code via the url_name parameter, which is not sanitized before being stored in links.txt, which is later used in an include statement.ADV-2006-088520060306 link bank code execution and xss191541700423750553Directory traversal vulnerability in resetpw.php in eschew.net phpBannerExchange 2.0 and earlier, and other versions before 2.0 Update 5, allows remote attackers to read arbitrary files via a .. (dot dot) in the email parameter during a "Recover password" operation (recoverpw.php).phpbannerexchange-recoverpw-dir-traversal(25080)phpbannerexchange-resetpw-dir-traversal(25071)ADV-2006-08691699620060307 phpBannerExchange 2.0 Directory Traversal Vulnerability23720http://www.h4cky0u.org/advisories/HYSA-2006-004-phpbanner.txthttp://www.eschew.net/scripts/phpbe/2.0/releasenotes.php1912720060307 phpBannerExchange 2.0 Directory Traversal VulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in textfileBB 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) mess and (2) user parameters in messanger.php, possibly requiring a URL encoded value.ADV-2006-089720060308 textfileBB <= 1.0 Multiple XSS19149http://notlegal.ws/textfilebbmessanger.txttextbb-messanger-xss(25091)170291015744PHP remote file include vulnerability in common.php in txtForum 1.0.4-dev and earlier allows remote attackers to include and execute arbitrary PHP code via a URL in the skin parameter to login.php, and possibly other parameters to other PHP scripts, related to include statements in common.php.20060309 txtForum: Script Injection Vulnerabilityhttp://www.seclab.tuwien.ac.at/advisories/TUVSA-0603-004.txttxtforum-login-file-include(25131)1706123952Multiple cross-site scripting (XSS) vulnerabilities in txtForum 1.0.4-dev and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) prev, (2) next, and (3) rand5 parameters in (a) index.php; the (4) r_username and (5) r_loc parameters in (b) new_topic.php; the (6) r_num, (7) r_family_name, (8) r_icq, (9) r_yahoo, (10) r_aim, (11) r_homepage, (12) r_interests, (13) r_about, (14) selected1, (15) selected0, (16) signature_selected1, (17) signature_selected0, (18) smile_selected1, (19) smile_selected0, (20) ubb_selected1, and (21) ubb_selected0 parameters in (c) profile.php; the (22) quote and (23) tid parameters in (d) reply.php; and the (24) tid, (25) sticked, and (26) mid parameters in (e) view_topic.php.20060309 txtForum: Multiple XSS Vulnerabilitieshttp://www.seclab.tuwien.ac.at/advisories/TUVSA-0603-003.txttxtforum-multiple-xss(25132)170542395723956239552395423953Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) confirmredirect and (2) post_id parameters in (a) delcomment.php, as reachable when mode=delcom from index.php; and the (3) del and (4) message parameters in (b) upload.php, the (5) errormsg parameter in (c) addcat.php, (d) edituser.php, (e) adduser.php, and (f) editcat.php, the (6) trackback_url parameter in (g) add.php, (7) id parameter in (h) deluser.php, (8) cat_id parameter in (i) delcat.php, and (9) post_id parameter in (j) del.php, as reachable from admin.php.mybloggie-index-admin-xss(25134)1704820060309 MyBloggie: Multiple XSS Vulnerabilitieshttp://www.seclab.tuwien.ac.at/advisories/TUVSA-0603-002.txt23992239912399023989239882398723986239752397423973Matt Johnston Dropbear SSH server 0.47 and earlier, as used in embedded Linux devices and on general-purpose operating systems, allows remote attackers to cause a denial of service (connection slot exhaustion) via a large number of connection attempts that exceeds the MAX_UNAUTH_CLIENTS defined value of 30.17024dropbear-connection-dos(25075)20060307 Dropbear SSH server Denial of Service1015742PHP Upload Center stores password hashes under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for the upload/users/[USERNAME] file.20060309 PHP Upload Center Download users password hashes And phpshell Uploadhttp://www.scripts-by.net/PHP/File-Manipulation/php-upload-center.htmlhttp://www.blogcu.com/Liz0ziM/317250/http://biyosecurity.be/bugs/phpuploadcenter2.txt23627Sergey Korostel PHP Upload Center allows remote attackers to execute arbitrary PHP code by uploading a file whose name ends in a .php.li extension, which can be accessed from the upload directory.ADV-2006-081720060309 PHP Upload Center Download users password hashes And phpshell Uploadhttp://www.scripts-by.net/PHP/File-Manipulation/php-upload-center.html23626http://www.blogcu.com/Liz0ziM/317250/19107http://biyosecurity.be/bugs/phpuploadcenter2.txt564PHP Advanced Transfer Manager 1.00 through 1.30 stores sensitive information, including password hashes, under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for a users/[USERNAME] file.20060309 PHP Advanced Transfer Manager Download users password hasheshttp://www.blogcu.com/Liz0ziM/316652/http://biyosecurity.be/bugs/patm.txtphpatm-password-hash-disclosure(25127)20060613 Re: PHP Advanced Transfer Manager Download users password hashes56517134The web interface for IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 includes the MySQL database username and password in cleartext in body.phtml, which allows remote attackers to gain privileges by reading the source. NOTE: IBM has privately confirmed to CVE that a fix is available for these issues.20060308 Remote access to NeuSecure/Netcool backend database via web interface credentials leakagenetcool-neusecure-ns-unauth-access(25270)17032IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 configures a MySQL database to allow connections from any source IP address with the ns database account, which allows remote attackers to bypass the Netcool/NeuSecure application layer and perform unauthorized database actions. NOTE: IBM has privately confirmed to CVE that a fix is available for these issues.20060308 Remote access to NeuSecure/Netcool backend database via web interface credentials leakagenetcool-neusecure-ns-unauth-access(25270)Unspecified vulnerability in index.php in Core CoreNews 2.0.1 allows remote attackers to execute arbitrary commands via the page parameter, possibly due to a PHP remote file include vulnerability. NOTE: this vulnerability could not be confirmed by source code inspection of CoreNews 2.0.1, which does not appear to use a "page" parameter or variable.corenews-index-command-execution(25180)1706720060309 CoreNews 2.0.1 Remote Command Exucetionhttp://web.archive.org/web/20050323212004/www.coreslawn.de/?show=downloads&cat_id=12408075420060313 Oddness - CoreNews 2.0.1 Remote Command ExucetionJiRo's Banner System Experience and Professional 1.0 and earlier allows remote attackers to bypass access restrictions and gain privileges via a direct request to certain scripts in the files directory, as demonstrated by using addadmin.asp to create a new administrator account.ADV-2006-091120060309 Advisory: Jiros Banner Experience Pro Remote Privilege Escalation.http://www.nukedx.com/?viewdoc=1919184jbspro-security-bypass(25169)170602378020060309 Advisory: Jiros Banner Experience Pro Remote Privilege Escalation.UnrealIRCd 3.2.3 allows remote attackers to cause an unspecified denial of service by causing a linked server to send malformed TKL Q:Line commands, as demonstrated by "TKL - q\x08Q *\x08PoC."2377819188http://forums.unrealircd.com/viewtopic.php?t=2985unrealircd-server-link-dos(25130)ADV-2006-090820060309 UnrealIRCd3.2.3 Server-Link Denial of Service17057Cross-site scripting (XSS) vulnerability in misc.php in Woltlab Burning Board (wBB) 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the percent parameter. NOTE: this issue has been disputed in a followup post, although the original disclosure might be related to reflected XSS.1695920060304 Re: Wbb 2.3. xss20060304 Wbb 2.3. xsswbb-misc-xss(25156)Cross-site scripting (XSS) vulnerability in bigshow.php in Runcms 1.x allows remote attackers to inject arbitrary web script or HTML via the id parameter.189971697020060304 [KAPDA::#31] - Runcms 1.x Cross_Site_Scripting vulnerability in bigshow.phphttp://www.kapda.ir/advisory-280.html23823474SQL injection vulnerability in DSPoll 1.1 allows remote attackers to execute arbitrary SQL commands via the pollid parameter to (1) results.php, (2) topolls.php, (3) pollit.php.ADV-2006-093219209http://evuln.com/vulns/96/summary.htmldspoll-pollid-sql-injection(25192)1710320060324 [eVuln] DSPoll Multiple SQL Injection Vulnerabilities2388123880238791015758622620Unspecified vulnerability in the HTTP proxy in Novell BorderManager 3.8 and earlier allows remote attackers to cause a denial of service (CPU consumption and ABEND) via unknown attack vectors related to "media streaming over HTTP 1.1".17031http://support.novell.com/cgi-bin/search/searchtid.cgi?/2972993.htm19163ADV-2006-087923752Directory traversal vulnerability in Gallery 2.0.3 and earlier, and 2.1 before RC-2a, allows remote attackers to include arbitrary PHP files via ".." (dot dot) sequences in the stepOrder parameter to (1) upgrade/index.php or (2) install/index.php.19175gallery-multiple-index-file-include(25129)ADV-2006-08951566http://gallery.menalto.com/2.0.4_and_2.1_rc_2a_update17051Integer overflow in the mach_msg_send function in the kernel for Mac OS X might allow local users to execute arbitrary code via unknown attack vectors related to a large message header size, which leads to a heap-based buffer overflow.17056http://www.felinemenace.org/~nemo/28453Untrusted search path vulnerability in the TrueVector service (VSMON.exe) in Zone Labs ZoneAlarm 6.x and Integrity does not search ZoneAlarm's own folders before other folders that are specified in a user's PATH, which might allow local users to execute code as SYSTEM by placing malicious DLLs into a folder that has insecure permissions, but is searched before ZoneAlarm's folder. NOTE: since this issue is dependent on the existence of a vulnerability in a separate product (weak permissions of executables or libraries, or the execution of malicious code), perhaps it should not be included in CVE.ADV-2006-094720060309 Statement Regarding Reported Local Escalation of Privileges Vulnerability for ZoneAlarm20060309 Re: 18 ways to escalate privileges in Zone Labs ZoneAlarm Security Suite build 6.1.744.00020060308 18 ways to escalate privileges in Zone Labs ZoneAlarm Security Suite build 6.1.744.0001015743http://reedarvin.thearvins.com/20060308-01.htmlzonealarm-path-gain-privileges(25097)17037Multiple cross-site scripting (XSS) vulnerabilities in zeroboard 4.1 pl7 allows allow remote attackers to inject arbitrary web script or HTML via the (1) memo box title, (2) user email, and (3) homepage fields.1707520060312 [INetCop Security Advisory] zeroboard IP session bypass XSS vulnerability1921420060312 [INetCop Security Advisory] zeroboard IP session bypass XSS vulnerabilityADV-2006-0944http://www.nzeo.com/bbs/zboard.php?id=cgi_bugreport2&no=5406http://www.inetcop.org/upfiles/33INCSA.2006-0x82-029-zeroboard.pdfzeroboard-multiple-fields-xss(25212)23847Cross-site scripting (XSS) vulnerability in Jupiter Content Manager 1.1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a Javascript URI in the image BBcode tag.ADV-2006-09421707220060311 Jupiter CMS <= 1.1.5 multiple XSS attack vectors.19215jupitercm-bbcodetag-xss(25241)20060412 Re: Jupiter CMS <= 1.1.5 multiple XSS attack vectors.23839http://www.jupiterportal.com/index.php?n=modules/forum&a=3&d=11&o=5&q=313572Directory traversal vulnerability in dwnld.php in GuppY 4.5.11 allows remote attackers to overwrite arbitrary files via a "%2E." (mixed encoding) in the pg parameter.guppy-dwnld-file-deletion(25141)1706820060310 [KAPDA::#33] - GuppY <= 4.5.11 Remote DoS vulnerabilityhttp://www.kapda.ir/advisory-291.htmlhttp://www.freeguppy.org/?lng=en101575319222ADV-2006-09362399323846569CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject headers of outgoing e-mail messages and use Drupal as a spam proxy.20060314 [DRUPAL-SA-2006-004] Drupal 4.6.6 / 4.5.8 fixes mail header injection issue19245http://drupal.org/node/53806drupal-header-data-manipulation(25206)1710423912DSA-100757919257Cross-site scripting (XSS) vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.20060314 [DRUPAL-SA-2006-002] Drupal 4.6.6 / 4.5.8 fixes XSS issue19245http://drupal.org/node/53803drupal-undisclosed-xss(25202)1710423910DSA-100758119257Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8, when menu.module is used to create a menu item, does not implement access control for the page that is referenced, which might allow remote attackers to access administrator pages.drupal-menumodule-bypass-security(25197)20060314 [DRUPAL-SA-2006-001] Drupal 4.6.6 / 4.5.8 fixes access control issue23909DSA-10071925719245http://drupal.org/node/5379617104578Session fixation vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to gain privileges by tricking a user to click on a URL that fixes the session identifier.This vulnerability affects Drupal versions 4.6.x before 4.6.6, as well as versions 4.5.x before 4.5.820060314 [DRUPAL-SA-2006-003] Drupal 4.6.6 / 4.5.8 fixes session fixation issue19245http://drupal.org/node/53805drupal-login-session-hijacking(25205)1710423911DSA-100758019257SQL injection vulnerability in search.asp in Hosting Controller 6.1 (Hotfix 2.9) allows remote attackers to execute arbitrary SQL commands via the search parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.This vulnerability may affect all versions of Hosting Controller previous to 6.1 Hotfix 2.9 as well.hosting-controller-search-sql-injection(25140)ADV-2006-09142380219191Multiple cross-site scripting (XSS) vulnerabilities in create.php in vCard 2.x allow remote attackers to inject arbitrary web script or HTML via the (1) card_id, (2) uploaded, (3) card_fontsize, or (4) card_color parameter. NOTE: the card_id vector was later reported to affect vCard 2.9, and the uploaded vector for 2.6.vcard-create-xss(25181)ADV-2006-0945228191707320070304 XSS Remote In vCard 2.6 (c)200220060527 multiple Xss exploits in : vCard 2.920060311 XSS in vCard23838101618319216CAPI4HylaFAX 1.3, when compiled with GENERATE_DEBUGSFFDATAFILE set, allows local users to modify arbitrary files via a symlink attack on the c2faxrecv_dbgdatafile.sff temporary file.1703420060307 capi4hylafax insecure manipulation with tmp files20060307 capi4hylafax insecure manipulation with tmp filescapi4hylafax-c2faxrecvdbgdatafile-symlink(25262)Multiple SQL injection vulnerabilities in DSDownload 1.0, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the (1) key and (2) category parameters to (a) search.php and (b) downloads.php."magic_quotes_gpc" parameter must be disabled in order for this vulnerability to be exploited. This vulnerability may affect DSPortal, DSDownload versions previous to 1.0 as well.ADV-2006-093419202http://evuln.com/vulns/99/summary.htmldsdownload-multiple-sql-injection(25193)1711620060325 [eVuln] DSDownload Multiple SQL Injection Vulnerabilities23887238861015755626Multiple cross-site scripting (XSS) vulnerabilities in WMNews allow remote attackers to inject arbitrary web script or HTML via the (1) ArtCat parameter to wmview.php, (2) ctrrowcol parameter to footer.php, or (3) ArtID parameter to wmcomments.php.ADV-2006-09391707620060312 WMNews Cross Site Scripting19204http://biyosecurity.be/bugs/wmnews.txtwmnews-multiple-scripts-xss(25210)238422384123840SQL injection vulnerability in index.php in DSCounter 1.2, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For field (HTTP_X_FORWARDED_FOR environment variable) in an HTTP header.Successful exploitation requires that the "magic_quotes_gpc" parameter is disabled.dscounter-index-sql-injection(25190)ADV-2006-09331711220060325 [eVuln] DSCounter 'X-Forwarded-For' SQL Injection Vulnerability101575619206http://evuln.com/vulns/98/summary.html23882627Directory traversal vulnerability in admin/deleteuser.php in HitHost 1.0.0 might allow remote attackers to delete directories (possibly only empty directories) via the $deleteuser variable. NOTE: the initial disclosure for this issue indicated that the researcher was unable to prove this issue; however, this might have been due to certain behaviors of rmdir.hithost-deleteuser-directory-deletion(25106)20060314 Re: histhost v1.0.0 xss and possible rmdir20060306 histhost v1.0.0 xss and possible rmdir19155Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrary code via a long setup sound command, a different vulnerability than CVE-2006-1010.ADV-2006-095117093158219237http://cvs.sourceforge.net/viewcvs.py/crossfire/crossfire/socket/request.c?rev=1.86&view=logcrossfire-setup-bo(25252)23904DSA-100919276Multiple SQL injection vulnerabilities in DSNewsletter 1.0, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the email parameter to (1) include/sub.php, (2) include/confirm.php, or (3) include/unconfirm.php.Successful exploitation requires that the "magic_quotes_gpc" parameter is disabled.dsnewsletter-email-sql-injection(25188)ADV-2006-09311711120060324 [eVuln] DSNewsletter SQL Injection Vulnerability101575719207http://evuln.com/vulns/97/summary.html238852388423883623SQL injection vulnerability in DSLogin 1.0, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands and bypass authentication via the $log_userid variable in (1) index.php and (2) admin/index.php.Successful exploitation requires that the "magic_quotes_gpc" parameter is disabled.dslogin-index-sql-injection(25194)dslogin-index-bypass-authentication(25194)ADV-2006-09531726220060327 [eVuln] DSLogin Authentication Bypass Vulnerability101575419201http://evuln.com/vulns/100/summary.html23896637Cross-site scripting (XSS) vulnerability in issue/createissue.aspx in Gemini 2.0 allows remote attackers to inject arbitrary web script or HTML via the rtcDescription$RadEditor1 field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.gemini-createissue-xss(25195)ADV-2006-0954239071904917092Buffer overflow in inet_server.cpp in (1) fb_inet_server and (2) fbserver in Firebird 1.5.2.4731 allows local users to gain privileges via a long value of the -p argument.1707720060312 Buffer Overflow and Installation Script Error in Firebird 1.5.3firebird-fbinetserver-fbserver-bo(25282)20060312 Buffer Overflow and Installation Script Error in Firebird 1.5.3Firebird 1.5.2.4731 installs (1) fb_lock_mgr, (2) gds_drop, and (3) fb_inet_server with setuid firebird permissions, which might allow local users to gain privileges via a buffer overflow as identified by CVE-2006-1240, or possibly other vulnerabilities.The problems are fixed in the current 1.5.3 version of the Firebird binary distribution.1707720060312 Buffer Overflow and Installation Script Error in Firebird 1.5.3firebird-fbinetserver-fbserver-bo(25282)20060312 Buffer Overflow and Installation Script Error in Firebird 1.5.3The ip_push_pending_frames function in Linux 2.4.x and 2.6.x before 2.6.16 increments the IP ID field when sending a RST after receiving unsolicited TCP SYN-ACK packets, which allows remote attackers to conduct an Idle Scan (nmap -sI) attack, which bypasses intended protections against such attacks.19402ADV-2006-2554ADV-2006-11401710920060316 Re: Linux zero IP ID vulnerability?20060315 Re: Linux zero IP ID vulnerability?20060314 Linux zero IP ID vulnerability?http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.1oval:org.mitre.oval:def:10317USN-281-120060323 Re: Linux zero IP ID vulnerability?RHSA-2006:0575RHSA-2006:0437SUSE-SA:2006:028MDKSA-2006:086DSA-1103DSA-1097http://support.avaya.com/elmodocs2/security/ASA-2006-200.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-180.htm224172198321465211362091420671203982015719955Directory traversal vulnerability in install05.php in Simple PHP Blog (SPB) 0.4.7.1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the blog_language parameter, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included using install05.php.simplephpblog-install05-file-include(25322)ADV-2006-100717102192701581Vendor ACK for CVE-2006-1243 (older Simple PHP Blog)http://sourceforge.net/forum/forum.php?forum_id=564904Unspecified vulnerability in certain versions of xpdf after 3.00, as used in various products including (a) pdfkit.framework, (b) gpdf, (c) pdftohtml, and (d) libextractor, has unknown impact and user-assisted attack vectors, possibly involving errors in (1) gmem.c, (2) SplashXPathScanner.cc, (3) JBIG2Stream.cc, (4) JPXStream.cc, and/or (5) Stream.cc. NOTE: this description is based on Debian advisory DSA 979, which is based on changes that were made after other vulnerabilities such as CVE-2006-0301 and CVE-2005-3624 through CVE-2005-3628 were fixed. Some of these newer fixes appear to be security-relevant, although it is not clear if they fix specific issues or are defensive in nature.DSA-998DSA-984DSA-983DSA-982DSA-979DSA-1019http://security.debian.org/pool/updates/main/p/pdfkit.framework/pdfkit.framework_0.8-2sarge3.diff.gz19644193641916419091190651902118948USN-270-11674823834Buffer overflow in mshtml.dll in Microsoft Internet Explorer 6.0.2900.2180, and probably other versions, allows remote attackers to execute arbitrary code via an HTML tag with a large number of script action handlers such as onload and onmouseover, as demonstrated using onclick, aka the "Multiple Event Handler Memory Corruption Vulnerability."TA06-101AVU#98447317131MS06-01310157941926918957ie-mshtml-bo(25292)ADV-2006-131820060325 Re: [optimized PoC] Remote overflow in MSIE script action handlers (mshtml.dll)2396420060316 Remote overflow in MSIE script action handlers (mshtml.dll)20061205 Re: MS Internet Explorer 6.0 (mshtml.dll) Denial of Service Exploit20061203 MS Internet Explorer 6.0 (mshtml.dll) Denial of Service Exploitoval:org.mitre.oval:def:1766oval:org.mitre.oval:def:1632oval:org.mitre.oval:def:1599oval:org.mitre.oval:def:1569oval:org.mitre.oval:def:1451Unspecified vulnerability in mklvcopy in BOS.RTE.LVM in IBM AIX 5.3 allows local users to execute arbitrary commands when mklvcopy calls external commands, possibly due to an untrusted search path vulnerability.http://www.nsfocus.com/english/homepage/research/0602.htm19235aix-mklvcopy-code-execution(25849)aix-bosrtelvm-gain-privileges(25299)ADV-2006-09571711523921IY82739101578620060323 IBM changing significant details?rm_mlcache_file in bos.rte.install in AIX 5.1.0 through 5.3.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.17576http://www.nsfocus.com/english/homepage/research/0603.htmIY8235719656aix-rm-mlcache-file-overwrite(25848)ADV-2006-138920060424 NSFOCUS SA2006-02 : IBM AIX mklvcopy Local Privilege Escalation Vulnerability20060424 NSFOCUS SA2006-03 : IBM AIX rm_mlcache_file Local Race Condition Vulnerability247061015952Unspecified vulnerability in usermod in HP-UX B.11.00, B.11.11, and B.11.23, when run with certain options that involve a new home directory, might cause usermod to change the ownership of all directories and files under the new directory, which might result in less secure permissions than intended.ADV-2006-0997HPSBUX02102hpux-usermod-unauthorized-access(25311)171431015834101578219305SSRT051078oval:org.mitre.oval:def:785oval:org.mitre.oval:def:772oval:org.mitre.oval:def:1098Integer overflow in Apple QuickTime Player 7.0.3 and 7.0.4 and iTunes 6.0.1 and 6.0.2 allows remote attackers to execute arbitrary code via a FlashPix (FPX) image that contains a field that specifies a large number of blocks.TA06-132BVU#570689quicktime-flashpix-overflow(26398)ADV-2006-17781707420060511 [EEYEB-20060307] Apple QuickTime FPX Integer Overflow20060512 Apple QuickDraw/QuickTime Multiple Vulnerabilitieshttp://www.eeye.com/html/research/upcoming/20060307b.html101606720069APPLE-SA-2006-05-11Unspecified vulnerability in the Webmail module in Winmail before 4.3 has unknown impact and unknown remote attack vectors.ADV-2006-0858http://www.magicwinmail.net/changelog.asp17009Argument injection vulnerability in greylistclean.cron in sa-exim 4.2 allows remote attackers to delete arbitrary files via an email with a To field that contains a filename separated by whitespace, which is not quoted when greylistclean.cron provides the argument to the rm command.17110http://marc.merlins.org/linux/exim/files/sa-exim-cvs/Changelog.htmlsaexim-greylistclean-file-deletion(25286)ADV-2006-094119225http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=345071Eval injection vulnerability in cal.php in Light Weight Calendar (LWC) 1.0 allows remote attackers to execute arbitrary PHP code via the date parameter to index.php.170591570Unspecified vulnerability in glFTPd before 2.01 RC5 allows remote attackers to bypass IP checks via a crafted DNS hostname, possibly a hostname that appears to be an IP address.19221http://www.glftpd.com/files/docs/changelog17118Unspecified vulnerability in BorderWare MXtreme 5.0 and 6.0 allows remote attackers to have an unknown impact via unknown attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.19223borderware-mxtreme-web-admin(25325)ADV-2006-097217140239391015787Stack-based buffer overflow in the IMAP service in Mercur Messaging 5.0 SP3 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long string to the (1) LOGIN or (2) SELECT command, a different set of attack vectors and possibly a different vulnerability than CVE-2003-1177.mercur-imap-bo(25290)ADV-2006-097717138239501926720060316 Re: Mercur IMAPD 5.0 SP3 DoS Exploit or more?20060316 Re: Mercur IMAPD 5.0 SP3 DoS Exploit or more?Cross-site scripting (XSS) vulnerability in guestbook.php in Soren Boysen (SkullSplitter) PHP Guestbook 2.6 allows remote attackers to inject arbitrary web script or HTML via the url parameter.This vulnerability can only be exploited if the "magic_quotes_gpc" parameter is set to 'off'.17136http://www.boysen.be/en/19268http://evuln.com/vulns/104/summary.htmlADV-2006-0974skullsplitter-guestbook-xss(25293)20060329 [eVuln] Skull-Splitter's PHP Guestbook XSS Vulnerability2394165020060318 Vendor ACK for Skull-Splitter Guestbook XSSThe sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with a valid username and any password, then going to the main site twice.1713420060316 Microsoft Commerce Server 2002: Logon as known user with a false passwordmscs-authfiles-authentication-bypass(25330)24121http://msdn.microsoft.com/library/default.asp?url=/library/en-us/csvr2002/htm/cs_se_securityconcepts_cbgw.asp594Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.1 allows remote attackers to inject arbitrary web script or HTML via the set_theme parameter.http://www.phpmyadmin.net/home_page/downloads.php?relnotes=019277ADV-2006-099117142phpmyadmin-settheme-xss(25305)239431015776Multiple SQL injection vulnerabilities in Maian Support 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) email or (2) pass parameter to admin/index.php.Successful exploitation requires that the "magic_quotes_gpc" parameter is disabled. This vulnerability may affect earlier versions of Maian, Support as well.ADV-2006-099219275http://evuln.com/vulns/103/summary.htmlmaiansupport-adminindex-sql-injection(25300)20060328 [eVuln] Maian Support Authentication Bypass23944645Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check.horde-servicesgo-information-disclosure(25239)171172391810157711924620060315 CodeScan Advisory: Unauthenticated Arbitrary File Read in Horde v3.09 and priorADV-2006-095920060315 CodeScan Advisory: Unauthenticated Arbitrary File Read in Horde v3.09 and priorSUSE-SR:2006:009GLSA-200604-02DSA-1034DSA-103359019897196921961919528Multiple cross-site scripting (XSS) vulnerabilities in ASPPortal 3.00 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.aspportal-multiple-xss(25235)1924720060315 CodeScan Advisory: Multiple Vulnerabilities In ASPPortal.net20060314 CodeScan Advisory: Multiple Vulnerabilities In ASPPortal.net1711423920http://www.aspportal.net/content/news/News_Item.asp?content_ID=321015772Multiple SQL injection vulnerabilities in ASPPortal 3.00 have unknown impact and attack vectors.aspportal-multiple-scripts-sql-injection(25234)1924720060315 CodeScan Advisory: Multiple Vulnerabilities In ASPPortal.net20060314 CodeScan Advisory: Multiple Vulnerabilities In ASPPortal.net1711423919http://www.aspportal.net/content/news/News_Item.asp?content_ID=321015772592Multiple "unannounced" cross-site scripting (XSS) vulnerabilities in WordPress before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.17069http://wordpress.org/development/2006/03/security-202/Cross-site scripting (XSS) vulnerability in xhawk.net discussion 2.0 beta2 allows remote attackers to inject arbitrary web script or HTML via a Javascript URI in a BBCode img tag.1711920060315 [eVuln] discussion - xhawk.net BBCode 'img' XSS & SQL Injection Vulnerabilitieshttp://evuln.com/vulns/92/summary.htmldiscussion-bbcode-xss(25236)23970SQL injection vulnerability in discussion.class.php in xhawk.net discussion 2.0 beta2 allows remote attackers to execute arbitrary SQL commands via the view parameter.20060315 [eVuln] discussion - xhawk.net BBCode 'img' XSS & SQL Injection Vulnerabilitieshttp://evuln.com/vulns/92/summary.htmldiscussion-class-sql-injection(25237)1712123971Cross-site scripting (XSS) vulnerability in Service_Requests.asp in VPMi Enterprise 3.3 allows remote attackers to inject arbitrary web script or HTML via the Request_Name_Display parameter.2391620060314 vendor dispute: VCSvpmi-servicerequests-xss(25339)1717219297Invision Power Board 2.1.4 allows remote attackers to hijack sessions and possibly gain administrative privileges by obtaining the session ID from the s parameter, then replaying it in another request.20060314 Invision Power Board v2.1.4 - session hijacking20060316 Re: Invision Power Board v2.1.4 - session hijackingThe Internet Key Exchange implementation in Funkwerk X2300 7.2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite. NOTE: due to the lack of details in the advisory, it is unclear which of CVE-2005-3666, CVE-2005-3667, and/or CVE-2005-3668 this issue applies to.19233ADV-2006-0958http://www.funkwerk-ec.com/portal/downloadcenter/dateien/x2300/r7201p09/readme_721p9.pdf17124Buffer overflow in the parse function in parse.c in zoo 2.10 might allow local users to execute arbitrary code via long filename command line arguments, which are not properly handled during archive creation. NOTE: since this issue is local and not setuid, the set of attack scenarios is limited, although is reasonable to expect that there are some situations in which the zoo user might automatically list attacker-controlled filenames to add to the zoo archive.https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=183426GLSA-200603-1219250ADV-2006-0969zoo-parse-bo(25264)1712619254Multiple cross-site scripting (XSS) vulnerabilities in zones.php in Inprotect 0.21 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Description field. NOTE: the provenance of this information is unknown; the details are obtained from third party information.A remote attacker must have "Manage Zones and Server" permissions on Inprotect to exploit this vulnerability.inprotect-zones-xss(25280)ADV-2006-0970171411924823936SQL injection vulnerability in index.php in OxyNews allows remote attackers to execute arbitrary SQL commands via the oxynews_comment_id parameter.ADV-2006-09761713219255http://biyosecurity.be/bugs/oxynews.txtoxynews-index-sql-injection(25301)20060316 Oxynews Sql İnjection23940Multiple cross-site scripting (XSS) vulnerabilities in member.php in MyBulletin Board (MyBB) 1.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) aim, (2) yahoo, (3) msn, or (4) website field.1709720060314 [[KAPDA::#35] MyBB 1.0.3~member.php~XSS Attack in contact details23935http://kapda.ir/advisory-297.htmlhttp://community.mybboard.net/showthread.php?tid=7368mybb-member-xss(25263)** DISPUTED ** Mozilla Firefox 1.0.7 and 1.5.0.1 allows remote attackers to cause a denial of service (crash) via an HTML tag with a large number of script action handlers such as onload and onmouseover, which triggers the crash when the user views the page source. NOTE: Red Hat has disputed this issue, suggesting that "It is likely the reporter was running the IE Tab extension," and Mozilla also confirmed that this is not an issue in Firefox itself.20060318 Re: Re: Remote overflow in MSIE script action handlers (mshtml.dll)20060317 Re: Re: Remote overflow in MSIE script action handlers (mshtml.dll)59331833Classic Planer in AntiVir PersonalEdition Classic 7 does not drop privileges before executing external programs, which allows local users to gain privileges via notepad.exe, which is used to display scan reports.17071ADV-2006-094820060311 AntiVir PersonalEdition Classic: Local Privilige Escalation1921720060311 AntiVir PersonalEdition Classic: Local Privilige Escalationantivir-notepad-gain-privilege(25244)23843573GGZ Gaming Zone 0.0.12 allows remote attackers to cause a denial of service (client disconnect) via inputs that produce malformed XML, including (1) trailing ' (apostrophe) character on the ID attribute in a PLAYER XML tag, (2) joining with a long ID attribute or non-trailing ' characters, which causes a <none> name to be assigned, and then disconnecting, or (3) a long CDATA message attribute, which prevents closing tags from being added to the string.ggzgaminzone-xml-dos(25164)ADV-2006-0935170942384819212http://aluigi.altervista.org/adv/ggzcdos-adv.txtadmin.php in Himpfen Consulting Company PHP SimpleNEWS 1.0.0 allows remote attackers to bypass authentication by setting the admin parameter in a cookie.ADV-2006-091319195http://evuln.com/vulns/94/summary.htmlsimplenews-admin-bypass-security(25177)1718620060322 [eVuln] PHP SimpleNEWS, PHP SimpleNEWS MySQL - Authentication Bypass Vulnerability23803613Cross-site scripting (XSS) vulnerability in signup.php in @1 File Store 2006.03.07 allows remote attackers to inject arbitrary web script or HTML via the (1) real_name, (2) email, and (3) login parameters.ADV-2006-09431709020060324 [eVuln] @1 File Store Multiple XSS and SQL Injection Vulnerabilities23850101582619224http://evuln.com/vulns/95/summary.htmlfilestore-signup-xss(25182)SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) functions.php and (2) user.php in the libs directory, (3) edit.php and (4) delete.php in control/files/, (5) edit.php and (6) delete.php in control/users/, (7) edit.php, (8) access.php, and (9) in control/folders/, (10) access.php and (11) delete.php in control/groups/, (12) confirm.php, and (13) download.php; (14) the email parameter in password.php, and (15) the id parameter in folder.php. NOTE: it was later reported that vectors 12 and 13 also affect @1 File Store PRO 3.2.Successful exploitation requires that the "magic_quotes_gpc" parameter is disabled.filestorepro-download-file-include(43724)filestorepro-id-sql-injection(43718)filestore-multiple-sql-injection(25183)ADV-2006-0943301821709020060324 [eVuln] @1 File Store Multiple XSS and SQL Injection Vulnerabilities241062386423863238622386123860238592385823857238562385523854238532385223851604020090825 @1 File Store PRO SQL injection - the old gray dupe101582661931063192244701847017http://evuln.com/vulns/95/summary.htmlCGI::Session 4.03-1 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by (1) Driver::File, (2) Driver::db_file, and possibly (3) Driver::sqlite.ADV-2006-0946171772386519211http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356555cgisession-cgisess-information-disclosure(25285)CGI::Session 4.03-1 does not set proper permissions on temporary files created in (1) Driver::File and (2) Driver::db_file, which allows local users to obtain privileged information, such as session keys, by viewing the files.ADV-2006-0946238672386619211http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356555cgisession-driver-files-insecure-permissions(25283)17099Cross-site scripting (XSS) vulnerability in member.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vulnerability than CVE-2006-1272. NOTE: 1.10 was later reported to be vulnerable.19213http://community.mybboard.net/showthread.php?tid=7368mybb-member-url-xss(25266)ADV-2006-0971174921709720060314 [KAPDA::#35] - MyBB1.0.4~member.php~XSS after login23935http://myimei.com/security/2006-03-09/mybb104memberphpxss-after-login.htmlhttp://kapda.ir/advisory-296.htmlCRLF injection vulnerability in inc/function.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to conduct cross-site scripting (XSS), poison caches, or hijack pages via CRLF (%0A%0D) sequences in the Referrer HTTP header field, possibly when redirecting to other web pages.http://kapda.ir/advisory-295.htmlhttp://community.mybboard.net/showthread.php?tid=73681709720060314 [KAPDA::#34] - MyBB1.0.4~redirectfunction()~HeaderInjectionhttp://myimei.com/security/2006-03-10/mybb104redirectfunctionheaderinjection.htmlmybb-crlf-header-injection(25267)opiepasswd in One-Time Passwords in Everything (OPIE) in FreeBSD 4.10-RELEASE-p22 through 6.1-STABLE before 20060322 uses the getlogin function to determine the invoking user account, which might allow local users to configure OPIE access to the root account and possibly gain root privileges if a root shell is permitted by the configuration of the wheel group or sshd.17194FreeBSD-SA-06:12bsd-opie-unauthorized-privileges(25397)ADV-2006-107424067101581719347The installation of SQLAnywhere in Symantec Ghost 8.0 and 8.2, as used in Symantec Ghost Solutions Suite (SGSS) 1.0, includes a default administrator login account and password, which allows local users to gain privileges or modify tasks.ADV-2006-087017018http://securityresponse.symantec.com/avcenter/security/Content/2006.03.07.html191711015733SQLAnywhere in Symantec Ghost 8.0 and 8.2, as used in Symantec Ghost Solutions Suite (SGSS) 1.0, gives read and write permissions to all users for database shared memory sections, which allows local users to access and possibly modify certain information.Update to Symantec Ghost 8.3 that is shipped as a part of Symantec Ghost Solutions Suite 1.1.ADV-2006-0870http://securityresponse.symantec.com/avcenter/security/Content/2006.03.07.html19171170191015733Buffer overflow in the login dialog in dbisqlc.exe in SQLAnywhere for Symantec Ghost 8.0 and 8.2, as used in Symantec Ghost Solutions Suite (SGSS) 1.0, might allow local users to read certain sensitive information from the database.Update to Symantec Ghost 8.3 that is shipped as a part of Symantec Ghost Solutions Suite 1.1.
ADV-2006-0870http://securityresponse.symantec.com/avcenter/security/Content/2006.03.07.html19171ghost-dbisqlc-bo(25089)1015733Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB) 2.0.4 and 2.1.4 before 20060130 allows remote attackers to steal cookies and probably conduct other activities when the victim is using Internet Explorer.http://forums.invisionpower.com/index.php?showtopic=206790ADV-2006-086119141Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 2.0.4 and 2.1.4 before 20060105 allow remote attackers to execute arbitrary SQL commands via cookies, related to (1) arrays of id/stamp pairs and (2) the keys in arrays of key/value pairs in ipsclass.php; (3) the topics variable in usercp.php; and the topicsread cookie in (4) topics.php, (5) search.php, and (6) forums.php.http://forums.invisionpower.com/index.php?showtopic=204627http://forums.invisionpower.com/index.php?act=Attach&type=post&id=9642ADV-2006-0861invision-multiple-sql-injection(25100)19141Multiple SQL injection vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) password, (3) team, (4) level, (5) status, (6) teamname, and (7) teamlead parameters in (a) auth.php; the (8) username, (9) action, and (10) filter parameters in (b) authuser.php; the (11) username parameter in (c) utils.php; the (12) id and (13) date parameters in (d) traffic.php; the (14) username parameter in (e) userstatistics.php; and the (15) USERNAME and (16) PASSWORD parameters in a cookie to (f) chgpwd.php.ADV-2006-0968http://www.ush.it/team/ascii/hack-milkeway/milkeyway.txt1712720060316 Milkeyway Multiple Vulnerabilitiesmilkeyway-admin-sql-injection(25287)milkeyway-multiple-sql-injection(25281)http://www.ush.it/team/ascii/hack-milkeway/advisory.txt2393123929239282392723925101577819258Multiple cross-site scripting (XSS) vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) ipAddress, (2) act, (3) username, and (4) unspecified other parameters in (a) authuser.php; and the (5) username and (6) unspecified other parameters in (b) userstatistics.php.ADV-2006-0968http://www.ush.it/team/ascii/hack-milkeway/milkeyway.txt1712720060316 Milkeyway Multiple Vulnerabilitiesmilkeyway-multiple-xss(25288)http://www.ush.it/team/ascii/hack-milkeway/advisory.txt2393323932101577819258publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for write access to the calendars directory, which allows remote attackers to upload and execute arbitrary PHP scripts via a WebDAV PUT request with a filename containing a .php extension and a trailing null character.ADV-2006-1019171291586http://downloads.securityfocus.com/vulnerabilities/exploits/php-iCalendar-221.upload.php19285Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the phpicalendar[cookie_language] and phpicalendar[cookie_style] cookies, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by day.php.ADV-2006-101915851712519285Cross-site scripting (XSS) vulnerability in index.php in Contrexx CMS 1.0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string (PHP_SELF).ADV-2006-10131712820060318 Contrexx CMS Xss Vulnhttp://www.contrexx.com/?section=news&cmd=details&newsid=54http://www.contrexx.com/?section=media1&act=download&path=/media/archive1/Opensource/Bugfixes/contrexx_1.0.8/&file=contrexx_v1.0.8_bugfix_27-02-06.ziphttp://soot.shabgard.org/Contrexx-CMS.txt19294contrexx-index-xss(25332)599PHP remote file include vulnerability in PageController.php in KnowledgebasePublisher 1.2 allows remote attackers to include and execute arbitrary PHP code via a URL in the dir parameter.ADV-2006-1020171201587knowledgebasepublisher-dir-file-include(25338)24002http://sourceforge.net/project/shownotes.php?release_id=402179&group_id=14415319298Cross-site scripting (XSS) vulnerability in recherche.php3 in SPIP 1.8.2-g allows remote attackers to inject arbitrary web script or HTML via the recherche parameter.http://zone.spip.org/trac/spip-zone/changeset/1672http://www.zone-h.fr/advisories/read/id=1105http://www.silitix.com/spip-xss.html17130spip-research-xss(25389)Untrusted search path vulnerability in Beagle 0.2.2.1 might allow local users to gain privileges via a malicious beagle-info program in the current working directory, or possibly directories specified in the PATH.beagle-beagle-status-privilege-escalation(25303)17195FEDORA-2006-188239421933619278http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=357392Unspecified vulnerability in Veritas Backup Exec for Windows Server Remote Agent 9.1 through 10.1, for Netware Servers and Remote Agent 9.1 and 9.2, and Remote Agent for Linux Servers 10.0 and 10.1 allow attackers to cause a denial of service (application crash or unavailability) due to "memory errors."http://www.symantec.com/avcenter/security/Content/2006.03.17a.htmlbackupexec-app-memory-dos(25309)ADV-2006-09951709820060317 Symantec Security Advisory SYM06-004101578419242597Format string vulnerability in the Job Engine service (bengine.exe) in the Media Server in Veritas Backup Exec 10d (10.1) for Windows Servers rev. 5629, Backup Exec 10.0 for Windows Servers rev. 5520, Backup Exec 10.0 for Windows Servers rev. 5484, and Backup Exec 9.1 for Windows Servers rev. 4691, when the job log mode is Full Detailed (aka Full Details), allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted filename on a machine that is backed up by Backup Exec.This vulnerability can only be exploited if the 'job log' mode is set to "Full Detailed" (aka Full Details). Other older versions of Windows Server (those that have been End-Of-Life'd) should be upgraded to the latest patch of one of the current versions listed above.17096http://support.veritas.com/docs/282254backupexec-bengine-format-string(25310)ADV-2006-0996http://www.symantec.com/avcenter/security/Content/2006.03.17b.html20060320 Symantec Security Advisory, SYM06-005101578519242Microsoft .NET framework 2.0 (ASP.NET) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1 allows remote attackers to bypass access restrictions via unspecified "URL paths" that can access Application Folder objects "explicitly by name."18920MS06-0331016465ADV-2006-2751ms-aspnet-appcode-information-disclosure(26802)2715320999oval:org.mitre.oval:def:419Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted SELECTION record that triggers memory corruption, a different vulnerability than CVE-2006-1302.MS06-037ADV-2006-2755188531016472oval:org.mitre.oval:def:557Buffer overflow in Microsoft Excel 2000 through 2003 allows user-assisted attackers to execute arbitrary code via a .xls file with certain crafted fields in a SELECTION record, which triggers memory corruption, aka "Malformed SELECTION record Vulnerability."18885MS06-037ADV-2006-275520060712 NSFOCUS SA2006-05 : Microsoft Excel SELECTION Record Memory Corruption Vulnerabilityhttp://www.nsfocus.com/english/homepage/research/0605.htm10164721238oval:org.mitre.oval:def:379Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1) DXImageTransform.Microsoft.MMSpecialEffect1Input, (2) DXImageTransform.Microsoft.MMSpecialEffect1Input.1, (3) DXImageTransform.Microsoft.MMSpecialEffect2Inputs, (4) DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, (5) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and (6) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, which causes memory corruption during garbage collection.VU#95904918328MS06-021ie-wmm2fxadll-execute-code(26774)http://www.zerodayinitiative.com/advisories/ZDI-06-018.htmlADV-2006-231920060613 ZDI-06-018: Microsoft Internet Explorer DXImageTransform ActiveX Memory Corruption Vulnerability26442101629120595oval:org.mitre.oval:def:2017oval:org.mitre.oval:def:1973oval:org.mitre.oval:def:1928oval:org.mitre.oval:def:1830oval:org.mitre.oval:def:1767oval:org.mitre.oval:def:1135Buffer overflow in Microsoft Excel 2000 through 2003 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted COLINFO record, which triggers the overflow during a "data filling operation."18888MS06-037ADV-2006-275520060712 NSFOCUS SA2006-06 : Microsoft Excel COLINFO Record Buffer Overflow Vulnerabilityhttp://www.nsfocus.com/english/homepage/research/0606.htm1016472oval:org.mitre.oval:def:545Microsoft Outlook 2000, 2002, and 2003 allows user-assisted remote attackers to cause a denial of service (memory exhaustion and interrupted mail recovery) via malformed e-mail header information, possibly related to (1) long subject lines or (2) large numbers of recipients in To or CC headers.TA07-009AVU#61743621937MS07-003101748823674ADV-2007-0104HPSBST02184SSRT07129631253http://osvdb.org/ref/24/24081-outlook1.txt[funsec] 20060308 DOSing Outlook 2003http://blogs.securiteam.com/index.php/archives/347oval:org.mitre.oval:def:122Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted BIFF record with an attacker-controlled array index that is used for a function pointer, aka "Malformed OBJECT record Vulnerability."18886MS06-037ADV-2006-275520060712 Microsoft Excel Array Index Error Remote Code Executionhttp://secway.org/advisory/AD20060711.txt1016472oval:org.mitre.oval:def:950Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted FNGROUPCOUNT value.18890MS06-037excel-fngroupcount-bo(27464)ADV-2006-2755101647220060712 Microsoft Excel Could Allow Remote Code Execution by Malformed FNGROUPCOUNT value Vulnerabilityoval:org.mitre.oval:def:243Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted LABEL record that triggers memory corruption.MS06-037ADV-2006-2755189101016472oval:org.mitre.oval:def:752The RichEdit component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1; Office 2000 SP3, XP SP3, 2003 SP2, and Office 2004 for Mac; and Learning Essentials for Microsoft Office 1.0, 1.1, and 1.5 allows user-assisted remote attackers to execute arbitrary code via a malformed OLE object in an RTF file, which triggers memory corruption.TA07-044AVU#368132MS07-013ADV-2007-0582ms-richedit-code-execution(30592)10176411017640218763188624152oval:org.mitre.oval:def:1090Microsoft JScript 5.1, 5.5, and 5.6 on Windows 2000 SP4, and 5.6 on Windows XP, Server 2003, Windows 98 and Windows Me, will "release objects early" in certain cases, which results in memory corruption and allows remote attackers to execute arbitrary code.TA06-164AVU#39004418359MS06-02320620ms-jscript-code-execution(26805)ADV-2006-2321264341016283oval:org.mitre.oval:def:2003oval:org.mitre.oval:def:1785oval:org.mitre.oval:def:1644oval:org.mitre.oval:def:1067Heap-based buffer overflow in the Server Service (SRV.SYS driver) in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 up to SP1, and other products, allows remote attackers to execute arbitrary code via crafted first-class Mailslot messages that triggers memory corruption and bypasses size restrictions on second-class Mailslot messages.TA06-192AVU#189140http://www.tippingpoint.com/security/advisories/TSRT-06-02.htmlMS06-035ADV-2006-2753win-mailslot-bo(26818)1886320060711 TSRT-06-02: Microsoft SRV.SYS Mailslot Ring0 Memory Corruption Vulnerability27154121221007oval:org.mitre.oval:def:600The Server Service (SRV.SYS driver) in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 up to SP1, and other products, allows remote attackers to obtain sensitive information via crafted requests that leak information in SMB buffers, which are not properly initialized, aka "SMB Information Disclosure Vulnerability."VU#333636MS06-035ADV-2006-2753win-smb-information-disclosure(26820)1889120060711 SMB Information Disclosure Vulnerability27155101646721007oval:org.mitre.oval:def:3Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via an Office file with malformed string that triggers memory corruption related to record lengths, aka "Microsoft Office Parsing Vulnerability," a different vulnerability than CVE-2006-2389.TA06-192AVU#580036MS06-038office-string-parse-bo(27607)ADV-2006-27561891227148101646921012oval:org.mitre.oval:def:918chpst in runit 1.3.3-1 for Debian GNU/Linux, when compiled on little endian i386 machines against dietlibc, does not properly handle when multiple groups are specified in the -u option, which causes chpst to assign permissions for the root group due to inconsistent bit sizes for the gid_t type.This vulnerability may be relevant only to Debian GNU/Linux implementations on little endian i386 machines.http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356016runit-chpst-gain-privileges(25419)1717919323util.c in rssh 2.3.0 in Debian GNU/Linux does not use braces to make a block, which causes a check for CVS to always succeed and allows rsync and rdist to bypass intended access restrictions in rssh.conf.http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=346322debian-rssh-rsync-rdist-bypass-security(25424)18999DSA-110921087Cross-site scripting (XSS) vulnerability in webcheck before 1.9.6 allows remote attackers to inject arbitrary web script or HTML via the (1) url, (2) title, or (3) author name in a crawled page, which is not properly sanitized in the tooltips of a report.Versions before 1.0 are named "linbot" instead of "webcheck".http://ch.tudelft.nl/~arthur/webcheck/news.html#20060130webcheck-content-xss(25428)1721219309Novell Netware NWFTPD 5.06.05 allows remote attackers to cause a denial of service (ABEND) via an MDTM command that uses a long path for the target file, possibly due to a buffer overflow.http://support.novell.com/cgi-bin/search/searchtid.cgi?/2973435.htmnetware-nwftpd-mdtm-dos(25289)ADV-2006-09751713723949101578119265Directory traversal vulnerability in WinHKI 1.6 and earlier allows user-assisted attackers to overwrite arbitrary files via a (1) RAR, (2) TAR, (3) ZIP, or (4) TAR.GZ archive with a file whose file name contains ".." sequences.winhki-extract-directory-traversal(25335)ADV-2006-10101715320060322 WinHKI 1.6x Archive Extraction Directory traversal19296http://hamid.ir/security/winhki.txtCross-site scripting (XSS) vulnerability in acp/lib/class_db_mysql.php in Woltlab Burning Board (wBB) 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the errormsg parameter when a SQL error is generated.ADV-2006-10031714720060318 Xss in Wbb 2.3.419293wbb-classdbmysql-xss(25313)1015789598529Cross-site scripting (XSS) vulnerability in Streber 0.055 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.The vulnerability has been fixed in version 0.055 (development release).ADV-2006-1005http://www.streber-pm.org/phpBB2/viewtopic.php?p=491#49119263streber-xss(25317)17157Multiple cross-site scripting (XSS) vulnerabilities in Invision Power Board 2.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) result_type, (2) search_in, (3) nav, (4) forums, and (5) s parameters in the Search action to index.php; (6) st parameter to index.php with showtopics set to 1; (7) m, (8) y, and (9) d parameters in a calendar action; (10) t parameter in a Print action; (11) MID parameter in a Mail action; (12) HID parameter in a Help action; (13) active parameter in a search action; (14) sort_order, (15) max_results, or (16) sort_key parameter in a Members action.1714420060317 XSS IN Invision Power Board25015250142501325012250112501025009SQL injection vulnerability in reg.php in SoftBB 0.1 allows remote attackers to execute arbitrary SQL commands via the mail parameter.ADV-2006-1002192831594softbb-reg-sql-injection(25320)1716023999SQL injection vulnerability in count.php in Skull-Splitter PHP Downloadcounter for Wallpapers 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) count_fieldname, (2) url_fieldname, or (3) url parameter.ADV-2006-100419314http://evuln.com/vulns/105/summary.htmldownloadcounter-count-sql-injection(25316)1715620060329 [eVuln] Skull-Splitter's PHP Downloadcounter for Wallpapers SQL Injection23972649The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service ("c2s segfault") by sending a "response stanza before an auth stanza".http://article.gmane.org/gmane.network.jabber.admin/27372jabberd-sasl-dos(25334)ADV-2006-100917155RHSA-2008:0261http://support.apple.com/kb/HT407719281APPLE-SA-2010-03-29-1Multiple SQL injection vulnerabilities in phpWebsite 0.83 and earlier allow remote attackers to execute arbitrary SQL commands via the sid parameter to (1) friend.php or (2) article.php.phpwebsite-multiple-sql-injection(25328)ADV-2006-10391715020060413 Re: phpWebsite <= SQL Injection (friend.php) & (article.php)20060318 phpWebsite <= SQL Injection (friend.php) & (article.php)19315Multiple cross-site scripting (XSS) vulnerabilities in index.php in Noah's Classifieds 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) method or (2) list parameter.http://zone14.free.fr/advisories/11715120060320 Noah's Classifieds Multiple Path Disclosure and Cross Site Scripting Vulnerabilitiesnoahs-index-path-disclosure(25331)noahs-index-xss(25099)20060308 Noah's Classifieds Multiple Cross-Site Scripting VulnerabilitiesNoah's Classifieds 1.3 and earlier allows remote attackers to obtain sensitive information via an invalid list parameter in the showdetails method to index.php, which reveals the path in an error message.20060320 Noah's Classifieds Multiple Path Disclosure and Cross Site Scripting Vulnerabilitiesnoahs-index-path-disclosure(25331)605471Multpile SQL injection vulnerabilities in BetaParticle Blog 6.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to template_permalink.asp or (2) fldGalleryID parameter to template_gallery_detail.asp.Update to version 6.02.19292ADV-2006-10001714820060318 Advisory: BetaParticle Blog <= 6.0 Multiple Remote SQL InjectionVulnerabilitieshttp://www.nukedx.com/?viewdoc=20http://blog.betaparticle.com/UserFiles/File/6fix.txtbpblog-multiple-sql-injection(25327)23966239651015788600Multiple SQL injection vulnerabilities in Maian Weblog 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) entry and (2) email parameters to (a) print.php and (b) mail.php.maianweblog-printmail-sql-injection(25295)ADV-2006-09942394619273http://evuln.com/vulns/101/summary.html172471715920060327 [eVuln] Maian Weblog Multiple SQL Injection Vulnerabilities239451015818638gnome screensaver before 2.14, when running on an X server with AllowDeactivateGrabs and AllowClosedownGrabs enabled, allows attackers with physical access to cause the screensaver to crash and access the session via the Ctl+Alt+Keypad-Multiply keyboard sequence, which removes the grab from gnome.The vulnerability has reportedly been fixed in version 2.14.gnomescreensaver-security-bypass(25340)2401519280http://bugzilla.gnome.org/show_bug.cgi?id=326663Cross-site scripting vulnerability in calendar.php in ExtCalendar 1.0 and possibly other versions before 2.0 allows remote attackers to inject arbitrary web script or HTML via the (1) year, (2) month, (3) next, and (4) prev parameters.This issue is reportedly addressed in ExtCalendar 2.0. Symantec has not confirmed this fix. Affected users are advised to contact the vendor for further information.ADV-2006-10121714620060319 ExtCalendar v1.0 Multiple Xss Vulnextcalendar-calendar-xss(25350)2396960119321Buffer overflow in the POP 3 (POP3) service in MailEnable Standard Edition before 1.93, Professional Edition before 1.73, and Enterprise Edition before 1.21 allows remote attackers to execute arbitrary code via unknown vectors before authentication.19288mailenable-pop-authentication(25314)ADV-2006-10061716224012http://www.mailenable.com/standardhistory.asphttp://www.mailenable.com/professionalhistory.asphttp://www.mailenable.com/enterprisehistory.asp101579720060320 [MU-200603-01] MailEnable POP3 Pre-Authentication Buffer OverflowWebmail in MailEnable Professional Edition before 1.73 and Enterprise Edition before 1.21 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors involving "incorrectly encoded quoted-printable emails".19288mailenable-webmail-component-dos(25315)ADV-2006-10061716124014http://www.mailenable.com/professionalhistory.asphttp://www.mailenable.com/enterprisehistory.aspDirectory traversal vulnerability in inc/functions.inc.php in CuteNews 1.4.1 and possibly other versions, when register_globals is enabled, allows remote attackers to include arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the archive parameter in an HTTP POST or COOKIE request, which bypasses a sanity check that is only applied to a GET request.1715219289http://hamid.ir/security/cutenews.txtcutenews-incfunction-directory-traversal(25324)20060322 cutenews 1.4.1 Arbitrary File AccessCuteNews 1.4.1 and possibly other versions allows remote attackers to obtain the installation path via unspecified vectors involving an invalid file path.Successful exploitation requires that the "register_globals" parameter is enabled.1715219289http://hamid.ir/security/cutenews.txt20060322 cutenews 1.4.1 Arbitrary File AccessSQL injection vulnerability in events.php in Maian Events 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) month and (2) year parameters.maianevents-events-sql-injection(25298)ADV-2006-099319274http://evuln.com/vulns/102/description.html20060328 [eVuln] Maian Events SQL Injection Vulnerability23947646net/ipv4/af_inet.c in Linux kernel 2.4 does not clear sockaddr_in.sin_zero before returning IPv4 socket names from the (1) getsockname, (2) getpeername, and (3) accept functions, which allows local users to obtain portions of potentially sensitive memory.http://www.kernel.org/git/?p=linux/kernel/git/marcelo/linux-2.4.git;a=commit;h=09d3b3dcfa80c9094f1748c1be064b9326c9ef2bADV-2006-4502[linux-netdev] 20060304 BUG: Small information leak in SO_ORIGINAL_DST (2.4 and 2.6) andhttp://www.vmware.com/download/esx/esx-254-200610-patch.htmlhttp://www.vmware.com/download/esx/esx-213-200610-patch.htmlhttp://www.vmware.com/download/esx/esx-202-200610-patch.html1720320061113 VMSA-2006-0008 - VMware ESX Server 2.0.2 Upgrade Patch 220061113 VMSA-2006-0005 - VMware ESX Server 2.5.4 Upgrade Patch 120061113 VMSA-2006-0007 - VMware ESX Server 2.1.3 Upgrade Patch 220061113 VMSA-2006-0006 - VMware ESX Server 2.5.3 Upgrade Patch 4RHSA-2006:0580RHSA-2006:0579SUSE-SA:2006:02822875210352039819357net/ipv4/netfilter/ip_conntrack_core.c in Linux kernel 2.4 and 2.6, and possibly net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c in 2.6, does not clear sockaddr_in.sin_zero before returning IPv4 socket names from the getsockopt function with SO_ORIGINAL_DST, which allows local users to obtain portions of potentially sensitive memory.[linux-netdev] 20060304 BUG: Small information leak in SO_ORIGINAL_DST (2.4 and 2.6) andADV-2006-4502ADV-2006-2071oval:org.mitre.oval:def:10875linux-sockaddr-memory-leak(25425)http://www.vmware.com/download/esx/esx-254-200610-patch.htmlhttp://www.vmware.com/download/esx/esx-213-200610-patch.htmlhttp://www.vmware.com/download/esx/esx-202-200610-patch.htmlUSN-281-12006-00321720320061113 VMSA-2006-0008 - VMware ESX Server 2.0.2 Upgrade Patch 220061113 VMSA-2006-0005 - VMware ESX Server 2.5.4 Upgrade Patch 120061113 VMSA-2006-0007 - VMware ESX Server 2.1.3 Upgrade Patch 220061113 VMSA-2006-0006 - VMware ESX Server 2.5.3 Upgrade Patch 420060531 rPSA-2006-0087-1 kernelRHSA-2006:0580RHSA-2006:0579RHSA-2006:0575RHSA-2006:043729841MDKSA-2006:150MDKSA-2006:123DSA-1184DSA-1097http://support.avaya.com/elmodocs2/security/ASA-2006-200.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-180.htm22875224172209321983214652113621045206711995519357Cross-site scripting (XSS) vulnerability in VeriSign haydn.exe, as used in Managed PKI (MPKI) 6.0, allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the VHTML_FILE parameter.ADV-2006-10841717020060320 CORE-2006-0124: Cross-Site Scripting in Verisign?s haydn.exe CGI scripthttp://www.coresecurity.com/common/showdoc.php?idx=522&idxseccion=10verisign-haydn-xss(25349)1015813614polls.php in MyBB (aka MyBulletinBoard) 1.10 allows remote attackers to obtain sensitive information via a vote action with an "option[]=null" parameter value, which reveals the path in an error message.mybb-polls-path-disclosure(25337)20060317 MyBB 1.10 Full Path DisclosureDirectory traversal vulnerability in inc/setLang.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a lang[*][file] parameter, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by index.php.ADV-2006-1015171651595240161932220060414 Provable vendor ACK for gcards issuesSQL injection vulnerability in loginfunction.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.Vulnerability can only be exploited if the "magic_quotes_gpc" parameter is set to Off.ADV-2006-1015171651595gcards-loginfunction-sql-injection(25344)240171932220060414 Provable vendor ACK for gcards issuesCross-site scripting (XSS) vulnerability in index.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang[*][file] parameter, which is injected into an error message. NOTE: this issue might be resultant from CVE-2006-1346.gcards-incsetlang-xss(25343)ADV-2006-1015171652401815951932220060414 Provable vendor ACK for gcards issuesMultiple cross-site scripting (XSS) vulnerabilities in Musicbox 2.3 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) id and (2) type and (3) show parameters in a top action in (a) index.php; and the (4) message1 parameter in (b) cart.php.musicbox-multiple-xss(27925)musicbox-index-cart-xss(25525)1714920060724 MusicBox <= 2.3.4 XSS SQL injection Vulnerability20060324 XSS & SQL Injection in Music Box v2.32396823967PHP remote file include vulnerability in index.php in 99Articles.com (aka ArticlesOne.com) Free articles directory allows remote attackers to include and execute arbitrary PHP code via a URL in the page parameter.ADV-2006-103720060321 Free Articles Directory Remote Command Exucetionfreearticlesdirectory-index-file-include(25378)17183240246161932020060322 Free Articles Directory - file inclusion, code execution?BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a "default internal servlet" accessed through HTTP.1716619310BEA06-120.00ADV-2006-1021weblogic-server-default-servlet(25347)1015792BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service (memory exhaustion) via crafted non-canonicalized XML documents.BEA06-123.00ADV-2006-10211716719310weblogic-xml-parser-dos(25348)1015790Multiple SQL injection vulnerabilities in ASPPortal 3.1.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the downloadid parameter in download_click.asp and (2) content_ID parameter in news/News_Item.asp; authenticated administrators can also conduct attacks via (3) user_id parameter to users/add_edit_user.asp, (4) bannerid parameter to banner_adds/banner_add_edit.asp, (5) cat_id parameter to categories/add_edit_cat.asp, (6) Content_ID parameter to News/add_edit_news.asp, (7) download_id parameter to downloads/add_edit_download.asp, (8) Poll_ID parameter to poll/add_edit_poll.asp, (9) contactid parameter to contactus/contactus_add_edit.asp, (10) sortby parameter to poll/poll_list.asp, and (11) unspecified inputs to downloads/add_edit_download.asp.ADV-2006-1014http://www.nukedx.com/?viewdoc=21159719286aspportal-multiple-aspscripts-sql-injection(25346)1717420060322 Re: [SPAM:] - ASPPortal <= 3.1.1 Multiple Remote SQL Injection Vulnerabilities - Email has different SMTP TO: and MIME TO: fields in the email addresses20060321 ASPPortal <= 3.1.1 Multiple Remote SQL Injection Vulnerabilities2409224091240902408924088240872408624085240842402060820060322 Re: [SPAM:] - ASPPortal <= 3.1.1 Multiple Remote SQL Injection Vulnerabilities - Email has different SMTP TO: and MIME TO: fields in the email addresses20060321 ASPPortal <= 3.1.1 Multiple Remote SQL Injection VulnerabilitiesUnspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service (server crash) via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module.19300ADV-2006-1016http://www.freeradius.org/security.htmloval:org.mitre.oval:def:10156freeradius-eap-mschapv2-auth-bypass(25352)2006-002017171MDKSA-2006:060GLSA-200604-03DSA-108910157952046119811195271951819405RHSA-2006:0271SUSE-SA:2006:01920060404-01-Uavast! Antivirus 4.6.763 and earlier sets "BUILTIN\Everyone" permissions to critical system files in the installation folder, which allows local users to gain privileges or disable protection by modifying those files.ADV-2006-1011http://www.dslreports.com/forum/remark,15601404~days=9999~start=2019284http://forum.avast.com/index.php?topic=19862.0avast-default-insecure-permissions(25336)17158Stack-based buffer overflow in the count_vcards function in LibVC 3, as used in Rolo, allows user-assisted attackers to execute arbitrary code via a vCard file (e.g. contacts.vcf) containing a long line.libvc-vc-bo(25430)172372398519295http://osvdb.org/ref/23/23985-libvc.txtCross-site scripting (XSS) vulnerability in my.support.php3 in F5 Firepass 4100 SSL VPN 5.4.2 allows remote attackers to inject arbitrary web script or HTML via the s parameter.ADV-2006-10361717520060321 XSS in Firepass 4100 SSL VPN v.5.4.2 (and probably others)firepass-mysupport-xss(25393)101579861119337Unspecified vulnerability in BEA WebLogic Portal 8.1 up to SP5 causes a JSR-168 Portlet to be retrieved from the cache for the wrong session, which might allow one user to see a Portlet of another user.19308BEA06-122.00ftp://ftpna.beasys.com/pub/releases/security/patch_CR259534_81SP5.zipADV-2006-1022weblogic-portal-portlet-disclosure(25345)171641015791Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer.TA06-101AVU#876678ie-createtextrange-command-execution(25379)ADV-2006-1318ADV-2006-10501719620060328 Determina Fix for CVE-2006-1359 (Zero Day MS Internet Explorer Remote "CreateTextRange()" Code Execution)20060328 EEYE: Temporary workaround for IE createTextRange vulnerability20060323 Secunia Research: Microsoft Internet Explorer "createTextRange()"Code Execution20060322 Microsoft Internet Explorer (mshtml.dll) - Remote Code Execution20060322 IE crash24050MS06-013http://www.microsoft.com/technet/security/advisory/917077.mspxhttp://www.computerterrorism.com/research/ct22-03-2006Q-1541015812http://secunia.com/secunia_research/2006-7/advisory/1868020060327 Determina Fix for the IE createTextRange() bug20060322 FW: [Full-disclosure] IE crash20060322 Microsoft Internet Explorer (mshtml.dll) - Remote Code Execution20060322 IE crashoval:org.mitre.oval:def:985oval:org.mitre.oval:def:1702oval:org.mitre.oval:def:1678oval:org.mitre.oval:def:1657oval:org.mitre.oval:def:1178Multiple SQL injection vulnerabilities in MusicBox 2.3 Beta 2 allow remote attackers to execute arbitrary SQL commands via the (1) id, (2) type, or (3) show parameter to (a) index.php; or the (4) message1 or (5) message parameter to (b) cart.php.musicbox-multiple-sql-injection(27926)1714920060724 MusicBox <= 2.3.4 XSS SQL injection Vulnerability20060324 XSS & SQL Injection in Music Box v2.3Cross-site scripting (XSS) vulnerability in OSWiki before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the username field to (1) list.rhtml or (2) show.rhtml.This vulnerability is addressed in the following product release:
OSWiki, OSWiki, 0.3.119290oswiki-username-xss(25410)ADV-2006-103517189http://svn.sourceforge.net/viewcvs.cgi/opensourcewiki/branches/0.3/oswiki/app/views/user/list.rhtml?view=logMultiple SQL injection vulnerabilities in Mini-Nuke CMS System 1.8.2 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the uid parameter in (a) members.asp, the (2) catid parameter in (b) articles.asp and (c) programs.asp, and the (3) id parameter in (d) hpages.asp and (e) forum.asp. NOTE: The pages.asp/id vector is already covered by CVE-2006-0870.20060321 Mini-Nuke<=1.8.2 SQL injection (6)mininuke-multiple-sql-injection(25372)61718439images.php in Justin White (aka YTZ) Free Web Publishing System (FreeWPS) 2.11 allows remote attackers to execute arbitrary PHP code by uploading a .php file into the /upload directory as specified in the dirPath parameter, then performing a direct request to that file.ADV-2006-10381600freewps-images-file-include(25377)19343Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allows remote attackers to cause a denial of service (resource consumption or crash) by repeatedly requesting each of several documents that refer to COM components, or are restricted documents located under the ASP.NET application path.17188http://www.securiteam.com/windowsntfocus/5KP0O0KI0Y.html1601http://hackingspirits.com/vuln-rnd/w3wp-remote-dos.zipms-aspnet-w3wp-dos(25392)20060322 w3wp remote DoS101582520060322 w3wp remote DoS20060322 w3wp remote DoS due to improper reference of STA COM components in ASP.NETThe Motorola PEBL U6, the Motorola V600, and possibly the Motorola E398 and other Motorola phones allow remote attackers to add an entry for their own Bluetooth device to a target device's list of trusted devices (aka Device History), and possibly obtain AT level access to the target device, by initiating and interrupting an OBEX Push Profile that pretends to send a vCard, aka a "HeloMoto" attack.20060321 DMA[2006-0321a] - 'Motorola P2K Platform setpath() overflow and Blueline attack'http://www.digitalmunition.com/DMA[2006-0321a].txthttp://trifinite.org/trifinite_stuff_helomoto.htmlBuffer overflow in the Motorola PEBL U6 08.83.76R, and possibly other Motorola P2K-based phones, allows remote attackers to cause a denial of service (device shutdown), and possibly execute arbitrary code, via a long OBEX setpath to the OBEX File Transfer (aka FTP) service on Bluetooth channel 9.Arbitrary code execution may also be possible, but has not been confirmed. This vulnerability may affect other versions of Motorola P2K-based phones.ADV-2006-10451718520060321 DMA[2006-0321a] - 'Motorola P2K Platform setpath() overflow and Blueline attack'http://www.digitalmunition.com/DMA[2006-0321a].txt19319motorola-peblu6-v600-obex-bo(25401)20060321 DMA[2006-0321a] - 'Motorola P2K Platform setpath() overflow and Blueline attack'The Motorola PEBL U6 08.83.76R, the Motorola V600, and possibly the Motorola E398 and other Motorola P2K-based phones does not require pairing for a connection related to the Headset Audio Gateway service, which allows user-assisted remote attackers to obtain AT level access and view phonebook entries and saved SMS messages by connecting on Bluetooth channel 3 and tricking the user into pressing Grant, aka a "Blueline" attack. NOTE: while user-assisted, the attack is made more feasible because of a GUI misrepresentation issue that allows a default message to be replaced by an attacker-specified one.motorola-peblu6-v600-name-spoofing(25402)ADV-2006-10451719020060321 DMA[2006-0321a] - 'Motorola P2K Platform setpath() overflow and Blueline attack'http://www.digitalmunition.com/DMA[2006-0321a].txt1931920060321 DMA[2006-0321a] - 'Motorola P2K Platform setpath() overflow and Blueline attack'Buffer overflow in the USB Gadget RNDIS implementation in the Linux kernel before 2.6.16 allows remote attackers to cause a denial of service (kmalloc'd memory corruption) via a remote NDIS response to OID_GEN_SUPPORTED_LIST, which causes memory to be allocated for the reply data but not the reply structure.Update to version 2.6.16.ADV-2006-2554ADV-2006-1046USN-281-117831MDKSA-2006:123http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8763716bfe4d8a16bef28c9947cf9d799b1796a5DSA-1103DSA-10972104520914206711995519330Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB) 2.1.5 and earlier before 20060308 allows remote attackers to inject arbitrary web script or HTML via a Private Message (PM) in certain circumstances.Update to version 2.1.5 (2006-03-08 or later).ADV-2006-10441718719299http://forums.invisionpower.com/index.php?showtopic=209178invision-privatemessage-xss(25384)Buffer overflow in RealNetworks RealPlayer 10.5 6.0.12.1040 through 6.0.12.1348, RealPlayer 10, RealOne Player v2, RealOne Player v1, RealPlayer 8, and RealPlayer Enterprise before 20060322 allows remote attackers to have an unknown impact via a malicious Mimio boardCast (mbc) file.This vulnerability affects all versions of RealNetworks, RealPlayer from 10.5 v6.0.12.1040 through 10.5 v6.0.12.1348. VU#451556http://www.service.real.com/realplayer/security/03162006_player/en/realnetworks-mbc-bo(25411)ADV-2006-105717202101581019358Laurentiu Matei eXpandable Home Page (XHP) CMS 0.5 and earlier allows remote authenticated users to use the HTMLArea FileManager plugin to upload and execute arbitrary PHP files using (1) manager.php, (2) standalonemanager.php, and (3) images.php.19353http://xhp.targetit.ro/index.php?page=3&box_id=34&action=show_single_entry&post_id=10xhpcms-filemanager-file-upload(25399)xhpcms-filemanager-file-upload(25399)ADV-2006-1052172092405924058160520060324 XHP vendor ack/fixMultiple SQL injection vulnerabilities in 1WebCalendar 4.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) EventID parameter in viewEvent.cfm, (2) NewsID parameter in newsView.cfm, or (3) ThisDate parameter in mainCal.cfm.ADV-2006-1040193291webcalendar-multiple-sql-injection(25373)17193240232402224021http://pridels0.blogspot.com/2006/03/1webcalendar-v-4x-vuln.htmlCross-site scripting (XSS) vulnerability in status_image.php in PHP Live! 3.0 allows remote attackers to inject arbitrary web script or HTML via the base_url parameter.ADV-2006-10541718420060322 PHP Live! XSS status_image.php19340phplive-statusimage-xss(25386)SQL injection vulnerability in viewStatement.php in AdMan 1.0.20051221 and earlier allows remote attackers to execute arbitrary SQL commands via the transactions_offset parameter.ADV-2006-107119351adman-viewstatement-sql-injection(25403)1720824064http://pridels0.blogspot.com/2006/03/adman-v10x-sql-vuln.htmlAdMan 1.0.20051221 and earlier allows remote attackers to obtain the full path via (1) a blank campaignId parameter to editCampaign.php and (2) a blank schemeId parameter to viewPricingScheme.php.ADV-2006-107119351adman-multiple-path-disclosure(25404)2406624065http://pridels0.blogspot.com/2006/03/adman-v10x-sql-vuln.htmlThe installation of Debian GNU/Linux 3.1r1 from the network install CD creates /var/log/debian-installer/cdebconf with world writable permissions, which allows local users to cause a denial of service (disk consumption).19331http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=358210debian-cdebconf-world-writable(25526)Cross-site scripting (XSS) vulnerability in img.php in (1) EasyMoblog 0.5.1 and (2) CoMoblog 1.1 allows remote attackers to inject arbitrary web script or HTML via the i parameter.ADV-2006-1087ADV-2006-1086172011719920060323 [KAPDA::#37] - CoMoblog XSShttp://www.kapda.ir/advisory-301.htmleasymoblog-img-xss(25420)comoblog-img-xss(25416)240942409310158241937919370PasswordSafe 3.0 beta, when running on Windows before XP, uses a weak random number generator (C++ rand function) during generation of the database encryption key, which makes it easier for attackers to decrypt the database and steal passwords by generating keys for all possible rand() seed values and conducting a known plaintext attack.This vulnerability exists only in Windows OS environments before XP. For some reason it would not let me notate that in the "vulnerable software" section.passwordsafe-key-brute-force(25429)1720020060323 PasswordSafe 3.0 weak random number generator allows key recovery attack20060907 Re: PasswordSafe 3.0 weak random number generator allows key recovery attack618Trend Micro PC-cillin Internet Security 2006 14.00.1485 and 14.10.0.1023, uses insecure DACLs for critical files, which allows local users to gain SYSTEM privileges by modifying executable programs such as (1) tmntsrv.exe and (2) tmproxy.exe.19282ADV-2006-1042http://www.secumind.net/content/french/modules/news/article.php?storyid=9&sel_lang=englishISNTSmtp directory in Trend Micro InterScan Messaging Security Suite (IMSS) 5.5 build 1183 and possibly other versions before 5.7.0.1121, uses insecure DACLs for critical files, which allows local users to gain SYSTEM privileges by modifying ISNTSysMonitor.exe.19022ADV-2006-1041http://www.secumind.net/content/french/modules/news/article.php?storyid=9&sel_lang=englishimss-isntsmtp-directory-permissions(25415)Trend Micro OfficeScan 5.5, and probably other versions before 6.5, uses insecure DACLs for critical files, which allows local users to gain SYSTEM privileges by modifying tmlisten.exe.ADV-2006-1041http://www.secumind.net/content/french/modules/news/article.php?storyid=9&sel_lang=english11576imss-isntsmtp-directory-permissions(25415)PHP remote file inclusion vulnerability in impex/ImpExData.php in vBulletin ImpEx module 1.74, when register_globals is disabled, allows remote attackers to include arbitrary files via the systempath parameter.ADV-2006-10561935220060323 XOR Crew :: vBulletin ImpEx <= 1.74 - Remote Command Execution Vulnerabilityimpex-systempath-file-include(34095)impex-impexdata-file-include(25391)1720620070504 Remote File Include In Script impex24070Directory traversal vulnerability in Baby FTP Server (BabyFTP) 1.24 allows remote authenticated users to determine existence of files outside the intended document root via unspecified manipulations, which generate different error messages depending on whether a file exists or not.ADV-2006-1069172052405719338baby-ftp-information-disclosure(25413)Cross-site scripting (XSS) vulnerability in apwc_win_main.jsp in the web console in IBM Tivoli Business Systems Manager (TBSM) before 3.1.0.1 allows remote attackers to inject arbitrary web script or HTML via the skin parameter.OA1490419332ADV-2006-1073tivoli-bsm-skin-xss(25412)17210240691015822Stack-based buffer overflow in the parseTaggedData function in WavePacket.mm in KisMAC R54 through R73p allows remote attackers to execute arbitrary code via multiple SSIDs in a Cisco vendor tag in a 802.11 management frame.Update to version R73p.kismac-80211-parsing-bo(25422)ADV-2006-10701719820060323 Advisory 03/2006: KisMAC Cisco Vendor Tag Encapsulated SSID Overflowhttp://www.hardened-php.net/advisory_032006.115.html19354http://kismac.de/_trac/changeset/113kismac-80211-parsing-bo(25422)2407260920060323 Advisory 03/2006: KisMAC Cisco Vendor Tag Encapsulated SSID OverflowThe (1) rdiff and (2) preview scripts in TWiki 4.0 and 4.0.1 ignore access control settings, which allows remote attackers to read restricted areas and access restricted content in TWiki topics.ADV-2006-1116http://twiki.org/cgi-bin/view/Codev/SecurityAlertTWiki4RdiffPreviewAccesstwiki-restricted-content-access(25444)17268101584319410TWiki 4.0, 4.0.1, and 20010901 through 20040904 allows remote authenticated users with edit rights to cause a denial of service (infinite recursion leading to CPU and memory consumption) via INCLUDE by URL statements that form a loop, such as a page that includes itself.ADV-2006-1116http://twiki.org/cgi-bin/view/Codev/SecurityAdvisoryDosAttackWithIncludetwiki-include-edit-dos(25445)1726719410Unspecified vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to execute HTA files via unknown vectors.TA06-101AVU#434641ie-hta-file-execution(25394)ADV-2006-1318171811015800http://news.zdnet.com/2100-1009_22-6052396.html?tag=zdfd.newsfeedhttp://jeffrey.vanderstad.net/grasshopper/24095MS06-0131937820060321 IE .hta vulnerability reportedoval:org.mitre.oval:def:1774oval:org.mitre.oval:def:1724oval:org.mitre.oval:def:1676oval:org.mitre.oval:def:1642oval:org.mitre.oval:def:1591Unspecified vulnerability in swagentd in HP-UX B.11.00, B.11.04, and B.11.11 allows remote attackers to cause a denial of service (application crash) via unspecified vectors.HPSBUX0210517215101581919373SSRT061134ADV-2006-1089hpux-swagentd-dos(25421)24097http://support.avaya.com/elmodocs2/security/ASA-2006-076.htm19395oval:org.mitre.oval:def:616oval:org.mitre.oval:def:312oval:org.mitre.oval:def:1031The configuration of NetHack 3.4.3-r1 and earlier, Falcon's Eye 1.9.4a and earlier, and Slash'EM 0.0.760 and earlier on Gentoo Linux allows local users in the games group to modify saved games files to execute arbitrary code via buffer overflows and overwrite arbitrary files via symlink attacks.This vulnerability applies only to the following games/versions:
1) NetHack 3.4.3-r1 and previous
2) Falcon's Eye 1.9.4a and previous
3) Slash'EM 0.0.760 and previousGLSA-200603-231721719376http://bugs.gentoo.org/show_bug.cgi?id=127319http://bugs.gentoo.org/show_bug.cgi?id=127167http://bugs.gentoo.org/show_bug.cgi?id=125902http://bugs.gentoo.org/show_bug.cgi?id=122376gentoo-multiple-games-privilege-escalation(25528)20060324 Re: [ GLSA 200603-23 ] NetHack, Slash'EM, Falcon's Eye: Local privilege escalation20060324 Re: [ GLSA 200603-23 ] NetHack, Slash'EM, Falcon's Eye: Localprivilege escalation24104The (a) Quick 'n Easy Web Server before 3.1.1 and (b) Baby ASP Web Server 2.7.2 allows remote attackers to obtain the source code of ASP files via (1) . (dot) and (2) space characters in the extension of a URL.1722220060324 Secunia Research: Quick 'n Easy/Baby Web Server ASP CodeDisclosure Vulnerability24100http://secunia.com/secunia_research/2006-19/advisory/19306ADV-2006-1088ADV-2006-108519312quickneasy-web-asp-disclosure(25418)baby-web-asp-disclosure(25417)24099624Multiple cross-site scripting (XSS) vulnerabilities in index.cgi in the login server in University of Washington Pubcookie 3.0.0, 3.1.0, 3.1.1, 3.2 before 3.2.1b, and 3.3 before 3.3.0a allow remote attackers to inject arbitrary web script or HTML via unspecified inputs.VU#337585pubcookie-login-server-xss(25427)19348http://pubcookie.org/news/20060306-login-secadv.html1722124521Multiple cross-site scripting (XSS) vulnerabilities in the mod_pubcookie Apache application server module in University of Washington Pubcookie 1.x, 3.0.0, 3.1.0, 3.1.1, 3.2 before 3.2.1b, and 3.3 before 3.3.0a allow remote attackers to inject arbitrary web script or HTML via unspecified attack vectors.VU#314540pubcookie-appserver-module-xss(25426)19348http://pubcookie.org/news/20060306-apps-secadv.html1722124103Multiple cross-site scripting (XSS) vulnerabilities in the Microsoft IIS ISAPI filter (aka application server module) in University of Washington Pubcookie 3.1.0, 3.1.1, 3.2 before 3.2.1b, and 3.3 before 3.3.0a allow remote attackers to inject arbitrary web script or HTML via unspecified attack vectors.VU#314540http://pubcookie.org/news/20060306-apps-secadv.html172212452019348SQL injection vulnerability in mb.cgi in Cholod MySQL Based Message Board allows remote attackers to execute arbitrary SQL commands via unspecified vectors in a showmessage action, possibly the username parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.ADV-2006-115317224cholod-mb-sql-injection(25520)19439Multiple cross-site scripting (XSS) vulnerabilities in Cholod MySQL Based Message Board allow remote attackers to inject arbitrary web script or HTML via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained from third party information.ADV-2006-115317223cholod-mb-xss(25518)19439Multiple cross-site scripting (XSS) vulnerabilities in (a) phpAdsNew and (b) phpPgAds before 2.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) certain parameters to the banner delivery module, which is not properly handled in the administrator interface, or (2) certain parameters to the login form.1725120060327 [PHPADSNEW-SA-2006-001] phpAdsNew and phpPgAds 2.0.8 fix multiple vulnerabilitieshttp://sourceforge.net/project/shownotes.php?release_id=404964http://sourceforge.net/project/shownotes.php?release_id=4049631015829101582819384ADV-2006-1107http://phpadsnew.com/two/nucleus/index.php?itemid=46phpadsnew-login-banner-xss(25458)2420624205633Cross-site scripting (XSS) vulnerability in guestbook.php in G-Book 1.0 allows remote attackers to inject arbitrary web script or HTML via the g_message parameter.ADV-2006-11001725320060327 HYSA-2006-006 G-Book 1.0 XSS And Other Vulnerabilitieshttp://www.h4cky0u.org/advisories/HYSA-2006-006-g-book.txt19414gbook-guestbook-xss(25475)241411015830634Cross-site scripting (XSS) vulnerability in searchresult.php in Meeting Reserve 1.0 beta allows remote attackers to inject arbitrary web script or HTML via the search_term parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.meeting-reserve-searchresult-xss(25432)ADV-2006-1110172561937224162Cross-site scripting (XSS) vulnerability in MyTasks/PersonalTaskEdit.asp in Metisware Instructor 1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the Task parameter.ADV-2006-11121723419385metisware-instructor-personaltaskcreate-xss(25490)24139http://pridels0.blogspot.com/2006/03/metisware-instructor-xss-vuln.htmlMultiple cross-site scripting (XSS) vulnerabilities in search.php in Calendar Express 2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) allwords or (2) oneword parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.ADV-2006-11091724019393calendarexpress-search-xss(25467)24161Buffer overflow in client/server Doom (csDoom) 0.7 and earlier allows remote attackers to (1) cause a denial of service via a long nickname or teamname to the SV_SetupUserInfo function or (2) execute arbitrary code via a long string sent when joining a match or a long chat message to the SV_BroadcastPrintf function.17248http://aluigi.altervista.org/adv/csdoombof-adv.txtADV-2006-1105http://voxelsoft.com/csdoom/19389csdoom-sv-setupuserinfo-bo(25449)csdoom-sv-broadcastprintf-bo(25448)Format string vulnerability in the PrintString function in c_console.cpp in client/server Doom (csDoom) 0.7 and earlier allows remote attackers cause a denial of service and possibly execute arbitrary commands via format string specifiers in strings passed to the console.17248http://voxelsoft.com/csdoom/19389http://aluigi.altervista.org/adv/csdoombof-adv.txtADV-2006-1105csdoom-printf-format-string(25450)Multiple cross-site scripting (XSS) vulnerabilities in bol.cgi in BlankOL 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) file or (2) function parameter.ADV-2006-111119387blankol-bol-xss(25488)1726524124http://pridels0.blogspot.com/2006/03/blankol-xss-vuln.htmlCross-site scripting (XSS) vulnerability in search.aspx in SweetSuite.NET Content Management System (ssCMS) 2.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.sscms-search-xss(25452)ADV-2006-1097172542412019399http://pridels0.blogspot.com/2006/03/sweetsuitenet-sscms-21x-xss-vuln.htmlMultiple cross-site scripting (XSS) vulnerabilities in wbadmlog.aspx in uniForum 4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) txtuser or (2) txtpassword parameters.ADV-2006-1101172452412319397uniforum-wbadmlog-xss(25433)http://pridels0.blogspot.com/2006/03/uniforum-xss-vuln.htmlMultiple cross-site scripting (XSS) vulnerabilities in Helm Web Hosting Control Panel 3.2.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) txtDomainName parameter to domains.asp or (2) SearchText or (3) UserLevel parameters to default.asp.These issues are reportedly fixed by the vendor. Version 3.2.10-stable will contain these fixes when it is released. Contact the vendor for further information on obtaining fixes.ADV-2006-10931726319375helm-domainsusersdefaault-xss(30309)helm-domainsdefault-xss(25470)2412624125http://pridels0.blogspot.com/2006/03/helm-web-hosting-control-panel-xss.html20060327 Helm Control Panel followupVavoom 1.19.1 and earlier allows remote attackers to cause a denial of service (infinite loop) via (1) a packet with no data or (2) a large packet, which prevents Vavoom from discarding the packet from the socket.ADV-2006-11041726119388http://aluigi.altervista.org/adv/vaboom-adv.txtvavoom-fionread-dos(25454)Buffer overflow in Vavoom 1.19.1 and earlier allows remote attackers to cause a denial of service (application crash) via an invalid comprLength value in a compressed packet.ADV-2006-11041726119388http://aluigi.altervista.org/adv/vaboom-adv.txtvavoom-comprlength-bo(25455)Multiple cross-site scripting (XSS) vulnerabilities in XIGLA Absolute Live Support XE 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Screen name or (2) Session Topic field.ADV-2006-10991725819415absolutelivesupport-register-xss(25434)24131http://pridels0.blogspot.com/2006/03/absolute-live-support-xe-v20-xss-vuln.htmlCross-site scripting (XSS) vulnerability in Absolute Image Gallery XE 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) the shownew parameter in gallery.asp and (2) unspecified search module parameters.ADV-2006-1103absolute-gallery-xss(25466)1871224214http://pridels0.blogspot.com/2006/03/absolute-image-gallery-xe-20-xss-vuln.htmlTFT Gallery 0.10 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the admin password file and obtain password hashes via a direct request to admin/passwd.ADV-2006-1115194111611tftgallery-passwd-disclosure(25465)1725020061204 Re: Multiple bugs in TFT-Gallery20061204 Multiple bugs in TFT-GalleryMultiple cross-site scripting (XSS) vulnerabilities in EZHomepagePro 1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) adid or (2) aname parameter in (a) common/email.asp, (b) users/users_search.asp, or (c) users/users_profiles.asp; (3) page parameter in (d) users/users_calendar.asp; (4) usid parameter in (e) users/users_mgallery.asp; or (5) m parameter in (f) users/users_search.asp.ADV-2006-109417236241362413524134241332413219386ezhomepagepro-multiple-xss(25468)http://pridels0.blogspot.com/2006/03/ezhomepagepro-multiple-xss-vuln.htmlMultiple cross-site scripting (XSS) vulnerabilities in toast.asp in Toast Forums 1.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) author, (2) subject, (3) message, or (4) dayprune parameter.ADV-2006-1092172492411919401toastforums-toast-xss(25440)http://pridels0.blogspot.com/2006/03/xss-in-toast-forums-16.htmlCross-site scripting (XSS) vulnerability in iforget.aspx in dotNetBB 2.42EC SP 3 and earlier allows remote attackers to inject arbitrary web script or HTML via the em parameter.ADV-2006-1098172462412219398dotnetbb-iforget-xss(25462)http://pridels0.blogspot.com/2006/03/xss-vuln-in-dotnetbb-v24.htmlCross-site scripting (XSS) vulnerability in afmsearch.aspx in Absolute FAQ Manager .NET 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search module parameters, possibly the question parameter.ADV-2006-109619396absolutefaqmanager-search-xss(25463)1724224127http://pridels0.blogspot.com/2006/03/absolute-faq-manager-net-xss-vuln.htmlMultiple cross-site scripting (XSS) vulnerabilities in Caloris Planitia Online Quiz System (aka Web Quiz pro), possibly 1.0, allow remote attackers to inject arbitrary web script or HTML via the (1) exam parameter in prequiz.asp or (2) msg parameter in student.asp.webquiz-multiple-xss(25431)ADV-2006-109117255241302412919416http://pridels0.blogspot.com/2006/03/web-quiz-pro-xss-vuln.htmlCross-site scripting (XSS) vulnerability in default.asp in Caloris Planitia E-School Management System 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter.A new version of School Management System was released on May 28, 2006.eschoolmanagementsystem-default-xss(25469)ADV-2006-1095172572412819381http://pridels0.blogspot.com/2006/03/e-school-management-system-xss-vuln.htmlSQL injection vulnerability in the Calendar module in nuked-klan 1.7.5 and earlier allows remote attackers to execute arbitrary SQL commands via the m parameter to index.php.ADV-2006-113420060326 nuked-klan<=1.7.5 SQL Injectionnuked-klan-calendar-sql-injection(25446)172332420463219382SQL injection vulnerability in print.php in SaphpLesson 2.0 allows remote attackers to execute arbitrary SQL commands via the lessid parameter.1723920060325 SQL Injection in SaphpLesson2.0saphplesson-print-sql-injection(25453)24254629Multiple SQL injection vulnerabilities in akocomment.php in AkoComment 2.0 module for Mambo, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the (1) acname or (2) contentid parameter.In order to exploit this vulnerability, the 'magic_quotes_gpc' parameter must be disabled.1724120060326 AkoComment SQL injection vulnerabilityakocomment-akocomment-sql-injection(25451)ADV-2006-11361939224209631SQL injection vulnerability in details_view.php in PHP Booking Calendar 1.0c and earlier allows remote attackers to execute arbitrary SQL commands via the event_id parameter.172301610phpbookingcal-detailsview-sql-injection(25580)SQL injection vulnerability in showflat.php in UBB.threads 5.5.1, 6.0 br5, 6.0.1, 6.0.2, and earlier, allows remote attackers to execute arbitrary SQL commands via the Number parameter.20060325 UBBThreads<=5.5.1+6.0.2+6.0 br5+6.0.1 SQL injection628** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-1482. Reason: This candidate is a duplicate of CVE-2006-1482. Notes: All CVE users should reference CVE-2006-1482 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.Cross-site scripting (XSS) vulnerability in track.php in phpmyfamily 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.ADV-2006-113020060327 HYSA-2006-007 phpmyfamily 1.4.1 CRLF injection & XSS20060327 HYSA-2006-007 phpmyfamily 1.4.1 CRLF injection & XSSphpmyfamily-track-xss(25476)172782416663619409Multiple SQL injection vulnerabilities in Pixel Motion Blog allow remote attackers to execute arbitrary SQL commands via the (1) date parameter in index.php or bypass authentication via the (2) password parameter in admin/index.php.ADV-2006-11351726020060327 Blog Pixel Motion<=1.xx Authentication Bypass Vulnerability & SQL injection19421pixelmotionblog-index-sql-injection(25481)pixelmotionblog-adminindex-security-bypass(25478)2416924168Multiple cross-site scripting (XSS) vulnerabilities in WebAPP 0.9.9.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) action, (2) id, (3) num, (4) board, (5) cat, (6) real, (7) viewcat, (8) img, or (9) curcatname parameter in cgi-bin/index.cgi, or (10) vsSD parameter in /mods/calendar/index.cgi.ADV-2006-1102webapp-index-xss(25435)http://www.web-app.net/cgi-bin/index.cgi?action=redirectd&cat=pastversions&id=1http://www.web-app.net/cgi-bin/index.cgi?action=downloadinfo&cat=pastversions&id=117359242792427819506http://pridels0.blogspot.com/2006/03/webapp-multiple-xss-vuln.htmlMultiple cross-site scripting (XSS) vulnerabilities in phpCOIN 1.2.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the fs parameter to (1) mod.php or (2) mod_print.php.ADV-2006-112919419phpcoin-multiple-xss(25492)172792418924188http://pridels0.blogspot.com/2006/03/phpcoin-v122-xss-vuln.htmlCross-site scripting (XSS) vulnerability in accountlogon.cfm in classifiedZONE 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the rtn parameter.ADV-2006-11321727319427classifiedzone-accountlogon-xss(25494)24187http://pridels0.blogspot.com/2006/03/classifiedzone-v12-xss-vuln.htmlMultiple cross-site scripting (XSS) vulnerabilities in CONTROLzx HMS (formerly DRZES) 3.3.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dedicatedPlanID parameter to dedicated_order.php, (2) sharedPlanID parameter to shared_order.php, (3) plan_id parameter to customers/server_management.php, and (4) email field to customers/forgotpass.php.ADV-2006-1131172822417624175241742417319432controlzshms-multiple-scripts-xss(25491)http://pridels0.blogspot.com/2006/03/controlzx-hms-hosting-management.htmlCross-site scripting (XSS) vulnerability in local.cfm in fusionZONE couponZONE 4.2 allows remote attackers to inject arbitrary web script or HTML via URL-encoded (1) srchfor and (2) srchby parameters.ADV-2006-11271727219430couponzone-local-xss(25484)24180http://pridels0.blogspot.com/2006/03/couponzone-v42-multiple-vuln.htmlfusionZONE couponZONE 4.2 allows remote attackers to obtain the full path of the web server, and other sensitive information, via invalid values, as demonstrated using manipulations associated with SQL.couponzone-local-path-disclosure(25486)http://pridels0.blogspot.com/2006/03/couponzone-v42-multiple-vuln.htmlAnnuaire (Directory) 1.0 allows remote attackers to obtain sensitive information via a direct request to include/lang-en.php, which reveals the full installation path.24302http://osvdb.org/ref/24/24302-annuaire_directory.txtannuaire-includelangen-path-disclosure(25668)19548Cross-site scripting (XSS) vulnerability in inscription.php in Annuaire (Directory) 1.0 allows remote attackers to inject arbitrary web script or HTML via the Comment Field (COMMENTAIRE parameter).24303http://osvdb.org/ref/24/24302-annuaire_directory.txtannuaire-inscription-xss(25669)1739319548Cross-site scripting (XSS) vulnerability in genmessage.php in Accounting Receiving and Inventory Administration (ARIA) 0.99-6 allows remote attackers to inject arbitrary web script or HTML via the Message Field (message parameter).24255http://osvdb.org/ref/24/24255-aria.txtaria-genmessage-xss(25688)1741119551Multiple cross-site scripting (XSS) vulnerabilities in UPOINT @1 Event Publisher allow remote attackers to inject arbitrary web script or HTML via the (1) Event, (2) Description, (3) Time, (4) Website, and (5) Public Remarks fields to (a) eventpublisher_admin.htm and (b) eventpublisher_usersubmit.htm.2423624235http://osvdb.org/ref/24/24236-upoint.txt1764619727UPOINT @1 Event Publisher stores sensitive information under the web document root with insufifcient access control, which allows remote attackers to read private comments via a direct request to eventpublisher.txt.24237http://osvdb.org/ref/24/24236-upoint.txt1764719727Multiple cross-site scripting (XSS) vulnerabilities in Andy's PHP Knowledgebase (aphpkb) 0.57 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword_list parameter to (a) index.php; (2) title, (3) article, (4) author, and (5) keywords parameters to (b) submit_article.php; and (6) Question, (7) Name, and (8) Email parameters to (c) submit_question.php.243122431124310http://osvdb.org/ref/24/24310-aphpkb.txtaphpkb-multiple-scripts-xss(25666)1737719554NSSecureTextField in AppKit in Apple Mac OS X 10.4.6 does not re-enable secure event input under certain circumstances, which could allow other applications in the window session to monitor input characters and keyboard events.This vulnerability is addressed in the following product release:
Apple, Mac OS X, 10.4.6 (2006-003)TA06-132AAPPLE-SA-2006-05-11macos-appkit-nssecuretext-weak-security(26404)ADV-2006-1779179512558320077BOM in Apple Mac OS X 10.3.9 and 10.4.6 allows attackers to overwrite arbitrary files via an archive that contains symbolic links.This vulnerability is addressed in the following product release:
Apple, Mac OS X, 10.4.6 (2006-003)TA06-132AAPPLE-SA-2006-05-11ADV-2006-1779macos-bom-archive-file-overwrite(26405)1795125584101608220077Integer overflow in CFNetwork in Apple Mac OS X 10.4.6 allows remote attackers to execute arbitrary code via crafted chunked transfer encoding.This vulnerability is addressed in the following product release:
Apple, Mac OS X, 10.4.6 (2006-003)TA06-132AAPPLE-SA-2006-05-11ADV-2006-1779macos-cfnetwork-chunked-overlow(26406)1795125585101608220077The bundle API in CoreFoundation in Apple Mac OS X 10.3.9 and 10.4.6 loads dynamic libraries even if the client application has not directly requested it, which allows attackers to execute arbitrary code from an untrusted bundle.This vulnerability is addressed in the following product release:
Apple, Mac OS X, 10.4.6 (2006-003)TA06-132AAPPLE-SA-2006-05-11ADV-2006-1779macos-corefoundation-bundle-code-execution(26407)1795125586101608020077Integer underflow in CoreFoundation in Apple Mac OS X 10.3.9 and 10.4.6 allows context-dependent attackers to execute arbitrary code via unspecified vectors involving conversions from string to file system representation within (1) CFStringGetFileSystemRepresentation or (2) getFileSystemRepresentation:maxLength:withPath in NSFileManager, and possibly other similar API functions.This vulnerability is addressed in the following product release:
Apple, Mac OS X, 10.4.6 (2006-003)TA06-132AAPPLE-SA-2006-05-11ADV-2006-1779macos-corefoundation-integer-underflow(26408)1795125587101608020077CoreGraphics in Apple Mac OS X 10.4.6, when "Enable access for assistive devices" is on, allows an application to bypass restrictions for secure event input and read certain events from other applications in the same window session by using Quartz Event Services.Successful exploitation requires that "Enable access for assistive devices" is on.
This vulnerability is addressed in the following product release:
Apple, Mac OS X, 10.4.6 (2006-003)TA06-132AAPPLE-SA-2006-05-11ADV-2006-1779macos-coregraphics-quartz-security-bypass(26409)1795125588101607920077Buffer overflow in the FTP server (FTPServer) in Apple Mac OS X 10.3.9 and 10.4.6 allows remote authenticated users to execute arbitrary code via vectors related to "FTP server path name handling."This vulnerability is addressed in the following product release:
Apple, Mac OS X, 10.4.6 (2006-003)TA06-132AAPPLE-SA-2006-05-11ADV-2006-1779macos-ftpserver-code-execution(26411)1795125589101608420077Keychain in Apple Mac OS X 10.3.9 and 10.4.6 might allow an application to bypass a locked Keychain by first obtaining a reference to the Keychain when it is unlocked, then reusing that reference after the Keychain has been locked.This vulnerability is addressed in the following product release:
Apple, Mac OS X, 10.4.6 (2006-003)TA06-132AAPPLE-SA-2006-05-11ADV-2006-1779macos-keychain-security-bypass(26413)1795125590101607220077LaunchServices in Apple Mac OS X 10.4.6 allows remote attackers to cause Safari to launch unsafe content via long file name extensions, which prevents Download Validation from determining which application will be used to open the file.This vulnerability is addressed in the following product release:
Apple, Mac OS X, 10.4.6 (2006-003)TA06-132AAPPLE-SA-2006-05-11ADV-2006-1779macos-launchservices-security-bypass(26416)1795125591101608120077Finder in Apple Mac OS X 10.3.9 and 10.4.6 allows user-assisted attackers to execute arbitrary code by tricking a user into launching an Internet Location item that appears to use a safe URL scheme, but which actually has a different and more risky scheme.This vulnerability is addressed in the following product release:
Apple, Mac OS X, 10.4.6 (2006-003)TA06-132AAPPLE-SA-2006-05-11ADV-2006-17791795125592101608220077macos-finder-url-type-spoofing(26410)Integer overflow in Mail in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to execute arbitrary code via a crafted MacMIME encapsulated attachment.This vulnerability is addressed in the following product release:
Apple, Mac OS X, 10.4.6 (2006-003)TA06-132AAPPLE-SA-2006-05-11ADV-2006-1779macos-mail-macmime-bo(26417)1795125593101607820077Mail in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to execute arbitrary code via an enriched text e-mail message with "invalid color information" that causes Mail to allocate and initialize arbitrary classes.This vulnerability is addressed in the following product release:
Apple, Mac OS X, 10.4.6 (2006-003)TA06-132AAPPLE-SA-2006-05-11ADV-2006-1779macos-mail-color-code-execution(26419)1795125594101607820077MySQL Manager in Apple Mac OS X 10.3.9 and 10.4.6, when setting up a new MySQL database server, does not use the "New MySQL root password" that is provided, which causes the MySQL root password to be blank and allows local users to gain full privileges to that database.This vulnerability is addressed in the following product release:
Apple, Mac OS X, 10.4.6 (2006-003)TA06-132AAPPLE-SA-2006-05-11ADV-2006-1779macos-mysql-manager-blank-password(26420)1795125595101607720077Stack-based buffer overflow in Preview in Apple Mac OS 10.4 up to 10.4.6 allows local users to execute arbitrary code via a deep directory hierarchy.This vulnerability is addressed in the following product release:
Apple, Mac OS X, 10.4.6 (2006-003)TA06-132AAPPLE-SA-2006-05-11ADV-2006-1779macos-preview-directory-bo(26422)1795125596101607620077Stack-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted QuickDraw PICT image format file containing malformed font information.TA06-132ATA06-132B1795317951101607510160672007720069APPLE-SA-2006-05-11APPLE-SA-2006-05-11quicktime-pict-font-bo(26400)ADV-2006-1779ADV-2006-177820060512 Apple QuickDraw/QuickTime Multiple Vulnerabilities887Heap-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted QuickDraw PICT image format file with malformed image data.TA06-132ATA06-132B1795317951101607510160672007720069APPLE-SA-2006-05-11APPLE-SA-2006-05-11quicktime-pict-image-bo(26401)ADV-2006-1779ADV-2006-177820060512 Apple QuickDraw/QuickTime Multiple Vulnerabilities887QuickTime Streaming Server in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to cause a denial of service (crash and connection interruption) via a QuickTime movie with a missing track, which triggers a null dereference.TA06-132AAPPLE-SA-2006-05-11ADV-2006-1779quicktime-missing-track-dos(26423)1795125599101607020077Buffer overflow in QuickTime Streaming Server in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to execute arbitrary code via a crafted RTSP request, which is not properly handled during message logging.TA06-132AAPPLE-SA-2006-05-11ADV-2006-1779quicktime-rtsp-bo(26424)1795125600101607020077Safari on Apple Mac OS X 10.4.6, when "Open `safe' files after downloading" is enabled, will automatically expand archives, which could allow remote attackers to overwrite arbitrary files via an archive that contains a symlink.TA06-132AVU#519473APPLE-SA-2006-05-11ADV-2006-1779safari-archive-code-execution(26427)1795125598101606920077Integer overflow in Apple QuickTime Player before 7.1 allows remote attackers to execute arbitrary code via a crafted JPEG image.VU#289705TA06-132B17953101606720069APPLE-SA-2006-05-11quicktime-jpeg-overflow(26391)ADV-2006-1778Multiple integer overflows in Apple QuickTime before 7.1 allow remote attackers to cause a denial of service or execute arbitrary code via a crafted QuickTime movie (.MOV).TA06-132B1795320060512 Apple QuickDraw/QuickTime Multiple Vulnerabilities101606720069APPLE-SA-2006-05-11quicktime-mov-overflow(26392)ADV-2006-1778887Multiple buffer overflows in Apple QuickTime before 7.1 allow remote attackers to execute arbitrary code via a crafted QuickTime movie (.MOV), as demonstrated via a large size for a udta Atom.TA06-132B1795320060512 Apple QuickDraw/QuickTime Multiple Vulnerabilities101606720069APPLE-SA-2006-05-11quicktime-mov-bo(26393)ADV-2006-177820060512 Apple QuickTime udta ATOM Heap Overflowhttp://secway.org/advisory/AD20060512.txt88720060512 Apple QuickTime udta ATOM Heap OverflowMultiple buffer overflows in Apple QuickTime before 7.1 allow remote attackers to execute arbitrary code via a crafted QuickTime Flash (SWF) file.TA06-132B1795320060512 Apple QuickDraw/QuickTime Multiple Vulnerabilities101606720069APPLE-SA-2006-05-11quicktime-flash-bo(26394)ADV-2006-1778887Multiple integer overflows in Apple QuickTime before 7.1 allow remote attackers to execute arbitrary code via a crafted QuickTime H.264 (M4V) video format file.TA06-132B1795320060512 Apple QuickDraw/QuickTime Multiple Vulnerabilities101606720069APPLE-SA-2006-05-11quicktime-h264-overflow(26395)ADV-2006-1778887Heap-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a H.264 (M4V) video format file with a certain modified size value.TA06-132Bhttp://www.zerodayinitiative.com/advisories/ZDI-06-015.html1795320060511 ZDI-06-015: Apple QuickTime H.264 Parsing Heap Overflow Vulnerability101606720069APPLE-SA-2006-05-11quicktime-h264-bo(26396)ADV-2006-1778888Buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted QuickTime MPEG4 (M4P) video format file.VU#587937TA06-132B1795320060512 Apple QuickDraw/QuickTime Multiple Vulnerabilities101606720069APPLE-SA-2006-05-11ADV-2006-1778quicktime-mpeg4-bo(26397)887Buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted QuickTime AVI video format file.TA06-132B1795320060512 Apple QuickDraw/QuickTime Multiple Vulnerabilities101606720069APPLE-SA-2006-05-11ADV-2006-1778quicktime-avi-bo(26399)887Xcode Tools before 2.3 for Mac OS X 10.4, when running the WebObjects plugin, allows remote attackers to access or modify WebObjects projects through a network service.ADV-2006-1950xcode-webobjects-unauth-access(26634)1809125889101614320267APPLE-SA-2006-05-23Integer overflow in the AAC file parsing code in Apple iTunes before 6.0.5 on Mac OS X 10.2.8 or later, and Windows XP and 2000, allows remote user-assisted attackers to execute arbitrary code via an AAC (M4P, M4A, or M4B) file with a sample table size (STSZ) atom with a "malformed" sample_size_table value.VU#90783620891APPLE-SA-2006-06-29itunes-aac-file-overflow(27481)http://www.zerodayinitiative.com/advisories/ZDI-06-020.htmlADV-2006-26011873020060630 ZDI-06-020: Apple iTunes AAC File Parsing Integer Overflow Vulnerability1016413Unspecified vulnerability in Apple File Protocol (AFP) server in Apple Mac OS X 10.4 up to 10.4.6 includes the names of restricted files and folders within search results, which might allow remote attackers to obtain sensitive information.This vulnerability is addressed in the following product release:
Apple, Mac OS X, 10.4.7APPLE-SA-2006-06-27macosx-afp-information-disclosure(27477)ADV-2006-2566187331868626930101639520877Stack-based buffer overflow in ImageIO in Apple Mac OS X 10.4 up to 10.4.6 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image.VU#988356macosx-imageio-tiff-bo(27478)ADV-2006-2566187311868626931101639420877APPLE-SA-2006-06-27OpenLDAP in Apple Mac OS X 10.4 up to 10.4.6 allows remote attackers to cause a denial of service (crash) via an invalid LDAP request that triggers an assert error.VU#65219618728186861016396macosx-openldap-directory-dos(27480)ADV-2006-25662693220877APPLE-SA-2006-06-27Format string vulnerability in the CF_syslog function launchd in Apple Mac OS X 10.4 up to 10.4.6 allows local users to execute arbitrary code via format string specifiers that are not properly handled in a syslog call in the logging facility, as demonstrated by using a crafted plist file.macosx-launchd-format-string(27479)ADV-2006-2566187241868620060629 DMA[2006-0628a] - 'Apple OSX launchd unformatted syslog() vulnerability'26933101639720877APPLE-SA-2006-06-27Unspecified vulnerability in AFP Server in Apple Mac OS X 10.3.9 allows remote attackers to determing names of unauthorized files and folders via unknown vectors related to the search results.TA06-214Amacosx-afp-file-disclosure(28134)ADV-2006-310119289101662021253APPLE-SA-2006-08-01Integer overflow in AFP Server for Apple Mac OS X 10.3.9 and 10.4.7 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via unknown vectors.VU#575372TA06-214Amacosx-afp-overflow(28135)ADV-2006-31011928927731101662021253APPLE-SA-2006-08-01Cross-site scripting (XSS) vulnerability in the "failed" functionality in Raindance Web Conferencing Pro allows remote attackers to inject arbitrary web script or HTML via the browser parameter.20060324 [DDSi-SA] XSS in Raindance Communications Web Conferencing ProWindows Firewall in Microsoft Windows XP SP2 does not produce application alerts when an application is executed using the NTFS Alternate Data Streams (ADS) filename:stream syntax, which might allow local users to launch a Trojan horse attack in which the victim does not obtain the alert that Windows Firewall would have produced for a non-ADS file.20060324 Microsoft Windows XP SP2 Firewall issuewinxp-firewall-ads-bypass(25597)20060327 Re: Microsoft Windows XP SP2 Firewall issueWindows Firewall in Microsoft Windows XP SP2 produces incorrect application block alerts when the application filename is ".exe" (with no characters before the "."), which might allow local user-assisted users to trick a user into unblocking a Trojan horse program, as demonstrated by a malicious ".exe" program in a folder named "Internet Explorer," which triggers a question about whether to unblock the "Internet Explorer" program.20060327 Re: Microsoft Windows XP SP2 Firewall issue20060324 Microsoft Windows XP SP2 Firewall issuewinxp-firewall-exe-bypass(25598)Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools PHP Live Helper 1.8 allow remote attackers to include and execute arbitrary PHP code via the abs_path parameter in (1) initiate.php, (2) waiting.php, (3) welcome.php, (4) admin/index.php, (5) javascript.php, (6) checkchat.php, and (7) blank.php.This vulnerability may affect all versions prior to 1.8 as well.http://www.turnkeywebtools.com/forum/showthread.php?p=10415http://www.worlddefacers.de/Public/WD-TMPLH.txtADV-2006-113720060327 PHPLiveHelper 1.8 remote command execution (include) Xploit (perl)19428phplivehelper-abspath-file-include(25489)1850920060619 Re: PHP Live Helper <=([abs_path]) Remote File Include Vulnerabilities20060619 PHP Live Helper <=([abs_path]) Remote File Include Vulnerabilities24199241982419724196241952419424193Directory traversal vulnerability in (1) initiate.php and (2) possibly other PHP scripts in Turnkey Web Tools PHP Live Helper 1.8, and possibly later versions, allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the language cookie, as demonstrated by uploading PHP code in a gl_session cookie to users.php, which causes the code to be stored in error.log, which is then included by initiate.php.This vulnerability may affect all other versions of Turnkey Web Tools, PHP Live Helper.http://www.turnkeywebtools.com/forum/showthread.php?p=10415http://www.worlddefacers.de/Public/WD-TMPLH.txt20060327 PHPLiveHelper 1.8 remote command execution (include) Xploit (perl)phplivehelper-abspath-file-include(25489)64119428Multiple cross-site scripting (XSS) vulnerabilities in Serge Rey gtd-php (aka Getting Things Done) 0.5 allow remote attackers to inject arbitrary web script or HTML via the Description field in (1) newProject.php, (2) newList.php, and (3) newWaitingOn.php; the Title field in (4) newProject.php, (5) newList.php, (6) newWaitingOn.php, (7) newChecklist.php, (8) newContext.php, and (9) newGoal.php; the (10) Category Name field in newCategory.php; the (11) listTitle field in listReport.php; the (12) projectName field in projectReport.php; and the (13) checklistTitle field in checklistReport.php.ADV-2006-120324158241572415624155241542415324152241512415024149http://osvdb.org/ref/24/24149-gtd-php.txtgtdphp-multiple-scripts-xss(25553)1736619512Directory traversal vulnerability in start.php in WebAlbum 2.02 allows remote attackers to include arbitrary files and execute commands by (1) injecting code into local log files via GET commands, then (2) accessing that log via a .. (dot dot) sequence and a trailing null (%00) byte in the skin2 COOKIE parameter.Successful exploitation requires that the "magic_quotes_gpc" parameter is disabled.
ADV-2006-110817228194001608webalbum-skin2-parameter-file-include(25443)24160SQL injection vulnerability in search.php in PHP Ticket 0.71 allows remote authenticated users to execute arbitrary SQL commands and obtain usernames and passwords via the frm_search_in parameter.ADV-2006-110617229194121609phpticket-search-sql-injection(25436)Cross-site scripting (XSS) vulnerability in index.php in ConfTool 1.1 allows remote attackers to inject arbitrary web script or HTML via the page parameter.20060327 CanfTool v1.1 Cross Site Scripting Attackcanftool-index-xss(25437)172312426463520060328 Conftool, not Canftool; appears to be distributableBlazix Web Server before 1.2.6, when running on Windows, allows remote attackers to obtain the source code of JSP files via (1) . (dot), (2) space, and (3) slash characters in the extension of a URL.1727020060328 Secunia Research: Blazix Web Server JSP Source Code DisclosureVulnerabilityhttp://secunia.com/secunia_research/2006-22/advisory/19341ADV-2006-1133blazix-jsp-source-disclosure(25485)241781015837643Genius VideoCAM NB Driver does not drop privileges when saving files, which allows local users to gain privileges by opening arbitrary files via the "save as" dialog.genius-videocam-saveas-gain-privileges(25501)1728420060328 Genius VideoCAM NB Local Privilege Escalationgenius-videocam-saveas-gain-privileges(25501)101583919437gm-upload.cgi in Greymatter 1.3.1 allows remote authenticated users with upload privileges to execute arbitrary programs by uploading files to locations within the web root. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-11381727119423greymatter-gmupload-file-upload(25496)24210Multiple cross-site scripting (XSS) vulnerabilities in index.cfm in realestateZONE 4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) bamin, (2) bemin, (3) pmin, and (4) state parameters.ADV-2006-11281727719429realestatezone-index-xss(25487)24186http://pridels0.blogspot.com/2006/03/realestatezone-42-multiple-xss-vuln.htmlCross-site scripting (XSS) vulnerability in ActiveCampaign SupportTrio 2.50.2 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to the KnowledgeBase search module.supporttrio-search-xss(25495)ADV-2006-1126172762419219431http://pridels0.blogspot.com/2006/03/activecampaign-supporttrio-25-vuln.htmlActiveCampaign SupportTrio 2.5 allows remote attackers to obtain the full path of the server via invalid (1) article or (2) print parameters in a kb action to index.php, or (3) an invalid category parameter to modules/KB/pdf.php, which leaks the path in an error message.ADV-2006-112619431supporttrio-index-pdf-path-disclosure(25517)2419124190http://pridels0.blogspot.com/2006/03/activecampaign-supporttrio-25-vuln.htmlMultiple SQL injection vulnerabilities in FusionZONE CouponZONE local.cfm in 4.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) companyid, (2) scat, and (3) coid parameters.1727424179couponzone-local-sql-injection(25576)http://pridels0.blogspot.com/2006/03/couponzone-v42-multiple-vuln.htmlPHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script that processes user input in the html_entity_decode function and sends the encoded results back to the client, aka a "binary safety" issue. NOTE: this issue has been referred to as a "memory leak," but it is an information leak that discloses memory contents.TA06-333Ahttp://cvs.php.net/viewcvs.cgi/php-src/ext/standard/html.c?r1=1.112&r2=1.113ADV-2006-4750ADV-2006-2685ADV-2006-114920060328 Critical PHP bug - act ASAP if you are running web with sensitive data20060328 Re: [Full-disclosure] Critical PHP bug - act ASAP if you are running web with sensitive dataoval:org.mitre.oval:def:11084http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/html.c?view=loghttp://bugs.gentoo.org/show_bug.cgi?id=127939php-htmlentitydecode-information-disclosure(25508)USN-320-12006-002017296SUSE-SA:2006:024MDKSA-2006:063http://support.avaya.com/elmodocs2/security/ASA-2006-129.htmGLSA-200605-0823155211252095120210200521997919832195701949919383RHSA-2006:0276APPLE-SA-2006-11-28http://docs.info.apple.com/article.html?artnum=30482920060501-01-UEval injection vulnerability in Horde Application Framework versions 3.0 before 3.0.10 and 3.1 before 3.1.1 allows remote attackers to execute arbitrary code via the help viewer.horde-help-viewer-command-execution(25516)172921015841http://lists.horde.org/archives/announce/2006/000271.htmlADV-2006-1154SUSE-SR:2006:007GLSA-200604-02DSA-1034DSA-103320060330 Recent unspecified Horde vuln is eval injection1969219619195281950419485http://lists.horde.org/archives/announce/2006/000272.htmlhttp://cvs.horde.org/diff.php?f=horde%2Fservices%2Fhelp%2Findex.php&r1=2.85&r2=2.86Directory traversal vulnerability in dir.php in Explorer XP allows remote attackers to read arbitrary files via the chemin parameter.http://www.zataz.com/news/10871/Probleme-de-securite-decouvert-dans-le-logiciel-ExploreXP.htmlADV-2006-1165http://www.silitix.com/explorerxp.phpexplorerxp-dir-directory-traversal(25523)173032425910158401946020060329 ExplorerXP : Directory Traversal and Cross Site ScriptingCross-site scripting (XSS) vulnerability in dir.php in Explorer XP allows remote attackers to inject arbitrary web script or HTML via the chemin parameter. NOTE: it is possible that this issue is resultant from CVE-2006-1492.http://www.zataz.com/news/10871/Probleme-de-securite-decouvert-dans-le-logiciel-ExploreXP.htmlADV-2006-1165http://www.silitix.com/explorerxp.phpexplorerxp-dir-xss(25524)173032426010158401946020060329 ExplorerXP : Directory Traversal and Cross Site ScriptingDirectory traversal vulnerability in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass open_basedir restrictions allows remote attackers to create files in arbitrary directories via the tempnam function.20060408 tempnam() open_basedir bypass PHP 4.4.2 and 5.1.219599ADV-2006-1290oval:org.mitre.oval:def:10196https://issues.rpath.com/browse/RPL-683php-tempnam-directory-traversal(25705)USN-320-11743920061005 rPSA-2006-0182-1 php php-mysql php-pgsqlRHSA-2006:0568RHSA-2006:0567SUSE-SA:2006:024MDKSA-2006:074http://support.avaya.com/elmodocs2/security/ASA-2006-175.htm1015881677222252172321252212022113521125210311997919775RHSA-2006:054920060701-01-USQL injection vulnerability in general/sendpassword.php in (1) PHPCollab 2.4 and 2.5.rc3, and (2) NetOffice 2.5.3-pl1 and 2.6.0b2 allows remote attackers to execute arbitrary SQL commands via the loginForm parameter in the "forgotten password" option.netoffice-sendpassword-sql-injection(25503)ADV-2006-1142ADV-2006-1141172831617GLSA-200812-203325819449http://downloads.securityfocus.com/vulnerabilities/exploits/PHPCollab_NetOffice_SQLINJ.phpphpcollab-sendpassword-sql-injection(25505)netoffice-sendpassword-bypass-security(25503)17286242302422619452Multiple cross-site scripting (XSS) vulnerabilities in index.php in ViHor Design allow remote attackers to inject arbitrary web script or HTML via (1) a remote URL in the page parameter, which is processed by an fopen call, or (2) HTML or script in the page parameter, which is returned to the client in an error message for the failed fopen call.1722620060324 VihorDesing Script Remote Command Exucetion And Cross Scripting Attack20060326 clarification of "VihorDesign" (not VihorDesing) issues20060326 clarification of "VihorDesign" (not VihorDesing) issuesvihordesign-index-xss(25483)19403Directory traversal vulnerability in index.php in ViHor Design allows remote attackers to read arbitrary files via the page parameter.19403ADV-2006-11141722620060324 VihorDesing Script Remote Command Exucetion And Cross Scripting Attack20060327 clarification of "VihorDesign" (not VihorDesing) issues1722720060326 clarification of "VihorDesign" (not VihorDesing) issues625Cross-site scripting (XSS) vulnerability in MediaWiki before 1.5.8 and 1.4.15 allows remote attackers to inject arbitrary web script or HTML via crafted encoded links.17269[MediaWiki-announce] 20060327 MediaWiki 1.5.8, 1.4.15 released [SECURITY]ADV-2006-1194http://www.mediawiki.org/wiki/MediaWikimediawiki-unspecified-xss(25588)SUSE-SR:2006:007GLSA-200604-01195171950819504SQL injection vulnerability in vCounter.php in vCounter 1.0 allows remote attackers to execute arbitrary SQL commands via the URI (_SERVER[REQUEST_URI] variable).ADV-2006-114719422http://evuln.com/vulns/108/summary.htmlvcounter-url-sql-injection(25500)1730220060407 [eVuln] vCounter - sourceworkshop SQL Injection Vulnerability24234SQL injection vulnerability in index.php in Tilde CMS 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.tildecms-index-sql-injection(25510)ADV-2006-1145172992423319447http://osvdb.org/ref/24/24233-tilde.txtSQL injection vulnerability in index.php in OneOrZero 1.6.3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly in the kans action.oneorzero-helpdesk-index-sql-injection(25511)ADV-2006-1146172982422819446http://osvdb.org/ref/24/24228-oneorzero.txtMultiple integer overflows in MPlayer 1.0pre7try2 allow remote attackers to cause a denial of service and trigger heap-based buffer overflows via (1) a certain ASF file handled by asfheader.c that causes the asf_descrambling function to be passed a negative integer after the conversion from a char to an int or (2) an AVI file with a crafted wLongsPerEntry or nEntriesInUse value in the indx chunk, which is handled in aviheader.c.http://www.xfocus.org/advisories/200603/11.htmlADV-2006-11561729520060329 [xfocus-SD-060329]MPlayer: Multiple integer overflows1941820060329 [xfocus-SD-060329]MPlayer: Multiple integer overflowsmplayer-aviheader-integer-overflow(25514)mplayer-asfheader-integer-overflow(25513)2424724246MDKSA-2006:068GLSA-200605-0110158426475321991919565PHP remote file inclusion vulnerability in includes/functions_install.php in Virtual War (VWar) 1.5.0 R11 and earlier allows remote attackers to include and execute arbitrary PHP code via a URL in the vwar_root parameter. NOTE: this is a different vulnerability than CVE-2006-1636.Successful exploitation requires that the "register_globals" parameter is enabled.virtual-war-functionsinstall-file-include(25497)ADV-2006-11441729020060328 VWar <= 1.5.0 R11 Remote Code Execution Exploit242391943820060403 Vendor ACK for VWar issue - VWar used by PhpNuke ClanMultiple cross-site scripting (XSS) vulnerabilities in Arab Portal 2.0 (aka Arab Dynamic Portal or ADP) stable allow remote attackers to inject arbitrary web script or HTML via the title parameter in (1) online.php and (2) download.php.Successful exploitation requires that the "register_globals" parameter is enabled.ADV-2006-115020060328 ArabPortal 2.0 Stable CrossSiteScripting19445arabportal-online-download-xss(25515)172852422124220673base_maintenance.php in Basic Analysis and Security Engine (BASE) before 1.2.4 (melissa), when running in standalone mode, allows remote attackers to bypass authentication, possibly by setting the standalone parameter to "yes".Succesful exploitation requires that the product is running in standalone mode.24101ADV-2006-1192http://cvs.sourceforge.net/viewcvs.py/secureideas/base-php4/docs/CHANGELOG?rev=1.233&view=markup1735419510Unspecified vulnerability in rsh in Sun Microsystems Sun Grid Engine 5.3 before 20060327 and N1 Grid Engine 6.0 before 20060327 allows local users to gain root privileges.This vulnerability affects Sun Microsystems, Sun Grid Engine 5.3 before 20060327 & N1 Grid Engine 6.0 before 20060327.1022681015835ADV-2006-1155Cross-site scripting (XSS) vulnerability in PHPKIT 1.6.03 allows remote attackers to inject arbitrary web script or HTML via the error parameter to include.php, possibly due to a problem in login/login.php.1729120060328 XSS in PHPKIT Version 1.6.03phpkit-error-xss(25594)Multiple cross-site scripting (XSS) vulnerabilities in MH Software Connect Daily Web Calendar Software 3.2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) calendar_id, (2) style_sheet, and (3) start parameters in (a) ViewDay.html; the (4) txtSearch and (5) opgSearch parameters in (b) ViewSearch.html; the (6) calendar_id and (7) approved parameters in (c) ViewYear.html; the (8) item_type_id parameter in (d) ViewCal.html; and the (9) week parameter in (e) ViewWeek.html.ADV-2006-11251728719434connectdailywebcalendar-multiple-xss(25474)2418524184241832418224181http://pridels0.blogspot.com/2006/03/connect-daily-multiple-xss-vuln.html/sbin/passwd in HP-UX B.11.00, B.11.11, and B.11.23 before 20060326 "does not recover gracefully from some error conditions," which allows local users to cause a denial of service.This vulnerability affects all versions of HP-UX B.11.00, B.11.11, and B.11.23 before 20060326.SSRT595317280HPSBUX02103ADV-2006-1208hpux-passwd-dos(25596)19490oval:org.mitre.oval:def:1690oval:org.mitre.oval:def:1660oval:org.mitre.oval:def:1412Buffer overflow in calloc.c in the Microsoft Windows XP SP2 ntdll.dll system library, when used by the ILDASM disassembler in the Microsoft .NET 1.0 and 1.1 SDK, might allow user-assisted attackers to execute arbitrary code via a crafted .dll file with a large static method.Succesful exploitation can only occur when ntdll.dll system library is used by the ILDASM disassembler in the Microsoft .NET 1.0 and 1.1 SDK packages.1724319406http://owasp.net/forums/234/showpost.aspx20060327 Buffer OverFlow in ILASM and ILDASMms-dotnet-ildasm-bo(25439)ADV-2006-1113http://owasp.net/forums/257/showpost.aspxBuffer overflow in the ILASM assembler in the Microsoft .NET 1.0 and 1.1 Framework might allow user-assisted attackers to execute arbitrary code via a .il file that calls a function with a long name.ms-dotnet-ilasm-bo(25438)ADV-2006-11131724319406http://owasp.net/forums/257/showpost.aspxhttp://owasp.net/forums/234/showpost.aspx20060327 Buffer OverFlow in ILASM and ILDASM** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-1712. Reason: This candidate is a reservation duplicate of CVE-2006-1712. Notes: All CVE users should reference CVE-2006-1712 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.Multiple buffer overflows in abc2ps before 1.3.3 allow user-assisted attackers to execute arbitrary code via crafted ABC music files.DSA-1041abc2ps-abc-bo(26043)ADV-2006-1511176891980719787Multiple buffer overflows in the abcmidi-yaps translator in abcmidi 20050101, and other versions, allow remote attackers to execute arbitrary code via crafted ABC music files that trigger the overflows during translation into PostScript.24974DSA-10431982919826ADV-2006-153117704Buffer overflow in the addnewword function in typespeed 0.4.4 and earlier might allow remote attackers to execute arbitrary code via unknown vectors.DSA-108420393ADV-2006-20871819420379GLSA-200606-2020708The check_connection function in sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 allows remote attackers to read portions of memory via a username without a trailing null byte, which causes a buffer over-read.TA07-072Ahttp://www.wisec.it/vulns.php?page=7101601719929http://dev.mysql.com/doc/refman/5.0/en/news-5-0-21.htmlADV-2008-1326ADV-2007-0930ADV-2006-163320060502 MySQL Anonymous Login Handshake - Information Leakage.oval:org.mitre.oval:def:9918http://bugs.debian.org/365938mysql-login-packet-info-disclosure(26236)USN-283-12006-00281778020060516 UPDATE: [ GLSA 200605-13 ] MySQL: Information leakageRHSA-2006:0544SUSE-SR:2006:012MDKSA-2006:084GLSA-200605-13DSA-1079DSA-1073DSA-1071236703SSA:2006-155-0184029847244792076220625204572042420333202532024120223200762007320002SUSE-SA:2006:036APPLE-SA-2007-03-13http://docs.info.apple.com/article.html?artnum=305214sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 allows remote attackers to obtain sensitive information via a COM_TABLE_DUMP request with an incorrect packet length, which includes portions of memory in an error message.TA07-072Ahttp://www.wisec.it/vulns.php?page=8101601619929http://dev.mysql.com/doc/refman/5.0/en/news-5-0-21.htmlhttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=365939ADV-2008-1326ADV-2007-0930ADV-2006-163320060502 MySQL COM_TABLE_DUMP Information Leakage and Arbitrary commandexecution.oval:org.mitre.oval:def:11036mysql-sqlparcecc-information-disclosure(26228)USN-283-12006-00281778020060516 UPDATE: [ GLSA 200605-13 ] MySQL: Information leakageRHSA-2006:054425228SUSE-SR:2006:012MDKSA-2006:084GLSA-200605-13DSA-1079DSA-1073DSA-1071236703SSA:2006-155-0183929847244792076220625204572042420333202532024120223200762007320002SUSE-SA:2006:036APPLE-SA-2007-03-13http://docs.info.apple.com/article.html?artnum=305214Buffer overflow in the open_table function in sql_base.cc in MySQL 5.0.x up to 5.0.20 might allow remote attackers to execute arbitrary code via crafted COM_TABLE_DUMP packets with invalid length values.VU#602457http://www.wisec.it/vulns.php?page=8101601619929http://dev.mysql.com/doc/refman/5.0/en/news-5-0-21.htmlhttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=365939ADV-2006-163320060502 MySQL COM_TABLE_DUMP Information Leakage and Arbitrary commandexecution.mysql-comtabledump-bo(26232)17780SUSE-SR:2006:012DSA-1079DSA-1073DSA-10718392076220457203332025320241SUSE-SA:2006:036** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-2224. Reason: This candidate is a duplicate of CVE-2006-2224. Notes: All CVE users should reference CVE-2006-2224 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.Format string vulnerability in ANSI C Sender Policy Framework library (libspf) before 1.0.0-p5, when debugging is enabled, allows remote attackers to execute arbitrary code via format string specifiers, possibly in an e-mail address.http://www.libspf.org/index.htmlhttp://www.gossamer-threads.com/lists/spf/devel/27053?page=lasthttp://permalink.gmane.org/gmane.mail.spam.spf.devel/849ADV-2006-1846libspf-debugging-format-string(26535)The sys_add_key function in the keyring code in Linux kernel 2.6.16.1 and 2.6.17-rc1, and possibly earlier versions, allows local users to cause a denial of service (OOPS) via keyctl requests that add a key to a user key instead of a keyring key, which causes an invalid dereference in the __keyring_search_one function.https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=18846617451http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c3a9d6541f84ac3ff566982d08389b87c1c36b4e19573linux-keyringsearchone-dos(25722)ADV-2006-1475ADV-2006-1307USN-302-1RHSA-2006:049324507MDKSA-2006:086http://support.avaya.com/elmodocs2/security/ASA-2006-161.htm2174520716202372015719735oval:org.mitre.oval:def:9325FEDORA-2006-423http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.3The __group_complete_signal function in the RCU signal handling (signal.c) in Linux kernel 2.6.16, and possibly other versions, has unknown impact and attack vectors related to improper use of BUG_ON.[linux-kernel] 20060411 [PATCH] __group_complete_signal: remove bogus BUG_ONhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=188604ADV-2006-255417640SUSE-SA:2006:028DSA-11032091420398madvise_remove in Linux kernel 2.6.16 up to 2.6.16.6 does not follow file and mmap restrictions, which allows local users to bypass IPC permissions and replace portions of readonly tmpfs files with zeroes, aka the MADV_REMOVE vulnerability. NOTE: this description was originally written in a way that combined two separate issues. The mprotect issue now has a separate name, CVE-2006-2071.1758719657linux-madvise-security-bypass(25870)ADV-2006-2554ADV-2006-1475ADV-2006-139124714SUSE-SA:2006:028DSA-1103DSA-10972091420671203981973519664FEDORA-2006-423http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.6ip_route_input in Linux kernel 2.6 before 2.6.16.8 allows local users to cause a denial of service (panic) via a request for a route for a multicast IP address, which triggers a null dereference.1759319709https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189346linux-ip-route-input-dos(25872)ADV-2006-2554ADV-2006-1475ADV-2006-1399USN-281-1RHSA-2006:049324715SUSE-SA:2006:028MDKSA-2006:086DSA-1103DSA-1097http://support.avaya.com/elmodocs2/security/ASA-2006-161.htm217452147620914206712039820237201571995519735oval:org.mitre.oval:def:10146FEDORA-2006-423http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.8Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.VU#633257RHSA-2006:0451SUSE-SA:2006:023GLSA-200605-0219956199511994319921199161991519900[xorg] 20060502 [CVE-2006-1525] X.Org security advisory: Buffer overflow in the Xrender extensionhttps://bugs.freedesktop.org/show_bug.cgi?id=6642ADV-2006-1617USN-280-1[3.8] 007: SECURITY FIX: May 2, 20061016018oval:org.mitre.oval:def:9929xorg-xrender-bo(26200)2006-002417795FLSA:190777MDKSA-2006:08110233919983The SCTP-netfilter code in Linux kernel before 2.6.16.13 allows remote attackers to trigger a denial of service (infinite loop) via unknown vectors that cause an invalid SCTP chunk size to be processed by the for_each_sctp_chunk function.Upgrade to Linux Kernel version 2.6.16.13 :
http://www.kernel.org/ADV-2006-1632http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.13oval:org.mitre.oval:def:10373linux-sctp-netfilter-dos(26194)USN-302-12006-002417806RHSA-2006:049325229SUSE-SA:2006:028MDKSA-2006:086http://support.avaya.com/elmodocs2/security/ASA-2006-161.htm217452071620398202372015719926Linux kernel before 2.6.13 allows local users to cause a denial of service (crash) via a dio transfer from the sg driver to memory mapped (mmap) IO space.https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=168791kernel-sg-dos(28510)ADV-2006-3330USN-302-118101RHSA-2006:0493SUSE-SA:2006:047SUSE-SA:2006:042MDKSA-2006:123DSA-1184DSA-1183http://support.avaya.com/elmodocs2/security/ASA-2006-161.htm220932208221745215552149821179210452071620237oval:org.mitre.oval:def:11037http://marc.theaimsgroup.com/?l=linux-scsi&m=112540053711489&w=2http://linux.bkbits.net:8080/linux-2.6/cset@43220081yu9ClBQNuqSSnW_9amW7iQhttp://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.33.1Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML. NOTE: due to the lack of sufficient public details from the vendor as of 20060413, it is unclear how CVE-2006-1529, CVE-2006-1530, CVE-2006-1531, and CVE-2006-1723 are different.This vulnerability is addressed in the following product releases:
Mozilla, Firefox, 1.5.0.2
Mozilla, Thunderbird, 1.5.0.2
Mozilla, SeaMonkey, 1.0.1
VU#350262http://www.mozilla.org/security/announce/2006/mfsa2006-20.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=315254ADV-2008-0083ADV-2006-3749ADV-2006-3748ADV-2006-1356SSRT061181SSRT061181SSRT06123617516SSRT061236DSA-1051DSA-104610159211015920101591922066220652103319941198631964919631SCOSA-2006.26oval:org.mitre.oval:def:1947Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML. NOTE: due to the lack of sufficient public details from the vendor as of 20060413, it is unclear how CVE-2006-1529, CVE-2006-1530, CVE-2006-1531, and CVE-2006-1723 are different.This vulnerability is addresses in the following product releases:
Mozilla, Firefox, 1.5.0.2
Mozilla, Thunderbird, 1.5.0.2
Mozilla, SeaMonkey, 1.0.1
VU#350262http://www.mozilla.org/security/announce/2006/mfsa2006-20.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=326615ADV-2008-0083ADV-2006-3749ADV-2006-3748ADV-2006-1356HPSBUX02153SSRT06123617516HPSBUX02153HPSBUX02156DSA-1051DSA-104610159211015920101591922066220652103319941198631964919631SCOSA-2006.26oval:org.mitre.oval:def:1903Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML. NOTE: due to the lack of sufficient public details from the vendor as of 20060413, it is unclear how CVE-2006-1529, CVE-2006-1530, CVE-2006-1531, and CVE-2006-1723 are different.VU#350262ADV-2008-0083ADV-2006-3749ADV-2006-3748HPSBUX02153SSRT061236http://www.mozilla.org/security/announce/2006/mfsa2006-20.html17516HPSBUX02153HPSBUX02156DSA-1051DSA-104610159211015920101591922066220652103319941198631964919631SCOSA-2006.26oval:org.mitre.oval:def:2023Cross-site scripting (XSS) vulnerability in search.php in PHP Classifieds 6.18, 6.20, and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the searchword parameter.phpclassifieds-search-xss(25507)ADV-2006-1143173052423219440http://osvdb.org/ref/24/24232-php_classifieds.txtSQL injection vulnerability in newsletter.php in Sourceworkshop newsletter 1.0 allows remote attackers to execute arbitrary SQL commands via the newsletteremail parameter.ADV-2006-114819425http://evuln.com/vulns/107/summary.htmlnewsletter-script-sql-injection(25498)1730420060407 [eVuln] newsletter - sourceworkshop SQL Injection Vulnerability24229Multiple SQL injection vulnerabilities in Null news allow remote attackers to execute arbitrary SQL commands via (1) the user_email parameter in (a) lostpass.php, and the (2) user_email and (3) user_username parameters in (b) sub.php and (c) unsub.php.Succesful exploitation of this vulnerability requires the "magic_quotes_gpc" parameter to be disabled.ADV-2006-115119413http://evuln.com/vulns/109/summary.htmlnullnews-multiple-sql-injection(25502)1730020060408 [eVuln] Null news SQL Injection Vulnerability242422424124240682Cross-site scripting (XSS) vulnerability in login.php in Phoetux.net PhxContacts 0.93.1 beta and earlier allows remote attackers to inject arbitrary web script or HTML via the m parameter.1730720060328 PhxContacts <= 0.93.1 beta Multiple SQL injection & xssMultiple SQL injection vulnerabilities in Phoetux.net PhxContacts 0.93.1 beta and earlier allow remote attackers to execute arbitrary SQL commands via the (1) motclef and (2) nbr_line_view parameters in (a) carnet.php, and the (3) id_contact parameter in (b) contact_view.php.1730620060328 PhxContacts <= 0.93.1 beta Multiple SQL injection & xssCraig Knudsen WebCalendar 1.1.0-CVS allows remote attackers to obtain sensitive information via a direct request to (1) includes/index.php, (2) tests/add_duration_test.php, (3) tests/all_tests.php, (4) groups.php, (5) nonusers.php, (6) includes/settings.php, (7) includes/init.php, (8) includes/settings.php.orig, (9) includes/js/admin.php, (10) includes/js/edit_entry.php, (11) includes/js/edit_layer.php, (12) includes/js/export_import.php, (13) includes/js/popups.php, (14) includes/js/pref.php, or (15) includes/menu/index.php, which reveal the path in various error messages.20060329 Full path disclosure in Webcalendar 1.1.0-CVSwebcalendar-multiple-path-disclosure(25539)245362453524534245332453224531245302452924528245272452624525245242452324522651The Enova X-Wall ASIC encrypts with a key obtained via Microwire from a serial EEPROM that stores the key in cleartext, which allows local users with physical access to obtain the key by reading and duplicating an EEPROM that is located on a hardware token, or by sniffing the Microwire bus.Physical access to the device or hardware token is required to perform
the attack.20060329 [HV-INFO] Enova hardware encryption: false sense of securityhttp://www.hexview.com/docs/20060328-1.txtenova-xwall-insecure-encryption-key(25527)648Multiple buffer overflows in the checkscores function in scores.c in tetris-bsd in bsd-games before 2.17-r1 in Gentoo Linux might allow local users with games group membership to gain privileges by modifying tetris-bsd.scores to contain crafted executable content, which is executed when another user launches tetris-bsd.17308GLSA-200603-26http://bugs.gentoo.org/show_bug.cgi?id=122399bsdgames-tetrisbsd-checkscores-bo(25611)2426119442MSO.DLL in Microsoft Office 2000, Office XP (2002), and Office 2003 allows user-assisted attackers to cause a denial of service and execute arbitrary code via multiple attack vectors, as originally demonstrated using a crafted document record with a malformed string, as demonstrated by replacing a certain "01 00 00 00" byte sequence with an "FF FF FF FF" byte sequence, possibly causing an invalid array index, in (1) an Excel .xls document, which triggers an access violation in ole32.dll; (2) an Excel .xlw document, which triggers an access violation in excel.exe; (3) a Word document, which triggers an access violation in mso.dll in winword.exe; and (4) a PowerPoint document, which triggers an access violation in powerpnt.txt. NOTE: after the initial disclosure, this issue was demonstrated by triggering an integer overflow using an inconsistent size for a Unicode "Sheet Name" string.TA06-192AVU#609868office-property-string-bo(27609)office-string-parse-bo(27607)ADV-2006-2756188891725220060710 SYMSA-2006-007: Microsoft Office Malformed String Parsing Vulnerability271501615MS06-038101585521012oval:org.mitre.oval:def:639SQL injection vulnerability in Default.asp in EzASPSite 2.0 RC3 and earlier allows remote attackers to execute arbitrary SQL commands and obtain the SHA1 hash of the admin password via the Scheme parameter.ADV-2006-1164http://www.nukedx.com/?viewdoc=221623ezaspsite-default-sql-injection(25544)1730920060329 EzASPSite <= 2.0 RC3 Remote SQL Injection Exploit Vulnerability.242561944120060329 EzASPSite <= 2.0 RC3 Remote SQL Injection Exploit Vulnerability.Stack-based buffer overflow in Python 2.4.2 and earlier, running on Linux 2.6.12.5 under gcc 4.0.3 with libc 2.3.5, allows local users to cause a "stack overflow," and possibly gain privileges, by running a script from a current working directory that has a long name, related to the realpath function. NOTE: this might not be a vulnerability. However, the fact that it appears in a programming language interpreter could mean that some applications are affected, although attack scenarios might be limited because the attacker might already need to cross privilege boundaries to cause an exploitable program to be placed in a directory with a long name; or, depending on the method that Python uses to determine the current working directory, setuid applications might be affected.Successful exploitation requires that the Python is running on Linux 2.6.12.5 under gcc 4.0.3 with libc 2.3.5RHSA-2008:0629http://www.gotfault.net/research/exploit/gexp-python.py314921591Multiple SQL injection vulnerabilities in vscripts (aka Kuba Kunkiewicz) VNews 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) loginvar parameter in (a) admin/admin.php, and the (2) news and (3) nom parameters in (b) news.php.ADV-2006-1173http://www.evuln.com/vulns/112vnews-adminnews-sql-injection(25529)1731620060411 [eVuln] VNews Multiple Vulnerabilities242742427319435Multiple cross-site scripting (XSS) vulnerabilities in news.php in vscripts (aka Kuba Kunkiewicz) VNews 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) autorkomentarza and (2) tresckomentarza parameters.ADV-2006-1173http://www.evuln.com/vulns/112vnews-news-xss(25530)1731720060411 [eVuln] VNews Multiple Vulnerabilities2427519435Direct static code injection vulnerability in admin/config.php in vscripts (aka Kuba Kunkiewicz) VNews 1.2 allows remote authenticated administrators to execute code by inserting the code into variables that are stored in admin/config.php.ADV-2006-1173http://www.evuln.com/vulns/112vnews-config-file-include(25531)20060411 [eVuln] VNews Multiple Vulnerabilities2427619435Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.ADV-2006-1205http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html[struts-user] 20060121 Validation Security Hole?[struts-devel] 20060122 Re: Validation Security Hole?http://issues.apache.org/bugzilla/show_bug.cgi?id=38374struts-iscancelled-security-bypass(25612)1734210158562011719493SUSE-SR:2006:010ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.htmlADV-2006-1205http://issues.apache.org/bugzilla/show_bug.cgi?id=38534struts-actionform-dos(25613)1734210158562011719493SUSE-SR:2006:010Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.https://issues.apache.org/struts/browse/STR-2781ADV-2006-1205http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.htmlhttp://issues.apache.org/bugzilla/show_bug.cgi?id=38749struts-lookupmap-xss(25614)1734210158562011719493SUSE-SR:2006:010PHP 4.4.2 and 5.1.2 allows local users to cause a crash (segmentation fault) by defining and executing a recursive function. NOTE: it has been reported by a reliable third party that some later versions are also affected.Upgrade to PHP 5.1.3-RC3php-function-dos(25704)ADV-2006-12902276620060414 Re: Re: function *() php/apache Crash PHP 4.4.2 and 5.1.220060412 Re: function *() php/apache Crash PHP 4.4.2 and 5.1.220060410 Re: function *() php/apache Crash PHP 4.4.2 and 5.1.220060409 function *() php/apache Crash PHP 4.4.2 and 5.1.2http://www.php-security.org/MOPB/MOPB-02-2007.html244851015880676231220060408 function *() php/apache Crash PHP 4.4.2 and 5.1.2Multiple buffer overflows in the xfig import code (xfig-import.c) in Dia 0.87 and later before 0.95-pre6 allow user-assisted attackers to have an unknown impact via a crafted xfig file, possibly involving an invalid (1) color index, (2) number of points, or (3) depth.17310diaxfig-xfig-import-bo(25566)USN-266-120060329 Buffer overflows in Dia XFig importRHSA-2006:0280FEDORA-2006-261SUSE-SR:2006:009MDKSA-2006:062GLSA-200604-14DSA-102510158531995919897197651954619543195071950519469oval:org.mitre.oval:def:10361[dia-list] 20060329 Vulnerability in xfig import codeEval injection vulnerability in pajax_call_dispatcher.php in PAJAX 0.5.1 and earlier allows remote attackers to execute arbitrary code via the (1) $method and (2) $args parameters.ADV-2006-1353http://www.redteam-pentesting.de/advisories/rt-sa-2006-001.phppajax-pajaxcalldispatcher-code-execution(25859)1751920060413 PAJAX Remote Code Injection and File Inclusion Vulnerability246181965320060413 PAJAX Remote file inclusion and File Inclusion VulnerabilityInteger overflow in ImageIO in Apple Mac OS X 10.4 up to 10.4.5 allows remote attackers to cause a denial of service (crash) via a crafted JPEG image with malformed JPEG metadata, as demonstrated using Safari, aka "Deja-Doom".TA06-132A20077APPLE-SA-2006-05-11macos-imageio-jpeg-bo(26412)ADV-2006-1779179511732125597http://drunkenblog.com/drunkenblog-archives/000760.htmlSQL injection vulnerability in functions/final_functions.php in VSNS Lemon 3.2.0, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.Successful exploitation requires that the "magic_quotes_gpc" parameter is disabled.17281101583619420http://evuln.com/vulns/106/description.htmlvsns-lemon-finalfunctions-sql-injection(25456)20060406 [eVuln] VSNS Lemon Multiple Vulnerabilities24211Cross-site scripting (XSS) vulnerability in VSNS Lemon 3.2.0 allows remote attackers to inject arbitrary web script or HTML via the name parameter while adding a comment.Successful exploitation requires that the "magic_quotes_gpc" parameter is disabled.19420http://evuln.com/vulns/106/description.htmlvsns-lemon-name-xss(25457)1739520060406 [eVuln] VSNS Lemon Multiple Vulnerabilities242121015836VSNS Lemon 3.2.0 allows remote attackers to bypass authentication and access password-protected articles by setting the vsns[topic_id] cookie to the targeted topic.1739620060406 [eVuln] VSNS Lemon Multiple Vulnerabilities24213101583619420http://evuln.com/vulns/106/description.htmlvsns-lemon-cookie-auth-bypass(25459)Multiple cross-site scripting (XSS) vulnerabilities in view_caricatier.php in AL-Caricatier 2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) CatName, (2) CaricatierID, or (3) CatID parameter.1728920060328 XSS in AL-Caricatier17292alcaricatier-viewcaricatier-xss(25493)Multiple SQL injection vulnerabilities in X-Changer 0.2 allow remote attackers to execute arbitrary SQL commands via the (1) from and (2) into parameters in a calculate action, and the (3) id parameter in an edit action to index.php.ADV-2006-11881732220060330 X-Changer <=v0.2 Demo SQL injectionxchanger-index-sql-injection(25549)2428865419459Cross-site scripting (XSS) vulnerability in search.php in PHP Script Index allows remote attackers to inject arbitrary web script or HTML via the search parameter.ADV-2006-1158172972424319443http://osvdb.org/ref/24/24243-script_index.txtSQL injection vulnerability in PHP Script Index allows remote attackers to execute arbitrary SQL commands via the search parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-1158Multiple SQL injection vulnerabilities in SkinTech phpNewsManager 1.48 allow remote attackers to execute arbitrary SQL commands via unspecified parameters, possibly (1) id and (2) topicid, in (a) browse.php, (b) category.php, (c) gallery.php, (d) poll.php, and (e) possibly other unspecified scripts. NOTE: portions of the description details are obtained from third party information.phpnewsmanager-multiple-sql-injection(25512)ADV-2006-115217301http://evuln.com/vulns/11020060410 [eVuln] phpNewsManager Multiple SQL Injections20060408 [eVuln] phpNewsManager Multiple SQL Injections2426824267242662426568019391SQL injection vulnerability in index.php in vscripts (aka Kuba Kunkiewicz) [V]Book (aka VBook) 2.0 allows remote attackers to execute arbitrary SQL commands via the x parameter.Successful exploitation requires that "magic_quotes_gpc" is set to off.ADV-2006-1174http://evuln.com/vulns/111vbook-index-sql-injection(25519)1732020060411 [eVuln] [V]Book Multiple Vulnerabilities2427069619448Multiple cross-site scripting (XSS) vulnerabilities in index.php in vscripts (aka Kuba Kunkiewicz) [V]Book (aka VBook) 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) autor, (2) www, (3) temat, and (4) tresc parameters.ADV-2006-1174http://evuln.com/vulns/111vbook-index-xss(25521)1731920060411 [eVuln] [V]Book Multiple Vulnerabilities2427119448Direct static code injection vulnerability in config.php in vscripts (aka Kuba Kunkiewicz) [V]Book (aka VBook) 2.0 allows remote administrators to execute arbitrary PHP code into the config file, which is included other [V]Book scripts.Successful exploitation requires that "magic_quotes_gpc" is set to off.ADV-2006-1174http://evuln.com/vulns/111vbook-config-file-include(25522)20060411 [eVuln] [V]Book Multiple Vulnerabilities2427219448Untrusted search path vulnerability in libapache2-svn 1.3.0-4 for Subversion in Debian GNU/Linux includes RPATH values under the /tmp/svn directory for the (1) mod_authz_svn.so and (2) mod_dav_svn.so modules, which might allow local users to gain privileges by installing malicious libraries in that directory.17288http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=359234libapache2-svn-file-upload(25680)Untrusted search path vulnerability in libgpib-perl 3.2.06-2 in Debian GNU/Linux includes an RPATH value under the /tmp/buildd directory for the LinuxGpib.so module, which might allow local users to gain privileges by installing malicious libraries in that directory.17288http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=359239libgpib-perl-buildd-file-upload(25681)Untrusted search path vulnerability in libtunepimp-perl 0.4.2-1 in Debian GNU/Linux includes an RPATH value under the /tmp/buildd directory for the tunepimp.so module, which might allow local users to gain privileges by installing malicious libraries in that directory.17288http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=359241libtunepimp-perl-buildd-file-upload(25682)Cross-site scripting (XSS) vulnerability in searchresults.asp in SiteSearch Indexer 3.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchField parameter.ADV-2006-118519467sitesearch-indexer-searchfield-xss(25564)1733224289http://pridels0.blogspot.com/2006/03/sitesearch-indexer-35-xss-vuln.htmlMultiple cross-site scripting (XSS) vulnerabilities in register.php in RedCMS 0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) email, (2) location, or (3) website parameters.Successful exploitation requires that "magic_quotes_gpc" is disabled.ADV-2006-118619475http://evuln.com/vulns/115/summary.htmlredcms-register-xss(25577)1733620060413 [eVuln] RedCMS Multiple XSS and SQL Injection Vulnerabilities24296708Multiple SQL injection vulnerabilities in RedCMS 0.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters to (a) login.php or (b) register.php; or (3) u parameter to (c) profile.php.Successful exploitation requires that "magic_quotes_gpc" is disabled.ADV-2006-118619475http://evuln.com/vulns/115/summary.htmlredcms-multiple-sql-injection(25578)1733620060413 [eVuln] RedCMS Multiple XSS and SQL Injection Vulnerabilities242992429824297Cross-site scripting (XSS) vulnerability in Esqlanelapse 2.0 and 2.2 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.http://sourceforge.net/project/shownotes.php?release_id=40602119474ADV-2006-1183esqlanelapse-xss(25568)1733124300Multiple SQL injection vulnerabilities in loginprocess.php in qliteNews 2005.07.01 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.Successful exploitation requires "magic_quotes_gpc" to be disabled.ADV-2006-118219476http://evuln.com/vulns/114/summary.htmlqlitenews-loginprocess-sql-injection(25565)1733320060413 [eVuln] qliteNews SQL Injection Vulnerability24301701SQL injection vulnerability in post.php in Oxygen 1.1.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter in a newthread action.ADV-2006-11811732420060330 Oxygen<=1.x.x SQL injection19481oxygen-post-sql-injection(25570)24287658PHP remote file inclusion vulnerability in index.php in MediaSlash Gallery allows remote attackers to execute arbitrary PHP code via a URL in the rub parameter (part of the $page_menu variable).1732320060330 MediaSlash Gallery 'rub' variable Remote File inlcusion Vulnerabilitymediaslash-index-file-include(25583)20060516 Re: MediaSlash Gallery 'rub' variable Remote File inlcusion Vulnerability24313657Cross-site scripting (XSS) vulnerability in Groupmax World Wide Web, World Wide Web Desktop, World Wide Web for Scheduler, and Desktop for Scheduler, allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.Apply patch :
http://www.hitachi-support.com/security_e/vuls_e/HS06-005_e/index-e.htmlhttp://www.hitachi-support.com/security_e/vuls_e/HS06-005_e/index-e.htmlADV-2006-118019483groupmax-www-xss(25574)1733724295Multiple cross-site scripting (XSS) vulnerabilities in news.php in QLnews 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) autorx and (2) newsx parameters.1733519479http://evuln.com/vulns/113/description.htmlqlnews-news-xss(25546)20060412 [eVuln] QLnews XSS and PHP Code Insertion Vulnerabilities24290699Direct static code injection vulnerability in QLnews 1.2 allows remote authenticated administrators to execute arbitrary PHP code by modifying config.php.1733519479http://evuln.com/vulns/113/description.htmlqlnews-config-file-include(25548)20060412 [eVuln] QLnews XSS and PHP Code Insertion Vulnerabilities24291Multiple cross-site scripting (XSS) vulnerabilities in view_all_set.php in Mantis 1.0.1, 1.0.0rc5, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) start_day, (2) start_year, and (3) start_month parameters.ADV-2006-11841732619471mantis-viewallset-script-xss(25579)24292DSA-113321400http://pridels0.blogspot.com/2006/03/mantis-xss-vuln.htmlMultiple SQL injection vulnerabilities in Keystone Digital Library Suite (DLS) 1.5.4 and earlier allow remote attackers to execute arbitrary SQL commands via the subject_type_id parameter in (1) the index page and (2) the search module.keystonedls-subjecttypeid-sql-injection(25571)http://pridels0.blogspot.com/2006/03/keystone-dls-sql-vuln.htmlSQL injection vulnerability in topics.php in Dynamic Bulletin Board System (DbbS) 2.0-alpha and earlier allows remote attackers to execute arbitrary SQL commands via the limite parameter.dbbs-topics-sql-injection(25584)1733820060331 DbbS<=2.0-alpha SQL injectionMultiple cross-site scripting (XSS) vulnerabilities in Bugzero 4.3.1 and other versions allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter in query.jsp and (2) entryId parameter in edit.jsp.ADV-2006-1195bugzero-query-edit-xss(25601)17351243292432819492http://pridels0.blogspot.com/2006/04/bugzero-xss-vuln.htmlDirectory traversal vulnerability in index.php in Blank'N'Berg 0.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the _path parameter.http://www.silitix.com/bnb.php173451015854blanknberg-index-directory-traversal(25617)2437319520Cross-site scripting (XSS) vulnerability in index.php in Blank'N'Berg 0.2 allows remote attackers to inject arbitrary web script or HTML via the _path parameter. NOTE: this might be resultant from the directory traversal issue.http://www.silitix.com/bnb.php173461015854blanknberg-index-xss(25618)2437419520Cross-site scripting (XSS) vulnerability in index.php in Warcraft III Replay Parser for PHP 1.8c allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: post-disclosure analysis by CVE suggests that the "page" parameter is not used in this product, and "id" might be the affected parameter.1733420060331 Warcraft III Replay Parser Script Remote Command Exucetion Vulnerability And Cross-Site Scripting Attackingwarcraft3-replay-parser-index-xss(25685)Unspecified vulnerability in index.php in Warcraft III Replay Parser for PHP 1.8c allows remote attackers to inject arbitrary web script or HTML via the page parameter, possibly related to fopen function calls or file uploads. NOTE: post-disclosure analysis by CVE suggests that the "page" parameter is not used in this product, and "id" might be the affected parameter.1733420060331 Warcraft III Replay Parser Script Remote Command Exucetion Vulnerability And Cross-Site Scripting Attackingwarcraft3-replay-parser-index-file-include(25686)Multiple SQL injection vulnerabilities in MonAlbum 0.8.7 allow remote attackers to execute arbitrary SQL commands via (1) the pc parameter in (a) index.php and (2) pnom, (3) pcourriel, and (4) pcommentaire parameters in (b) image_agrandir.php.monalbum-image-imageagrandir-sql-injection(25572)ADV-2006-120620060331 MonAlbum 0.8.7 SQL Injection17327http://www.bash-x.net/undef/adv/monalbum.html66019503SQL injection vulnerability in admin_login.asp in ISP of Egypt SiteMan allows remote attackers to execute arbitrary SQL commands via the pass parameter.ADV-2006-11901734720060401 SiteMan <= All version SQL injection in admin_login.aspsiteman-adminlogin-sql-injection(25595)2436219500NetBSD 1.6 up to 3.0, when a user has "set record" in .mailrc with the default umask set, creates the record file with 0644 permissions, which allows local users to read the record file.101584719465bsd-mailrc-insecure-permissions(25581)24258The bridge ioctl (if_bridge code) in NetBSD 1.6 through 3.0 does not clear sensitive memory before copying ioctl results to the requesting process, which allows local users to obtain portions of kernel memory.17312101584619464NetBSD-SA2006-005bsd-ifbridge-information-disclosure(25582)24262The elf_load_file function in NetBSD 2.0 through 3.0 allows local users to cause a denial of service (kernel crash) via an ELF interpreter that does not have a PT_LOAD section in its header, which triggers a null dereference.The NetBSD 2.x versions are only affected if the kernel is compiled with the USE_TOPDOWN_VM option (not default in generic kernels).1015848NetBSD-SA2006-008netbsd-elfloadfile-dos(25690)24576Cross-site scripting (XSS) vulnerability in the PrintFreshPage function in (1) Basic Analysis and Security Engine (BASE) 1.2.4 and (2) Analysis Console for Intrusion Databases (ACID) 0.9.6b23 allows remote attackers to inject arbitrary web script or HTML via the (a) back parameter to base_graph_main.php, (b) netmask parameter to base_stat_ipaddr.php, or (c) submit parameter to base_qry_alert.php within BASE, or (d) query string to acid_main.php in ACID, which causes the request URI ($_SERVER['REQUEST_URI']) to be inserted into a refresh operation.Analysis Console for Intrusion Databases - The vendor has discontinued this product and therefore has no patch or upgrade that mitigates this problem.
Basic Analysis and Security Engine - Upgrade to cvs version or version 1.2.5 (daiga) or higher, as it has been reported to fix this vulnerability. ADV-2006-12642430720835[secureideas-base-devel] 20060328 3 XSS in BASE 1.2.4base-multiple-scripts-xss(25671)1739119544Heap-based buffer overflow in Microsoft Windows Help winhlp32.exe allows user-assisted attackers to execute arbitrary code via crafted embedded image data in a .hlp file.win-winhlp32-hlp-bo(25573)1732520060413 Windows Help Heap Overflowhttp://www.open-security.org/advisories/1520060331 Windows Help Heap Overflow700Buffer overflow in the is_client_wad_ok function in w_wad.cpp for (1) Zdaemon 1.08.01 and (2) X-Doom allows remote attackers to execute arbitrary code via a long filename argument.ADV-2006-1199ADV-2006-119820060331 Buffer-overflow and in-game crash in Zdaemon 1.08.0119509http://aluigi.altervista.org/adv/zdaebof-adv.txtzdaemon-isclientwadok-bo(25592)173401949620060331 Buffer-overflow and in-game crash in Zdaemon 1.08.01The (1) ZD_MissingPlayer, (2) ZD_UseItem, and (3) ZD_LoadNewClientLevel functions in sv_main.cpp for (a) Zdaemon 1.08.01 and (b) X-Doom allows remote attackers to cause a denial of service (crash) via an invalid player slot or item number, which causes an invalid memory access, possibly due to an invalid array index.zdaemon-memory-access-dos(25593)ADV-2006-1199ADV-2006-11981734020060331 Buffer-overflow and in-game crash in Zdaemon 1.08.01662195091949620060331 Buffer-overflow and in-game crash in Zdaemon 1.08.01http://aluigi.altervista.org/adv/zdaebof-adv.txtMultiple directory traversal vulnerabilities in document/rqmkhtml.php in Claroline 1.7.4 and earlier allow remote attackers to use ".." (dot dot) sequences to (1) read arbitrary files via the file parameter in a rqEditHtml command to document/rqmkhtml.php or (2) execute arbitrary code via the includePath parameter to learnPath/include/scormExport.inc.php.Successful exploitation requires that "register_globals" is enabled.ADV-2006-1187162719461http://retrogod.altervista.org/claroline_174_incl_xpl.htmlclaroline-rqmkhtml-directory-traversal(25561)17343Cross-site scripting (XSS) vulnerability in document/rqmkhtml.php in Claroline 1.7.4 and earlier allows remote attackers to read arbitrary files via ".." sequences in the file parameter in a rqEditHtml command.Successful exploitation requires that "register_globals" is enabled.claroline-rqmkhtml-xss(25562)ADV-2006-1187173442428519461http://retrogod.altervista.org/claroline_174_incl_xpl.html20060331 Re: [Full-disclosure] Claroline <= 1.7.4 (scormExport.inc.php) Remote Code Execution Exploit by rgod242841627PHP remote file inclusion vulnerability in learnPath/include/scormExport.inc.php in Claroline 1.7.4 and earlier allows remote attackers to execute arbitrary PHP code via the includePath parameter.claroline-scormexportinc-file-include(25563)ADV-2006-11871734119461http://retrogod.altervista.org/claroline_174_incl_xpl.html20060331 Claroline <= 1.7.4 (scormExport.inc.php) Remote Code Execution Exploit by rgod242861627AN HTTPD 1.42n, and possibly other versions before 1.42p, allows remote attackers to obtain source code of scripts via crafted requests with (1) dot and (2) space characters in the file extension.1735019326ADV-2006-120020060403 Secunia Research: AN HTTPD Script Source Disclosure Vulnerabilityhttp://secunia.com/secunia_research/2006-21/advisoryanhttpd-script-source-disclosure(25591)243231015858Unspecified vulnerability in VCEngine.php in v-creator before 1.3-pre3, when the VC_CRYPTO_METHOD option is OPENSSL, allows remote attackers to execute arbitrary commands, possibly due to problems in the (1) enrypt and (2) decrypt functions.vcreator-vcengine-command-execution(25560)19453ADV-2006-118917328http://sourceforge.net/forum/forum.php?forum_id=55712924304SQL injection vulnerability in category.php in PhpWebGallery 1.4.1 allows remote attackers to execute arbitrary SQL commands via the search parameter.20060403 Phpwebgallery <= 1.4.1 SQL injection Vulnerability669Unspecified vulnerability in SunPlex Manager in Sun Cluster 3.1 4/04 allows local users with solaris.cluster.gui authorization to view arbitrary files via unspecified vectors.19444ADV-2006-1175173131022781015849suncluster-sunplex-information-disclosure(25543)PHP remote file inclusion vulnerability in includes/functions_common.php in the VWar Account module (vWar_Account) in PHPNuke Clan 3.0.1 allows remote attackers to include arbitrary files via a URL in the vwar_root2 parameter. NOTE: it is possible that this issue stems from a problem in VWar itself, but this is not clear.ADV-2006-12021735620060401 PHPNuke-Clan 3.0.1 Remote File Inclusion Exploit19501phpnukeclan-functionscommon-file-include(25609)24481Cross-site scripting (XSS) vulnerability in profile.php in phpBB 2.0.19 allows remote attackers to inject arbitrary web script or HTML via the cur_password parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-11911735519494phpbb-profile-script-xss(25599)24353http://osvdb.org/ref/24/24353-phpbb.txtUnspecified vulnerability in Exponent CMS before 0.96.5 RC 1 has unknown impact and remote attack vectors related to variables that are not "typecasted."17357http://sourceforge.net/project/shownotes.php?release_id=406474&group_id=11852419498ADV-2006-1201Unspecified vulnerability in the image module in Exponent CMS before 0.96.5 RC 1 allows remote attackers to execute arbitrary code via unknown vectors involving "parsed PHP."17357http://sourceforge.net/project/shownotes.php?release_id=406474&group_id=11852419498ADV-2006-120124358Unspecified vulnerability in the image module in Exponent CMS before 0.96.5 RC 1 allows "directory disclosure" with unknown attack vectors.17357http://sourceforge.net/project/shownotes.php?release_id=406474&group_id=11852419498ADV-2006-1201Unspecified vulnerability in the banner module in Exponent CMS before 0.96.5 RC 1 allows "php injection" via unknown attack vectors.17357http://sourceforge.net/project/shownotes.php?release_id=406474&group_id=11852419498ADV-2006-1201exponent-banner-php-command-execution(25610)24358The copy function in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass safe mode and read arbitrary files via a source argument containing a compress.zlib:// URI.20060408 copy() Safe Mode Bypass PHP 4.4.2 and 5.1.219599ADV-2006-1290php-copy-safemode-bypass(25706)USN-320-11743920060723 Re: new shell bypass safe mode20060718 new shell bypass safe mode20060409 copy() Safe Mode Bypass PHP 4.4.2 and 5.1.224487MDKSA-2006:074http://us.php.net/releases/5_1_3.php10158826782112519775Unspecified vulnerability in Hitachi XFIT/S, XFIT/S/JCA, XFIT/S/ZGN, and XFIT/S ZENGIN TCP/IP Procedure allows remote attackers to cause a denial of service (server process and transfer control process stop) when the products "receive data unexpectedly".17329http://www.hitachi-support.com/security_e/vuls_e/HS06-004_e/index-e.html19472xfits-data-dos(25567)24309PHP remote file inclusion vulnerability in lib/armygame.php in SQuery 4.5 and earlier, as used in products such as Autonomous LAN party (ALP), allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter. NOTE: this only occurs when register_globals is disabled.squery-file-include(25605)ADV-2006-12041743420060401 SQuery <= 4.5 Remote File Inclusion Exploit24400194821629Directory traversal vulnerability in KGB Archiver before 1.1.5.22 allows remote attackers to overwrite arbitrary files wile decompressing an archive, possibly due to directory traversal sequences in a filename.This vulnerability affects all versions of KGB, Archiver before 1.1.5.22http://sourceforge.net/project/shownotes.php?group_id=162546&release_id=406411ADV-2006-120719511kgb-archiver-archive-directory-traversal(25606)17363Multiple cross-site scripting (XSS) vulnerabilities in visview.php in aWebNews 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) yname, (2) emailadd, (3) subject, and (4) comment parameters.Successful exploitation requires that "magic_quotes_gpc" is disabled.
ADV-2006-119619487http://evuln.com/vulns/116/summary.htmlawebnews-visview-xss(25589)20060414 [eVuln] aWebNews Multiple XSS and SQL Injection Vulnerabilities24333707Multiple SQL injection vulnerabilities in aWebNews 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) user123 variable in (a) login.php or (b) fpass.php; or (2) cid parameter to (c) visview.php.Condition: magic_quotes_gpc = off
ADV-2006-119619487http://evuln.com/vulns/116/summary.htmlawebnews-multiple-sql-injection(25590)20060414 [eVuln] aWebNews Multiple XSS and SQL Injection Vulnerabilities243362433524334Integer overflow in the cli_scanpe function in the PE header parser (libclamav/pe.c) in Clam AntiVirus (ClamAV) before 0.88.1, when ArchiveMaxFileSize is disabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code.TA06-132ADSA-1024http://sourceforge.net/project/shownotes.php?release_id=407078&group_id=866381953619534ADV-2006-1779ADV-2006-12582006-00201738820060406 [Overflow.pl] Clam AntiVirus Win32-UPX Heap Overflow (not default configuration)http://www.overflow.pl/adv/clamavupxinteger.txtGLSA-200604-0619570clamav-pe-overflow(25660)1795124457MDKSA-2006:067http://up2date.astaro.com/2006/05/low_up2date_6202.html10158872371920077196081956719564SUSE-SA:2006:020APPLE-SA-2006-05-11Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code. NOTE: as of 20060410, it is unclear whether this is a vulnerability, as there is some evidence that the arguments are actually being sanitized properly.TA06-132A17388GLSA-200604-06DSA-1024http://sourceforge.net/project/shownotes.php?release_id=407078&group_id=866381960819570195641953619534SUSE-SA:2006:020clamav-output-format-string(25661)ADV-2006-1779ADV-2006-12582006-00201795124458MDKSA-2006:067http://up2date.astaro.com/2006/05/low_up2date_6202.html237192007719567APPLE-SA-2006-05-11Multiple SQL injection vulnerabilities in Advanced Poll 2.02 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to comments.php or (2) poll_id parameter to page.php.http://ns79.hosteur.com/~secuti/advancedpoll.txtadvancedpoll-comments-page-sql-injection(25676)Multiple cross-site scripting (XSS) vulnerabilities in Advanced Poll 2.02 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to comments.php or (2) poll_id parameter to page.php. NOTE: it is possible that this issue is resultant from CVE-2006-1616.http://ns79.hosteur.com/~secuti/advancedpoll.txtadvancedpoll-comments-page-xss(25677)Format string vulnerability in the (1) Con_message and (2) conPrintf functions in con_main.c in Doomsday engine 1.8.6 allows remote attackers to execute arbitrary code via format string specifiers in an argument to the JOIN command, and possibly other command arguments.ADV-2006-122119515http://aluigi.altervista.org/adv/doomsdayfs-adv.txtdoomsday-conmessage-conprintf-format-string(25622)1736920060403 Format string in Doomsday 1.8.6GLSA-200604-0510158601951920060403 Format string in Doomsday 1.8.6IBM WebSphere Application Server 4.0.1 through 4.0.3 allows remote attackers to cause a denial of service (application crash) via an HTTP request with a large header.ADV-2006-1214PQ621441015857websphere-http-header-dos(25619)admin/accounts/AccountActions.asp in Hosting Controller 2002 RC 1 allows remote attackers to modify passwords of other users, probably via an "Update User" ActionType with a modified UserName parameter and the PassCheck parameter set to TRUE. It was later reported that the vulnerability is present in 6.1 Hotfix 3.3 and earlier.hostingcontroller-multiple-security-bypass(39038)hosting-controller-accountactions-password(25673)2686220071213 Hosting Controller - Multiple Security Bugs (Extremely Critical)20060402 Hosting Controller AccountActions.asp and saveuploadfiles.asp vulns (PoC)24773473028973http://hostingcontroller.com/english/logs/Post-Hotfix-3_3-sec-Patch-ReleaseNotes.htmlDirectory traversal vulnerability in admin/folders/saveuploadfiles.asp in Hosting Controller 2002 RC 1 allows remote authenticated users to overwrite arbitrary files via an absolute path in the OpenPath parameter.20060402 Hosting Controller AccountActions.asp and saveuploadfiles.asp vulns (PoC)hosting-controller-Saveupload-file-upload(25675)24772Cross-site scripting (XSS) vulnerability in PHPSelect linksubmit allows remote attackers to inject arbitrary web script or HTML via (1) the description parameter to linklist.php and possibly other vectors involving (2) index.php and (3) linksubmit.php.20060401 linksubmit <= All version Html Tag Injector in index.phplinksubmit-linksubmit-xss(25607)Unspecified vulnerability in main.php in an unspecified "file created by Andries Bruinsma," possibly a FleXiBle Development (FXB) application, allows remote attackers to include and execute arbitrary PHP code. NOTE: this disclosure is extremely vague and has very little information about the specific vulnerability type. In addition, there is little public information on the named product. Finally, an XSS vector is implied in the subject line, but because there is no other information and evidence of a cut-and-paste error, it will not be assigned a separate CVE identifier unless additional information is provided.flexible-development-main-xss(25603)flexible-development-main-command-execution(25600)20060405 Re: FleXiBle Development Script Remote Command Exucetion And XSS Attacking20060401 FleXiBle Development Script Remote Command Exucetion And XSS Attacking20060404 FleXiBle Development Script Remote Command Exucetion And XSS AttackingThe default configuration of syslogd in the Linux sysklogd package does not enable the -x (disable name lookups) option, which allows remote attackers to cause a denial of service (traffic amplification) via messages with spoofed source IP addresses.20060402 RE: DoS-ing sysklogd?20060331 DoS-ing sysklogd?sysklogd-sourceip-dos(25672)Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.10 allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in a BBCode email tag, as demonstrated using the onmousemove event.mybb-email-bbcode-xss(25615)mybb-email-bbcode-xss(25615)ADV-2006-12161736820060402 MyBB 1.10 New CrossSiteScripting2437519516Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: this is a different vulnerability than CVE-2006-1192.This vulnerability affects any version of Windows OS previous to XP SP2 that is using Internet Explorer 6.0ie-swf-addressbar-spoofing(25634)ADV-2006-2319ADV-2006-12181740420060721 about bid 1740420060404 Another way to spoof Internet Explorer Address Bar20060403 Another Internet Explorer Address Bar Spoofing VulnerabilityMS06-0211016291http://secunia.com/Internet_Explorer_Address_Bar_Spoofing_Vulnerability_Test/19521oval:org.mitre.oval:def:1918oval:org.mitre.oval:def:1881oval:org.mitre.oval:def:1842oval:org.mitre.oval:def:1806oval:org.mitre.oval:def:1604oval:org.mitre.oval:def:1600Adobe Document Server for Reader Extensions 6.0 does not provide proper access control, which allows remote authenticated users to perform privileged actions by modifying the (1) actionID and (2) pageID parameters. NOTE: due to an error during reservation, this identifier was inadvertently associated with multiple issues. Other CVE identifiers have been assigned to handle other problems that are covered by the same disclosure.ADV-2006-1342http://www.adobe.com/support/techdocs/322699.htmlhttp://secunia.com/secunia_research/2005-68/advisory/15924adobe-access-control-bypass(25769)1750020060413 Secunia Research: Adobe Document Server for Reader ExtensionsMultiple Vulnerabilities1015905Adobe LiveCycle Workflow 7.01 and LiveCycle Forum Manager 7.01 allows users to authenticate and perform privileged actions when their account is marked "OBSOLETE" but the account is also active, within the authentication system.http://www.adobe.com/support/techdocs/333036.html19620ADV-2006-1343adobe-livecycle-information-disclosure(25779)175111015906OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LD_PRELOAD environment variable.OpenVPN version 2.0.6 fixes this vulnerability. 1739219531http://openvpn.net/changelog.htmlADV-2006-1261http://www.osreviews.net/reviews/security/openvpn-printhttp://sourceforge.net/mailarchive/forum.php?thread_id=10093825&forum_id=8482openvpn-ldpreload-code-execution(25667)24444SUSE-SR:2006:009MDKSA-2006:069DSA-1045198971983719598The cli_bitset_set function in libclamav/others.c in Clam AntiVirus (ClamAV) before 0.88.1 allows remote attackers to cause a denial of service via unspecified vectors that trigger an "invalid memory access."TA06-132ADSA-1024http://sourceforge.net/project/shownotes.php?release_id=407078&group_id=866381953619534ADV-2006-1779ADV-2006-125817388clamav-others-dos(25662)2006-00201795124459MDKSA-2006:067GLSA-200604-06http://up2date.astaro.com/2006/05/low_up2date_6202.html237192007719608195701956719564SUSE-SA:2006:020APPLE-SA-2006-05-11Unspecified vulnerability in the HTTP compression functionality in Cisco CSS 11500 Series Content Services switches allows remote attackers to cause a denial of service (device reload) via (1) "valid, but obsolete" or (2) "specially crafted" HTTP requests.20060405 Cisco 11500 Content Services Switch HTTP Request VulnerabilityADV-2006-1257cisco-css-http-comp-dos(25642)1738324433101587019552Cross-site scripting (XSS) vulnerability in index.php in LucidCMS 2.0.0 RC4 allows remote attackers to inject arbitrary web script or HTML via the command parameter.1736020060402 Multiple Vulnerabilities in LucidCMSlucidcms-index-login-panel-xss(25632)LucidCMS 2.0.0 RC4 allows remote attackers to obtain sensitive information via a direct request to /lucid_phplib/translator.php, which reveals the path in an error message.20060402 Multiple Vulnerabilities in LucidCMSlucidcms-translator-path-disclosure(25633)PHP remote file inclusion vulnerability in get_header.php in VWar 1.5.0 R12 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter. NOTE: this is a different vulnerability than CVE-2006-1503.19524ADV-2006-12281735820060402 VWar <= 1.5.0 R12 Remote File Inclusion Exploit24480http://downloads.securityfocus.com/vulnerabilities/exploits/VWar_1.5.0_R12.plMultiple cross-site scripting (XSS) vulnerabilities in aWebBB 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) tname or (2) fpost parameters to (a) post.php; (3) fullname, (4) emailadd, (5) country, (6) sig, or (7) otherav parameters to (b) editac.php; or (8) fullname, (9) emailadd, or (10) country parameters to (c) register.php.awebbb-multiple-xss(25585)ADV-2006-11971735220060415 [eVuln] aWebBB Multiple XSS and SQL Injection Vulnerabilities24339243382433719486http://evuln.com/vulns/117/summary.htmlMultiple SQL injection vulnerabilities in aWebBB 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) Username parameter to (a) accounts.php, (b) changep.php, (c) editac.php, (d) feedback.php, (e) fpass.php, (f) login.php, (g) post.php, (h) reply.php, or (i) reply_log.php; (2) p parameter to (j) dpost.php; (3) c parameter to (k) list.php or (l) ndis.php; or (12) q parameter to (m) search.php.Successful exploitation requires "magic_quotes_gpc" to be disabled.ADV-2006-119719486http://evuln.com/vulns/117/summary.htmlawebbb-multiple-sql-injection(25587)1735220060415 [eVuln] aWebBB Multiple XSS and SQL Injection Vulnerabilities24352243512435024349243482434724346243452434424343243422434124340SQL injection vulnerability in index.php in wpBlog 0.4 allows remote attackers to execute arbitrary SQL commands via the postid parameter.Successful exploitation requires that "magic_quotes_gpc" is disabled. This vulnerability may affect all previous versions of Wire Plastik Design, wpBlog before 0.4ADV-2006-123819538http://evuln.com/vulns/119/summary.htmlwpblog-index-sql-injection(25628)1738120060417 [eVuln] Wire Plastik wpBlog SQL Injection Vulnerability243851015951734Cross-site scripting (XSS) vulnerability in news.php in CzarNews 1.14 allows remote attackers to inject arbitrary web script or HTML via the email parameter.ADV-2006-123719541http://evuln.com/vulns/118/summary.htmlczarnews-news-xss(25623)1738020060417 [eVuln] CzarNews XSS and Multiple SQL Injection Vulnerabilities243811015957732Multiple SQL injection vulnerabilities in CzarNews 1.14 allow remote attackers to execute arbitrary SQL commands via the (1) usern or (2) passw parameters to (a) cn_auth.php, (3) s parameter to (b) news.php, or (4) a parameter to (c) dpost.php.Successful exploitation requires that "magic_quotes_gpc" is disabled.ADV-2006-123719541http://evuln.com/vulns/118/summary.htmlczarnews-multiple-sql-injection(25624)1738020060417 [eVuln] CzarNews XSS and Multiple SQL Injection Vulnerabilities2438424383243821015957Cross-site scripting (XSS) vulnerability in Interact 2.1.1 allows remote attackers to inject arbitrary web script or HTML via (1) the search_terms parameter to (a) search.php, and (2) the first_name, (3) last_name, (4) email, (5) password, and (6) confirm_password parameters to (b) userinput.php. NOTE: the provenance of this information is unknown; the details are obtained from third party. In addition, the lack of precision in the third party descriptions makes it unclear whether the named vectors are correct.ADV-2006-124419488interact-search-xss(25652)2446124389SQL injection vulnerability in login.php in Interact 2.1.1 allows remote attackers to execute arbitrary SQL commands via the user_name parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party.ADV-2006-124419488interact-login-sql-injection(25653)1738524390login.php in Interact 2.1.1 generates different responses depending on whether or not a username is valid, which allows remote attackers to determine valid usernames. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-124419488interact-login-error-info-disclosure(25651)24388Cross-site scripting (XSS) vulnerability in Anton Vlasov and Rostislav Gaitkuloff ReloadCMS 1.2.5 and earlier allows remote attackers to inject arbitrary web script or HTML and gain leverage to execute arbitrary PHP code via the User-Agent HTTP header, which is displayed by admin/modules/general/statistic.php in the administration panel.ADV-2006-11931735320060402 ReloadCMS <= 1.2.5stable Cross site scripting / remote command execution19470reloadcms-useragent-xss(25604)24327The Internet Key Exchange version 1 (IKEv1) implementation (isakmp_agg.c) in the Shoichi Sakane KAME Project racoon, as used by NetBSD 1.6, 2.x before 20060119, certain FreeBSD releases, and possibly other distributions of BSD or Linux operating systems, when running in aggressive mode, allows remote attackers to cause a denial of service (daemon crash) via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.http://www.niscc.gov.uk/niscc/docs/re-20051114-01014.pdf?lang=enhttp://www.ee.oulu.fi/research/ouspg/protos/testing/c09/isakmp/19463http://mail-index.netbsd.org/source-changes/2006/01/19/0017.htmlAn unspecified "logical programming mistake" in SMART SynchronEyes Student and Teacher 6.0, and possibly earlier versions, allows remote attackers to cause a denial of service via a large packet to the Teacher discovery port (UDP port 5496), which causes a thread to terminate and prevents communications on that port.ADV-2006-12411737320060404 SMART Technologies SynchronEyes Remote Denial of Servicessynchroneyes-datagram-dos(25659)101586919535SMART SynchronEyes Student and Teacher 6.0, and possibly earlier versions, allows remote attackers to cause a denial of service (memory consumption) via a certain packet to the Teacher discovery port that causes SynchronEyes to connect to the attacker's machine and read a value that is used as a parameter to malloc.ADV-2006-12411737320060404 SMART Technologies SynchronEyes Remote Denial of Servicessynchroneyes-packet-dos(25663)24392101586919535The "restore to" selection in the "quarantine a file" capability of ESET NOD32 before 2.51.26 allows a restore to any directory that permits read access by the invoking user, which allows local users to create new files despite write-access directory permissions.ESET NOD32 Antivirus version 2.51.26 fixes this vulnerability. All versions of this product prior to 2.51.26 are vulnerable.1737420060404 NOD32 local privilege escalation vulnerabilitynod32-restoreto-file-upload(25640)ADV-2006-124224393101586719054672Firefox 1.5.0.1 allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: a followup was unable to replicate this issue.ie-swf-addressbar-spoofing(25634)20060406 Re: Re: Another Internet Explorer Address Bar Spoofing Vulnerability20060404 Re: Another Internet Explorer Address Bar Spoofing Vulnerability** DISPUTED ** Microsoft ISA Server 2004 allows remote attackers to bypass certain filtering rules, including ones for (1) ICMP and (2) TCP, via IPv6 packets. NOTE: An established researcher has disputed this issue, saying that "Neither ISA Server 2004 nor Windows 2003 Basic Firewall support IPv6 filtering ... This is different network protocol."This vulnerability has been disputed.20060404 Re: Bypassing ISA Server 2004 with IPv620060403 Bypassing ISA Server 2004 with IPv620060410 Re: Bypassing ISA Server 2004 with IPv620060405 Re: Re: Bypassing ISA Server 2004 with IPv6Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-assisted remote attackers to execute arbitrary code via a malicious server that sends a long string to a client that connects on TCP port 5900, which triggers an overflow in Log::ReallyPrint; and (2) allow remote attackers to cause a denial of service (server crash) via a long HTTP GET request to TCP port 5800, which triggers an overflow in VNCLog::ReallyPrint.There are two seperate vulnerabilities here; One allows escalated priveleges to authenticated users, the other allows remote unauthenticated users to cause a Denial of Service (DoS).ultr@vnc-vnclogreallyprint-bo(25650)untr@vnc-error-bo(25648)ADV-2006-12401737820060411 Re: Buffer-overflow in Ultr@VNC 1.0.1 viewer POC20060405 Re: Buffer-overflow in Ultr@VNC 1.0.1 viewer and server20060404 Buffer-overflow in Ultr@VNC 1.0.1 viewer and server674195131643164220060404 Buffer-overflow in Ultr@VNC 1.0.1 viewer and serverPHP remote file inclusion vulnerability in loadkernel.php in AngelineCMS 0.8.1 allows remote attackers to execute arbitrary PHP code via a URL in the installPath parameter.17371http://advisories.echo.or.id/adv/adv27-K-159-2006.txtangelinecms-loadkernel-file-include(25658)20060404 [ECHO_ADV_27$2006] AngelineCMS 0.8.1 Installpath Remote File Inclusion24610Directory traversal vulnerability in the HP Color LaserJet 2500 Toolbox and Color LaserJet 4600 Toolbox on Microsoft Windows before 20060402 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request to TCP port 5225.SSRT061141101586220060404 [SEC-1 LTD] HP Colour LaserJet 2500 and 4600 Toolbox Directory Traversal VulnerabilityADV-2006-123017367HPSBPI2109hp-laserjet-toolbox-directory-traversal(25627)20060404 [SEC-1 LTD] HP Colour LaserJet 2500 and 4600 Toolbox Directory Traversal Vulnerability2439619529Multiple buffer overflows in mpg123 0.59r allow user-assisted attackers to trigger a segmentation fault and possibly have other impacts via a certain MP3 file, as demonstrated by mpg1DoS3. NOTE: this issue might be related to CVE-2004-0991, but it is not clear.17365DSA-1074202812027520240http://downloads.securityfocus.com/vulnerabilities/exploits/mpg1DoS3.plMDKSA-2006:092vserver in util-vserver 0.30.209 executes a command as root when the suexec userid parameter is invalid and non-numeric, which might cause local users to inadvertently execute dangerous commands as root.17361http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=360438https://savannah.nongnu.org/patch/?func=detailitem&item_id=4966https://savannah.nongnu.org/bugs/?func=detailitem&item_id=15996Cross-site scripting (XSS) vulnerability in index.php in Chucky A. Ivey N.T. 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter, which is not filtered when the administrator views the "Login Log" page.ADV-2006-124319526http://evuln.com/vulns/121/summary.htmlnt-index-xss(25638)1738720060419 [eVuln] N.T. Version 1.1.0 XSS and PHP Code Insertion Vulnerabilities24397741Direct static code injection vulnerability in ticker.db.php in Chucky A. Ivey N.T. 1.1.0 allows remote administrators to insert arbitrary PHP code into the config file, which is included other N.T. scripts.ADV-2006-124319526http://evuln.com/vulns/121/summary.htmlnt-ticker-file-include(25639)1738720060419 [eVuln] N.T. Version 1.1.0 XSS and PHP Code Insertion Vulnerabilities24398Multiple SQL injection vulnerabilities in Softbiz Image Gallery allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in image_desc.php, (2) provided parameter in template.php, (3) cid parameter in suggest_image.php, (4) img_id parameter in insert_rating.php, and (5) cid parameter in images.php.This vulnerability most likely affects all versions of Softbiz, Image Gallery.ADV-2006-12171733920060331 SQL Injection in Softbiz Image Gallery243722437124370243692436819523softbizimagegallery-multiple-sql-injection(25616)Cross-site scripting (XSS) vulnerability in image_desc.php in Softbiz Image Gallery allows remote attackers to inject arbitrary web script or HTML via msg parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.This vulnerability most likely affects all versions of Softbiz, Image Gallery.ADV-2006-121719523Multiple cross-site scripting (XSS) vulnerabilities in SKForum 1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) areaID parameter in area.View.action, (2) time parameter in planning.View.action, and (3) userID parameter in user.View.action.skforum-multiple-xss(25641)ADV-2006-12601738924432244312443019484http://pridels0.blogspot.com/2006/04/skforum-xss-vuln.htmlThe frontpage option in Limbo CMS 1.0.4.2 and 1.0.4.1 allows remote attackers to execute arbitrary PHP commands via the Itemid parameter in index.php.20060404 Re: Limbo CMS code execution1690220060228 Limbo CMS code executionlimbocms-index-code-execution(24992)51920060228 Limbo CMS code execution** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-0996. Reason: This candidate is a reservation duplicate of CVE-2006-0996. Notes: All CVE users should reference CVE-2006-0996 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.Buffer overflow in xine_list_delete_current in libxine 1.14 and earlier, as distributed in xine-lib 1.1.1 and earlier, allows remote attackers to execute arbitrary code via a crafted MPEG stream.http://www.securityfocus.com/data/vulnerabilities/exploits/xinelib_poc.pl17370FEDORA-2008-1047FEDORA-2008-1043xinelib-mpeg-bo(25670)GLSA-200604-16http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=57160810158682866619856198531641http://bugs.gentoo.org/show_bug.cgi?id=128838Multiple cross-site scripting (XSS) vulnerabilities in Arab Portal 2.0.1 stable allow remote attackers to inject arbitrary web script or HTML via the (1) adminJump and (2) forum_middle parameters in (a) forum.php, and the (3) form parameter in (b) members.php, (c) pm.php, and (d) mail.php.arabportal-multiple-xss(25657)1737520060404 ArabPortal 2.0.1 Stable [ 9 CrossSiteScripting & 1 SQL Injection ] MultBugzSQL injection vulnerability in forum.php in Arab Portal 2.0.1 stable allows remote attackers to execute arbitrary SQL commands via the mineID parameter.arabportal-forum-sql-injection(25656)1737520060404 ArabPortal 2.0.1 Stable [ 9 CrossSiteScripting & 1 SQL Injection ] MultBugz644SQL injection vulnerability in slides.php in Eric Gerdes Crafty Syntax Image Gallery (CSIG) (aka PHP thumbnail Photo Gallery) 3.1g and earlier allows remote authenticated users to execute arbitrary SQL commands via the limitquery_s parameter when the $projectid variable is less than 1, which prevents the $limitquery_s from being set within slides.php.ADV-2006-123917379194781645http://bash-x.net/undef/exploits/crappy_syntax.txthttp://bash-x.net/undef/adv/craftygallery.htmlcrafty-slides-sql-injection(25654)24386newimage.php in Eric Gerdes Crafty Syntax Image Gallery (CSIG) (aka PHP thumbnail Photo Gallery) 3.1g and earlier allows remote authenticated users to upload and execute arbitrary PHP code via a multipart/form-data POST with a .jpg filename in the fullimage parameter and the ext parameter set to .php.Successful exploitation requires privileges to upload images. This product is also known as PHP thumbnail Photo Gallery.ADV-2006-123917379194781645http://bash-x.net/undef/exploits/crappy_syntax.txthttp://bash-x.net/undef/adv/craftygallery.htmlcrafty-http-post-code-execution(25655)24387SQL injection vulnerability in chat/messagesL.php3 in phpHeaven Team PHPMyChat 0.14.5 and earlier allows remote attackers to execute arbitrary SQL commands via the T parameter. NOTE: this issue can be leveraged to execute arbitrary shell commands since the username is later processed in an eval() call, but since the username originated from the SQL injection, it could be a resultant issue.1738220060405 PHPMyChat <= 0.14.5 remote commands execution10158731646phpmychat-messagesl-sql-injection(25687)Control cards for Cisco Optical Networking System (ONS) 15000 series nodes before 20060405 allow remote attackers to cause a denial of service (memory exhaustion and possibly card reset) by sending an invalid response when the final ACK is expected, aka bug ID CSCei45910.1738420060405 Cisco Optical Networking System 15000 Series and Cisco Transport Controller VulnerabilitiesADV-2006-1256cisco-ons-iplan-ack-dos(25643)24434101587219553Control cards for Cisco Optical Networking System (ONS) 15000 series nodes before 20060405 allow remote attackers to cause a denial of service (card reset) via (1) a "crafted" IP packet to a device with secure mode EMS-to-network-element access, aka bug ID CSCsc51390; (2) a "crafted" IP packet to a device with IP on the LAN interface, aka bug ID CSCsd04168; and (3) a "malformed" OSPF packet, aka bug ID CSCsc54558.The vendor has released fixes to address these issues.ADV-2006-12561738420060405 Cisco Optical Networking System 15000 Series and Cisco Transport Controller Vulnerabilitiescisco-ons-ospf-dos(25646)cisco-ons-cc-ip-dos(25645)cisco-ons-cc-ems-dos(25644)244372443624435101587219553The installation of Cisco Transport Controller (CTC) for Cisco Optical Networking System (ONS) 15000 series nodes adds a Java policy file entry with a wildcard that grants the java.security.AllPermission permission to any http URL containing "fs/LAUNCHER.jar", which allows remote attackers to execute arbitrary code on a CTC workstation, aka bug ID CSCea25049.ADV-2006-12561738420060405 Cisco Optical Networking System 15000 Series and Cisco Transport Controller Vulnerabilitiescisco-ons-ctc-code-execution(25647)24438101587119553Cross-site scripting (XSS) vulnerability in vbugs.php in Dark_Wizard vBug Tracker 3.5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the sortorder parameter.ADV-2006-1267vbulletin-vbugtracker-vbugs-xss(25649)174072444819562http://pridels0.blogspot.com/2006/04/vbug-tracker-for-vbulletin-35x-xss.htmlCross-site scripting (XSS) vulnerability in search.php in PHPWebGallery 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter, a different vulnerability than CVE-2006-1675.http://www.Silitix.com/phpwebgalleryMultiple cross-site scripting (XSS) vulnerabilities in PHPWebGallery 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) cat, (2) num, and (3) search parameters to (a) category.php, and the (4) slideshow, (5) show_metadata, and (6) start parameters to (b) picture.php, a different vulnerability than CVE-2006-1674.ADV-2006-130117421phpwebgallery-category-picture-xss(25733)20060410 PHPWebGallery Multiple Cross Site Scripting Vulnerabilities19610SQL injection vulnerability in the display function in the Topics module for MAXdev MDPro (MD-Pro) 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a display action, which is not properly handled in PNuserapi.PHP.mdpro-index-sql-injection(25710)ADV-2006-12821739920060620 Re: MAXDEV CMS Multiple vulnerabilities20060406 MAXDEV CMS Multiple vulnerabilitieshttp://www.maxdev.com/Article592.phtml19578MAXdev MDPro 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to obtain the full path of the server via a direct request to includes/legacy.php.mdpro-legacy-path-disclosure(25714)ADV-2006-128220060620 Re: MAXDEV CMS Multiple vulnerabilities20060406 MAXDEV CMS Multiple vulnerabilitieshttp://www.maxdev.com/Article592.phtml19578Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.8.0.3 allow remote attackers to inject arbitrary web script or HTML via unknown vectors in unspecified scripts in the themes directory.http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-119556ADV-2006-126317390phpmyadmin-themes-xss(25689)24450SUSE-SR:2006:009DSA-12072278119897Cross-site scripting (XSS) vulnerability in modules/online.php in Jupiter CMS 1.1.5 allows remote attackers to inject arbitrary web script or HTML via the layout parameter to index.php.ADV-2006-13021740520060407 Multiple vulnerability in jupiter CMS19582jupitercm-index-xss(25700)Jupiter CMS 1.1.5, when display_errors is enabled, allows remote attackers to obtain the full server path via a direct request to modules/online.php.ADV-2006-130220060407 Multiple vulnerability in jupiter CMSjupitercm-online-path-disclosure(25703)19582Cross-site scripting (XSS) vulnerability in Cherokee HTTPD 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated.19587ADV-2006-12921740820060406 XSS Bug in Cherokee Webservercherokee-handlererror-xss(25698)24469Cross-site scripting (XSS) vulnerability in webplus.exe in TalentSoft Web+Shop 5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the deptname parameter, possibly involving the webpshop/ department.wml script.ADV-2006-12891741819594webshop-deptname-xss(25721)http://pridels0.blogspot.com/2006/04/web-shop-50-xss.htmlSQL injection vulnerability in admin/login.php in Chipmunk Guestbook allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the User name.ADV-2006-132320060407 SQL Injection in Chipmunk Guestbookchipmunk-guestbook-login-sql-injection(25695)1748319584Unspecified vulnerability in ecotwo Shopsystem 1.0-192 and earlier allows remote attackers to include arbitrary local files via (1) the lang parameter in news.php and (2) other unspecified vectors.http://pridels0.blogspot.com/2006/04/ecotwo-shopsystem-vuln.htmlMultiple SQL injection vulnerabilities in modules.php in APT-webshop-system 4.0 PRO, 3.0 BASIC, and 3.0 LIGHT allow remote attackers to execute arbitrary SQL commands via the (1) group, (2) seite, and (3) id parameter, possibly involving the artikel functionality. NOTE: this vulnerability also allows resultant path disclosure when the SQL queries are invalid.ADV-2006-129319592apt-webshop-sql-injection(25731)17425http://pridels0.blogspot.com/2006/04/apt-webshop-system-vuln.htmlUnspecified vulnerability in modules.php in APT-webshop-system 4.0 PRO, 3.0 BASIC, and 3.0 LIGHT allows remote attackers to access unspecified files via a modified warp parameter.http://pridels0.blogspot.com/2006/04/apt-webshop-system-vuln.htmlCross-site scripting (XSS) vulnerability in APT-webshop-system 4.0 PRO, 3.0 BASIC, and 3.0 LIGHT allows remote attackers to inject arbitrary web script or HTML via the message parameter, probably involving the basket functionality.ADV-2006-129319592http://pridels0.blogspot.com/2006/04/apt-webshop-system-vuln.htmlMultiple PHP remote file inclusion vulnerabilities in SQuery 4.5 and earlier, as used in products such as Autonomous LAN party (ALP), allow remote attackers to execute arbitrary PHP code via a URL in the libpath parameter to scripts in the lib directory including (1) ase.php, (2) devi.php, (3) doom3.php, (4) et.php, (5) flashpoint.php, (6) gameSpy.php, (7) gameSpy2.php, (8) gore.php, (9) gsvari.php, (10) halo.php, (11) hlife.php, (12) hlife2.php, (13) igi2.php, (14) main.lib.php, (15) netpanzer.php, (16) old_hlife.php, (17) pkill.php, (18) q2a.php, (19) q3a.php, (20) qworld.php, (21) rene.php, (22) rvbshld.php, (23) savage.php, (24) simracer.php, (25) sof1.php, (26) sof2.php, (27) unreal.php, (28) ut2004.php, and (29) vietcong.php. NOTE: the lib/armygame.php vector is already covered by CVE-2006-1610. The provenance of most of these additional vectors is unknown, although likely from post-disclosure analysis. NOTE: this only occurs when register_globals is disabled.ADV-2006-12841743420060724 SQuery v.x (devi.php) (armygame.php) Remote File Inclusion20060710 SQuery <= 4.5(libpath) Remote File Inclusion Exploit20060408 Autonomous LAN party File iNclusion2442924428244272442624425244242442324422244212442024419244182441724416244152441424413244122441124410244092440824407244062440524404244032440224401http://www.blogcu.com/Liz0ziM/431845/10158846791958819482http://liz0zim.no-ip.org/alp.txtUnspecified vulnerability in su in HP HP-UX B.11.11, when using the LDAP netgroup feature, allows local users to gain unspecified access.HP-UX B.11.11:
Install PHCO_34545 or later.ADV-2006-1272SSRT061132SSRT06113224449101587419560hpux-su-ldap-privilege-escalation(25691)17400oval:org.mitre.oval:def:1754Cross-site scripting (XSS) vulnerability in subscribe.php in MWNewsletter 1.0.0b allows remote attackers to inject arbitrary web script or HTML via the user_name parameter.ADV-2006-127019568http://evuln.com/vulns/123/summary.htmlmwnewsletter-subscribe-xss(25684)174122444675220060421 [eVuln] MWNewsletter SQL Injection and XSS VulnerabilitiesSQL injection vulnerability in MWNewsletter 1.0.0b allows remote attackers to execute arbitrary SQL commands via the user_name parameter to unsubscribe.php.ADV-2006-127019568http://evuln.com/vulns/123/summary.htmlmwnewsletter-unsubscribe-sql-injection(25683)17412249052444520060421 [eVuln] MWNewsletter SQL Injection and XSS VulnerabilitiesMultiple SQL injection vulnerabilities in MWNewsletter 1.0.0b allow remote attackers to execute arbitrary SQL commands via the (1) user_email parameter to (a) unsubscribe.php or (b) subscribe.php; or the (2) user_name parameter to subscribe.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information, although it is likely that this was discovered during post-disclosure analysis.ADV-2006-1270195682490524445Unspecified vulnerability in GlobalSCAPE Secure FTP Server before 3.1.4 Build 01.10.2006 allows attackers to cause a denial of service (application crash) via a "custom command" with a long argument.This issue is addressed in Secure FTP Server 3.1.4 Build 01.10.2006.1739819547http://www.globalscape.com/gsftps/history.aspglobalscape-custom-commands-dos(25665)24451SQL injection vulnerability in members.php in XBrite Members 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.ADV-2006-128317424196021655xbritemembers-id-sql-injection(25708)The fbgs script in the fbi package 2.01-1.4, when the TMPDIR environment variable is not defined, allows local users to overwrite arbitrary files via a symlink attack on temporary files in /var/tmp/fbps-[PID].ADV-2006-128119559http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=361370fbida-fbgs-tmpdir-symlink(25729)17436SUSE-SR:2006:019GLSA-200604-13DSA-1068214592016619766Cross-site scripting (XSS) vulnerability in Gallery before 1.5.3 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.http://sourceforge.net/project/shownotes.php?release_id=408602&group_id=713019580ADV-2006-1285gallery-unspecified-xss(25707)1743724466Cross-site scripting (XSS) vulnerability in Matt Wright Guestbook 2.3.1 allows remote attackers to execute arbitrary web script or HTML via the (1) Your Name, (2) E-Mail, or (3) Comments fields when posting a message.ADV-2006-12871743820060408 Matt Wright Guestbook Xss Script İnjection2447919586http://liz0zim.no-ip.org/mattguestbook.htmlguestbook-guestbook-parameters-xss(25697)681Cross-site scripting (XSS) vulnerability in Matt Wright Guestbook 2.3.1 allows remote attackers to execute arbitrary web script or HTML via the (1) url, (2) city, (3) state, or (4) country parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information, although it is likely that they are the result of post-disclosure analysis.ADV-2006-128719586guestbook-guestbook-parameters-xss(25697)Cross-site scripting (XSS) vulnerability in index.php in Aweb Banner Generator 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the banner parameter in view mode.ADV-2006-1348174161015877awebbannergenerator-index-xss(25782)19621Buy.php in Aweb Scripts Seller uses predictable cookies for authentication based on the time and the script number, which allows remote attackers to bypass authentication.17417101587819626Cross-site scripting (XSS) vulnerability in the Pages module in Shadowed Portal allows remote attackers to inject arbitrary web script or HTML via the page parameter to load.php.ADV-2006-128620060408 Shadowed Portal Cross Site Scripting19595http://liz0zim.no-ip.org/shad0w.txtshadowedportal-load-xss(25716)17430685PHP remote file inclusion vulnerability in spip_login.php3 in SPIP 1.8.3 allows remote attackers to execute arbitrary PHP code via a URL in the url parameter.1742320060409 Vulnerabilities in SPIPspip-spiplogin-file-include(25711)PHP remote file inclusion vulnerability in lire.php in Sire 2.0 nws allows remote attackers to execute arbitrary PHP code via a URL in the rub parameter.1742820060407 Sire 2.0 Nws Remote File inclusion & Arbitary Files Uploadsire-lire-file-include(25726)1015885Sire 2.0 nws allows remote attackers to upload arbitrary image files without authentication via a direct request to upload.php.1743120060407 Sire 2.0 Nws Remote File inclusion & Arbitary Files Uploadsire-upload-auth-bypass(25727)1015885Oracle Database 9.2.0.0 to 10.2.0.3 allows local users with "SELECT" privileges for a base table to insert, update, or delete data by creating a crafted view then performing the operations on that view.VU#805737ADV-2006-12971742620060410 Oracle read-only user can insert/update/delete data via specially crafted viewshttp://www.red-database-security.com/advisory/oracle_modify_data_via_views.html101588619574oracle-base-table-data-manipulation(25696)20060410 Oracle read-only user can insert/update/delete data via specially crafted viewsMultiple SQL injection vulnerabilities in Shopweezle 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) itemID parameter to (a) login.php and (b) memo.php; and the (2) itemgr, (3) brandID, and (4) album parameters to (c) index.php. NOTE: this issue also produces resultant full path disclosure from invalid SQL queries.ADV-2006-12911744119593shopweezle-multiple-path-disclosure(25724)shopweezle-multiple-sql-injection(25723)24473244722447124470http://pridels0.blogspot.com/2006/04/shopweezle-20-multiple-vuln.htmlindex.php in Shopweezle 2.0 allows remote attackers to include arbitrary local files via the url parameter.shopweezle-index-file-include(25725)24474http://pridels0.blogspot.com/2006/04/shopweezle-20-multiple-vuln.htmlSQL injection vulnerability in member.php in Clansys 1.1 allows remote attackers to execute arbitrary SQL commands via the showid parameter in the member page to index.php.ADV-2006-129519609clansys-index-sql-injection(25746)1745610159351662Cross-site scripting (XSS) vulnerability in shop_main.cgi in interaktiv.shop 5 allows remote attackers to inject arbitrary web script or HTML via the (1) pn and (2) sbeg parameters.ADV-2006-1326174852455719622interaktiv-shopmain-xss(25739)http://pridels0.blogspot.com/2006/04/interaktivshop-v5-xss-vuln.htmlSQL injection vulnerability in admin.php in Design Nation DNGuestbook 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) email and (2) id parameters.Successful exploitation requires that "magic_quotes_gpc" is disabled.dnguestbook-admin-sql-injection(25699)ADV-2006-129917435196011653Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPassword methods, which allows remote attackers to modify portraits.https://svn.plone.org/svn/plone/PloneHotfix20060410/trunk/README.txtADV-2006-1340http://dev.plone.org/plone/ticket/5432plone-memberid-data-manipulation(25781)17484DSA-10321964019633Cross-site scripting (XSS) vulnerability in the private archive script (private.py) in GNU Mailman 2.1.7 allows remote attackers to inject arbitrary web script or HTML via the action argument.17403101587619558ADV-2006-126924442[Mailman-Announce] 20060407 Released: Mailman 2.1.8 release candidatehttp://bugs.gentoo.org/show_bug.cgi?id=129136http://www.mail-archive.com/mailman-checkins@python.org/msg06273.htmlCross-site scripting (XSS) vulnerability in index.php in Christoph Roeder phpMyForum 4.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter.1742020060410 phpMyForum Cross Site Scripting & CRLF injectionphpmyforum-index-xss(25742)20060425 Re: phpMyForum Cross Site Scripting & CRLF injectionCRLF injection vulnerability in index.php in Christoph Roeder phpMyForum 4.0 allows remote attackers to inject HTTP headers via hex-encoded CRLF sequences in the type parameter.1742020060410 phpMyForum Cross Site Scripting & CRLF injectionphpmyforum-index-crlf-injection(25750)20060425 Re: phpMyForum Cross Site Scripting & CRLF injectionMultiple directory traversal vulnerabilities in Christian Kindahl TUGZip 3.4.0.0, 3.3.0.0, and 3.1.0.2 allow user-assisted attackers to create files in arbitrary directories via a .. (dot dot) in an archive pack with a crafted (1) .gz, (2) .jar, (3) .rar, or (4) .zip file.tugzip-archive-directory-traversal(25713)1743220060410 TUGZip Archive Extraction Directory traversalhttp://www.hamid.ir/security/tugzip.txt686Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.10 allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in a BBCode img tag. NOTE: the email vector is already covered by CVE-2006-1625, although it might stem from the same core issue.Successful exploitation requires that unauthenticated users are allowed to post new threads (not the default setting).mybb-email-img-bbcode-xss(25615)mybb-email-bbcode-xss(25615)1741320060407 [KAPDA::#38] - MyBB 1.1.0~functions_post.php~XSS Attack2437519516http://myimei.com/security/2006-03-12/mybb-110functions_postphpxss-attack.htmlhttp://kapda.ir/advisory-305.htmlCross-site scripting (XSS) vulnerability in newthread.php in MyBB (aka MyBulletinBoard) 1.10, when configured to permit new threads by unregistered users, allows remote attackers to inject arbitrary web script or HTML via the username.Successful exploitation requires that unauthenticated users are allowed to post new threads (not the default setting).1742720060409 MyBB 1.10 'newthread.php' < CrossSiteScripting >19516mybb-newthread-xss(25730)Magus Perde Clever Copy 3.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to view the database username and password via a direct request for connect.inc.ADV-2006-13161746120060407 [ECHO_ADV_28$2006] Clever Copy <= 3.0 Connect.inc Critical Information Disclosure19579http://advisories.echo.or.id/adv/adv28-K-159-2006.txtclevercopy-connect-disclose-information(25720)Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) via any scrollbar Cascading Style Sheets (CSS) property.20060410 Re: IE6 Crash20060407 IE6 Crashie-css-scrollbar-dos(25852)Cross-site scripting (XSS) vulnerability in search.php in SaphpLesson 3.0 allows remote attackers to inject arbitrary web script or HTML via the Word parameter. NOTE: it is possible that this issue is resultant from SQL injection.ADV-2006-131720060407 Xss In SaphpLesson3.0saphplesson-search-xss(25719)174141015883683digestmd5.c in the CMU Cyrus Simple Authentication and Security Layer (SASL) library 2.1.18, and possibly other versions before 2.1.21, allows remote unauthenticated attackers to cause a denial of service (segmentation fault) via malformed inputs in DIGEST-MD5 negotiation.1744619618http://labs.musecurity.com/advisories/MU-200604-01.txtcyrus-sasl-digest-dos(25738)ADV-2008-1744ADV-2006-3852ADV-2006-1306http://www.vmware.com/security/advisories/VMSA-2008-0009.htmlUSN-272-12006-002420080604 VMSA-2008-0009 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Fusion, VMware Server, VMware VIX API, VMware ESX, VMware ESXi resolve critical security issuesRHSA-2007:0878RHSA-2007:0795SUSE-SA:2006:025MDKSA-2006:073GLSA-200604-09DSA-1042http://support.avaya.com/elmodocs2/security/ASA-2007-426.htm101696030535272372685726708221872001419964198251980919753oval:org.mitre.oval:def:986120060410 [MU-200604-01] Cyrus SASL DIGEST-MD5 Pre-Authentication Denial of ServiceAPPLE-SA-2006-09-29http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-sasl&msg=777520070901-01-PCross-site scripting (XSS) vulnerability in suche.htm in ShopXS 4.0 allows remote attackers to inject arbitrary web script or HTML via the Suchstring1 (aka search) parameter.shopxs-search-xss(25715)http://pridels0.blogspot.com/2006/04/shopxs-v40-xss-vuln_10.htmlUnspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML. NOTE: due to the lack of sufficient public details from the vendor as of 20060413, it is unclear how CVE-2006-1529, CVE-2006-1530, CVE-2006-1531, and CVE-2006-1723 are different.This vulnerability is addressed in the following product releases:
Mozilla, Firefox, 1.5.0.2
Mozilla, Thunderbird, 1.5.0.2
Mozilla, SeaMonkey, 1.0.1
VU#350262http://www.mozilla.org/security/announce/2006/mfsa2006-20.htmlADV-2008-0083ADV-2006-3749ADV-2006-3748ADV-2006-1356HPSBUX02153SSRT06123617516SSRT061181SSRT061236DSA-1051DSA-104610159211015920101591922066220652103319941198631964919631SCOSA-2006.26oval:org.mitre.oval:def:1574Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to DHTML.Fixed in:
Firefox 1.5.0.2
Thunderbird 1.5.0.2
SeaMonkey 1.0.1TA06-107AVU#350262https://bugzilla.mozilla.org/show_bug.cgi?id=282105ADV-2008-0083ADV-2006-3749ADV-2006-3748ADV-2006-1356HPSBUX02153SSRT061236SSRT061145http://www.mozilla.org/security/announce/2006/mfsa2006-20.html228526oval:org.mitre.oval:def:1024317516HPSBUX02153HPSBUX02156FLSA:189137-2HPSBTU02118RHSA-2006:0330RHSA-2006:0328FEDORA-2006-411FEDORA-2006-410DSA-1051DSA-1046http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm1025501015921101592010159192206622065216222103319941198631978019714196961964919631SCOSA-2006.26oval:org.mitre.oval:def:1901Mozilla Firefox 1.5 before 1.5.0.2 and SeaMonkey before 1.0.1 causes certain windows to become translucent due to an interaction between XUL content windows and the history mechanism, which might allow user-assisted remote attackers to trick users into executing arbitrary code.Fixed in:
Firefox 1.5.0.2
SeaMonkey 1.0.1https://bugzilla.mozilla.org/show_bug.cgi?id=327014mozilla-xul-window-spoofing(25827)ADV-2008-0083ADV-2006-3748ADV-2006-135617516SSRT061181SSRT061181http://www.mozilla.org/security/announce/2006/mfsa2006-29.html220661964919631oval:org.mitre.oval:def:1471Unspecified vulnerability in Firefox and Thunderbird 1.5 before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to bypass the js_ValueToFunctionObject check and execute arbitrary code via unknown vectors involving setTimeout and Firefox' ForEach method.This vulnerability is addressed in the following product releases:
Mozilla, Firefox, 1.5.0.2
Mozilla, Thunderbird, 1.5.0.2
Mozilla, SeaMonkey, 1.0.1TA06-107AVU#968814http://www.mozilla.org/security/announce/2006/mfsa2006-28.htmlmozilla-valuetofunctionobject-sec-bypass(25825)ADV-2008-0083ADV-2006-3749ADV-2006-3748ADV-2006-135617516SSRT061181HPSBUX02153SSRT061236SSRT061236SSRT061145HPSBTU0211810159331015932101593122066220651964919631oval:org.mitre.oval:def:1968Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to gain chrome privileges via multiple attack vectors related to the use of XBL scripts with "Print Preview".Fixed in: Firefox 1.5.0.2
Firefox 1.0.8
Thunderbird 1.5.0.2
Thunderbird 1.0.8
SeaMonkey 1.0.1
Mozilla Suite 1.7.13ADV-2008-0083ADV-2006-3749ADV-2006-3748ADV-2006-3391ADV-2006-1356USN-276-1USN-275-1USN-271-117516HPSBUX02153HPSBUX02153SSRT061236HPSBUX02122SSRT061158FLSA:189137-2FLSA:189137-1RHSA-2006:0330RHSA-2006:0329RHSA-2006:0328FEDORA-2006-411FEDORA-2006-410SUSE-SA:2006:022SUSE-SA:2006:004http://www.mozilla.org/security/announce/2006/mfsa2006-25.htmlGLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-104422852610255010159291015928101592710159262162221033199501994119902198631986219852198231982119811197591974619721197141964919631oval:org.mitre.oval:def:10364SUSE-SA:2006:02120060404-01-USCOSA-2006.26mozilla-printpreview-privilege-escalation(25824)SSRT061236MDKSA-2006:078MDKSA-2006:076http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm220662206520051197801972919696oval:org.mitre.oval:def:1649Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via unknown vectors related to the crypto.generateCRMFRequest method.Fixed in: Firefox 1.5.0.2
Firefox 1.0.8
Thunderbird 1.5.0.2
Thunderbird 1.0.8
SeaMonkey 1.0.1
Mozilla Suite 1.7.13TA06-107AVU#932734ADV-2008-0083ADV-2007-0058ADV-2006-3749ADV-2006-3748ADV-2006-3391ADV-2006-1356USN-276-1USN-275-1USN-271-117516HPSBUX02153SSRT061236SSRT061158HPSBUX02122FLSA:189137-2FLSA:189137-1SSRT061145SSRT061145RHSA-2006:0330RHSA-2006:0329RHSA-2006:0328FEDORA-2006-411FEDORA-2006-410SUSE-SA:2006:004SUSE-SA:2006:004http://www.mozilla.org/security/announce/2006/mfsa2006-24.htmlGLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044101592510159241015923101592219950199411990219863198621985219823198211981119794197591974619721197141964919631oval:org.mitre.oval:def:10508SUSE-SA:2006:02120060404-01-USCOSA-2006.26mozilla-generatecrmfrequest-code-execution(25812)SSRT061181SSRT061236MDKSA-2006:078MDKSA-2006:076MDKSA-2006:075http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm1027631025502206622065216222103320051197801972919696oval:org.mitre.oval:def:1698Mozilla Firefox 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to read arbitrary files by (1) inserting the target filename into a text box, then turning that box into a file upload control, or (2) changing the type of the input control that is associated with an event handler.Fixed in: Firefox 1.5.0.2
Firefox 1.0.8
SeaMonkey 1.0.1
Mozilla Suite 1.7.13mozilla-textbox-file-access(25823)ADV-2008-0083ADV-2006-3748ADV-2006-3391ADV-2006-1356USN-275-1USN-271-117516HPSBUX02153HPSBUX02153FLSA:189137-2FLSA:189137-1RHSA-2006:0329RHSA-2006:0328FEDORA-2006-411FEDORA-2006-410SUSE-SA:2006:035http://www.mozilla.org/security/announce/2006/mfsa2006-23.htmlMDKSA-2006:076MDKSA-2006:075GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm228526102550220662162221033199411990219863198621985219811197941975919746197291972119714196961964919631oval:org.mitre.oval:def:10922SUSE-SA:2006:02120060404-01-USCOSA-2006.26oval:org.mitre.oval:def:1929Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via a large number in the CSS letter-spacing property that leads to a heap-based buffer overflow.Fixed in: Firefox 1.5.0.2
Firefox 1.0.8
Thunderbird 1.5.0.2
Thunderbird 1.0.8
SeaMonkey 1.0.1
Mozilla Suite 1.7.13TA06-107AVU#17901410159181015917101591610159151964919631http://www.zerodayinitiative.com/advisories/ZDI-06-010.htmlADV-2008-0083ADV-2006-3749ADV-2006-3748ADV-2006-3391ADV-2006-1356USN-276-1USN-275-1USN-271-117516HPSBUX02153SSRT061236SSRT061158SSRT061158FLSA:189137-2FLSA:189137-1SSRT061145SSRT06114520060415 ZDI-06-010: Mozilla Firefox CSS Letter-Spacing Heap Overflow VulnerabilityRHSA-2006:0330RHSA-2006:0329RHSA-2006:0328FEDORA-2006-411FEDORA-2006-410SUSE-SA:2006:004SUSE-SA:2006:004http://www.mozilla.org/security/announce/2006/mfsa2006-22.htmlGLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044228526102550210331995019941199021986319862198521982319821198111979419759197461972119714oval:org.mitre.oval:def:10055SUSE-SA:2006:02120060404-01-USCOSA-2006.26mozilla-css-letterspacing-overflow(25826)SSRT061181HPSBUX02156MDKSA-2006:078MDKSA-2006:076MDKSA-2006:075http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm72022066220652162220051197801972919696oval:org.mitre.oval:def:1614Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 returns the Object class prototype instead of the global window object when (1) .valueOf.call or (2) .valueOf.apply are called without any arguments, which allows remote attackers to conduct cross-site scripting (XSS) attacks.Fixed in: Firefox 1.5
Firefox 1.0.8
Thunderbird 1.5
Thunderbird 1.0.8
SeaMonkey 1.0
Mozilla Suite 1.7.13ADV-2006-3391ADV-2006-1356USN-276-1USN-275-1USN-271-117516SSRT061158HPSBUX02122FLSA:189137-2FLSA:189137-1RHSA-2006:0330RHSA-2006:0329RHSA-2006:0328FEDORA-2006-411FEDORA-2006-410SUSE-SA:2006:022SUSE-SA:2006:004http://www.mozilla.org/security/announce/2006/mfsa2006-19.htmlGLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm22852610255021622210331995019941199021986319862198521982319821198111979419759197461972919721197141969619631oval:org.mitre.oval:def:9604SUSE-SA:2006:02120060404-01-USCOSA-2006.26mozilla-valueof-xss(25820)MDKSA-2006:078MDKSA-2006:076MDKSA-2006:0752005119780oval:org.mitre.oval:def:1955Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to bypass same-origin protections and conduct cross-site scripting (XSS) attacks via unspecified vectors involving the window.controllers array.This vulnerability also affects Mozilla Suite before 1.7.13, and SeaMonkey before 1.0
This vulnerability is addressed in the following product releases:
Mozilla, Firefox, 1.5
Mozilla, Firefox, 1.0.8
Mozilla, Thunderbird, 1.5
Mozilla, Thunderbird, 1.0.8
Mozilla, SeaMonkey, 1.0
Mozilla, Suite, 1.7.13
https://bugzilla.mozilla.org/show_bug.cgi?id=313373http://www.mozilla.org/security/announce/2006/mfsa2006-17.htmlADV-2006-3391ADV-2006-1356SSRT061158SUSE-SA:2006:004228526oval:org.mitre.oval:def:10232mozilla-windows-controllers-xss(25818)USN-276-1USN-275-1USN-271-117516SSRT061158FLSA:189137-2FLSA:189137-1RHSA-2006:0330RHSA-2006:0329RHSA-2006:0328FEDORA-2006-411FEDORA-2006-410SUSE-SA:2006:004MDKSA-2006:078MDKSA-2006:076MDKSA-2006:075GLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm10255021622210332005119950199021986219852198231982119811197941978019759197461972919721197141969619631SUSE-SA:2006:02120060404-01-USCOSA-2006.26oval:org.mitre.oval:def:1887Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 does not properly protect the compilation scope of privileged built-in XBL bindings, which allows remote attackers to execute arbitrary code via the (1) valueOf.call or (2) valueOf.apply methods of an XBL binding, or (3) "by inserting an XBL method into the DOM's document.body prototype chain."This vulnerability also affects Mozilla, SeaMonkey, 1.0 and Mozilla, Suite, 1.7.13
This vulnerabiloity is addressed in the following product releases:
Mozilla, Firefox, 1.5
Mozilla, Firefox, 1.0.8
Mozilla, Thunderbird, 1.5
Mozilla, Thunderbird, 1.0.8
Mozilla, SeaMonkey, 1.0
Mozilla, Suite, 1.7.13
TA06-107AVU#488774http://www.mozilla.org/security/announce/2006/mfsa2006-16.html20060404-01-UADV-2006-1356USN-276-1USN-275-1USN-271-117516SSRT061158SSRT061158FLSA:189137-2FLSA:189137-1SSRT061145HPSBTU02118RHSA-2006:0330RHSA-2006:0329RHSA-2006:0328FEDORA-2006-411FEDORA-2006-410SUSE-SA:2006:004SUSE-SA:2006:004GLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm2285261025502162221033199501994119902198631986219852198231982119811197941975919746197211971419631oval:org.mitre.oval:def:10815SUSE-SA:2006:021SCOSA-2006.26mozilla-valueof-code-execution(25817)MDKSA-2006:078MDKSA-2006:076MDKSA-2006:07520051197801972919696oval:org.mitre.oval:def:2020Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to execute arbitrary code by using the Object.watch method to access the "clone parent" internal function.Fixed in: Firefox 1.5
Firefox 1.0.8
Thunderbird 1.5
Thunderbird 1.0.8
SeaMonkey 1.0
Mozilla Suite 1.7.13TA06-107AVU#842094ADV-2006-1356USN-276-1USN-275-1USN-271-117516SSRT061158HPSBUX02122FLSA:189137-2FLSA:189137-1SSRT061145HPSBTU02118RHSA-2006:0330RHSA-2006:0329RHSA-2006:0328FEDORA-2006-411FEDORA-2006-410SUSE-SA:2006:022SUSE-SA:2006:004http://www.mozilla.org/security/announce/2006/mfsa2006-15.htmlGLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm2285261025502162221033199501994119902198631986219852198231982119811197941975919746197211971419631oval:org.mitre.oval:def:10755SUSE-SA:2006:02120060404-01-USCOSA-2006.26mozilla-cloneparent-code-execution(25816)MDKSA-2006:078MDKSA-2006:076MDKSA-2006:07520051197801972919696oval:org.mitre.oval:def:1247Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to execute arbitrary code by using an eval in an XBL method binding (XBL.method.eval) to create Javascript functions that are compiled with extra privileges.Fixed in: Firefox 1.5
Firefox 1.0.8
Thunderbird 1.5
Thunderbird 1.0.8
SeaMonkey 1.0
Mozilla Suite 1.7.13TA06-107AVU#813230ADV-2006-1356USN-276-1USN-275-1USN-271-117516SSRT061158HPSBUX02122FLSA:189137-2FLSA:189137-1HPSBTU02118HPSBTU02118RHSA-2006:0330RHSA-2006:0329RHSA-2006:0328FEDORA-2006-411FEDORA-2006-410SUSE-SA:2006:022SUSE-SA:2006:004http://www.mozilla.org/security/announce/2006/mfsa2006-14.htmlGLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm2285261025502162221033199501994119902198631986219852198231982119811197941975919746197211971419631oval:org.mitre.oval:def:10930SUSE-SA:2006:02120060404-01-USCOSA-2006.26mozilla-xbl-code-execution(25815)MDKSA-2006:078MDKSA-2006:076MDKSA-2006:07520051197801972919696oval:org.mitre.oval:def:1037Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to trick users into downloading and saving an executable file via an image that is overlaid by a transparent image link that points to the executable, which causes the executable to be saved when the user clicks the "Save image as..." option. NOTE: this attack is made easier due to a GUI truncation issue that prevents the user from seeing the malicious extension when there is extra whitespace in the filename.Fixed in: Firefox 1.5
Firefox 1.0.8
SeaMonkey 1.0
Mozilla Suite 1.7.13https://bugzilla.mozilla.org/show_bug.cgi?id=293527ADV-2006-1356SSRT061158http://www.mozilla.org/security/announce/2006/mfsa2006-13.html228526mozilla-saveimageas-ext-spoofing(25814)USN-275-1USN-271-117516HPSBUX02122MDKSA-2006:076MDKSA-2006:075GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm102550216222103319941199021986319862198521979419759197461972119631SUSE-SA:2006:021SCOSA-2006.26oval:org.mitre.oval:def:1548Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary bytecode via JavaScript with a large regular expression.TA06-107AVU#329500ADV-2006-1356USN-276-1USN-275-1USN-271-117516SSRT061158HPSBUX02122FLSA:189137-2FLSA:189137-1SSRT061145SSRT061145RHSA-2006:0330RHSA-2006:0329RHSA-2006:0328FEDORA-2006-411FEDORA-2006-410SUSE-SA:2006:022SUSE-SA:2006:004http://www.mozilla.org/security/announce/2006/mfsa2006-11.htmlGLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm2285261025502162221033199501994119902198631986219852198231982119811197941975919746197211971419631oval:org.mitre.oval:def:10817SUSE-SA:2006:02120060404-01-USCOSA-2006.26mozilla-javascript-regexpr-memory-corruption(25808)MDKSA-2006:078MDKSA-2006:076MDKSA-2006:07520051197801972919696oval:org.mitre.oval:def:1829Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) by changing the (1) -moz-grid and (2) -moz-grid-group display styles.TA06-107AVU#252324ADV-2006-1356SSRT061158SSRT061145http://www.mozilla.org/security/announce/2006/mfsa2006-11.html228526oval:org.mitre.oval:def:9405mozilla-mozgrid-memory-corruption(25811)USN-276-1USN-275-1USN-271-117516HPSBUX02122FLSA:189137-2FLSA:189137-1SSRT061145RHSA-2006:0330RHSA-2006:0329RHSA-2006:0328FEDORA-2006-411FEDORA-2006-410MDKSA-2006:078MDKSA-2006:076MDKSA-2006:075GLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm1025502162221033200511995019941199021986319862198521982119811197941978019759197461972919721197141969619631SUSE-SA:2006:02120060404-01-USCOSA-2006.26oval:org.mitre.oval:def:1687The CSS border-rendering code in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain Cascading Style Sheets (CSS) that causes an out-of-bounds array write and buffer overflow.Fixed in: Firefox 1.5
Firefox 1.0.8
Thunderbird 1.5
Thunderbird 1.0.8
SeaMonkey 1.0
Mozilla Suite 1.7.13TA06-107AVU#93555617516http://www.mozilla.org/security/announce/2006/mfsa2006-11.html19631https://bugzilla.mozilla.org/show_bug.cgi?id=265736ADV-2006-1356USN-276-1USN-275-1USN-271-1SSRT061158SSRT061158FLSA:189137-2FLSA:189137-1SSRT061145HPSBTU02118RHSA-2006:0330RHSA-2006:0329RHSA-2006:0328FEDORA-2006-411FEDORA-2006-410SUSE-SA:2006:004SUSE-SA:2006:004GLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm22852610255021622210331995019941199021986319862198521982319821198111979419780197591974619729197211971419696oval:org.mitre.oval:def:9817SUSE-SA:2006:02120060404-01-USCOSA-2006.26mozilla-css-memory-corruption(25810)MDKSA-2006:078MDKSA-2006:076MDKSA-2006:07520051oval:org.mitre.oval:def:1667Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to spoof secure site indicators such as the locked icon by opening the trusted site in a popup window, then changing the location to a malicious site.Fixed in: Firefox 1.5
Firefox 1.0.8
SeaMonkey 1.0
Mozilla Suite 1.7.13https://bugzilla.mozilla.org/show_bug.cgi?id=271194ADV-2006-1356SSRT061158http://www.mozilla.org/security/announce/2006/mfsa2006-12.html228526oval:org.mitre.oval:def:10424mozilla-secure-site-spoofing(25813)USN-275-1USN-271-117516HPSBUX02122FLSA:189137-2FLSA:189137-1RHSA-2006:0329RHSA-2006:0328FEDORA-2006-411FEDORA-2006-410MDKSA-2006:076MDKSA-2006:075GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm10255021622210331994119902198631986219852198111979419759197461972919721197141969619631SUSE-SA:2006:02120060404-01-USCOSA-2006.26oval:org.mitre.oval:def:1811Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to inject arbitrary Javascript into other sites by (1) "using a modal alert to suspend an event handler while a new page is being loaded", (2) using eval(), and using certain variants involving (3) "new Script;" and (4) using window.__proto__ to extend eval, aka "cross-site JavaScript injection".Fixed in: Firefox 1.5
Firefox 1.0.8
Mozilla Suite 1.7.13
SeaMonkey 1.0mozilla-eventhandler-xss(25806)ADV-2006-1356USN-276-1USN-275-1USN-271-1SSRT061158SSRT061158FLSA:189137-2FLSA:189137-1RHSA-2006:0330RHSA-2006:0329RHSA-2006:0328FEDORA-2006-411FEDORA-2006-410SUSE-SA:2006:004SUSE-SA:2006:004http://www.mozilla.org/security/announce/2006/mfsa2006-09.htmlMDKSA-2006:076GLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm2285261025502162221033200511995019941199021986319862198521982319821198111978019759197461972919721197141969619631oval:org.mitre.oval:def:9167SUSE-SA:2006:02120060404-01-USCOSA-2006.26MDKSA-2006:078oval:org.mitre.oval:def:1855The JavaScript engine in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 does not properly handle temporary variables that are not garbage collected, which might allow remote attackers to trigger operations on freed memory and cause memory corruption.Fixed in: Firefox 1.5
Firefox 1.0.8
Thunderbird 1.5
Thunderbird 1.0.8
SeaMonkey 1.0
Mozilla Suite 1.7.13VU#492382ADV-2006-1356SSRT061158SUSE-SA:2006:004http://www.mozilla.org/security/announce/2006/mfsa2006-10.html228526oval:org.mitre.oval:def:11808mozilla-garbage-memory-corruption(25807)USN-276-1USN-275-1USN-271-1HPSBUX02122FLSA:189137-2FLSA:189137-1RHSA-2006:0330RHSA-2006:0329RHSA-2006:0328FEDORA-2006-411FEDORA-2006-410SUSE-SA:2006:004MDKSA-2006:076MDKSA-2006:075GLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm1025502162221033200511995019941199021986319862198521982319811197941978019759197461972919721197141969619631SUSE-SA:2006:02120060404-01-USCOSA-2006.26oval:org.mitre.oval:def:1087Multiple SQL injection vulnerabilities in form.php in JBook 1.4 allow remote attackers to execute arbitrary SQL commands via the (1) nom or (2) mail parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-13151745819613jbook-form-sql-injection(25735)Buffer overflow in pl_main.c in sail in BSDgames before 2.17-7 allows local users to execute arbitrary code via a long player name that is used in a scanf function call.24634DSA-10361968717401http://www.pulltheplug.org/fu/?q=node/56http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=360989736Cross-site scripting (XSS) vulnerability in login.php in Bitweaver 1.3 allows remote attackers to inject arbitrary web script or HTML via the error parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-13701740619673Directory traversal vulnerability in PHPList 2.10.2 and earlier allows remote attackers include arbitrary local files via the (1) GLOBALS[database_module] or (2) GLOBALS[language_module] parameters, which overwrite the underlying $GLOBALS variable.20060411 Re: PHPList <= 2.10.2 remote commands executionADV-2006-12961742920061012 new version of phplist fix XSS vulnerability20060410 PHPList <= 2.10.2 remote commands executionhttp://tincan.co.uk/?lid=8511015889http://downloads.securityfocus.com/vulnerabilities/exploits/PHPList-lfi.phpphplist-index-file-include(25701)PHP remote file inclusion vulnerability in Virtual War (VWar) 1.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter to (1) admin/admin.php, (2) war.php, (3) stats.php, (4) news.php, (5) joinus.php, (6) challenge.php, (7) calendar.php, (8) member.php, (9) popup.php, and other unspecified scripts in the admin folder. NOTE: these are different attack vectors than CVE-2006-1636 and CVE-2006-1503.17443http://www.blogcu.com/Liz0ziM/431925/http://liz0zim.no-ip.org/vwar.txtvirtualwar-member-file-include(28265)1938720060408 Virtual War File İnclusion165820060807 Virtual War v1.5.0 Remote File Include (vwar_root)Cross-site scripting (XSS) vulnerability in XMB Forum 1.9.5 allows remote attackers to inject arbitrary web script or HTML by uploading a Flash (.SWF) video that contains a getURL function call, which causes the video to be rendered without disabling ActionScript.1744520060409 XMB Forum 1.9.5-Final XSSxmb-swf-geturl-xss(25737)PHP remote file inclusion vulnerability in config.php in phpListPro 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the returnpath parameter. NOTE: this issue was later reported to affect 2.01 as well.phplistpro-config-file-include(25760)ADV-2006-13251744820060508 PhpListPro 2.01 Remote File Include Vulnerability20060411 phpListPro <= 2.0 - Remote File Include Vulnerability2454019625Multiple cross-site scripting (XSS) vulnerabilities in index.php in Autogallery 0.41 allow remote attackers to inject arbitrary web script or HTML via the (1) pic or (2) show parameters.autogallery-index-xss(25756)ADV-2006-132817480http://www.elitemexico.org/12.txt1962920060411 Autogallery Multiple Cross-Site Scripting VulnerabilitieMultiple SQL injection vulnerabilities in MvBlog before 1.6 allow remote attackers to execute arbitrary SQL commands via unknown vectors.1748119634mvblog-multiple-sql-injection(25765)ADV-2006-1330http://dev.mvblog.org/cgi-bin/trac.cgi/ticket/54Multiple cross-site scripting (XSS) vulnerabilities in the backend in MvBlog before 1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) body fields in a comment.19634ADV-2006-133017481http://dev.mvblog.org/cgi-bin/trac.cgi/ticket/55mvblog-comment-xss(25767)A cron job in fcheck before 2.7.59 allows local users to overwrite arbitrary files via a symlink attack on a temporary file.This vulnerability is addressed in the following product releases:
Fcheck, 2.7.59-7sarge1
Fcheck, 2.7.59-8
DSA-10351967517524fcheck-tmpfile-symlink(25830)SQL injection vulnerability in index.php in SWSoft Confixx 3.0.6, 3.0.8, and 3.1.2 allows remote attackers to execute arbitrary SQL commands via the SID parameter.19611ADV-2006-13311747620060411 Confixx 3.1.2 <= SQL Injectionconfixx-index-sql-injection(25749)20060419 Confixx SQL Injection exploit (confixx_exploit.pl)20060413 Re: Confixx 3.1.2 <= SQL Injectionhttp://download1.swsoft.com/Confixx/security_hotfix/release_notes.txtSQL injection vulnerability in admin.php in MD News 1 allows remote attackers to execute arbitrary SQL commands via the id parameter.ADV-2006-12591739419530http://evuln.com/vulns/120/summary.htmlmdnews-admin-sql-injection(25635)20060418 [eVuln] MD News Authentication Bypass and SQL Injection Vulnerabilities24454MD News 1 allows remote attackers to bypass authentication via a direct request to a script in the Administration Area.ADV-2006-12591739419530http://evuln.com/vulns/120/summary.htmlmdnews-admin-security-bypass(25636)20060418 [eVuln] MD News Authentication Bypass and SQL Injection Vulnerabilities24455Cross-site scripting (XSS) vulnerability in index.php in Vegadns 0.99 allows remote attackers to inject arbitrary web script or HTML via the message parameter.1743320060410 Vegadns blind sql injection and cross site scriptingSQL injection vulnerability in index.php in Vegadns 0.99 allows remote attackers to execute arbitrary SQL commands via the cid parameter.ADV-2006-12981743320060410 Vegadns blind sql injection and cross site scripting19614vegadns-index-sql-injection(25741)Cross-site scripting (XSS) vulnerability in allgemein_transfer.php in SWSoft Confixx 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the jahr parameter.19611ADV-2006-13311746620060410 Confixx 3.1.2 <= Cross Site Scripting Vuln1015890confixx-transfer-xss(25748)Multiple cross-site scripting (XSS) vulnerabilities in JetPhoto allow remote attackers to inject arbitrary web script or HTML via the page parameter in (1) Classic.view/thumbnail.php, (2) Classic.view/gallery.php, (3) Classic.view/detail.php, or (4) Orange.view/detail.php; or (5) the name parameter in Orange.view/slideshow.php.jetphoto-name-page-xss(25745)ADV-2006-130017449244942449324492244911960320060411 JetPhoto Multiple Cross-Site Scripting VulnerabilitieCross-site scripting vulnerability in index.php in blur6ex 0.3.452 allows remote attackers to inject arbitrary web script or HTML via the errormsg parameter, which is not sanitized in the error message. NOTE: the vector in the shard parameter is not XSS and has been assigned a separate name.1746520060411 Multiple vulnerabilities in Blur6ex20060412 Multiple vulnerabilities in Blur6ex (fwd)blur6ex-index-xss(25757)20060413 Re: Multiple vulnerabilities in Blur6exDirectory traversal vulnerability in index.php in blur6ex 0.3.452 allows remote attackers to include arbitrary files via the shard parameter. NOTE: this issue can be exploited to produce resultant XSS when the parameter has XSS manipulations, and path disclosure with other invalid values.1746520080502 blur6ex-0.3.462 LOCAL FILE INCLUSION Vulnerbility20060411 Multiple vulnerabilities in Blur6ex20060412 Multiple vulnerabilities in Blur6ex (fwd)blur6ex-index-path-disclosure(25758)20060413 Re: Multiple vulnerabilities in Blur6exMultiple SQL injection vulnerabilities in index.php in blur6ex 0.3.452 allows remote attackers to execute arbitrary SQL commands via the ID parameter in a (1) g_reply or (2) g_permaPost action to the blog shard (engine/shards/blog.php), or a (3) g_viewContent action to the content shard (engine/shards/content.php).1746520060411 Multiple vulnerabilities in Blur6exblur6ex-index-sql-injection(25759)689Hosting Controller 6.1 stores forum/db/forum.mdb under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as user name and password credentials. NOTE: the provenance of this information is unknown; the details are obtained from third party information.ADV-2006-12682444719569Cross-site scripting (XSS) vulnerability in index.php in JBook 1.3 allows remote attackers to inject arbitrary web script or HTML via the page parameter.1741920060410 Jbook Cross Site Scriptingjbook-index-xss(25734)19613Multiple SQL injection vulnerabilities in Papoo 2.1.5, and 3 beta1 and earlier, allow remote attackers to execute arbitrary SQL commands via the (1) getlang and (2) reporeid parameter in (a) index.php, (3) menuid parameter in (b) plugin.php and (c) forumthread.php, and (4) msgid parameter in forumthread.php.papoo-multiple-scripts-sql-injection(25728)http://pridels0.blogspot.com/2006/04/papoo-multiple-sql-vuln.htmlMultiple PHP remote file inclusion vulnerabilities in nicecoder.com INDEXU 5.0.0 and 5.0.1 allow remote attackers to execute arbitrary PHP code via a URL in the theme_path parameter in (1) index.php, (2) become_editor.php, (3) add.php, (4) bad_link.php, (5) browse.php, (6) detail.php, (7) fav.php, (8) get_rated.php, (9) login.php, (10) mailing_list.php, (11) new.php, (12) modify.php, (13) pick.php, (14) power_search.php, (15) rating.php, (16) register.php, (17) review.php, (18) rss.php, (19) search.php, (20) send_pwd.php, (21) sendmail.php, (22) tell_friend.php, (23) top_rated.php, (24) user_detail.php, and (25) user_search.php; and the (26) base_path parameter in invoice.php.1747020060411 INDEXU <= 5.0.1 (theme_path)and (base_path) Remote File Inclusion Exploit10158912842728426284252842228419284172841628415284132841228410284092840624597245961016331http://ftp.kep.online.fr/Indexu_5.0.1_File_Inclusion_Exploit-by_King-Hacker_and-Khamaileon.txtMultiple cross-site scripting (XSS) vulnerabilities in register.php in Tritanium Bulletin Board (TBB) 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) newuser_name, (2) newuser_email, and (3) newuser_hp parameters in the faction=register mode in index.php.Succesful exploitation requires that "register_globals" is enabled.ADV-2006-13291747320060411 Tritanium Bulletin Board 1.2.3 - XSStritaniumbb-register-xss(25751)2455619635Multiple cross-site scripting (XSS) vulnerabilities in UserLand Manila 9.5 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the mode parameter in msgReader$1 and (2) the end of the URI in viewDepartment$.1747520060411 Manila <= 9.5 - XSS Vulnerabilitiesmanila-multiple-xss(25753)2455469219636Multiple PHP remote file inclusion vulnerabilities in Azerbaijan Design & Development Group (AZDG) AzDGVote allow remote attackers to execute arbitrary PHP code via a URL in the int_path parameter in (1) vote.php, (2) view.php, (3) admin.php, and (4) admin/index.php.ADV-2006-132420060411 AzDGVote File inclusion19630azdgvote-intpath-file-inclusion(25762)17447695Directory traversal vulnerability in misc in pbcs.dll in SAXoTECH SAXoPRESS, aka Saxotech Online (formerly Publicus) allows remote attackers to read arbitrary files and possibly execute arbitrary programs via a .. (dot dot) in the url parameter.saxopress-pbcs-directory-traversal(25768)ADV-2006-13271747420060412 Re: SAXoPRESS - directory traversal aka Saxotech Online20060411 SAXoPRESS - directory traversal19566debconf in Debian GNU/Linux, when configuring mnogosearch in the mnogosearch-common 3.2.31-1 package, uses the world-readable config.dat file instead of the restricted passwords.dat for storing the cleartext database administrator password in the mnogosearch-common/database_admin_pass record, which allows local users to view the password.17477http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=36177519589SQL injection vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier allows remote attackers to execute arbitrary SQL commands via the contentid parameter, possibly involving content/news.php.17467http://www.hamid.ir/security/phpkit.txt1015888phpkit-contentid-sql-injection(25743)HP System Management Homepage (SMH) 2.1.3.132, when running on CompaqHTTPServer/9.9 on Windows, Linux, or Tru64 UNIX, and when "Trust by Certificates" is not enabled, allows remote attackers to bypass authentication via a crafted URL.The only way to prevent this is to set the Trust level to "Trust by Certificates"20060411 [SRC-Telindus advisory] - HP System Management Homepage Remote Unauthorized Accesshttp://src.telindus.com/articles/hpsm_vulnerability.html1015901hp-smh-auth-bypass(25761)Multiple cross-site scripting (XSS) vulnerabilities in phpBB 2.0.19 allow remote attackers to inject arbitrary web script or HTML via the (1) Site Description field in (a) admin_board.php, the (2) Group name and (3) Group description fields in (b) admin_groups.php and (c) groupcp.php, the (4) Theme Name field in (d) admin_styles.php, and the (5) Rank Title field in (e) admin_ranks.php. NOTE: the profile.php/Current password vector is already covered by CVE-2006-1603.24357243562435524354http://osvdb.org/ref/24/24353-phpbb.txtPHP remote file inclusion vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the s parameter.ADV-2006-13321749020060412 Simplog <=0.9.2 multiple vulnerabilities24559101590419628http://retrogod.altervista.org/simplog_092_incl_xpl.html1663simplog-index-file-include(25775)Directory traversal vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the s parameter, as demonstrated by injecting PHP sequences into an Apache error_log file, which is then included by doc/index.php.ADV-2006-13321749020060412 Simplog <=0.9.2 multiple vulnerabilities24559101590419628http://retrogod.altervista.org/simplog_092_incl_xpl.html1663simplog-index-file-include(25775)Multiple SQL injection vulnerabilities in Jeremy Ashcraft Simplog 0.9.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) blogid parameter in (a) index.php and (b) archive.php, the (2) m and (3) y parameters in archive.php, and the (4) sql parameter in (c) server.php.ADV-2006-13321749120060412 Simplog <=0.9.2 multiple vulnerabilities2456124560101590419628http://retrogod.altervista.org/simplog_092_incl_xpl.html1663simplog-index-archive-sql-injection(25776)702Cross-site scripting (XSS) vulnerability in login.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the btag parameter.ADV-2006-13321749320060412 Simplog <=0.9.2 multiple vulnerabilities24562101590419628http://retrogod.altervista.org/simplog_092_incl_xpl.html1663simplog-login-xss(25778)The Bourne shell (sh) in Solaris 8, 9, and 10 allows local users to cause a denial of service (sh crash) via an unspecified attack vector that causes sh processes to crash during creation of temporary files.Apply patches.19627ADV-2006-1333102282solaris-sh-dos(25744)17478http://support.avaya.com/elmodocs2/security/ASA-2006-122.htm101590221493oval:org.mitre.oval:def:881PHP remote file inclusion vulnerability in functions.php in Circle R Monster Top List (MTL) 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter. NOTE: It was later reported that 1.4.2 and earlier are affected.monstertoplist-functions-file-include(25774)ADV-2006-1350230741754624650353019688http://pridels0.blogspot.com/2006/04/monstertoplist.htmlUnspecified vulnerability in Solaris 8 and 9 allows local users to obtain the LDAP Directory Server root Distinguished Name (rootDN) password when a privileged user (1) runs idsconfig; or "insecurely" runs LDAP2 commands with the -w option, including (2) ldapadd, (3) ldapdelete, (4) ldapmodify, (5) ldapmodrdn, and (6) ldapsearch.ADV-2006-133410211319638solaris-ldap2-password-disclosure(25747)17479245682456724566245652456424563http://support.avaya.com/elmodocs2/security/ASA-2006-122.htm101590321493oval:org.mitre.oval:def:1840Cross-site scripting (XSS) vulnerability in PatroNet CMS allows remote attackers to inject arbitrary web script or HTML via the URI.1749520060412 PatroNet CMS Xss VulnPHP remote file inclusion vulnerability in admin/configset.php in Sphider 1.3 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the settings_dir parameter.ADV-2006-134117514196421665sphider-configset-file-inclusion(25780)Adobe Document Server for Reader Extensions 6.0 allows remote authenticated users to inject arbitrary web script via a leading (1) ftp or (2) http URI in the ReaderURL variable in the "Update Download Site" section of ads-readerext. NOTE: it is not clear whether the vendor advisory addresses this issue. In addition, since the issue requires administrative privileges to exploit, it is not clear whether this crosses security boundaries.ADV-2006-1342http://www.adobe.com/support/techdocs/322699.htmlhttp://secunia.com/secunia_research/2005-68/advisory/15924adobe-readerurl-xss(25770)1750020060413 Secunia Research: Adobe Document Server for Reader ExtensionsMultiple Vulnerabilities24588Cross-site scripting (XSS) vulnerability in Adobe Document Server for Reader Extensions 6.0 allows remote attackers to inject arbitrary web script or HTML via (1) the actionID parameter in ads-readerext and (2) the op paremeter in AlterCast. NOTE: it is not clear whether the vendor advisory addresses this issue.ADV-2006-1342http://www.adobe.com/support/techdocs/322699.htmlhttp://secunia.com/secunia_research/2005-68/advisory/15924adobe-actionid-op-xss(25771)1750020060413 Secunia Research: Adobe Document Server for Reader ExtensionsMultiple Vulnerabilities2459024589Adobe Document Server for Reader Extensions 6.0 includes a user's session (jsession) ID in the HTTP Referer header, which allows remote attackers to gain access to PDF files that are being processed within that session.http://www.adobe.com/support/techdocs/331915.htmlADV-2006-1342http://www.adobe.com/support/techdocs/322699.htmlhttp://secunia.com/secunia_research/2005-68/advisory/15924adobe-jsessionid-information-disclosure(25773)1750020060413 Secunia Research: Adobe Document Server for Reader ExtensionsMultiple VulnerabilitiesAdobe Document Server for Reader Extensions 6.0, during log on, provides different error messages depending on whether the user ID is valid or invalid, which allows remote attackers to more easily identify valid user IDs via brute force attacks.http://www.adobe.com/support/techdocs/331917.htmlADV-2006-1342http://secunia.com/secunia_research/2005-68/advisory/15924adobe-error-account-enumeration(25772)1750020060413 Secunia Research: Adobe Document Server for Reader ExtensionsMultiple VulnerabilitiesDirectory traversal vulnerability in pajax_call_dispatcher.php in PAJAX 0.5.1 and earlier allows remote attackers to read arbitrary files via the $className variable.Users of PAJAX should upgrade to the latest version pajax-0.5.2 [1].ADV-2006-1353http://www.redteam-pentesting.de/advisories/rt-sa-2006-001.phppajax-pajaxcalldispatcher-dir-traversal(25860)1751920060413 PAJAX Remote Code Injection and File Inclusion Vulnerability248621965320060413 PAJAX Remote Code Injection and File Inclusion VulnerabilityA regression fix in Mozilla Firefox 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the InstallTrigger.install method, which leads to memory corruption.mozilla-installtrigger-memory-corruption(25809)ADV-2006-1356USN-276-1USN-275-1USN-271-117516SSRT061158SSRT061158FLSA:189137-2FLSA:189137-1RHSA-2006:0330RHSA-2006:0329RHSA-2006:0328FEDORA-2006-411FEDORA-2006-410http://www.mozilla.org/security/announce/2006/mfsa2006-11.htmlMDKSA-2006:076MDKSA-2006:075GLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm228526102550216222103320051199501994119902198631986219852198111979419780197591974619729197211971419631oval:org.mitre.oval:def:11202SUSE-SA:2006:02120060404-01-USCOSA-2006.26oval:org.mitre.oval:def:1266Directory traversal vulnerability in acc.php in QuickBlogger 1.4 allows remote attackers to read or include arbitrary local files via the request parameter. NOTE: this issue can also produce resultant XSS when the associated include statement fails.20060412 QuickBlogger v1.4 Cross-Site Scripting15942quickblogger-acc-xss(25795)20060414 Re: QuickBlogger v1.4 Cross-Site ScriptingUnspecified vulnerability in the POP service in MailEnable Standard Edition before 1.94, Professional Edition before 1.74, and Enterprise Edition before 1.22 has unknown attack vectors and impact related to "authentication exploits". NOTE: this is a different set of affected versions, and probably a different vulnerability than CVE-2006-1337.http://www.mailenable.com/standardhistory.asphttp://www.mailenable.com/professionalhistory.asphttp://www.mailenable.com/enterprisehistory.aspDirectory traversal vulnerability in runCMS 1.2 and earlier allows remote attackers to read arbitrary files via the bbPath[path] parameter to (1) class.forumposts.php and (2) forumpollrenderer.php. NOTE: this issue is closely related to CVE-2006-0659.Succesful exploitation requires that register_globals = On & allow_url_fopen = On20060209 runCMS <= 1.3a2 possible remote code execution through the integrated FCKEditor packagehttp://retrogod.altervista.org/runcms_13a_xpl.html16578SQL injection vulnerability in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via (1) the $username variable in the mosGetParam function and (2) the $task parameter in the mosMenuCheck function in (a) includes/mambo.php; and (3) the $filter variable to the showCategory function in the com_content component (content.php).Successful exploitation requires that "magic_quotes_gpc" is disabled.16775http://www.gulftech.org/?node=research&article_id=00104-02242006http://source.mambo-foundation.org/view/news/Announcements/Security_Patch_Released/20060224 Mambo Multiple VulnerabilitiesADV-2006-0719235032340218935mambo-index2-sql-injection(24951)Cross-site scripting (XSS) vulnerability in tablepublisher.cgi in UPDI Network Enterprise @1 Table Publisher 2006-03-23 allows remote attackers to inject arbitrary web script or HTML via the Title of Table field.http://www.osvdb.org/24238http://www.osvdb.org/242381764219723Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly other versions before 2.0.1, allows remote attackers to inject arbitrary web script or HTML to Internet Explorer users via the request URI ($_SERVER['REQUEST_URI']).The vulnerability manifests itself only when viewed by IE.
This vulnerability is addressed in the following product release:
Wordpress 2.0.1-1http://trac.wordpress.org/ticket/1686http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=328909The kernel in NetBSD-current before September 28, 2005 allows local users to cause a denial of service (system crash) by using the SIOCGIFALIAS ioctl to gather information on a non-existent alias of a network interface, which causes a NULL pointer dereference.17497101590819615NetBSD-SA2006-012bsd-siocgifalias-ioctl-dos(25766)24578SQL injection vulnerability in rateit.php in RateIt 2.2 allows remote attackers to execute arbitrary SQL commands via the rateit_id parameter.ADV-2006-135819637http://evuln.com/vulns/124/summary.htmlrateit-rateit-sql-injection(25801)1751820060424 [eVuln] RateIt SQL Injection Vulnerability246221015983censtore.cgi in Censtore 7.3.002 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter.ADV-2006-13521751519666censtore-page-command-execution(25905)1669Directory traversal vulnerability in posts.php in SimpleBBS 1.0.6 through 1.1 allows remote attackers to include and execute arbitrary files via ".." sequences in the language cookie, as demonstrated by by injecting the code into the gl_session cookie of users.php, which is stored in error.log.http://www.worlddefacers.de/Public/WD-SMPL.txt1750120060412 SimpleBBS v1.1(posts.php) remote command executionhttp://downloads.securityfocus.com/vulnerabilities/exploits/SimpleBBS-RCE-posts.php.plsimplebbs-posts-command-execution(25788)Cross-site scripting (XSS) vulnerability in planetsearchplus.php in planetSearch+ allows remote attackers to inject arbitrary web script or HTML via the search_exp parameter.ADV-2006-136820060413 planetSearch+ - XSS Vulnerabilities19681http://d4igoro.blogspot.com/2006/04/planetsearch-xss-vulnerabilities.htmlplanetsearchplus-script-xss(25832)17527Cross-site scripting (XSS) vulnerability in index.php in TinyWebGallery 1.3 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the twg_album parameter.ADV-2006-13691753620060415 Tiny Web Gallery <= 1.4 XSS19660tinywebgallery-index-xss(25831)20060606 Re: Tiny Web Gallery <= 1.4 XSS717Cross-site scripting (XSS) vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to inject arbitrary web script or HTML via the sql_query parameter.ADV-2006-13721748720060414 Re: phpMyAdmin 2.7.0-pl120060412 phpMyAdmin 2.7.0-pl119659phpmyadmin-sql-xss(25796)SUSE-SR:2006:00919897SQL injection vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to execute arbitrary SQL commands via the sql_query parameter.This vulnerbability may affect earlier versions of phpMyAdmin as well.ADV-2006-137220060412 phpMyAdmin 2.7.0-pl119659phpmyadmin-sql-sql-injection(25858)SUSE-SR:2006:00919897SQL injection vulnerability in member.php in PowerClan 1.14 allows remote attackers to execute arbitrary SQL commands via the memberid parameter.19689ADV-2006-137120060413 PowerClan 1.14 - SQL Injectionhttp://d4igoro.blogspot.com/2006/04/powerclan-114-sql-injection.htmlpowerclan-member-sql-injection(25876)17528706Cross-site scripting (XSS) vulnerability in index.php in Musicbox 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the term parameter in a search action.ADV-2006-137319672musicbox-multiple-xss(27925)musicbox-index-xss(25835)1754520060724 MusicBox <= 2.3.4 XSS SQL injection Vulnerabilityhttp://pridels0.blogspot.com/2006/04/musicbox-vuln.htmlMultiple SQL injection vulnerabilities in index.php in Musicbox 2.3.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) start parameter in a search action or (2) type parameter in a top action.ADV-2006-137319672musicbox-multiple-sql-injection(27926)musicbox-index-sql-injection(25836)1754520060724 MusicBox <= 2.3.4 XSS SQL injection Vulnerabilityhttp://pridels0.blogspot.com/2006/04/musicbox-vuln.htmlCross-site scripting (XSS) vulnerability in index.php in Lifetype 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the show parameter in a Template operation.ADV-2006-136720060414 Vulnerabilities in lifetype101594119646lifetype-index-xss(25899)17529index.php in Lifetype 1.0.3 allows remote attackers to obtain sensitive information via an invalid show parameter, which reveals the path in an error message.20060414 Vulnerabilities in lifetype1015941lifetype-index-path-disclosure(25903)711Multiple cross-site scripting (XSS) vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to inject arbitrary web script or HTML via the (1) ICQ, (2) AIM, (3) MSN, (4) Google Talk, (5) Website Name, (6) Website Address, (7) Email Address, (8) Location, (9) Signature, and (10) Sub-Titles fields in the user profile.1753920060416 FlexBB v0.5.5 BETA [SQL Inj] [XSS] [Login bypass]Multiple SQL injection vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to execute arbitrary SQL commands via the (1) id, (2) forumid, or (3) threadid parameter to index.php; the (4) ICQ, (5) AIM, (6) MSN, (7) Google Talk, (8) Website Name, (9) Website Address, (10) Email Address, (11) Location, (12) Signature, and (13) Sub-Titles fields in the user profile; or (14) flexbb_password field in a cookie.20060416 FlexBB v0.5.5 BETA [SQL Inj] [XSS] [Login bypass]17574phpWebFTP 3.2 and earlier stores script.js under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information.1755720060417 PhpWebFTP 3.2 Login Scriptphpwebftp-scriptjs-obtain-information(25921)19706Directory traversal vulnerability in index.php in phpWebFTP 3.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the language parameter.ADV-2006-13881755720060417 PhpWebFTP 3.2 Login Scriptphpwebftp-index-directory-traversal(25920)72319706NetBSD 1.6, 2.0, 2.1 and 3.0 allows local users to cause a denial of service (memory exhaustion) by using the sysctl system call to lock a large buffer into physical memory.17498101590919616bsd-sysctl-dos(25764)24579Multiple cross-site scripting (XSS) vulnerabilities in register.php in Tritanium Bulletin Board (TBB) 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) newuser_realname and (2) newuser_icq parameters, a different vector than CVE-2006-1768. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-13292455619635tritaniumbb-register-xss(25751)693PHP remote file inclusion vulnerability in VBulletin 3.5.1, 3.5.2, and 3.5.4 allows remote attackers to execute arbitrary code via a URL in the systempath parameter to (1) ImpExModule.php, (2) ImpExController.php, and (3) ImpExDisplay.php.20060412 Remote File Inclusion in VBulletin ImpEximpex-systempath-file-include(34095)impex-multiple-file-inclusion(25789)20070504 Remote File Include In Script impex24692246912469019352SQL injection vulnerability in authcheck.php in warforge.NEWS 1.0, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the (1) authusername and possibly the (2) authpassword cookie.ADV-2006-1359http://evuln.com/vulns/125/summary.htmlwarforgenews-authcheck-sql-injection(25900)177051752020060426 [eVuln] warforge.NEWS SQL Injection and Multiple XSS VulnerabilitiesMultiple cross-site scripting (XSS) vulnerabilities in warforge.NEWS 1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly including the (1) first_name and (2) last_name parameter in myaccounts.php. NOTE: portions of these details were obtained from third party sources instead of the original disclosure.ADV-2006-1359http://evuln.com/vulns/125/summary.html1752020060426 [eVuln] warforge.NEWS SQL Injection and Multiple XSS VulnerabilitiesDirectory traversal vulnerability in the loadConfig function in index.php in phpWebSite 0.10.2 and earlier allows remote attackers to include arbitrary local files and execute arbitrary PHP code via the hub_dir parameter, as demonstrated by including access_log. NOTE: in some cases, arbitrary remote file inclusion could be performed under PHP 5 using an SMB share argument such as "\\systemname\sharename".ADV-2006-136117521http://downloads.securityfocus.com/vulnerabilities/exploits/PHPWebSite_fi_pocphpwebsite-index-hubdir-file-include(25867)GLSA-200605-04101594219914196471673Cross-site scripting (XSS) vulnerability in index.php in ModX 0.9.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this might be resultant from the directory traversal vulnerability.ADV-2006-13831753320060414 Vulnerabilities in MODx1015940modx-index-xss(25894)19645Directory traversal vulnerability in index.php in ModX 0.9.1 allows remote attackers to read arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the id parameter.To address this issue, the vendor has released a patch available at the following location:
http://modxcms.com/forums/index.php/topic,3982.0.htmlADV-2006-13831753320060414 Vulnerabilities in MODx1015940modx-index-directory-traversal(25895)19645Cross-site scripting (XSS) vulnerability in search.php in FarsiNews 2.5.3 Pro and earlier allows remote attackers to inject arbitrary web script or HTML via the selected_search_arch parameter.ADV-2006-14111753420060414 Farsinews Cross-Site Scripting & Path disclosure vulnerabilityhttp://www.aria-security.net/advisory/farsinews/farsinews042006.txt1015943farsinews-search-xss(25833)71019648Directory traversal vulnerability in FarsiNews 2.5.3 Pro and earlier allows remote attackers to obtain the installation path via ".." sequences in the archive parameter to index.php, which leaks the full pathname in an error message.ADV-2006-141120060414 Farsinews Cross-Site Scripting & Path disclosure vulnerability101594371019648Multiple cross-site scripting (XSS) vulnerabilities in PhpGuestbook.php in PhpGuestbook 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) Website, and (3) Comment parameter.ADV-2006-1422phpguestbook-script-xss(25850)175941753720060415 PhpGuestbook <= 1.0 XSS19669http://pridels0.blogspot.com/2006/04/phpguestbook-v10-script-insertion.htmlCross-site scripting (XSS) vulnerability in index.php in phpLinks 2.1.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the term parameter.ADV-2006-1378phplinks-index-xss(25890)17586http://pridels0.blogspot.com/2006/04/phplinks-2131-xss-vuln.htmlMultiple cross-site scripting (XSS) vulnerabilities in Snipe Gallery 3.1.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gallery_id parameter in view.php, (2) keyword parameter in search.php, and (3) image_id parameter in image.php. NOTE: it is possible that vectors 1 and 3 are resultant from SQL injection.snipe-view-image-xss(25803)1754320060416 Re: Snipe Gallery <= 3.1.4 Multiple XSS20060415 Snipe Gallery <= 3.1.4 Multiple XSS1015947Integer signedness error in format_jpeg.c in Asterisk 1.2.6 and earlier allows remote attackers to execute arbitrary code via a length value that passes a length check as a negative number, but triggers a buffer overflow when it is used as an unsigned length.http://www.cipher.org.uk/index.php?p=advisories/Asterisk_Codec_Integer_Overflow_07-04-2006.advisoryhttp://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.7-patch.gzADV-2006-147817561SUSE-SR:2006:009DSA-1048198971987219800SQL injection vulnerability in php121language.php in PHP121 1.4 allows remote attackers to execute arbitrary SQL commands and execute arbitrary code via the sess_username variable, as set by the php121un HTTP COOKIE parameter, which is used in multiple files including php121login.php. NOTE: the code execution occurs because the SQL query results are used in an include statement.Successful exploitation requires that "magic_quotes_gpc" is disabled.ADV-2006-1349196431666php121-php121login-sql-injection(25785)175091015936http://retrogod.altervista.org/php121im_14_sql_xpl.htmlEAServer Manager in Sybase EAServer 5.2 and 5.3 allows remote authenticated users, possibly guests, to obtain password credentials of arbitrary users via unspecified vectors involving (1) connection caches, (2) open password prompts, and (3) stored custom connection profiles.ADV-2006-1344http://www.sybase.com/detail?id=104011717508101591319605easerver-password-disclosure(25777)Sun Java Studio Enterprise 8, when installed as root, creates certain files with world-writable permissions, which allows local users to execute arbitrary commands via unspecified vectors.1751710229219632ADV-2006-1357sun-javastudio-insecure-permissions(25822)1015930Direct static code injection vulnerability in sysinfo.cgi in sysinfo 1.21 and possibly other versions before 2.25 allows remote attackers to execute arbitrary commands via a leading ; (semicolon) in the name parameter in a systemdoc action, which is injected into phpinfo.php.17523sysinfo-sysinfo-command-execution(25906)ADV-2006-1360196901677sysinfo.cgi in sysinfo 1.21 allows remote attackers to obtain the installation path via the debugger action.17523ADV-2006-1360sysinfo-debugger-information-disclosure(25909)196901677Intel RNG Driver in NetBSD 1.6 through 3.0 may incorrectly detect the presence of the pchb interface, which will cause it to always generate the same random number, which allows remote attackers to more easily crack encryption keys generated from the interface.24577101590719585NetBSD-SA2006-009netbsd-intel-rng-security-bypass(25786)17496Integer signedness error in Opera before 8.54 allows remote attackers to execute arbitrary code via long values in a stylesheet attribute, which pass a length check. NOTE: a sign extension problem makes the attack easier with shorter strings.17513ADV-2006-1354http://www.sec-consult.com/259.htmlhttp://www.opera.com/docs/changelogs/windows/854/101591220060413 SEC Consult SA-20060314 :: Opera Browser CSS Attribute Integer Wrap / Buffer Overflowopera-wcsncpy-css-bo(25829)20060413 SEC Consult SA-20060314 :: Opera Browser CSS Attribute Integer Wrap / Buffer OverflowGLSA-200606-0120117SUSE-SR:2006:010Cross-site scripting (XSS) vulnerability in yearcal.php in Calendarix allows remote attackers to inject arbitrary web script or HTML via the ycyear parameter.ADV-2006-13761756220060416 Calendarix "yearcal.php" XSS Attackingcalendarix-yearcal-xss(25874)101595472719710Untrusted search path vulnerability in unspecified components in Symantec LiveUpdate for Macintosh 3.0.0 through 3.5.0 do not set the execution path, which allows local users to gain privileges via a Trojan horse program.http://securityresponse.symantec.com/avcenter/security/Content/2006.04.17b.htmlADV-2006-13861757120060418 [Symantec Security Advisory] LiveUpdate for Macintosh Local Privilege Escalation101595319682liveupdate-exepath-env-privilege-escalation(25839)100SQL injection vulnerability in archiv2.php in Fuju News 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.ADV-2006-137417572196771682fujunews-archiv2-sql-injection(25897)edit_kategorie.php in Fuju News 1.0 allows remote attackers to bypass authentication by setting the authorized cookie.ADV-2006-137417572196771682PHP remote file inclusion vulnerability in language.php in PHP Album 0.3.2.3, when register_globals is enabled, allows remote attackers to execute arbitrary code via an FTP URL in the data_dir parameter, which satisfies the file_exists function call.ADV-2006-138220060415 PHP Album <= 0.3.2.3 remote commnads execution19661http://retrogod.altervista.org/phpalbum_0323_incl_xpl.htmlphpalbum-language-file-include(25846)1752624741Multiple format string vulnerabilities in Empire Server before 4.3.1 allow attackers to cause a denial of service (crash) via the (1) load, (2) spy and (3) bomb functions.http://sourceforge.net/project/shownotes.php?release_id=410001&group_id=2403119674empireserver-unspecified(25863)ADV-2006-13801758524700Cross-site scripting (XSS) vulnerability in search.php in boastMachine (bMachine) 2.7, and possibly other versions before 2.9b, allows remote attackers to inject arbitrary web script or HTML via the key parameter, as used by the search field.ADV-2006-137520060416 Xss In bMachine 2٫719711boastmachine-search-xss(25914)17550Cross-site scripting (XSS) vulnerability in global.php in ShoutBOOK 1.1 allows remote attackers to inject arbitrary web script or HTML via the (1) NAME and (2) COMMENTS parameters.ADV-2006-13851754820060417 ShoutBOOK <= 1.1 XSS101595819704shoutbook-global-xss(25862)Cross-site scripting (XSS) vulnerability in global.php in ShoutBOOK 1.1 allows remote attackers to inject arbitrary web script or HTML via the (1) LOCATION and (2) URL parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-138519704shoutbook-global-xss(25862)The Debian installer for the (1) shadow 4.0.14 and (2) base-config 2.53.10 packages includes sensitive information in world-readable log files, including preseeded passwords and pppoeconf passwords, which might allow local users to gain privileges.23922http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=35693919170** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-0537. Reason: This candidate is a duplicate of CVE-2006-0537. Notes: All CVE users should reference CVE-2006-0537 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.Cross-site scripting (XSS) vulnerability in the Your_Account module in PHP-Nuke 7.8 might allows remote attackers to inject arbitrary HTML and web script via the ublock parameter, which is saved in the user's personal menu. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. In addition, it is unclear whether this issue is a vulnerability, since it is related to the user's personal menu, which presumably is not modifiable by others.ADV-2006-0687167742343118972SQL injection vulnerability in the Your_Account module in PHP-Nuke 7.8 might allows remote attackers to execute arbitrary SQL commands via the user_id parameter in the Your_Home functionality. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.phpnuke-yourhome-sql-injection(44730)ADV-2006-0687167742343218972Multiple cross-site scripting (XSS) vulnerabilities in stats_view.php in LinPHA 1.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) date_from, (2) date_to, and (3) date parameter.ADV-2006-13961758120060417 Linpha 1.1.0 - XSS Vulnerabilities19679http://d4igoro.blogspot.com/2006/04/linpha-xss-vulnerabilities.htmllinpha-statsview-xss(25916)Multiple SQL injection vulnerabilities in members_only/index.cgi in xFlow 5.46.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) position and (2) id parameter.ADV-2006-141219707xflow-index-sql-injection(25853)17614http://pridels0.blogspot.com/2006/04/xflow-v5x-multiple-vuln.htmlMultiple cross-site scripting (XSS) vulnerabilities in xFlow 5.46.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) level, (2) position, (3) id, and (4) action parameters to members_only/index.cgi, and the (5) page parameter to customer_area/index.cgi.ADV-2006-141219707xflow-index-xss(25854)17614http://pridels0.blogspot.com/2006/04/xflow-v5x-multiple-vuln.htmlxFlow 5.46.11 and earlier allows remote attackers to determine the installation path of the application via the (1) action parameter to members_only/index.cgi and (2) page parameter customer_area/index.cgi, probably due to invalid values.xflow-index-path-disclosure(25855)17614http://pridels0.blogspot.com/2006/04/xflow-v5x-multiple-vuln.htmlSQL injection vulnerability in category.php in Article Publisher Pro 1.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cname parameter.articlepublisher-category-sql-injection(25898)24730http://pridels0.blogspot.com/2006/04/article-publisher-pro-sql-inj.htmlMultiple SQL injection vulnerabilities in ModernBill 4.3.2 and earlier allow remote attackers or administrators to execute arbitrary SQL commands via the (1) id parameter in (a) user.php, or (2) where and (3) order parameters to (b) admin.php.ADV-2006-14151759619641modernbill-user-sql-injection(25926)http://pridels0.blogspot.com/2006/04/modernbill-multiple-sql-inj-vuln.html** DISPUTED ** Multiple cross-site scripting (XSS) vulnerabilities in BluePay Manager 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML during a login action via the (1) Account Name and (2) Username field. NOTE: the vendor has disputed this vulnerability, saying that "it does not exist currently in the Bluepay 2.0 product," and older versions might not have been affected either. As of 20060512, CVE has not formally investigated this dispute.http://pridels0.blogspot.com/2006/04/bluepay-manager-v20-script-insertion.htmlchoose_new_parent in Linux kernel before 2.6.11.12 includes certain debugging code, which allows local users to cause a denial of service (panic) by causing certain circumstances involving termination of a parent process.https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=127302oval:org.mitre.oval:def:11235USN-302-118099RHSA-2006:0493SUSE-SA:2006:042DSA-1184http://support.avaya.com/elmodocs2/security/ASA-2006-161.htm2209321745211792071620237Certain modifications to the Linux kernel 2.6.16 and earlier do not add the appropriate Linux Security Modules (LSM) file_permission hooks to the (1) readv and (2) writev functions, which might allow attackers to bypass intended access restrictions.https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=191524[linux-kernel] 20060426 [PATCH] LSM: add missing hook to do_compat_readv_writev()oval:org.mitre.oval:def:9927[linux-security-module] 20050928 readv/writev syscalls are not checked by lsmUSN-302-118105RHSA-2006:049325747MDKSA-2006:123DSA-1184http://support.avaya.com/elmodocs2/security/ASA-2006-161.htm2209321745210452071620237Buffer overflow in SCTP in Linux kernel before 2.6.16.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a malformed HB-ACK chunk.linux-sctp-hback-dos(26584)ADV-2006-2554ADV-2006-1893USN-302-118085RHSA-2006:057525695SUSE-SA:2006:047SUSE-SA:2006:042MDKSA-2006:150MDKSA-2006:123DSA-1103DSA-1097http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm22417214982147621465211792104520914207162067120185oval:org.mitre.oval:def:10622http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.17SCTP in Linux kernel before 2.6.16.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a chunk length that is inconsistent with the actual length of provided parameters.linux-sctp-parameter-dos(26585)ADV-2006-2554ADV-2006-1893USN-302-118085RHSA-2006:061725696SUSE-SA:2006:047SUSE-SA:2006:042MDKSA-2006:150MDKSA-2006:123DSA-1103DSA-1097http://support.avaya.com/elmodocs2/security/ASA-2006-203.htm22174216052149821476211792104520914207162067120185oval:org.mitre.oval:def:9510http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.17Memory leak in __setlease in fs/locks.c in Linux kernel before 2.6.16.16 allows attackers to cause a denial of service (memory consumption) via unspecified actions related to an "uninitialised return value," aka "slab leak."20083ADV-2006-1767http://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.16.y.git;a=commit;h=1f0e637c94a9b041833947c79110d6c02fff8618http://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.16.y.git;a=blobdiff;h=aa7f66091823dde953e15895dc427615701c39c7;hp=e75ac392a313f3fad823bf2e46a03f29701e3e34;hb=1f0e637c94a9b041833947c79110d6c02fff8618;f=fs/locks.clinux-locks-setlease-dos(26438)USN-302-12006-002818033SUSE-SA:2006:042MDKSA-2006:123211792104520716lease_init in fs/locks.c in Linux kernel before 2.6.16.16 allows attackers to cause a denial of service (fcntl_setlease lockup) via actions that cause lease_init to free a lock that might not have been allocated on the stack.1794320083ADV-2006-1767http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.16http://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.16.y.git;a=commit;h=1f0e637c94a9b041833947c79110d6c02fff8618http://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.16.y.git;a=blobdiff;h=aa7f66091823dde953e15895dc427615701c39c7;hp=e75ac392a313f3fad823bf2e46a03f29701e3e34;hb=1f0e637c94a9b041833947c79110d6c02fff8618;f=fs/locks.clinux-locks-lease-init-dos(26437)USN-302-12006-002825425SUSE-SA:2006:042MDKSA-2006:123211792104520716Multiple integer overflows in FreeType before 2.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to (1) bdf/bdflib.c, (2) sfnt/ttcmap.c, (3) cff/cffgload.c, and (4) the read_lwfn function and a crafted LWFN file in base/ftmac.c. NOTE: item 4 was originally identified by CVE-2006-2493.freetype-lwfn-overflow(26553)18034http://sourceforge.net/project/shownotes.php?release_id=41646320100FEDORA-2009-5644FEDORA-2009-5558https://issues.rpath.com/browse/RPL-429https://bugzilla.redhat.com/show_bug.cgi?id=502565https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=190593#c8https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=190593https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=128606ADV-2007-0381ADV-2006-1868USN-291-120060612 rPSA-2006-0100-1 freetypeRHSA-2009:1062RHSA-2009:0329RHSA-2006:0500MDKSA-2006:099GLSA-200710-09DSA-1095http://support.avaya.com/elmodocs2/security/ASA-2006-176.htmhttp://support.apple.com/kb/HT34381027051016522GLSA-200607-023523335204352003393727271271672716223939217012138521135210622100020791206382059120525oval:org.mitre.oval:def:9124SUSE-SA:2006:037SUSE-SR:2007:021APPLE-SA-2009-02-1220060701-01-UThe virtual memory implementation in Linux kernel 2.6.x allows local users to cause a denial of service (panic) by running lsof a large number of times in a way that produces a heavy system load.RHSA-2006:0493https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189260https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189031oval:org.mitre.oval:def:939031663http://support.avaya.com/elmodocs2/security/ASA-2006-161.htm2174520237Directory traversal vulnerability in CIFS in Linux 2.6.16 and earlier allows local users to escape chroot restrictions for an SMB-mounted filesystem via "..\\" sequences, a similar vulnerability to CVE-2006-1864.https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189434http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=296034f7de8bdf111984ce1630ac598a9c94a253ADV-2006-2554ADV-2006-1542RHBA-2007-0304oval:org.mitre.oval:def:10383kernel-cifs-directory-traversal(26141)2006-00241774225068SUSE-SA:2006:028MDKSA-2006:151MDKSA-2006:150http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.11DSA-110321614209142039819868Directory traversal vulnerability in smbfs in Linux 2.6.16 and earlier allows local users to escape chroot restrictions for an SMB-mounted filesystem via "..\\" sequences, a similar vulnerability to CVE-2006-1863.https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189435ADV-2006-4502ADV-2006-2554oval:org.mitre.oval:def:11327kernel-smbfs-directory-traversal(26137)http://www.vmware.com/download/esx/esx-254-200610-patch.htmlhttp://www.vmware.com/download/esx/esx-213-200610-patch.htmlhttp://www.vmware.com/download/esx/esx-202-200610-patch.htmlUSN-302-12006-00261773520061113 VMSA-2006-0008 - VMware ESX Server 2.0.2 Upgrade Patch 220061113 VMSA-2006-0005 - VMware ESX Server 2.5.4 Upgrade Patch 120061113 VMSA-2006-0007 - VMware ESX Server 2.1.3 Upgrade Patch 220061113 VMSA-2006-0006 - VMware ESX Server 2.5.3 Upgrade Patch 4RHSA-2006:0710RHSA-2006:0580RHSA-2006:0579RHSA-2006:049325067SUSE-SA:2006:028MDKSA-2006:151MDKSA-2006:150DSA-1103DSA-1097http://support.avaya.com/elmodocs2/security/ASA-2006-254.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-161.htm23064228752249721745216142147621035209142071620671203982023719869Argument injection vulnerability in Beagle before 0.2.5 allows attackers to execute arbitrary commands via crafted filenames that inject command line arguments when Beagle launches external helper applications while indexing.https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189282beagle-indexing-command-execution(26104)1761124938SUSE-SR:2006:009198971978119778http://scary.beasts.org/security/CESA-2006-002.htmlFEDORA-2006-440Multiple unspecified vulnerabilities in Oracle Database Server 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and other versions have unknown impact and attack vectors in the (1) Advanced Replication component, as identified by Vuln# DB01, and (2) Oracle Spatial component, as identified by Vuln# DB10. NOTE: details are unavailable from Oracle, but as of 20060421, they have not publicly disputed a claim by a reliable independent researcher that states that DB01 is an unknown issue in the DBMS_REPUTIL package, and DB10 is SQL injection in the INSERT_CATALOG, UPDATE_CATALOG, and DELETE_CATALOG functions of the SDO_CATALOG package.TA06-109AVU#139049http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html101596119712oracle-sdocatalog-sql-injection(26054)oracle-dbmsreputil-sql-injection(26050)ADV-2006-1571ADV-2006-139717590SSRT061148SSRT061148http://www.red-database-security.com/advisory/oracle_cpu_apr_2006.html19859Unspecified vulnerability in Oracle Database Server 9.2.0.6 has unknown impact and attack vectors in the Advanced Replication component, aka Vuln# DB02.http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html1015961ADV-2006-1571ADV-2006-139717590HPSBMA0211319712oracle-database-multiple-unspecified(26068)SSRT06114819859Buffer overflow in the Advanced Replication component in Oracle Database Server 10.1.0.4 allows database users to execute arbitrary code via the VERIFY_LOG procedure of the DBMS_SNAPSHOT_UTL package, aka Vuln# DB03.VU#797465TA06-109Ahttp://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html1015961oracle-dbmssnapshotutl-bo(26049)ADV-2006-1571ADV-2006-139717590HPSBMA02113SSRT06114820060420 [Argeniss] Oracle Database 10gR1 Buffer overflow in VERIFY_LOG procedurehttp://www.red-database-security.com/advisory/oracle_cpu_apr_2006.htmlhttp://www.argeniss.com/research/ARGENISS-ADV-040603.txt1985919712Unspecified vulnerability in Oracle Database Server 8.1.7.4 and 9.0.1.5 has unknown impact and attack vectors in the Dictionary component, aka Vuln# DB04.TA06-109AVU#241481http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html1015961ADV-2006-1571ADV-2006-139717590HPSBMA0211319712oracle-dictionary-constraint-modification(26052)SSRT06114819859Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.2 has unknown impact and attack vectors in the Export component, aka Vuln# DB05. NOTE: details are unavailable from Oracle, but as of 20060427, they have not publicly commented on whether DB05 is the same issue as CVE-2006-2081.VU#452681http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html1015961ADV-2006-1571ADV-2006-139717590HPSBMA02113HPSBMA02113http://www.red-database-security.com/advisory/oracle_cpu_apr_2006.html1985919712SQL injection vulnerability in Oracle Database Server 9.2.0.7 and 10.1.0.5 allows remote attackers to execute arbitrary SQL commands via the DELETE_FROM_TABLE function in the DBMS_LOGMNR_SESSION (Log Miner) package, aka Vuln# DB06.1015961oracle-dbmslogmnrsession-sql-injection(26047)ADV-2006-1571ADV-2006-139717590SSRT061148HPSBMA0211320060418 SQL Injection in package SYS.DBMS_LOGMNR_SESSIONhttp://www.red-database-security.com/advisory/oracle_sql_injection_dbms_logmnr_session.htmlhttp://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html198591971220060418 SQL Injection in package SYS.DBMS_LOGMNR_SESSIONUnspecified vulnerability in Oracle Database Server 9.0.1.5 and 9.2.0.7 has unknown impact and attack vectors in the Oracle Enterprise Manager Intelligent Agent component, aka Vuln# DB07.Apply patches :
http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.htmlADV-2006-1571ADV-2006-139717590HPSBMA02113http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html101596119712oracle-database-multiple-unspecified(26068)HPSBMA0211319859Unspecified vulnerability in Oracle Database Server 9.2.0.7, 10.1.0.4, and 10.2.0.1 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB08.Apply patches :
http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.htmloracle-database-multiple-unspecified(26068)ADV-2006-1571ADV-2006-139717590HPSBMA02113HPSBMA02113http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html10159611985919712Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, and 9.2.0.6 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB09. NOTE: Oracle has not disputed reliable claims that this issue is SQL injection in MDSYS.PRVT_IDX using the (1) EXECUTE_INSERT, (2) EXECUTE_DELETE, (3) EXECUTE_UPDATE, (4) EXECUTE UPDATE, and (5) CRT_DUMMY functions.Apply patches.oracle-prvtidx-sql-injection(26053)ADV-2006-1571ADV-2006-139717590SSRT061148HPSBMA02113http://www.red-database-security.com/advisory/oracle_cpu_apr_2006.htmlhttp://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html10159611985919712Unspecified vulnerability in Oracle Database Server 9.0.1.5, 9.2.0.7, and 10.1.0.5 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB11. NOTE: Oracle has not disputed reliable researcher claims that this issue is SQL injection in MDSYS.SDO_LRS_TRIG_INS.The most severe of these vulnerabilities could possibly expose affected computers to complete compromise.17590http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html101596119712oracle-sdolrstrigins-sql-injection(26055)ADV-2006-1571ADV-2006-1397HPSBMA02113HPSBMA02113http://www.red-database-security.com/advisory/oracle_cpu_apr_2006.html19859Unspecified vulnerability in Oracle Database Server 9.2.0.7 and 10.1.0.4 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB12. NOTE: details are unavailable from Oracle, but as of 20060421, they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the (1) GEN_RID_RANGE_BY_AREA and (2) GEN_RID_RANGE functions in the MDSYS.SDO_PRIDX package.VU#240249http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html1015961oracle-sdopridx-sql-injection(26051)ADV-2006-1571ADV-2006-139717590HPSBMA02113SSRT061148http://www.red-database-security.com/advisory/oracle_cpu_apr_2006.html1985919712Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, and 9.2.0.7 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB13.http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html1015961oracle-database-multiple-unspecified(26068)ADV-2006-1571ADV-2006-139717590HPSBMA02113SSRT061148248611985919712Cross-site scripting (XSS) vulnerability in index.php in phpFaber TopSites allows remote attackers to inject arbitrary web script or HTML via the page parameter.ADV-2006-13941754220060415 phpFaber TopSites Script Cross-Site Scriptingphpfabertopsites-index-xss(25804)101594576071919652Multiple unspecified vulnerabilities in the Email Server component in Oracle Collaboration Suite 9.0.4.2, 10.1.1, 10.1.2.0, and 10.1.2.1 have unknown impact and attack vectors, aka Vuln# (1) OCS01, (2) OCS02, (3) OCS03, and (4) OCS04.TA06-109AVU#879041VU#54914617590http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html101596119712ADV-2006-1571ADV-2006-1397SSRT061148oracle-collab-unauth-access(26057)HPSBMA0211319859Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.10CU2 have unknown impact and attack vectors, as identified by Vuln# (1) APPS01 in the (a) Application Install component; (2) APPS09 in the (b) Oracle Diagnostics Interfaces component; (3) APPS10 in the (c) Oracle General Ledger component; (4) APPS12 and (5) APPS13 in the (d) Oracle Receivables component.VU#94072917590http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html101596119712ADV-2006-1571ADV-2006-1397HPSBMA02113oracle-ebusiness-multiple-unspecifed(26058)SSRT06114819859Unspecified vulnerability in the Financials for Asia/Pacific component in Oracle E-Business Suite and Applications 11.5.9 has unknown impact and attack vectors. component, aka Vuln# APPS02.17590http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html101596119712ADV-2006-1571ADV-2006-1397HPSBMA02113oracle-ebusiness-multiple-unspecifed(26058)HPSBMA0211319859Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.10 have unknown impact and attack vectors, as identified by Vuln# (1) APPS03 in (a) iProcurement; (2) APPS04 in (b) Oracle Application Object Library; (3) APPS06, (4) APPS07, and (5) APPS08 in (c) Oracle Applications Technology Stack; and (6) APPS11 in (d) Oracle Order Capture.VU#824833VU#61919417590http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html101596119712ADV-2006-1571ADV-2006-1397HPSBMA02113oracle-ebusiness-multiple-unspecifed(26058)SSRT06114819859Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite and Applications 11.5.10CU1 has unknown impact and attack vectors, aka Vuln# APPS05.17590http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html101596119712ADV-2006-1571ADV-2006-1397HPSBMA02113oracle-ebusiness-multiple-unspecifed(26058)SSRT06114819859Unspecified vulnerability in the Oracle Thesaurus Management System component in Oracle E-Business Suite and OPA 4.5.2 Applications has unknown impact and attack vectors, aka Vuln# OPA01.The vendor has addressed this issue through the release of product updates:
http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html
17590http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html101596119712oracle-ebusiness-multiple-unspecifed(26058)ADV-2006-1571ADV-2006-1397HPSBMA02113HPSBMA0211319859Multiple unspecified vulnerabilities in the Reporting Framework component in Oracle Enterprise Manager 9.0.1.5 and 9.2.0.7 have unknown impact and attack vectors, aka Vuln# (1) EM01 and (2) EM02.VU#44326517590http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html101596119712ADV-2006-1571ADV-2006-1397HPSBMA02113oracle-reporting-framework-access(26056)HPSBMA0211319859Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Enterprise 8.46.12 and 8.47.04 has unknown impact and attack vectors, aka Vuln# PSE01.TA06-109A17590http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html101596119712ADV-2006-1571ADV-2006-1397HPSBMA02113oracle-peopletools-unspecified(26059)SSRT06114819859Unspecified vulnerability in Oracle JD Edwards EnterpriseOne Security Server 8.95.J1 has unknown impact and attack vectors, aka Vuln# JDE01.TA06-109A17590http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html101596119712ADV-2006-1571ADV-2006-1397HPSBMA02113oracle-jdedwards-enterpriseone-unspecified(26069)HPSBMA0211319859phpGraphy 0.9.11 and earlier allows remote attackers to bypass authentication and gain administrator privileges via a direct request to index.php with the editwelcome parameter set to 1, which can then be used to modify the main page to inject arbitrary HTML and web script. NOTE: XSS attacks are resultant from this issue, since normal functionality allows the admin to modify pages.1756719705phpgraphy-index-xss(25892)ADV-2006-137920060418 Re: - PHPGraphy <= 0.9.11 20060417 - PHPGraphy <= 0.9.11 1015971733http://retrogod.altervista.org/phpgraphy_0911_adv.htmlCross-site scripting (XSS) vulnerability in the search action handler in index.php in Nils Asmussen (aka SCRIPTSOLUTION) Boardsolution 1.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the "Search for" item (keyword parameter).ADV-2006-14131754920060415 Boardsolution <= 1.12 XSSboardsolution-index-xss(25805)101594876671819654Multiple PHP remote file inclusion vulnerabilities in myWebland myEvent 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the myevent_path parameter in (1) event.php and (2) initialize.php. NOTE: vector 2 was later reported to affect 1.4 as well.myevent-myevent-file-include(28347)myevent-event-initialize-file-include(25882)ADV-2006-13841757520060416 MyEvent Remote File Execution And XSS Attacking2472324722101661676772619680Cross-site scripting (XSS) vulnerability in Martin Scheffler betaboard 0.1 allows remote attackers to inject arbitrary web script or HTML via a user's profile, possibly using the FormVal_profile parameter. NOTE: it is not clear whether this is a distributable product or a site-specific vulnerability. If it is site-specific, then it should not be included in CVE.betaboard-editprofile-xss(25838)ADV-2006-13771755620060416 BetaBoard Cross Site Scripting vulnerability10159551970020060416 BetaBoard Cross Site Scripting vulnerability765724avast! 4 Linux Home Edition 1.0.5 allows local users to modify permissions of arbitrary files via a symlink attack on the /tmp/_avast4_ temporary directory.ADV-2006-13871753520060414 Avast Linux Home Edition (vulnerability on a temporary folder creation)76471219683Cross-site scripting (XSS) vulnerability in print.php in ar-blog 5.2 allows remote attackers to inject arbitrary web script or HTML via the id parameter.1752220060413 Xss In ar-blog v 5.2arblog-print-xss(25834)763Cross-site scripting (XSS) vulnerability in RevoBoard 1.8, as derived from PunBB, allows remote attackers to inject arbitrary web script or HTML via a substitution cipher of the email tag, which is transformed when the application's e-mail address obfuscator reverses the transformation. NOTE: it is not clear whether this is a site-specific issue; however, the claimed codebase relationship with PunBB might be relevant.20060413 RevoBoard [email] tag XSS768Direct static code injection vulnerability in includes/template.php in phpBB allows remote authenticated users with write access to execute arbitrary PHP code by modifying a template in a way that (1) bypasses a loose ".*" regular expression to match BEGIN and END statements in overall_header.tpl, or (2) is used in an eval statement by includes/bbcode.php for bbcode.tpl.1757320060414 phpBB template file code executionphpbb-template-code-execution(25888)769Unspecified vulnerability in phpBB allows remote authenticated users with Administration Panel access to execute arbitrary PHP code via crafted Font Colour 3 ($theme[fontcolor3] variable) and/or signature values, possibly involving the highlight functionality. NOTE: the original report does not clarify whether this issue is static code injection, eval injection, or another type of vulnerability.DSA-106620197phpbb-admin-code-execution(25889)20060418 Re: phpBB Admin command execution20060414 phpBB Admin command execution76271520093Webplus (aka talentsoft) Web+Shop 5.3.6, when Redirect URL for "Script Not Found" Error is not configured, allows remote attackers to obtain sensitive information via a quote (') or possibly other invalid value in the storeid parameter in store.wml in webplus.exe, which reveals the path in a "Script Not Found" error message.2462120060413 TalentSoft Web+Shop Path Disclosure19662webplusshop-webplus-path-disclosure(25802)761703Multiple cross-site scripting (XSS) vulnerabilities in Ralph Capper Tiny PHP Forum (TPF) 3.6 allow remote attackers to inject arbitrary web script or HTML via (1) the uname parameter in a view action in profile.php and (2) a login name. NOTE: the "Access to hash password" issue is already covered by CVE-2006-0103.20060417 Tiny PHP forum - vulnstinyphpforum-profile-error-xss(25856)17553773728Multiple cross-site scripting (XSS) vulnerabilities in dev Neuron Blog 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) website parameters.ADV-2006-140620060417 Neuron Blog <= 1.1 XSSneuronblog-addcomment-xss(25913)17552101596019703Multiple buffer overflows in World Wide Web Consortium (W3C) Amaya 9.4, and possibly other versions including 8.x before 8.8.5, allow remote attackers to execute arbitrary code via a long value in (1) the COMPACT attribute of the COLGROUP element, (2) the ROWS attribute of the TEXTAREA element, and (3) the COLOR attribute of the LEGEND element; and via other unspecified attack vectors consisting of "dozens of possible snippets."amaya-various-attribute-bo(25791)246242462319670ADV-2006-135117507http://morph3us.org/advisories/20060412-amaya-94.txthttp://morph3us.org/advisories/20060412-amaya-94-2.txt20060412 [BuHa-Security] Stack Based Buffer Overflow Vulnerability in Amaya 9.4 #220060412 [BuHa-Security] Stack Based Buffer Overflow Vulnerability in Amaya 9.4Mozilla Camino 1.0 and earlier allow remote attackers to cause a denial of service (null dereference and application crash or hang) via HTML with certain improperly nested elements. NOTE: this might be the same issue as CVE-2006-1724.20060413 Camino Browser HTML Parsing Null Pointer Dereference Denial of Service Vulnerability772fold_binary in fold-const.c in GNU Compiler Collection (gcc) 4.1 improperly handles pointer overflow when folding a certain expr comparison to a corresponding offset comparison in cases other than EQ_EXPR and NE_EXPR, which might introduce buffer overflow vulnerabilities into applications that could be exploited by context-dependent attackers.NOTE: the vendor states that the essence of the issue is "not correctly interpreting an offset to a pointer as a signed value."20060418 RE: gcc 4.1 bug miscompiles pointer range checks, may place you at risk20060417 gcc 4.1 bug miscompiles pointer range checks, may place you at risk20060418 Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk20060418 Re: gcc 4.1 bug miscompiles pointer range checks, may place you at riskhttp://gcc.gnu.org/viewcvs/branches/gcc-4_1-branch/gcc/fold-const.c?r1=110549&r2=112698&pathrev=112698&diff_format=h[gcc-bugs] 20060417 [Bug middle-end/27180] New: pointer arithmetic overflow handling broken[gcc-bugs] 20060417 [Bug c/27180] New: pointer arithmetic overflow handling brokenhttp://gcc.gnu.org/bugzilla/show_bug.cgi?id=26763http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356896Multiple cross-site scripting (XSS) vulnerabilities in UserLand Manila allow remote attackers to inject arbitrary web script or HTML (1) via the referer parameter in sendMail, and via attributes of (2) the A element and certain other HTML elements in web pages edited with the editInBrowser module. NOTE: the msgReader$1 mode attack vector is already covered by CVE-2006-1769.20060414 manila.userland cross site scriptable1756517563Cross-site scripting (XSS) vulnerability in index.php in AnimeGenesis Gallery allows remote attackers to inject arbitrary web script or HTML via the cat parameter.ADV-2006-139520060417 AnimeGenesis <= XSSMultiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.3 allow remote attackers to execute arbitrary code via format string specifiers in a long filename on an EXTINFO line in a playlist file.ADV-2006-14321757920060418 Remote Xine Format String Vulnerabilityxine-playlist-format-string(25851)24747SUSE-SA:2006:025MDKSA-2006:085GLSA-200604-15http://sourceforge.net/mailarchive/message.php?msg_id=154298451015959200661985419671http://open-security.org/advisories/16Cross-site scripting (XSS) vulnerability in index.php in jjgan852 phpLister 0.4.1 allows remote attackers to inject arbitrary web script or HTML via the page parameter.20060418 phpLister v. 0.4.1 XSS Attackinghttp://advisory.patriotichackers.com/index.php?itemid=3phplister-index-xss(25910)17591770735Multiple SQL injection vulnerabilities in myEvent 1.x allow remote attackers to inject arbitrary SQL commands via the event_id parameter to (1) addevent.php or (2) del.php or (3) event_desc parameter to addevent.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-138419680myevent-addevent-del-sql-injection(25886)2472124720Cross-site scripting vulnerability in addevent.php in myEvent 1.x allows remote attackers to inject arbitrary web script or HTML via the event_desc parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-138419680myevent-addevent-xss(25885)24719Directory traversal vulnerability in index.php in Coppermine 1.4.4 allows remote attackers to read arbitrary files via a .//./ (modified dot dot slash) in the file parameter, which causes a regular expression to collapse the sequences into standard "../" sequences.ADV-2006-13921757020060416 Re: [KAPDA]CopperminePhotoGallery1.4.4~ PluginInclusionSystem(index.php)~ RemoteFileInclusion attack20060415 [KAPDA]CopperminePhotoGallery1.4.4~ PluginInclusionSystem(index.php)~ RemoteFileInclusion attack19665http://myimei.com/security/2006-04-14/copperminephotogallery144-plugininclusionsystemindexphp-remotefileinclusion-attack.htmlcoppermine-index-file-include(25866)config.php in S9Y Serendipity 1.0 beta 2 allows remote attackers to inject arbitrary PHP code by editing values that are stored in config.php and later executed. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.1756620040614 Serendipity Blog vulnCross-site scripting (XSS) vulnerability in MyBB (MyBulletinBoard) 1.1 allows remote attackers to inject arbitrary web script or HTML via the attachment content disposition in an HTML attachment.This vulnerability is addressed in the following product release:
MyBB, MyBB, 1.1.119668http://community.mybboard.net/showthread.php?tid=8232ADV-2006-1381mybb-html-attachment-xss(25864)MyBB (MyBulletinBoard) 1.1.0 does not set the constant KILL_GLOBAL variable in (1) global.php and (2) inc/init.php, which allows remote attackers to initialize arbitrary variables that are processed by an @extract command, which could then be leveraged to conduct cross-site scripting (XSS) or SQL injection attacks.Upgrade to MyBB 1.1.1mybb-global-init-data-manipulation(25865)ADV-2006-1381247112471019668http://myimei.com/security/2006-04-14/mybb110globalphpparameterextracting.htmlhttp://community.mybboard.net/showthread.php?tid=823220060415 [KAPDA]MyBB1.1.0~global.php~ParameterExtractingCross-site scripting (XSS) vulnerability in jax_guestbook.php in Jax Guestbook 3.1, 3.31, and 3.50 allows remote attackers to inject arbitrary web script or HTML via the page parameter.ADV-2006-18001756016337http://lostmon.blogspot.com/2005/08/jax-php-scripts-multiple.htmljaxguestbook-admin-xss(26448)249912011019843http://kiki91.altervista.org/exploit/jax.txtDbbS 2.0-alpha and earlier allows remote attackers to obtain sensitive information via an invalid (1) fcategoryid parameter to topics.php or (2) unavariabile, (3) GLOBALS, or (4) _SERVER[] parameters to script.php. NOTE: this information leak might be resultant from a global variable overwrite issue.20060416 DbbS<=2.0-alpha Multiple Vulnerabilitiesdbbs-multiple-path-disclosure(25922)771SQL injection vulnerability in topics.php in DbbS 2.0-alpha and earlier allows remote attackers to execute arbitrary SQL commands via the fcategoryid parameter.20060416 DbbS<=2.0-alpha Multiple Vulnerabilities771661Multiple cross-site scripting (XSS) vulnerabilities in profile.php in DbbS 2.0-alpha and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ulocation or (2) uhobbies parameters.1755920060416 DbbS<=2.0-alpha Multiple Vulnerabilitiesdbbs-profile-xss(25923)771SQL injection vulnerability in member.php in Blackorpheus ClanMemberSkript 1.0 allows remote attackers to execute arbitrary SQL commands via the userID parameter.ADV-2006-140517558http://downloads.securityfocus.com/vulnerabilities/exploits/Blackorpheus_pocblackorpheus-member-sql-injection(25902)196781683Multiple cross-site scripting (XSS) vulnerabilities in Papoo 2.1.5 allow remote attackers to inject arbitrary web script or HTML via the menuid parameter to (1) index.php or (2) forum.php, or the (3) reporeid_print parameter to print.php.10159391753020060414 Vulnerabilities in PapooPHP remote file inclusion vulnerability in index.php in Internet Photoshow 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.ADV-2006-1417197261694ip-index-file-include(25937)1762024743SQL injection vulnerability in index.php in PMTool 1.2.2 allows remote attackers to execute arbitrary SQL commands via the order parameter in the include files (1) user.inc.php, (2) customer.inc.php, and (3) project.inc.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-141619685pmtool-order-sql-injection(25877)17599247822478124780nettools.php in PHP Net Tools 2.7.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the host parameter.ADV-2006-1420196941695phpnettools-nettools-command-execution(25941)1760120060609 [VIM] Update Regarding CVE-2006-1921 (fwd)PHP remote file inclusion vulnerability in (1) about.php or (2) auth.php in TotalCalendar allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter.ADV-2006-141819730176182475124748http://sweetphp.com/files/downloads/patches/TotalCalendar/Security_Patch.ziphttp://pridels0.blogspot.com/2006/04/totalcalendar-remote-code-execution.htmlMultiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.1.1 allow remote attackers to inject arbitrary web script or HTML via (1) RSS/RSS.php and (2) possibly other vectors.19719ADV-2006-1424linpha-rss-xss(26269)176192481620060420 LinPHA provenance/acknowledgementSQL injection vulnerability in functions/db_api.php in LinPHA 1.1.1 allows remote attackers to execute arbitrary SQL commands via unknown vectors.19719ADV-2006-1424linpha-functionsdbapi-sql-injection(26268)176192481720060420 LinPHA provenance/acknowledgementDirectory traversal vulnerability in the editnews module (inc/editnews.mdu) in index.php in CuteNews 1.4.1 allows remote attackers to read or modify files via the source parameter in the (1) editnews or (2) doeditnews action. NOTE: this can also produce resultant XSS when the target file does not exist.cutenews-index-source-xss(25935)1759220060420 Re: CuteNews 1.4.1 <= Cross Site Scripting20060418 CuteNews 1.4.1 <= Cross Site Scripting775SQL injection vulnerability in showtopic.php in ThWboard 2.84 beta 3 and earlier allows remote attackers to execute arbitrary SQL commands via the pagenum parameter.1760620060419 ThWboard <= 3 Beta 2.84 SQL Injectionthwboard-showtopic-sql-injection(25891)20060613 Re: BUGTRAQ:20060611 ThWboard 3.0 <= SQL Injection20060611 ThWboard 3.0 <= SQL InjectionCisco IOS XR, when configured for Multi Protocol Label Switching (MPLS) and running on Cisco CRS-1 or Cisco 12000 series routers, allows remote attackers to cause a denial of service (Line card crash) via certain MPLS packets, as identified by Cisco bug ID CSCsc77475.Only systems that are running Cisco IOS XR and configured for MPLS are affected by this vulnerability.ADV-2006-14331760720060419 Cisco IOS XR MPLS Vulnerabilitiescisco-iosxr-mpls-dos(25881)101596419740Cisco IOS XR, when configured for Multi Protocol Label Switching (MPLS) and running on Cisco CRS-1 routers, allows remote attackers to cause a denial of service (Modular Services Cards (MSC) crash or "MPLS packet handling problems") via certain MPLS packets, as identified by Cisco bug IDs (1) CSCsd15970 and (2) CSCsd55531.ADV-2006-14331760720060419 Cisco IOS XR MPLS Vulnerabilitiescisco-iosxr-mpls-dos(25881)24811101596419740PHP remote file inclusion vulnerability in include/common.php in I-Rater Platinum allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.ADV-2006-143119684Irater-common-file-include(25963)1762324777http://pridels0.blogspot.com/2006/04/i-rater-platinum-remote-file-inclusion.html** DISPUTED ** Multiple SQL injection vulnerabilities in userscript.php in Green Minute 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) huserid, (2) pituus, or (3) date parameters. NOTE: this issue has been disputed by the vendor, saying "those parameters mentioned ARE checked (preg_match) before they are used in SQL-query... If someone decided to add SQL-injection stuff to certain parameter, they would see an error text, but only because _nothing_ was passed inside that parameter (to MySQL-database)." As allowed by the vendor, CVE investigated this report on 20060525 and found that the demo site demonstrated a non-sensitive SQL error when given standard SQL injection manipulations.greenminute-userscript-sql-injection(25942)25207http://pridels0.blogspot.com/2006/04/green-minute-sql-inj-vuln.htmlhttp://osvdb.org/ref/25/25207-dispute.txthttp://hoito.org/en/products/The HTTP/XMLRPC server in Ruby before 1.8.2 uses blocking sockets, which allows attackers to cause a denial of service (blocked connections) via a large amount of data.https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189540http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-dev/27787ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.2-webrick-dos-1.patchoval:org.mitre.oval:def:11100ruby-socket-dos(26102)USN-273-117645RHSA-2006:042724972SUSE-SR:2006:012MDKSA-2006:079GLSA-200605-11DSA-1157101597821657204572006420024198041977216904ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.2-xmlrpc-dos-1.patchOff-by-one error in the OID printing routine in Ethereal 0.10.x up to 0.10.14 has unknown impact and remote attack vectors.http://www.ethereal.com/appnotes/enpa-sa-00023.htmlADV-2006-1501oval:org.mitre.oval:def:9823ethereal-oid-printing-offbyone(26012)17682RHSA-2006:0420FEDORA-2006-461FEDORA-2006-456MDKSA-2006:077GLSA-200604-17DSA-1049http://support.avaya.com/elmodocs2/security/ASA-2006-128.htm1015985209442021020117199621995819839198281980519769SUSE-SR:2006:01020060501-01-UMultiple unspecified vulnerabilities in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service (large or infinite loops) viarafted packets to the (1) UMA and (2) BER dissectors.http://www.ethereal.com/appnotes/enpa-sa-00023.htmlADV-2006-1501oval:org.mitre.oval:def:10841ethereal-ber-loop-dos(26024)ethereal-uma-dissector-dos(26008)17682RHSA-2006:0420FEDORA-2006-461FEDORA-2006-456MDKSA-2006:077GLSA-200604-17DSA-1049http://support.avaya.com/elmodocs2/security/ASA-2006-128.htm1015985209442021020117199621995819839198281980519769SUSE-SR:2006:01020060501-01-UMultiple buffer overflows in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the (1) ALCAP dissector, (2) Network Instruments file code, or (3) NetXray/Windows Sniffer file code.http://www.ethereal.com/appnotes/enpa-sa-00023.htmlADV-2006-1501oval:org.mitre.oval:def:10445ethereal-netxwin-sniffer-bo(26027)ethereal-net-instr-bo(26026)ethereal-alcap-dissector-bo(26014)17682RHSA-2006:0420FEDORA-2006-461FEDORA-2006-456MDKSA-2006:077GLSA-200604-17DSA-1049http://support.avaya.com/elmodocs2/security/ASA-2006-128.htm1015985209442021020117199621995819839198281980519769SUSE-SR:2006:01020060501-01-UBuffer overflow in Ethereal 0.9.15 up to 0.10.14 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the COPS dissector.http://www.ethereal.com/appnotes/enpa-sa-00023.htmlADV-2006-1501oval:org.mitre.oval:def:10811ethereal-cops-dissector-bo(26013)17682RHSA-2006:0420FEDORA-2006-461FEDORA-2006-456MDKSA-2006:077GLSA-200604-17DSA-1049http://support.avaya.com/elmodocs2/security/ASA-2006-128.htm1015985209442021020117199621995819839198281980519769SUSE-SR:2006:01020060501-01-UBuffer overflow in Ethereal 0.8.5 up to 0.10.14 allows remote attackers to execute arbitrary code via the telnet dissector.http://www.ethereal.com/appnotes/enpa-sa-00023.htmlADV-2006-1501oval:org.mitre.oval:def:10341ethereal-telnet-dissector-bo(26029)17682RHSA-2006:0420FEDORA-2006-461FEDORA-2006-456MDKSA-2006:077GLSA-200604-17DSA-1049http://support.avaya.com/elmodocs2/security/ASA-2006-128.htm1015985209442021020117199621995819839198281980519769SUSE-SR:2006:01020060501-01-UMultiple unspecified vulnerabilities in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service (crash from null dereference) via (1) multiple vectors in H.248, and the (2) X.509if, (3) SRVLOC, (4) H.245, (5) AIM, and (6) general packet dissectors; and (7) the statistics counter.http://www.ethereal.com/appnotes/enpa-sa-00023.htmlethereal-h248-dos(26031)ethereal-aim-dos(26019)ethereal-general-dissector-dos(26018)ethereal-statistics-counter-dos(26015)ethereal-h245-dos(26011)ethereal-srvloc-dos(26010)ethereal-x509if-dissector-dos(26009)ethereal-h248-dissector-dos(26007)ADV-2006-150117682RHSA-2006:0420FEDORA-2006-461FEDORA-2006-456MDKSA-2006:077GLSA-200604-17DSA-1049http://support.avaya.com/elmodocs2/security/ASA-2006-128.htm1015985209442021020117199621995819839198281980519769oval:org.mitre.oval:def:10323SUSE-SR:2006:01020060501-01-UMultiple unspecified vulnerabilities in Ethereal 0.8.x up to 0.10.14 allow remote attackers to cause a denial of service (crash from null dereference) via the (1) Sniffer capture or (2) SMB PIPE dissector.http://www.ethereal.com/appnotes/enpa-sa-00023.htmlADV-2006-1501oval:org.mitre.oval:def:9850ethereal-smbpipe-dos(26023)ethereal-sniffer-capture-dos(26016)17682RHSA-2006:0420FEDORA-2006-461FEDORA-2006-456MDKSA-2006:077GLSA-200604-17DSA-1049http://support.avaya.com/elmodocs2/security/ASA-2006-128.htm1015985209442021020117199621995819839198281980519769SUSE-SR:2006:01020060501-01-UMultiple unspecified vulnerabilities in Ethereal 0.9.x up to 0.10.14 allow remote attackers to cause a denial of service (crash from null dereference) via (1) an invalid display filter, or the (2) GSM SMS, (3) ASN.1-based, (4) DCERPC NT, (5) PER, (6) RPC, (7) DCERPC, and (8) ASN.1 dissectors.http://www.ethereal.com/appnotes/enpa-sa-00023.htmlADV-2006-1501oval:org.mitre.oval:def:11030ethereal-per-diss-dos(26033)ethereal-dcerpcnt-dissector-dos(26032)ethereal-asn1based-dissector-dos(26030)ethereal-gsmsms-dissector-dos(26028)ethereal-asn1-dissector-dos(26022)ethereal-dcerpc-dissector-dos(26021)ethereal-rpc-dos(26020)ethereal-display-filter-dos(26017)17682RHSA-2006:0420FEDORA-2006-461FEDORA-2006-456MDKSA-2006:077GLSA-200604-17DSA-1049http://support.avaya.com/elmodocs2/security/ASA-2006-128.htm1015985209442021020117199621995819839198281980519769SUSE-SR:2006:01020060501-01-UUnspecified vulnerability in Ethereal 0.10.4 up to 0.10.14 allows remote attackers to cause a denial of service (abort) via the SNDCP dissector.http://www.ethereal.com/appnotes/enpa-sa-00023.htmlADV-2006-1501oval:org.mitre.oval:def:9781ethereal-sndcp-dissector-dos(26025)17682RHSA-2006:0420FEDORA-2006-461FEDORA-2006-456MDKSA-2006:077GLSA-200604-17DSA-1049http://support.avaya.com/elmodocs2/security/ASA-2006-128.htm1015985209442021020117199621995819839198281980519769SUSE-SR:2006:01020060501-01-UNeon Responder 5.4 for LANsurveyor allows remote attackers to cause a denial of service (application outage) via a crafted Clock Synchronisation packet that triggers an access violation.20060417 Neon Responder (Dos,Exploit)ADV-2006-144217569neonresponder-clocksynchronization-dos(25904)101595077673119702Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2, and K-Meleon 0.9.13 allows user-assisted remote attackers to open local files via a web page with an IMG element containing a SRC attribute with a non-image file:// URL, then tricking the user into selecting View Image for the broken image, as demonstrated using a .wma file to launch Windows Media Player, or by referencing an "alternate web page."http://www.gavinsharp.com/tmp/ImageVuln.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=334341firefox-viewimage-security-bypass(25925)ADV-2008-0083ADV-2006-3748ADV-2006-210618228SSRT061181SSRT06118120060602 rPSA-2006-0091-1 firefox thunderbird20060507 Re: Firefox 1.5.0.3 code execution exploit20060505 Firefox 1.5.0.3 code execution exploit20060418 Another flaw in Firefox 1.5.0.2: to open files from remote24713SUSE-SA:2006:035http://www.networksecurity.fi/advisories/netscape-view-image.htmlhttp://www.mozilla.org/security/announce/2006/mfsa2006-39.htmlDSA-1134DSA-1120DSA-111810162022206621324211832117620376200631998819698Multiple cross-site scripting (XSS) vulnerabilities in Smarter Scripts IntelliLink Pro 5.06 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter in addlink_lwp.cgi and the (2) id, (3) forgotid, and (4) forgotpass parameters in edit.cgi.ADV-2006-14091760519701intellilink-multiple-xss(25929)2473324732http://pridels0.blogspot.com/2006/04/intellilink-pro-xss-vuln.htmlMultiple cross-site scripting (XSS) vulnerabilities in SibSoft CommuniMail 1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the list_id parameter in mailadmin.cgi and (2) the form_id parameter in templates.cgi.ADV-2006-14071760219667communimail-multiple-xss(25931)2473624735http://pridels0.blogspot.com/2006/04/communimail-xss-vuln.htmlCross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the config parameter. NOTE: this might be the same core issue as CVE-2005-2732.17621GLSA-200606-0620496http://pridels0.blogspot.com/2006/04/awstats-65-vuln.htmlMultiple cross-site scripting (XSS) vulnerabilities in Visale 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the keyval parameter in pbpgst.cgi, (2) the catsubno parameter in pblscg.cgi, and (3) the listno parameter in pblsmb.cgi.ADV-2006-14081759824718247172471619655visale-multiple-xss(25928)http://pridels0.blogspot.com/2006/04/visale-xss-vuln.htmlMultiple SQL injection vulnerabilities in plexum.php in NicPlex Plexum X5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) pagesize, (2) maxrec, and (3) startpos parameters.ADV-2006-14231761719720plexum-multiple-sql-injection(25918)http://pridels0.blogspot.com/2006/04/plexum-x5-sql-vuln.htmlThe "Add Sender to Address Book" operation (AddSenderToAddressBook.lss) and NameHelper.lss in IBM Lotus Notes 6.0 and 6.5 before 20060331 do not properly store information in the Personal Address Book when multiple messages are checked and a message uses AltFrom, which might allow user-assisted remote attackers to trick a user into sending e-mail to an unauthorized recipient.http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg212329451015914SQL injection vulnerability in plexcart.pl in NicPlex PlexCart X3 and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.plexcartx3-catid-sql-injection(25917)18033http://pridels0.blogspot.com/2006/04/plexcart-x3-sql-inj.htmlMultiple cross-site scripting (XSS) vulnerabilities in banners.cgi in PerlCoders BannerFarm 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) aff and (2) cat parameters.ADV-2006-14101761319718bannerfarm-banners-xss(25919)24728http://pridels0.blogspot.com/2006/04/bannerfarm-xss-vuln.htmlDirectory traversal vulnerability in SolarWinds TFTP Server 8.1 and earlier allows remote attackers to download arbitrary files via a crafted GET request including "....//" sequences, which are collapsed into "../" sequences by filtering.1764820060421 Rapid7 Advisory R7-0019: Directory traversal vulnerability in SolarWinds TFTP Server for Windowshttp://www.rapid7.com/advisories/R7-0019.htmlADV-2006-1561tftp-dotdotdotdot-directory-traversal(25969)7781984820060421 Rapid7 Advisory R7-0019: Directory traversal vulnerability in SolarWinds TFTP Server for WindowsDirectory traversal vulnerability in WinAgents TFTP Server for Windows 3.1 and earlier allows remote attackers to read arbitrary files via "..." (triple dot) sequences in a GET request.According to the vendor, WinAgents TFTP server version 3.2 fixes this directory traversal vulnerability.ADV-2006-1562http://www.rapid7.com/advisories/R7-0020.htmltftp-dotdotdot-directory-traversal(25971)http://www.winagents.com/en/news/410.php1771819844Directory traversal vulnerability in Caucho Resin 3.0.17 and 3.0.18 for Windows allows remote attackers to read arbitrary files via a "C:%5C" (encoded drive letter) in a URL.This vulnerability is addressed in the following product release:
Caucho Technology, Resin, 3.0.19
The following product releases are not vulnerable:
Caucho Technology, Resin, 3.0.16
Caucho Technology, Resin, 2.1.12
Caucho Technology, Resin, 2.1.2
Caucho Technology, Resin, 2.1.1
Caucho Technology, Resin, 2.01800520060516 Caucho Resin Windows Directory Traversal VulnerabilityADV-2006-1831resin-webserver-directory-traversal(26478)http://www.rapid7.com/advisories/R7-0024.html2557010161099042012520060516 Caucho Resin Windows Directory Traversal VulnerabilitySQL injection vulnerability in authent.php4 in Nicolas Fischer (aka NFec) RechnungsZentrale V2 1.1.3, and possibly earlier versions, allows remote attackers to execute arbitrary SQL commands via the User field.ADV-2006-142517588http://www.g-0.org/code/rz2-adv.htmlrechnungszentrale-authent-sql-injection(25911)2475219728169920060419 RechnungsZentrale V2 - SQL injection and Remote PHP inclusion vulnerabilitiesPHP remote file inclusion vulnerability in authent.php4 in Nicolas Fischer (aka NFec) RechnungsZentrale V2 1.1.3, and possibly earlier versions, allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter.ADV-2006-142517589http://www.g-0.org/code/rz2-adv.htmlrechnungszentrale-authent-file-inclusion(25912)2475319728169920060419 RechnungsZentrale V2 - SQL injection and Remote PHP inclusion vulnerabilitiesThe com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to obtain sensitive information via an invalid feed parameter, which reveals the path in an error message.20060418 [KAPDA::#41] - Mambo/Joomla rss component vulnerabilityhttp://www.kapda.ir/advisory-313.htmlhttp://irannetjob.com/content/view/209/28/The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to cause a denial of service (disk consumption and possibly web-server outage) via multiple requests with different values of the feed parameter.20060418 [KAPDA::#41] - Mambo/Joomla rss component vulnerabilityhttp://www.kapda.ir/advisory-313.htmlhttp://irannetjob.com/content/view/209/28/mambo-joomla-rss-dos(26131)20060419 Re: [KAPDA::#41] - Mambo/Joomla rss component vulnerabilityMultiple SQL injection vulnerabilities in WWWThreads RC 3 allow remote attackers to execute arbitrary SQL commands via (1) the forumreferrer cookie to register.php and (2) the messages parameter in message_list.php.ADV-2006-14471761520060419 WWWThread RC 3 MultBugswwwthreads-multiple-sql-injection(25936)73919732PHP remote file inclusion vulnerability in direct.php in ActualScripts ActualAnalyzer Lite 2.72 and earlier, Gold 7.63 and earlier, and Server 8.23 and earlier allows remote attackers to execute arbitrary code via a URL in the rf parameter.ADV-2006-14301759720060419 [MajorSecurity]ActualAnalyzer - Remote File Include Vulnerability19743actualanalyzer-direct-file-include(25893)20060520 ActualAnalyzer Server <=8.23 - Remote File Include Vulnerability247781015967742Cross-site scripting (XSS) vulnerability in the appliance web user interface in Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before 2.13 allows remote attackers to inject arbitrary web script or HTML, possibly via the displayMsg parameter to archiveApplyDisplay.jsp, aka bug ID CSCsc01095.20060419 Multiple Vulnerabilities in the WLSE Appliance101596519736ADV-2006-1434cisco-wlse-user-xss(25883)1760420060419 Multiple vulnerabilities in Linux based Cisco products20060419 Re: Multiple vulnerabilities in Linux based Cisco products24812http://www.assurance.com.au/advisories/200604-cisco.txtCisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before 2.13, Hosting Solution Engine (HSE) and User Registration Tool (URT) before 20060419, and all versions of Ethernet Subscriber Solution Engine (ESSE) and CiscoWorks2000 Service Management Solution (SMS) allow local users to gain Linux shell access via shell metacharacters in arguments to the "show" command in the application's command line interface (CLI), aka bug ID CSCsd21502 (WLSE), CSCsd22861 (URT), and CSCsd22859 (HSE). NOTE: other issues might be addressed by the Cisco advisory.20060419 Response to Privilege Escalation on Multiple Cisco Products20060419 Multiple Vulnerabilities in the WLSE Appliance101596519736cisco-wlse-shell-privilege-escalation(25884)ADV-2006-1435ADV-2006-14341760920060419 Multiple vulnerabilities in Linux based Cisco products20060419 Re: Multiple vulnerabilities in Linux based Cisco products24813http://www.assurance.com.au/advisories/200604-cisco.txt1974119739SQL injection vulnerability in PCPIN Chat 5.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the username field (login parameter) to main.php.pcpin-chat-main-sql-injection(25961)ADV-2006-14411763220060604 Re: PCPIN Chat <= 5.0.4 20060419 PCPIN Chat <= 5.0.4 101596819708http://retrogod.altervista.org/pcpin_504_xpl.htmlDirectory traversal vulnerability in main.php in PCPIN Chat 5.0.4 and earlier allows remote authenticated users to include and execute arbitrary PHP code via a ".." (dot dot) in a language cookie, as demonstrated by uploading then accessing a smiliefile image that actually contains PHP code.ADV-2006-14411763220060419 PCPIN Chat <= 5.0.4 "login/language" remote cmmnds xctn19708http://retrogod.altervista.org/pcpin_504_xpl.htmlpcpin-chat-main-file-include(25962)20060604 Re: PCPIN Chat <= 5.0.4 "login/language" remote cmmnds xctn1015968SQL injection vulnerability in Haberler.asp in ASPSitem 1.83 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.1761620060419 ASPSitem <= 1.83 Remote SQL Injection Vulnerabilityhttp://www.nukedx.com/?getxpl=2319693ADV-2006-1439aspsitem-haberler-sql-injection(25932)Multiple cross-site scripting (XSS) vulnerabilities in aasi media Net Clubs Pro 4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) onuser, (2) pass, (3) chatsys, (4) room, (5) username, and (6) to parameters in (a) sendim.cgi; the (7) username parameter in (b) imessage.cgi; the (8) password parameter in (c) login.cgi; and the (9) cat_id parameter in (d) viewcat.cgi.ADV-2006-1436netclubspro-multiple-xss(25957)176222475724756247552475419651http://pridels0.blogspot.com/2006/04/net-clubs-pro-xss-vuln.htmlAn unspecified Fortinet product, possibly Fortinet28, allows remote attackers to cause a denial of service via a "small synflood" to the SMTP port (TCP port 25), as demonstrated by a 10-microsecond wait between sending packets. NOTE: this issue has been disputed in followup posts that suggest that a protection feature is triggering a RST.20060416 Fortinet28 box does not resist has small synflood!20060418 Re: Fortinet28 box does not resist has small synflood!20060418 Re: Fortinet28 box does not resist has small synflood!Cross-site scripting (XSS) vulnerability in calendar/Visitor.cgi in KCScripts Calendar, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the sort_order parameter.portalpack-multiple-xss(25940)ADV-2006-1440176282476119695503http://pridels0.blogspot.com/2006/04/portal-pack-6-xss-vuln.htmlCross-site scripting (XSS) vulnerability in news/NsVisitor.cgi in KCScripts News Publisher, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the sort_order parameter.portalpack-multiple-xss(25940)ADV-2006-1440176282476219695http://pridels0.blogspot.com/2006/04/portal-pack-6-xss-vuln.htmlCross-site scripting (XSS) vulnerability in search/search.cgi in an unspecified KCScripts script, probably Search Engine or Site Search, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the q parameter.ADV-2006-144019695portalpack-multiple-xss(25940)1762824763http://pridels0.blogspot.com/2006/04/portal-pack-6-xss-vuln.htmlCross-site scripting (XSS) vulnerability in classifieds/viewcat.cgi in KCScripts Classifieds, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the cat_id parameter.ADV-2006-144019695portalpack-multiple-xss(25940)1762824764http://pridels0.blogspot.com/2006/04/portal-pack-6-xss-vuln.htmlCross-site scripting (XSS) vulnerability in login.php in KRANKIKOM ContentBoxX allows remote attackers to inject arbitrary web script or HTML via the action parameter.ADV-2006-14381761220060419 ContentBoxx Login.php Cross-Site Scripting19733contentboxx-login-xss(25952)24768779740Cross-site scripting (XSS) vulnerability in EasyGallery.php in Wingnut EasyGallery allows remote attackers to inject arbitrary web script or HTML via the ordner parameter.ADV-2006-143720060419 EasyGallery Cross-Site Scriptinghttp://advisory.patriotichackers.com/index.php?itemid=5easygallery-script-xss(25943)1762474619713Multiple unspecified vulnerabilities in Linksys RT31P2 VoIP router allow remote attackers to cause a denial of service via malformed Session Initiation Protocol (SIP) messages.VU#621566ADV-2006-1443http://www.kb.cert.org/vuls/id/MIMG-6GMMW4linksys-rt31p2-sip-dos(25915)176312481019722SQL injection vulnerability in index.php in MyBB (MyBulletinBoard) before 1.04 allows remote attackers to execute arbitrary SQL commands via the referrer parameter.http://www.securityfocus.com/bid/16443/exploit16443Cross-site scripting (XSS) vulnerability in guestbook_newentry.php in PHP-Gastebuch 1.61 allows remote attackers to inject arbitrary web script or HTML via the Kommentar field.23962http://osvdb.org/ref/23/23962-gastebuch.txt19810Cross-site scripting (XSS) vulnerability in addRequest.php in Prayer Request Board (PRB) Beta 1 before 20060320 allows remote attackers to inject arbitrary web script or HTML via the Request field.23958http://osvdb.org/ref/23/23958-prb.txtCross-site scripting (XSS) vulnerability in FlexBB 0.5.7 BETA and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) name and (2) message parameters.ADV-2006-139320060415 FlexBB <= 0.5.7 BETA XSS1015946flexbb-newthread-xss(25868)777SQL injection vulnerability in inc/start.php in FlexBB 0.5.5 and earlier allows remote attackers to execute arbitrary SQL commands via the flexbb_username COOKIE parameter.20060417 FlexBB 0.5.5 Bypass Exploit1015949175681686Cross-site scripting (XSS) vulnerability in mwguest.php in Manic Web MWGuest 2.1.0 allows remote attackers to inject arbitrary web script or HTML via the homepage parameter.1763020060420 [eVuln] MWGuest XSS Vulnerabilityhttp://evuln.com/vulns/122/summary.htmlmwguest-mwguest-xss(25674)747Cross-site scripting (XSS) vulnerability in W2B Online Banking allows remote attackers to inject arbitrary web script or HTML via the (1) query string, (2) SID parameter, or (3) ilang parameter.w2bonlinebanking-sid-xss(25947)ADV-2006-1445176262475919717http://pridels0.blogspot.com/2006/04/w2b-online-banking-vuln.htmlUnspecified vulnerability in Java InputMethods on Mac OS X 10.4.5 may cause InputMethods to send input events for secure fields to the wrong text field, which might reveal the password to others who can view the screen.ADV-2006-1398http://docs.info.apple.com/article.html?artnum=303658macosx-java-inputmethods-info-disclosure(26167)Heap-based buffer overflow in the LZWDecodeVector function in Mac OS X before 10.4.6, as used in applications that use ImageIO or AppKit, allows remote attackers to execute arbitrary code via crafted TIFF images.TA06-132Ahttp://www.security-protocols.com/sp-x24-advisory.php20077APPLE-SA-2006-05-11http://docs.info.apple.com/article.html?artnum=303411ADV-2006-1779ADV-2006-14521795117634http://www.security-protocols.com/modules.php?name=News&file=article&sid=32333183719686Multiple heap-based buffer overflows in Mac OS X 10.4.6 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) PredictorVSetField function for TIFF or (2) CFAllocatorAllocate function for GIF, as used in applications that use ImageIO or AppKit. NOTE: the BMP vector has been re-assigned to CVE-2006-2238 because it affects a separate product family.TA06-132A101606720077APPLE-SA-2006-05-11macosx-predictorvsetfield-bo(25951)macosx-cfallocatorallocate-bo(25949)ADV-2006-1779ADV-2006-14521795117634http://www.security-protocols.com/sp-x30-advisory.phphttp://www.security-protocols.com/sp-x28-advisory.phphttp://www.security-protocols.com/modules.php?name=News&file=article&sid=3233248222482119686Unspecified vulnerability in the _cg_TIFFSetField function in Mac OS X 10.4.6 and earlier, as used in applications that use ImageIO or AppKit, allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers a null dereference.TA06-132A20077APPLE-SA-2006-05-11macosx-tiffsetfield-bo(25950)ADV-2006-1779ADV-2006-14521795117634http://www.security-protocols.com/sp-x29-advisory.phphttp://www.security-protocols.com/modules.php?name=News&file=article&sid=323319686Heap-based buffer overflow in BOM BOMArchiveHelper 10.4 (6.3) Build 312, as used in Mac OS X 10.4.6 and earlier, allows user-assisted attackers to execute arbitrary code via a crafted archive (such as ZIP) that contains long path names, which triggers an error in the BOMStackPop function.TA06-132Ahttp://www.security-protocols.com/sp-x25-advisory.php20077APPLE-SA-2006-05-11macosx-archivehelper-bo(25945)ADV-2006-1779ADV-2006-14521795117634http://www.security-protocols.com/modules.php?name=News&file=article&sid=323324819101608219686Apple Safari 2.0.3 allows remote attackers to cause a denial of service and possibly execute code via a large CELLSPACING attribute in a TABLE tag, which triggers an error in KWQListIteratorImpl::KWQListIteratorImpl.ADV-2006-145217634http://www.security-protocols.com/sp-x26-advisory.phphttp://security-protocols.com/poc/sp-x26-1.htmlmacosx-safari-dos(25946)2482319686Apple Safari 2.0.3 allows remote attackers to cause a denial of service and possibly execute code via an invalid FRAME tag, possibly due to (1) multiple SCROLLING attributes with no values, or (2) a SRC attribute with no value. NOTE: due to lack of diagnosis by the researcher, it is unclear which vector is responsible.ADV-2006-145217634http://www.security-protocols.com/sp-x26-advisory.phphttp://security-protocols.com/poc/sp-x26-4.htmlmacosx-safari-dos(25946)19686The WebTextRenderer(WebInternal) _CG_drawRun:style:geometry: function in Apple Safari 2.0.3 allows remote attackers to cause a denial of service (application crash) via an HTML LI tag with a large VALUE attribute (list item number), which triggers a null dereference in QPainter::drawText, probably due to a failed memory allocation that uses the VALUE.ADV-2006-145217634http://www.security-protocols.com/sp-x26-advisory.phpmacosx-safari-dos(25946)24823http://security-protocols.com/poc/sp-x26-2.html19686Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0.80 to 0.88.1 might allow remote web servers to execute arbitrary code via long HTTP headers.This vulnerability is addressed in the following product release:
Clam Anti-Virus, ClamAV, 0.88.2VU#5992201775419880ADV-2006-2566ADV-2006-15862006-002425120SUSE-SA:2006:025GLSA-200605-03DSA-1050http://www.clamav.net/security/0.88.2.html201592011719964199631991219874SUSE-SR:2006:010APPLE-SA-2006-06-27http://kolab.org/security/kolab-vendor-notice-09.txtclamav-freshclam-http-bo(26182)MDKSA-2006:080101639220877Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated, which triggers a heap-based buffer overflow in a memcpy function call, a different vulnerability than CVE-2002-1396.TA06-333AADV-2006-4750ADV-2006-1500MDKSA-2006:091http://www.infigo.hr/en/in_focus/advisories/INFIGO-2006-04-02oval:org.mitre.oval:def:9696https://issues.rpath.com/browse/RPL-683php-wordwrap-string-bo(26001)USN-320-1TLSA-2006-3820061005 rPSA-2006-0182-1 php php-mysql php-pgsqlRHSA-2006:0568RHSA-2006:0501SUSE-SA:2006:031MDKSA-2006:122MDKSA-2006:091http://support.avaya.com/elmodocs2/security/ASA-2006-175.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-160.htm1015979GLSA-200605-082315522225217232156421252211352112521050210312067620269202222005219803RHSA-2006:0549APPLE-SA-2006-11-28http://docs.info.apple.com/article.html?artnum=30482920060701-01-UThe substr_compare function in string.c in PHP 5.1.2 allows context-dependent attackers to cause a denial of service (memory access violation) via an out-of-bounds offset argument.20269php-substrcompare-length-dos(26003)ADV-2006-1500USN-320-1SUSE-SA:2006:031MDKSA-2006:091MDKSA-2006:091http://www.infigo.hr/en/in_focus/advisories/INFIGO-2006-04-021015979GLSA-200605-08211252067620052mshtml.dll 6.00.2900.2873, as used in Microsoft Internet Explorer, allows remote attackers to cause a denial of service (crash) via nested OBJECT tags, which trigger invalid pointer dereferences including NULL dereferences. NOTE: the possibility of code execution was originally theorized, but Microsoft has stated that this issue is non-exploitable.MS06-021101629119762ie-object-memory-corruption(25978)ADV-2006-15071765820060422 MSIE (mshtml.dll) OBJECT tag vulnerability27475101600178120060423 MSIE (mshtml.dll) OBJECT tag vulnerability20060422 Re: MSIE (mshtml.dll) OBJECT tag vulnerabilityMozilla Firefox 1.5.0.2, when designMode is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain Javascript that is not properly handled by the contentWindow.focus method in an iframe, which causes a reference to a deleted controller context object. NOTE: this was originally claimed to be a buffer overflow in (1) js320.dll and (2) xpcom_core.dll, but the vendor disputes this claim.VU#8663001767119802firefox-iframe-contentwindowfocus-bo(25994)ADV-2008-0083ADV-2006-3748ADV-2006-1922ADV-2006-1614HPSBUX02153HPSBUX02153SSRT061145SSRT06114520060424 Firefox Remote Code Execution and DoS 1.5.0.2http://www.securident.com/vuln/ff.txthttp://www.mozilla.org/security/announce/2006/mfsa2006-30.htmlGLSA-200605-06DSA-1055DSA-105310159817802206620214200702001920015oval:org.mitre.oval:def:1790PHP remote file inclusion vulnerability in dForum 1.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DFORUM_PATH parameter to (1) about.php, (2) admin.php, (3) anmelden.php, (4) losethread.php, (5) config.php, (6) delpost.php, (7) delthread.php, (8) dfcode.php, (9) download.php, (10) editanoc.php, (11) forum.php, (12) login.php, (13) makethread.php, (14) menu.php, (15) newthread.php, (16) openthread.php, (17) overview.php, (18) post.php, (19) suchen.php, (20) user.php, (21) userconfig.php, (22) userinfo.php, and (23) verwalten.php.ADV-2006-14821765020060421 dForum <= 1.5 Multiple Remote File Inclusion Vulnerabilities.http://www.nukedx.com/?viewdoc=2719788dforum-dforumpath-parameter-file-include(26035)20060421 dForum <= 1.5 Multiple Remote File Inclusion Vulnerabilities.Directory traversal vulnerability in index.php in Scry Gallery 1.1 allows remote attackers to read arbitrary files via ".." sequences in the p parameter, which is not properly sanitized due to an rtrim function call with the arguments in the wrong order.ADV-2006-14901764920060421 Scry Gallery Directory Traversal & Full Path Disclosure Vulnerabiliteshttp://downloads.securityfocus.com/vulnerabilities/exploits/17649-directory-traversal.exploitscry-gallery-index-directory-traversal(25991)17668248897841977720060425 Interesting Scry stuffScry Gallery 1.1 allows remote attackers to obtain sensitive information via an invalid p parameter, which reveals the path in an error message.ADV-2006-149020060421 Scry Gallery Directory Traversal & Full Path Disclosure Vulnerabilitesscry-gallery-index-path-disclosure(25990)17668248907841977720060425 Interesting Scry stuffUnspecified vulnerability in Sybase Pylon Anywhere groupware synchronization server before 7.0 allows local users to obtain sensitive information such as email and PIM data of another user via unknown attack vectors.http://www.sybase.com/detail?id=104021319784pylon-groupware-unauth-access(25989)ADV-2006-147717677OpenTTD 0.4.7 and earlier allows local users to cause a denial of service (application exit) via a large invalid error number, which triggers an error.http://aluigi.altervista.org/adv/openttdx-adv.txtADV-2006-148019768openttd-command-packet-dos(26000)1766120060423 Denial of service bugs in OpenTTD 0.4.7GLSA-200609-0321799The multiplayer menu in OpenTTD 0.4.7 allows remote attackers to cause a denial of service via a UDP packet with an incorrect size, which causes the client to return to the main menu.http://aluigi.altervista.org/adv/openttdx-adv.txtADV-2006-148019768openttd-udp-packet-dos(26004)1766120060423 Denial of service bugs in OpenTTD 0.4.7GLSA-200609-0321799Cross-site scripting (XSS) vulnerability in /lms/a2z.jsp in logMethods 0.9 allows remote attackers to inject arbitrary web script or HTML via the kwd parameter.ADV-2006-148419793logmethods-lmsa2z-xss(25968)1767524876http://pridels0.blogspot.com/2006/04/logmethods-xss-vuln.htmlCross-site scripting (XSS) vulnerability in index.php in Scry Gallery 1.1 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: this is a different vulnerability than the directory traversal vector.ADV-2006-149020060424 Scry Gallery XSS Vulnerabilityscry-gallery-index-xss(26101)17668248917831977720060425 Interesting Scry stuffPHP remote file inclusion vulnerability in stats.php in MyGamingLadder 7.0 allows remote attackers to execute arbitrary PHP code via a URL in the dir[base] parameter.Successful exploitation requires that "register_globals" is enabled.ADV-2006-14831765720060422 Advisory: My Gaming Ladder Combo System <= 7.0 Remote File Inclusion Vulnerability.http://www.nukedx.com/?viewdoc=2819773mygamingladder-stats-file-inclusion(25992)24892Cross-site scripting (XSS) vulnerability in cgi-bin/guest in Community Architect Guestbook allows remote attackers to inject arbitrary web script or HTML by signing the guestbook, which is displayed by fsguestbook.html. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-14462478419742Multiple SQL injection vulnerabilities in RI Blog 1.1 allow remote attackers to execute arbitrary SQL command via the (1) username or (2) password fields.ADV-2006-14891765419783http://colander.altervista.org/advisory/riblog.txtriblog-login-sql-injection(26132)20060423 RIblog Remote SQL Injection ExploitEval injection vulnerability in index.php in ClanSys 1.1 allows remote attackers to execute arbitrary PHP code via PHP code in the page parameter, as demonstrated by using an "include" statement that is injected into the eval statement. NOTE: this issue has been described as file inclusion by some sources, but that is just one attack; the primary vulnerability is eval injection.1766020060423 Advisory: Clansys <= 1.1 PHP Code Insertion Vulnerability.http://www.nukedx.com/?getxpl=291015988clansys-index-file-include(25976)25083782Multiple directory traversal vulnerabilities in IZArc Archiver 3.5 beta 3 allow remote attackers to write arbitrary files via a ..\ (dot dot backslash) in a (1) .rar, (2) .tar, (3) .zip, (4) .jar, or (5) .gz archive. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-14881766419791izarc-extract-directory-traversal(26039)24895Heap-based buffer overflow in Winny 2.0 b7.1 and earlier allows remote attackers to execute arbitrary code via long strings to certain commands sent to the file transfer port.VU#167033ADV-2006-148617666http://www.eeye.com/html/research/advisories/AD20060421.html19795JVN#74294680winny-file-transfer-bo(25986)24883PHP remote file inclusion vulnerability in movie_cls.php in Built2Go PHP Movie Review 2B and earlier allows remote attackers to execute arbitrary PHP code via a URL in the full_path parameter.ADV-2006-1481197491711moviereview-moviecls-file-include(26063)1767924887PHP remote file inclusion vulnerability in agenda.php3 in phpMyAgenda 3.0 Final and earlier allows remote attackers to execute arbitrary PHP code via a URL in the rootagenda parameter.ADV-2006-15091767020060424 [MajorSecurity] phpMyAgenda 3.0 Final - Remote File Include Vulnerabilityhttp://downloads.securityfocus.com/vulnerabilities/exploits/phpMyAgenda_fi.txtphpmyagenda-rootagenda-file-include(26062)20060515 tyree[at]users.sourceforge.net24943101598478719748http://osvdb.org/ref/29/2914x-phpmyagenda.txtMultiple SQL injection vulnerabilities in check_login.asp in Bloggage allow remote attackers to execute arbitrary SQL commands via the (1) acc_name and (2) password parameter.ADV-2006-144819751http://colander.altervista.org/advisory/bloggage.txtbloggage-checklogin-sql-injection(25955)1763920060421 bloggage Remote SQL Injection24797751Cross-site scripting (XSS) vulnerability in member.php in 4images 1.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the nickname, probably involving the user_name parameter in register.php.ADV-2006-14491762520060420 4images <= 1.7 XSS197454images-member-xss(25987)24796Format string vulnerability in Skulltag 0.96f and earlier allows remote attackers to cause a denial of service via the version string.ADV-2006-147919767http://aluigi.altervista.org/adv/skulltagfs-adv.txtskulltag-version-format-string(25988)1765920060423 Format string bug in Skulltag 0.96fSQL injection vulnerability in page.php in SL_site 1.0 allows remote attackers to execute arbitrary SQL commands via the id_page parameter. NOTE: this issue could be used to produce resultant XSS from an error message.ADV-2006-1487101597219792slsite-page-sql-injection(26036)1766724896Directory traversal vulnerability in gallerie.php in SL_site 1.0 allows remote attackers to list images in arbitrary directories via ".." sequences in the rep parameter, which is used to construct a directory name in admin/config.inc.php. NOTE: this issue could be used to produce resultant XSS from an error message.ADV-2006-1487101597219792slsite-gallerie-directory-traversal(26037)176721766724897Cross-site scripting (XSS) vulnerability in SL_site 1.0 allows remote attackers to inject arbitrary web script or HTML via the recherche parameter in recherche.php. NOTE: other XSS vectors, as reported in the original disclosure, are resultant from other primary vulnerabilities that have separate CVE names.ADV-2006-1487101597219792slsite-recherche-xss(26038)1766724898Multiple cross-site scripting (XSS) vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dn parameter in (a) compare_form.php, (b) copy_form.php, (c) rename_form.php, (d) template_engine.php, and (e) delete_form.php; (2) scope parameter in (f) search.php; and (3) Container DN, (4) Machine Name, and (5) UID Number fields in (g) template_engine.php.ADV-2006-14501764324794247932479224790247892478819747phpldapadmin-templateengine-xss(25959)phpldapadmin-scope-dn-xss(25958)DSA-105720124http://pridels0.blogspot.com/2006/04/phpldapadmin-multiple-vuln.htmlDnsmasq 2.29 allows remote attackers to cause a denial of service (application crash) via a DHCP client broadcast reply request.This vulnerability is addressed in the following product release:
version 2.301766219760ADV-2006-1494http://thekelleys.org.uk/dnsmasq/CHANGELOGdnsmasq-dhcp-dos(26005)24884SQL injection vulnerability in calendar.php in vBulletin 3.0.x allows remote attackers to execute arbitrary SQL commands via the eventid parameter. NOTE: the affected version has been disputed by the vendor. It appears that this is the same issue as CVE-2004-0036, which was fixed in 2.3.4.This vulnerability has been disputed by the vendor. The affected version has been disputed by the vendor via e-mail to CVE. It appears that this is the same issue as CVE-2004-0036, which was fixed in 2.3.4.20060423 vbulletin<--3.0.x SQL Injection20060424 Re: vbulletin<--3.0.x SQL InjectionApple Mac OS X Safari 2.0.3, 1.3.1, and possibly other versions allows remote attackers to cause a denial of service (CPU consumption and crash) via a TD element with a large number in the rowspan attribute.ADV-2006-15081767420060424 Re: Apple Mac OS X Safari 2.0.3 Vulnerability20060424 Apple Mac OS X Safari 2.0.3 Vulnerability10159821976320060424 Apple Mac OS X Safari 2.0.3 Vulnerabilitymacosx-safari-table-dos(25998)1715Asterisk Recording Interface (ARI) in Asterisk@Home before 2.8 stores recordings/includes/main.conf under the web document root with insufficient access control, which allows remote attackers to obtain password information.This vulnerability is addressed in the following product releases:
Littlejohn Consulting, Asterisk Recording Interface, 0.10.00 and higher2480519744ADV-2006-1457http://www.securiweb.net/wiki/Ressources/AvisDeSecurite/2006.120060421 [SecuriWeb 2006.1] directory traversal in Asterisk@Home and ARIasterisk-mail-disclose-information(25993)Absolute path traversal vulnerability in recordings/misc/audio.php in the Asterisk Recording Interface (ARI) web interface in Asterisk@Home before 2.8 allows remote attackers to read arbitrary MP3, WAV, and GSM files via a full pathname in the recording parameter. NOTE: this issue can also be used to determine existence of files.This vulnerability is addressed in the following product release:
Asterisk@Home, Asterisk@Home, 2.8
1764119744ADV-2006-1457http://www.securiweb.net/wiki/Ressources/AvisDeSecurite/2006.120060421 [SecuriWeb 2006.1] directory traversal in Asterisk@Home and ARIasterisk-audio-directory-traversal(25996)24806750Buffer overflow in the parse_url function in the RTSP module (rtsp/parse_url.c) in Fenice 1.10 and earlier allows remote attackers to execute arbitrary code via a long URL.ADV-2006-14911767820060423 Buffer-overflow and crash in Fenice OMS 1.1019770fenice-parseurl-bo(26078)20060607 Re: Buffer-overflow and crash in Fenice OMS 1.1020060425 Fenice - Open Media Streaming Server remote BOF exploit794http://aluigi.altervista.org/adv/fenicex-adv.txtInteger overflow in the RTSP_msg_len function in rtsp/RTSP_msg_len.c in Fenice 1.10 and earlier allows remote attackers to cause a denial of service (application crash) via a large HTTP Content-Length value, which leads to an invalid memory access.ADV-2006-14911767820060423 Buffer-overflow and crash in Fenice OMS 1.1019770fenice-contentlength-dos(26080)20060607 Re: Buffer-overflow and crash in Fenice OMS 1.1024882794http://aluigi.altervista.org/adv/fenicex-adv.txtMultiple vulnerabilities in libtiff before 3.8.1 allow context-dependent attackers to cause a denial of service via a TIFF image that triggers errors in (1) the TIFFFetchAnyArray function in (a) tif_dirread.c; (2) certain "codec cleanup methods" in (b) tif_lzw.c, (c) tif_pixarlog.c, and (d) tif_zip.c; (3) and improper restoration of setfield and getfield methods in cleanup functions within (e) tif_jpeg.c, tif_pixarlog.c, (f) tif_fax3.c, and tif_zip.c.This vulnerability is addressed in the following product release:
libTIFF, libTIFF, 3.8.1https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189933ADV-2006-1563oval:org.mitre.oval:def:9893http://bugzilla.remotesensing.org/show_bug.cgi?id=1102libtiff-tifffetchanyarray-dos(26133)USN-277-12006-002417730RHSA-2006:0425SUSE-SR:2006:009MDKSA-2006:082GLSA-200605-17DSA-1054http://support.avaya.com/elmodocs2/security/ASA-2006-119.htm201332103099206672034520210200232002119964199491993619897198511983820060501-01-UInteger overflow in the TIFFFetchData function in tif_dirread.c for libtiff before 3.8.1 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via a crafted TIFF image.This vulnerability is addressed in the following product release:
libTIFF, libTIFF, 3.8.1https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189933http://bugzilla.remotesensing.org/show_bug.cgi?id=1102ADV-2006-1563oval:org.mitre.oval:def:10593libtiff-tifffetchdata-overflow(26134)USN-277-12006-002417732RHSA-2006:0425SUSE-SR:2006:009MDKSA-2006:082GLSA-200605-17DSA-1054http://support.avaya.com/elmodocs2/security/ASA-2006-119.htm2013321030992066720345202102002320021199641994919936198971983820060501-01-UDouble free vulnerability in tif_jpeg.c in libtiff before 3.8.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers errors related to "setfield/getfield methods in cleanup functions."This vulnerability is addressed in the following product release:
libTIFF, libTIFF, 3.8.1https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189933http://bugzilla.remotesensing.org/show_bug.cgi?id=1102libtiff-tifjpeg-doublefree-memory-corruption(26135)ADV-2006-1563USN-277-12006-002417733RHSA-2006:0425SUSE-SR:2006:009MDKSA-2006:082GLSA-200605-17DSA-1054http://support.avaya.com/elmodocs2/security/ASA-2006-119.htm20667203452021020023200211996419949199361989719838oval:org.mitre.oval:def:1138920060501-01-U201332103099Buffer overflow in Unicode processing in the logging functionality in Pablo Software Solutions Quick 'n Easy FTP Server Professional and Lite, probably 3.0, allows remote authenticated users to execute arbitrary code by sending a command with a long argument, which triggers a buffer overflow when an admin selects the Logging section in the FTP server main window. NOTE: the original researcher claims that the vendor disputes this issue.20060424 Quick 'n Easy FTP Server pro/lite Logging unicode stack overflow1768125235788Cross-site scripting (XSS) vulnerability in imagelist.php in Jeremy Ashcraft Simplog 0.9.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the imagedir parameter. NOTE: this issue might be resultant from directory traversal.ADV-2006-14931765320060421 Advisory: Simplog <= 0.93 Multiple Remote Vulnerabilities.24880http://www.nukedx.com/?getxpl=251976420060423 RE: Advisory: Simplog <= 0.93 Multiple Remote Vulnerabilities.simplog-imagelist-xss(25984)799Multiple SQL injection vulnerabilities in Jeremy Ashcraft Simplog 0.9.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) tid parameter in (a) preview.php; the (2) cid, (3) pid, and (4) eid parameters in (b) archive.php; and the (5) pid parameter in (c) comments.php.ADV-2006-149320060421 Advisory: Simplog <= 0.93 Multiple Remote Vulnerabilities.248792487824877http://www.nukedx.com/?getxpl=2510159761976420060423 RE: Advisory: Simplog <= 0.93 Multiple Remote Vulnerabilities.simplog-multiple-sql-injection(25982)http://www.simplog.org/archive.php?blogid=1&pid=57799The Allied Telesyn AT-9724TS switch allows remote attackers to cause a denial of service via a large amount of UDP data to the switch, which leads to unstable operation and possibly failure of the management interface or routing.20060419 Allied Telesyn Switch UDP Data Flood Management Denial Of Service Vulnerabilitytelesyn-udp-dos(25938)Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin 2.8.0.3, 2.8.0.2, 2.8.1-dev, and 2.9.0-dev allows remote attackers to inject arbitrary web script or HTML via the lang parameter.19659phpmyadmin-index-xss(25954)http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2http://pridels0.blogspot.com/2006/04/phpmyadmin-xss-vuln.htmlMultiple SQL injection vulnerabilities in Core CoreNews 2.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) icon_id and (2) userid parameters in preview.php.1765520060421 Advisory: CoreNews <= 2.0.1 Multiple Remote Vulnerabilities.http://www.nukedx.com/?getxpl=24corenews-preview-sql-injection(25977)79720060421 Advisory: CoreNews <= 2.0.1 Multiple Remote Vulnerabilities.PHP remote file inclusion vulnerability in Core CoreNews 2.0.1 and earlier allows remote authenticated users to execute arbitrary commands via the show parameter. NOTE: this is a different vector than CVE-2006-1212, although it might be the same primary issue.1765520060421 Advisory: CoreNews <= 2.0.1 Multiple Remote Vulnerabilities.http://www.nukedx.com/?getxpl=24corenews-index-file-include(25979)79720060421 Advisory: CoreNews <= 2.0.1 Multiple Remote Vulnerabilities.SQL injection vulnerability in function/showprofile.php in FlexBB 0.5.5 allows remote attackers to execute arbitrary SQL commands, and view all usernames and passwords, via the id parameter to the showprofile page in index.php.1757420060421 FlexBB 0.5.5 Exploit [ function/showprofile.php ] Remote SQL Injection24867Websense, when configured to permit access to the dynamic content category, allows local users to bypass intended blocking of the Uncategorized category by appending a "/?" sequence to a URL.20060421 RE: [BULK] - Websense Filter Bypass20060420 Websense Filter Bypasswebsense-uncategorized-filter-bypass(25980)25211iOpus Secure Email Attachments (SEA), probably 1.0, does not properly handle passwords that consist of repetitions of a substring, which allows attackers to decrypt files by entering only the substring.1765620060422 ADVISORY FOR IOPUS SECURE EMAIL ATTACHMENTSiopus-insecure-passwords(26266)20060425 Re: ADVISORY FOR IOPUS SECURE EMAIL ATTACHMENTS101598019771Cross-site scripting (XSS) vulnerability in index.php in Thwboard 3.0 Beta 2.84 allows remote attackers to inject arbitrary web script or HTML via the navpath parameter.1762720060420 ThWboard 3 Beta 2.84 Cross Site Scriptingthwboard-index-xss(25953)Multiple SQL injection vulnerabilities in ampleShop 2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) RecordID parameter in (a) Customeraddresses_RecordAction.cfm and (b) youraccount.cfm; (2) solus parameter in (c) detail.cfm; and (3) cat parameter in (d) category.cfm.ADV-2006-151219806ampleshop-multiple-sql-injection(26064)24937249362493524934http://pridels0.blogspot.com/2006/04/ampleshop-ecommerce-software-vuln.htmlMultiple SQL injection vulnerabilities in the osTicket module in Help Center Live before 2.1.0 allow remote attackers to execute arbitrary SQL commands via unknown vectors.1767619776ADV-2006-1492http://sourceforge.net/project/shownotes.php?release_id=411859helpcenterlive-osticket-sql-injection(26040)Multiple SQL injection vulnerabilities in photokorn 1.53 and 1.542 allow remote attackers to execute arbitrary SQL commands via the (1) cat, (2) pic and (3) page parameter in index.php; (4) id parameter in postcard.php; and (5) cat parameter in print.php.ADV-2006-15251768320060425 photokorn 1.53 , 1.542 << Sqlphotokorn-multiple-sql-injection(26066)24983249822498178919836PhpWebGallery before 1.6.0RC1 allows remote attackers to obtain arbitrary pictures via a request to picture.php without specifying the cat parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.19801ADV-2006-1515phpwebgallery-picture-bypass-security(26079)Adobe Dreamweaver 8 before 8.0.2 and MX 2004 can generate code that allows SQL injection attacks in the (1) ColdFusion, (2) PHP mySQL, (3) ASP, (4) ASP.NET, and (5) JSP server models.This vulnerability affects all versions of Adobe, Dreamweaver, 8.0 before 8.0.2
This vulnerability is addressed in the following product releases:
Adobe, Dreamweaver, 8.0.2
Code update for Macromedia, Dreamweaver MX, 2004http://www.adobe.com/support/security/bulletins/apsb06-07.htmlADV-2006-1753dreamweaver-server-sql-injection(26339)179282536110160502005420060509 Multiple SQL Injection Vulnerabilities in Dreamweaver Generated Codena-img-4.0.34.bin for the IP3 Networks NetAccess NA75 allows local users to gain Unix shell access via "`" (backtick) characters in the appliance's command line interface (CLI).ADV-2006-15401769820060424 Multiple vulnerabilities in IP3 Networks 'NetAccess' NA75 applianceip3-na75-backtick-command-injection(26108)79319818na-img-4.0.34.bin for the IP3 Networks NetAccess NA75 has a default username of admin and a default password of admin.ADV-2006-15401769820060424 Multiple vulnerabilities in IP3 Networks 'NetAccess' NA75 applianceip3-na75-default-account(26112)79319818The (1) shadow password file in na-img-4.0.34.bin for the IP3 Networks NetAccess NA75 has world readable permissions, which allows local users to view encrypted passwords; and the (2) NetAccess database file has world readable and writable permissions, which allows local users to view sensitive information and modify data.ADV-2006-15401769820060424 Multiple vulnerabilities in IP3 Networks 'NetAccess' NA75 applianceip3-na75-database-file-permission(26110)ip3-na75-shadow-file-permission(26109)19818Multiple SQL injection vulnerabilities in Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) keywords parameters in (a) Results.cfm, and the (3) ProdID parameter in (b) Details.cfm.ADV-2006-1513cartweaver-multiple-sql-injection(26060)http://www.techfeed.net/blog/index.cfm/2006/4/26/cartweaver-holes25210179412496224961426419812http://pridels0.blogspot.com/2006/04/cartweaver-coldfusion-vuln.htmlApplication Dynamics Cartweaver ColdFusion 2.16.11 and earlier allows remote attackers to obtain sensitive information via an invalid (1) secondary, (2) PageNum_Results, (3) category, or (4) keywords parameter in (a) Results.cfm; or an invalid (5) ProdID parameter in (b) Details.cfm; which reveal the path in various error messages. NOTE: the behavior for the category, keywords, and ProdID parameters might be resultant from SQL injection.ADV-2006-1513cartweaver-multiple-path-disclosure(26061)249642496319812http://pridels0.blogspot.com/2006/04/cartweaver-coldfusion-vuln.htmlMultiple cross-site scripting (XSS) vulnerabilities in index.php in Edwin van Wijk phpWebFTP 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) port, (2) server, and (3) user parameters. NOTE: it is possible that the affected version is actually 3.2.ADV-2006-1530http://www.subjectzero.net/research/phpwebftpxss.htm20060425 PhpWebFtp Cross Site Scripting Vulnerabilityphpwebftp-index-xss(26067)176882497578619827Cross-site scripting (XSS) vulnerability in dcboard.cgi in DCScripts DCForumLite 3.0 allows remote attackers to inject arbitrary web script or HTML via the az parameter.ADV-2006-15321769720060425 DCForumLite V 3.0<--XSS/SQL Injectiondcforumlite-dcboard-xss(26083)2498879219815SQL injection vulnerability in dcboard.cgi in DCScripts DCForumLite 3.0 allows remote attackers to execute arbitrary SQL commands via the az parameter.1769720060425 DCForumLite V 3.0<--XSS/SQL Injectiondeforumlite-dcboard-sql-injection(26084)24989792Multiple cross-site scripting (XSS) vulnerabilities in myadmin/index.php in NextAge Shopping Cart allow remote attackers to inject arbitrary web script or HTML via the (1) username and (2) password parameters.20060425 NextAge Shopping Cart Software XSShttp://www.aria-security.net/advisory/nextage/nextageshoppingcart.txtnextageshoppingcart-index-xss(26065)17685791Cross-site scripting (XSS) vulnerability in Verosky Media Instant Photo Gallery allows remote attackers to inject arbitrary web script or HTML via the member parameter in a viewpro action in member.php. NOTE: the original report may be inaccurate, since the "viewpro" string does not appear in the source code for version 1.0.2 of the product.1769620060427 Re: Instant Photo Gallery <= Multiple XSS20060425 Instant Photo Gallery <= Multiple XSS24984790Multiple SQL injection vulnerabilities in QuickEStore 7.9 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the OrderID parameter in (a) shipping.cfm and (b) checkout.cfm, (2) ItemID parameter in (c) proddetail.cfm, (3) SubCatID parameter in (d) index.cfm, the (4) CategoryID parameter in (e) prodpage.cfm, and (5) ProdID parameter in (f) Details.cfm. NOTE: these issues can also be exploited for path disclosure.ADV-2006-1514quickestore-multiple-sql-injection(26045)249802497924978249772497619817http://pridels0.blogspot.com/2006/04/quickestore-79-vuln.html3Com Baseline Switch 2848-SFP Plus Model #3C16486 with firmware before 1.0.2.0 allows remote attackers to cause a denial of service (unstable operation) via long DHCP packets.Update to firmware version 1.0.2.0.
http://www.3com.com/products/en_...e&order=desc&prodcat=allADV-2006-151017686http://support.3com.com/infodeli/tools/switches/baseline/3C16486_V1_0_2_0_readme.pdf197563com-baseline-dhcp-dos(26076)249421015997Argument injection vulnerability in Microsoft Outlook 2003 SP1 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an arbitrary filename as an attachment. NOTE: it is not clear whether this issue is implementation-specific or a problem in the Microsoft API.office-mailto-obtain-information(26118)ADV-2006-15382500319819http://ingehenriksen.blogspot.com/2006/04/office-2003-file-attachment-exploit.htmlArgument injection vulnerability in Internet Explorer 6 for Windows XP SP2 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an arbitrary filename as an attachment. NOTE: it is not clear whether this issue is implementation-specific or a problem in the Microsoft API.ADV-2006-1538http://ingehenriksen.blogspot.com/2006/04/office-2003-file-attachment-exploit.htmloffice-mailto-obtain-information(26118)Argument injection vulnerability in Mozilla Firefox 1.0.6 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an arbitrary filename as an attachment. NOTE: it is not clear whether this issue is implementation-specific or a problem in the Microsoft API.ADV-2006-153820060424 Multiple browsers Windows mailto protocol Office 2003 file attachment exploithttp://ingehenriksen.blogspot.com/2006/04/office-2003-file-attachment-exploit.htmloffice-mailto-obtain-information(26118)Argument injection vulnerability in Avant Browser 10.1 Build 17 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an arbitrary filename as an attachment. NOTE: it is not clear whether this issue is implementation-specific or a problem in the Microsoft API.ADV-2006-153820060424 Multiple browsers Windows mailto protocol Office 2003 file attachment exploithttp://ingehenriksen.blogspot.com/2006/04/office-2003-file-attachment-exploit.htmloffice-mailto-obtain-information(26118)785action_public/search.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a search with a crafted value of the lastdate parameter, which alters the behavior of a regular expression to add a "#e" (execute) modifier.http://forums.invisionpower.com/index.php?showtopic=213374ADV-2006-15341769520060425 Invision Vulnerabilities, including remote code executioninvision-search-file-include(26070)20060710 Re: RE: Invision Vulnerabilities, including remote code execution20060427 Invision Power Board 2.1.5 POC20060427 Re: Invision Vulnerabilities, including remote code execution2500579619830Directory traversal vulnerability in action_admin/paysubscriptions.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote authenticated administrators to include and execute arbitrary local PHP files via a .. (dot dot) in the name parameter, preceded by enough backspace (%08) characters to erase the initial static portion of a filename.If you've downloaded IPB 2.1.5 since the time of this post, there is no need to update your installation as the main download has been updated.http://forums.invisionpower.com/index.php?showtopic=213374ADV-2006-153420060425 Invision Vulnerabilities, including remote code executioninvision-admin-file-include(26072)20060710 Re: RE: Invision Vulnerabilities, including remote code execution20060427 Re: Invision Vulnerabilities, including remote code execution2500879619830SQL injection vulnerability in lib/func_taskmanager.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary SQL commands via the ck parameter, which can inject at most 32 characters.The vendor has released an update to address this and other versions.17690ADV-2006-153420060425 Invision Vulnerabilities, including remote code executionhttp://forums.invisionpower.com/index.php?showtopic=213374invision-index-ck-sql-injection(26071)20060427 Re: Invision Vulnerabilities, including remote code execution79619830Multiple SQL injection vulnerabilities in Leadhound Full and LITE 2.1, and probably the Network Version "Full Version", allow remote attackers to execute arbitrary SQL commands via the (1) banner parameter in agent_links.pl; the offset parameter in (2) agent_links.pl, (3) agent_transactions.pl, (4) agent_subaffiliates.pl, and (5) agent_summary.pl; the camp_id parameter in (6) agent_transactions_csv.pl, (7) agent_subaffiliates.pl, and (8) agent_camp_det.pl; the (9) login parameter in agent_commission_statement.pl; the logged parameter in (10) agent_commission_statement.pl and (11) agent_camp_det.pl; the (12) agent_id parameter in agent_commission_statement.pl; and the (13) sub parameter in unspecified files.2502925028250272502625025250242502319867http://pridels0.blogspot.com/2006/04/leadhound-multiple-vuln.htmlMultiple cross-site scripting (XSS) vulnerabilities in Leadhound Full and LITE 2.1, and probably the Network Version "Full Version", allow remote attackers to inject arbitrary web script or HTML via the login parameter in (1) agent_affil.pl, (2) agent_help.pl, (3) agent_faq.pl, (4) agent_help_insert.pl, (5) sign_out.pl, (6) members.pl, (7) modify_agent_1.pl, (8) modify_agent_2.pl, (9) modify_agent.pl, (10) agent_links.pl, (11) agent_stats_pending_leads.pl, (12) agent_logoff.pl, (13) agent_rev_det.pl, (14) agent_subaffiliates.pl, (15) agent_stats_pending_leads.pl, (16) agent_transactions.pl, (17) agent_payment_history.pl, (18) agent_summary.pl, (19) agent_camp_all.pl, (20) agent_camp_new.pl, (21) agent_camp_notsub.pl, (22) agent_campaign.pl, (23) agent_camp_expired.pl, (24) agent_stats_det.pl, (25) agent_stats.pl, (26) agent_camp_det.pl, (27) agent_camp_sub.pl, (28) agent_affil_list.pl, and (29) agent_affil_code.pl; the logged parameter in (30) agent_faq.pl, (31) agent_help_insert.pl, (32) members.pl, (33) modify_agent_1.pl, (34) modify_agent_2.pl, (35) modify_agent.pl, (36) agent_links.pl, (37) agent_subaffiliates.pl, (38) agent_stats_pending_leads.pl, (39) agent_transactions.pl, (40) agent_summary.pl, (41) agent_camp_all.pl, (42) agent_camp_new.pl, (43) agent_camp_notsub.pl, (44) agent_campaign.pl, (45) agent_camp_expired.pl, (46) agent_stats.pl, (47) agent_camp_det.pl, (48) agent_camp_sub.pl, (49) agent_affil_list.pl, and (50) agent_affil_code.pl; the camp_id parameter in (51) agent_links.pl, (52) agent_subaffiliates.pl, and (53) agent_camp_det.pl; the (54) banner parameter in agent_links.pl; the offset parameter in (55) agent_links.pl, (56) agent_subaffiliates.pl, (57) agent_transactions.pl, and (58) agent_summary.pl; the date parameter in (59) agent_subaffiliates.pl, (60) agent_transactions.pl, and (61) agent_summary.pl; the dates parameter in (62) agent_rev_det.pl and (63) agent_stats_det.pl; the (64) page parameter in agent_camp_det.pl; the (65) agent_id parameter in agent_commission_statement.pl; and the (66) lost password field in lost_pwd.pl.25060250592505825057250562505525054250532505225051250502504925048250472504625045250442504325042250412503925038250372503625035250342503325032250312503019867http://pridels0.blogspot.com/2006/04/leadhound-multiple-vuln.htmlUnspecified vulnerability in the libpkcs11 library in Sun Solaris 10 might allow local users to gain privileges or cause a denial of service (application failure) via unknown attack vectors that involve the getpwnam family of non-reentrant functions.17687102316101598719789ADV-2006-1504solaris-libpkcs11-privilege-escalation(26075)SQL injection vulnerability in save.php in PHPSurveyor 0.995 and earlier allows remote attackers to execute arbitrary SQL commands via the surveyid cookie. NOTE: this issue could be leveraged to execute arbitrary PHP code, as demonstrated by inserting directory traversal sequences into the database, which are then processed by the thissurvey['language'] variable.197611015970http://retrogod.altervista.org/phpsurveyor_0995_xpl.htmlphpsurveyor-surveyid-shell-execution(25970)1763320060420 PHPSurveyor <= 0.995 'save.php/surveyid' remote cmmnds xctn24787Multiple cross-site scripting (XSS) vulnerabilities pm_popup.php in MKPortal 1.1 Rc1 and earlier, as used with vBulletin 3.5.4 and earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) u1, (2) m1, (3) m2, (4) m3, (5) m4 parameters.ADV-2006-1485202321765120060928 Re: xxs in MKPortal M1.120060927 MkPortal Cross Site Scripting (All versions) xSS20060421 vBulletin <= 3.5.4 with MKPortal 1.1 Remote SQL Injection Vulnerability.24901http://www.nukedx.com/?viewdoc=26101597780119786SQL injection vulnerability in vb_board_functions.php in MKPortal 1.1, as used with vBulletin 3.5.4 and earlier, allows remote attackers to execute arbitrary SQL commands via the userid parameter.20060421 vBulletin <= 3.5.4 with MKPortal 1.1 Remote SQL Injection Vulnerability.http://www.nukedx.com/?viewdoc=26101597717651801Unspecified vulnerability in Hitachi JP1 products allow remote attackers to cause a denial of service (application stop or fail) via unexpected requests or data.http://www.hitachi-support.com/security_e/vuls_e/HS06-007_e/index-e.htmlADV-2006-152419841hitachi-jp1-request-dos(26087)17706The recursor in PowerDNS before 3.0.1 allows remote attackers to cause a denial of service (application crash) via malformed EDNS0 packets.