Stack-based buffer overflow in Microsoft Publisher 2000 through 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted PUB file, which causes an overflow when parsing fonts.TA06-255AVU#4062361995120060912 Computer Terrorism (UK) :: Incident Response Centre - Microsoft Publisher Font Parsing VulnerabilityMS06-054http://www.computerterrorism.com/research/ct12-09-2006-2.htm21863publisher-pub-code-execution(28648)ADV-2006-3565SSRT061187HPSBST0213410168251548oval:org.mitre.oval:def:590Unspecified vulnerability in Microsoft Outlook 2000 through 2003, Exchange 5.0 Server SP2 and 5.5 SP4, Exchange 2000 SP3, and Office allows remote attackers to execute arbitrary code via an e-mail message with a crafted Transport Neutral Encapsulation Format (TNEF) MIME attachment, related to message length validation.TA06-010AVU#2521461619720060110 Microsoft Outlook Critical Vulnerability20060110 Microsoft Exchange Critical VulnerabilityMS06-0031015461101546018368win-tnef-overflow(22878)ADV-2006-0119http://support.avaya.com/elmodocs2/security/ASA-2006-004.htm331330oval:org.mitre.oval:def:624oval:org.mitre.oval:def:1485oval:org.mitre.oval:def:1456oval:org.mitre.oval:def:1316oval:org.mitre.oval:def:1165oval:org.mitre.oval:def:1082Unspecified vulnerability in the RDS.Dataspace ActiveX control, which is contained in ActiveX Data Objects (ADO) and distributed in Microsoft Data Access Components (MDAC) 2.7 and 2.8, allows remote attackers to execute arbitrary code via unknown attack vectors.TA06-101AVU#234812MS06-014ie-wscriptshell-command-execution(29915)mdac-rdsdataspace-execute-code(25006)ADV-2006-2452ADV-2006-1319http://www.securityfocus.com/data/vulnerabilities/exploits/0day_ie.pdf207971746220080128 Re: Exploit in IE6,720080128 Exploit in IE6,720070731 Re: Exploit In Internet Explorer20070730 RE: Exploit In Internet Explorer20070730 Re: Exploit In Internet Explorer20070729 Exploit In Internet Explorer2451721642052http://www.hitachi-support.com/security_e/vuls_e/HS06-013_e/index-e.htmlhttp://www.hitachi-support.com/security_e/vuls_e/HS06-013_e/01-e.html10158942071919583oval:org.mitre.oval:def:1778oval:org.mitre.oval:def:1742oval:org.mitre.oval:def:1511oval:org.mitre.oval:def:1323oval:org.mitre.oval:def:1204Microsoft PowerPoint 2000 in Office 2000 SP3 has an interaction with Internet Explorer that allows remote attackers to obtain sensitive information via a PowerPoint presentation that attempts to access objects in the Temporary Internet Files Folder (TIFF).VU#963628MS06-010ADV-2006-0579powerpoint-tiff-information-disclosure(24490)16634101563218865oval:org.mitre.oval:def:1555Buffer overflow in the plug-in for Microsoft Windows Media Player (WMP) 9 and 10, when used in browsers other than Internet Explorer and set as the default application to handle media files, allows remote attackers to execute arbitrary code via HTML with an EMBED element containing a long src attribute.TA06-045AVU#692060win-mediaplayer-plugin-embed-bo(24493)ADV-2006-057516644MS06-00620060214 Microsoft Windows Media Player Plugin Buffer Overflow Vulnerability101562818852oval:org.mitre.oval:def:1559Heap-based buffer overflow in the bitmap processing routine in Microsoft Windows Media Player 7.1 on Windows 2000 SP4, Media Player 9 on Windows 2000 SP4 and XP SP1, and Media Player 10 on XP SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted bitmap (.BMP) file that specifies a size of 0 but contains additional data.TA06-045AVU#29139616633MS06-005http://www.eeye.com/html/research/advisories/AD20060214.html101562718835win-media-player-bmp-bo(24488)ADV-2006-057420060215 Windows Media Player BMP Heap Overflow (MS06-005)20060214 [EEYEB-20051017] Windows Media Player BMP Heap Overflow423oval:org.mitre.oval:def:1661oval:org.mitre.oval:def:1598oval:org.mitre.oval:def:1578oval:org.mitre.oval:def:1256Buffer overflow in GIFIMP32.FLT, as used in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via a crafted GIF image that triggers memory corruption when it is parsed.TA06-192AVU#668564MS06-039ADV-2006-27571891520060712 NSFOCUS SA2006-04 : Microsoft Office GIF Filter Buffer Overflow Vulnerability2714610164702101320060712 NSFOCUS SA2006-04 : Microsoft Office GIF Filter Buffer Overflow Vulnerabilityoval:org.mitre.oval:def:21The ShellAbout API call in Korean Input Method Editor (IME) in Korean versions of Microsoft Windows XP SP1 and SP2, Windows Server 2003 up to SP1, and Office 2003, allows local users to gain privileges by launching the "shell about dialog box" and clicking the "End-User License Agreement" link, which executes Notepad with the privileges of the program that displays the about box.VU#73984416643MS06-009101563118859win-korean-ime-privilege-elevation(24492)ADV-2006-057820060215 Security advisory: Windows IME Vulnerability (MS06-009)http://www.ryanstyle.com/alert/my/5/ms06_009_eng.htmloval:org.mitre.oval:def:727oval:org.mitre.oval:def:1688oval:org.mitre.oval:def:1664oval:org.mitre.oval:def:1650oval:org.mitre.oval:def:1595Buffer overflow in Microsoft Office 2000 SP3, XP SP3, and other versions and packages, allows user-assisted attackers to execute arbitrary code via a routing slip that is longer than specified by the provided length field, as exploited by malware such as TROJ_MDROPPER.BH and Trojan.PPDropper.E in attacks against PowerPoint.TA06-073AVU#6828201700020060314 SYMSA-2006-001: Buffer overflow in Microsoft Office 2000, Office XP (2002), and Office 2003 Routing Slip MetadataMS06-012101576619138powerpoint-presentation-code-execution(29009)office-routing-slip-bo(25009)ADV-2006-3678ADV-2006-0950http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ%5FMDROPPER%2EBHhttp://www.symantec.com/security_response/writeup.jsp?docid=2006-091810-5028-99http://www.symantec.com/enterprise/research/SYMSA-2006-001.txt2005920060919 Microsoft PowerPoint 0-day Vulnerability FAQ - September written20060919 New PowerPoint 0-day Trojan in the wild20060822 Major updates in PowerPoint FAQ document - not a 0-day issue20060819 New PowerPoint 0-day and Trojan - FAQ document ready20060422 PowerPoint Phishing Trojan23903http://www.darkreading.com/document.asp?doc_id=101970http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm101688610167201923820060919 New PowerPoint 0-day Trojan in the wildhttp://isc.sans.org/diary.php?storyid=1618http://blogs.securiteam.com/?p=559http://blogs.securiteam.com/?p=557http://blogs.securiteam.com/?author=2820060822 Major updates in PowerPoint FAQ document - not a 0-day issueoval:org.mitre.oval:def:798oval:org.mitre.oval:def:1653oval:org.mitre.oval:def:1553oval:org.mitre.oval:def:1504Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression.TA06-010AVU#91593016194MS06-00218365win-embedded-fonts-bo(23922)http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=375525ADV-2006-011820060110 [EEYEB-2000801] - Windows Embedded Open Type (EOT) Font Heap Overflow Vulnerability18829EEYEB20050801http://support.avaya.com/elmodocs2/security/ASA-2006-004.htm10154591839118311oval:org.mitre.oval:def:714oval:org.mitre.oval:def:698oval:org.mitre.oval:def:1491oval:org.mitre.oval:def:1462oval:org.mitre.oval:def:1185oval:org.mitre.oval:def:1126Unspecified vulnerability in Windows Explorer in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via attack vectors involving COM objects and "crafted files and directories," aka the "Windows Shell Vulnerability."TA06-101AVU#641460MS06-01519606win-explorer-com-code-execution(25554)ADV-2006-132017464245161015897oval:org.mitre.oval:def:1764oval:org.mitre.oval:def:1743oval:org.mitre.oval:def:1679oval:org.mitre.oval:def:1448oval:org.mitre.oval:def:1191Buffer overflow in the Web Client service (WebClnt.dll) for Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote authenticated users or Guests to execute arbitrary code via crafted RPC requests, a different vulnerability than CVE-2005-1207.VU#38890016636MS06-008101563018857msrpc-webclient-message-bo(24491)ADV-2006-0577oval:org.mitre.oval:def:716oval:org.mitre.oval:def:683oval:org.mitre.oval:def:1602oval:org.mitre.oval:def:1547oval:org.mitre.oval:def:1220Buffer overflow in Microsoft Outlook Express 5.5 and 6 allows remote attackers to execute arbitrary code via a crafted Windows Address Book (WAB) file containing "certain Unicode strings" and modified length values.MS06-01619617http://www.zerodayinitiative.com/advisories/ZDI-06-007.htmlADV-2006-13211745920060411 ZDI-06-007: Microsoft Windows Address Book (WAB) File Format Parsing Vulnerabilityoutlook-express-wab-bo(25535)101589869120060411 ZDI-06-007: Microsoft Windows Address Book (WAB) File Format Parsing Vulnerabilityoval:org.mitre.oval:def:812oval:org.mitre.oval:def:1791oval:org.mitre.oval:def:1780oval:org.mitre.oval:def:1771oval:org.mitre.oval:def:1769oval:org.mitre.oval:def:1682oval:org.mitre.oval:def:1611Cross-site scripting (XSS) vulnerability in _vti_bin/_vti_adm/fpadmdll.dll in Microsoft FrontPage Server Extensions 2002 and SharePoint Team Services allows remote attackers to inject arbitrary web script or HTML, then leverage the attack to execute arbitrary programs or create new accounts, via the (1) operation, (2) command, and (3) name parameters.17452MS06-017http://www.argeniss.com/research/ARGENISS-ADV-040602.txt1015896101589519623ADV-2006-132220060412 Vulnerability in Microsoft FrontPage Server Extensions Could Allow Cross-Site Scriptingfpse-html-xss(25537)704oval:org.mitre.oval:def:1748** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-3899. Reason: This candidate is a duplicate of CVE-2005-3899. Notes: All CVE users should reference CVE-2005-3899 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.Heap-based buffer overflow in the encodeURI and decodeURI functions in the kjs JavaScript interpreter engine in KDE 3.2.0 through 3.5.0 allows remote attackers to execute arbitrary code via a crafted, UTF-8 encoded URI.20060119 [KDE Security Advisory] kjs encodeuri/decodeuri heap overflowhttp://www.kde.org/info/security/advisory-20060119-1.txt18500ftp://ftp.kde.org/pub/kde/security_patches/post-3.4.3-kdelibs-kjs.diffADV-2006-0265USN-245-1SUSE-SA:2006:003RHSA-2006:0184GLSA-200601-11DSA-9481857018561185591855218540oval:org.mitre.oval:def:11858kde-kjs-bo(24242)16325FLSA:17860622659MDKSA-2006:019SSA:2006-045-0510155123641889918583An unspecified Microsoft WMF parsing application, as used in Internet Explorer 5.01 SP4 on Windows 2000 SP4, and 5.5 SP2 on Windows Millennium, and possibly other versions, allows attackers to cause a denial of service (crash) and possibly execute code via a crafted WMF file with a manipulated WMF header size, possibly involving an integer overflow, a different vulnerability than CVE-2005-4560, and aka "WMF Image Parsing Memory Corruption Vulnerability."VU#312956TA06-045A16516MS06-00418729ADV-2006-046922976http://www.microsoft.com/technet/security/advisory/913333.mspx18912[funsec] 20060110 Another WMF flaw without a Microsoft patchoval:org.mitre.oval:def:1638Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote attackers to cause a denial of service (hang) via an IGMP packet with an invalid IP option, aka the "IGMP v3 DoS Vulnerability."TA06-045AVU#83928416645MS06-00718853win-igmpv3-dos(24489)ADV-2006-057620071023 SYMSA-2007-012: Microsoft Windows CE IGMP Denial of Servicehttp://www.securiteam.com/exploits/5PP0T0KI0O.html15991015629oval:org.mitre.oval:def:678oval:org.mitre.oval:def:1662oval:org.mitre.oval:def:1647oval:org.mitre.oval:def:1425oval:org.mitre.oval:def:1310Unspecified vulnerability in Microsoft PowerPoint in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP1 and SP2, Office 2004 for Mac, and v. X for Mac allows user-assisted attackers to execute arbitrary code via a PowerPoint document with a malformed record, which triggers memory corruption.TA06-164AVU#19008918382MS06-028powerpoint-record-bo(26784)ADV-2006-232526435101628720633oval:org.mitre.oval:def:1984oval:org.mitre.oval:def:1836oval:org.mitre.oval:def:1069Microsoft Windows XP SP1 and SP2 before August 2004, and possibly other operating systems and versions, uses insecure default ACLs that allow the Authenticated Users group to gain privileges by modifying critical configuration information for the (1) Simple Service Discovery Protocol (SSDP), (2) Universal Plug and Play Device Host (UPnP), (3) NetBT, (4) SCardSvr, (5) DHCP, and (6) DnsCache services, aka "Permissive Windows Services DACLs." NOTE: the NetBT, SCardSvr, DHCP, DnsCache already require privileged access to exploit.VU#953860MS06-01118756win-auth-users-insecure-permissions(24463)http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=391523&RenditionID=ADV-2006-041720060131 Windows Access Control Demystifiedhttp://www.microsoft.com/technet/security/advisory/914457.mspxhttp://www.cs.princeton.edu/~sudhakar/papers/winval.pdfhttp://support.avaya.com/elmodocs2/security/ASA-2006-069.htm101576510155951931319238oval:org.mitre.oval:def:1696oval:org.mitre.oval:def:1671Multiple unspecified vulnerabilities in Adobe Flash Player 8.0.22.0 and earlier allow remote attackers to execute arbitrary code via a crafted SWF file.TA07-352ATA06-132ATA06-129ATA06-075AVU#945060http://www.macromedia.com/devnet/security/security_zone/apsb06-03.html19218macromedia-swf-code-execution(25005)ADV-2007-4238ADV-2006-1779ADV-2006-1744ADV-2006-1262ADV-2006-095217106RHSA-2006:02682390817951http://www.opera.com/docs/changelogs/windows/854/SUSE-SA:2006:015MS06-020GLSA-200603-201015770281362007720045193281925919198APPLE-SA-2007-12-17APPLE-SA-2006-05-11http://docs.info.apple.com/article.html?artnum=307179oval:org.mitre.oval:def:1922oval:org.mitre.oval:def:1894Stack-based buffer overflow in Microsoft Windows Media Player 9 and 10 allows remote attackers to execute arbitrary code via a PNG image with a large chunk size.TA06-164AVU#60802018385MS06-02420060613 Windows Media Player PNG Chunk Decoding Stack-Based Buffer Overflow20626win-media-player-png-bo(26788)ADV-2006-2322264301016284oval:org.mitre.oval:def:1974oval:org.mitre.oval:def:1820oval:org.mitre.oval:def:1807oval:org.mitre.oval:def:1805oval:org.mitre.oval:def:1729oval:org.mitre.oval:def:1230Buffer overflow in Microsoft Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows local and possibly remote attackers to execute arbitrary code via crafted Active Server Pages (ASP).VU#395588TA06-192Aiis-asp-bo(26796)18858MS06-034101646621006ADV-2006-27522715220060718 ASP.DLL Include File Buffer Overflowoval:org.mitre.oval:def:435Unspecified vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary code via e-mail messages with crafted (1) vCal or (2) iCal Calendar properties.TA06-129AVU#303452MS06-019exchange-calendar-code-execution(25556)ADV-2006-17431790825338101604820029oval:org.mitre.oval:def:2035oval:org.mitre.oval:def:1996oval:org.mitre.oval:def:1818Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via a BIFF parsing format file containing malformed BOOLERR records that lead to memory corruption, probably involving invalid pointers.TA06-073AVU#339878MS06-012101576619138excel-parsing-format-file-bo(25225)http://www.zerodayinitiative.com/advisories/ZDI-06-004.htmlADV-2006-095020060314 ZDI-06-004: Microsoft Excel File Format Parsing Vulnerability23899http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm58319238oval:org.mitre.oval:def:1635oval:org.mitre.oval:def:1509oval:org.mitre.oval:def:1411oval:org.mitre.oval:def:1158Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed description, which leads to memory corruption.TA06-073AVU#235774MS06-012101576619138excel-description-bo(25227)ADV-2006-095023900http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm58658519238oval:org.mitre.oval:def:1633oval:org.mitre.oval:def:1579oval:org.mitre.oval:def:1570oval:org.mitre.oval:def:1522Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed graphic, which leads to memory corruption.TA06-073AVU#123222MS06-012101576619138excel-graphic-bo(25229)ADV-2006-09501618123901http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm19238oval:org.mitre.oval:def:1666oval:org.mitre.oval:def:1630oval:org.mitre.oval:def:1510oval:org.mitre.oval:def:1401Stack-based buffer overflow in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed record with a modified length value, which leads to memory corruption.TA06-073AVU#10430217101MS06-012101576619138excel-record-bo(25228)ADV-2006-095020060315 [xfocus-SD-060314]Microsoft Office Excel Buffer Overflow Vulnerability23902http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm5891923820060314 [xfocus-SD-060314]Microsoft Office Excel Buffer Overflow Vulnerabilityoval:org.mitre.oval:def:763oval:org.mitre.oval:def:1750oval:org.mitre.oval:def:1525oval:org.mitre.oval:def:1327Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose charset is set to UTF-7.Successful exploitation requires that the Indexing service is accessible through IIS.TA06-255AVU#10888419927MS06-05321861ms-indexing-service-xss(28651)ADV-2006-356420061001 Microsoft Internet Information Services UTF-7 XSS Vulnerability [MS06-053]20061002 IE UXSS (Universal XSS in IE, was Re: Microsoft Internet Information Services UTF-7 XSS Vulnerability [MS06-053])SSRT061187HPSBST02134http://www.geocities.jp/ptrs_sec/advisory09e.html1016826oval:org.mitre.oval:def:535Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via a crafted PNG image that triggers memory corruption when it is parsed.TA06-192AVU#45938818913MS06-039ADV-2006-275727147http://www.fortinet.com/FortiGuardCenter/advisory/FG-2006-22.html101647021013oval:org.mitre.oval:def:163Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0 and Windows 2000 SP2 and SP3 allows remote attackers to execute arbitrary code via a long fifth argument to the BuildContextW or BuildContext opcode, which triggers a bug in the NdrAllocate function, aka the MSDTC Invalid Memory Access Vulnerability.1790620060509 [EEYEB20051011A] - Microsoft Distributed Transaction Coordinator Heap OverflowMS06-018http://www.eeye.com/html/research/advisories/AD20060509a.html20000msdtc-network-message-dos(25559)ADV-2006-174220060511 Microsoft MSDTC NdrAllocate Validation Vulnerability25335101604786320060510 Microsoft MSDTC NdrAllocate Validation Vulnerability20060509 [EEYEB20051011A] - Microsoft Distributed Transaction Coordinator Heap Overflowoval:org.mitre.oval:def:1908oval:org.mitre.oval:def:1477oval:org.mitre.oval:def:1222The netlink_rcv_skb function in af_netlink.c in Linux kernel 2.6.14 and 2.6.15 allows local users to cause a denial of service (infinite loop) via a nlmsg_len field of 0.2006-000418482kernel-afnetlink-dos(24202)ADV-2006-022016414http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ad8e4b75c8a7bed475d72ce09bf5267188621961388ip_nat_pptp in the PPTP NAT helper (netfilter/ip_nat_helper_pptp.c) in Linux kernel 2.6.14, and other versions, allows remote attackers to cause a denial of service (memory corruption or crash) via an inbound PPTP_IN_CALL_REQUEST packet that causes a null pointer to be used in an offset calculation.ADV-2006-0220http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=15db34702cfafd24acc60295cf14861e497502abkernel-pptpincallrequest-dos(24203)2006-00041641438818482ip_nat_pptp in the PPTP NAT helper (netfilter/ip_nat_helper_pptp.c) in Linux kernel 2.6.14, and other versions, allows local users to cause a denial of service (memory corruption or crash) via a crafted outbound packet that causes an incorrect offset to be calculated from pointer arithmetic when non-linear SKBs (socket buffers) are used.ADV-2006-0220http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=03b9feca89366952ae5dfe4ad8107b1ece50b710kernel-pptpnathelper-dos(24204)2006-00041641438818482Integer overflow in the do_replace function in netfilter for Linux before 2.6.16-rc3, when using "virtualization solutions" such as OpenVZ, allows local users with CAP_NET_ADMIN rights to cause a buffer overflow in the copy_from_user function.Linux kernel version 2.6.16 has been released to address this issue.17178https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=186295linux-netfilter-doreplace-overflow(25400)ADV-2006-2554ADV-2006-1046USN-302-1RHSA-2006:0575http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ee4bb818ae35f68d1f848eae0a7b150a38eb4168DSA-1103DSA-1097http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm224172146520914207162067119330oval:org.mitre.oval:def:10945Race condition in the do_add_counters function in netfilter for Linux kernel 2.6.16 allows local users with CAP_NET_ADMIN capabilities to read kernel memory by triggering the race condition in a way that produces a size value that is inconsistent with allocated memory, which leads to a buffer over-read in IPT_ENTRY_ITERATE.http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2722971cbe831117686039d5c334f2c0f560be13http://bugs.gentoo.org/show_bug.cgi?id=133465https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=191698linux-doaddcounters-race-condition(26583)ADV-2006-2554ADV-2006-1893USN-311-118113RHSA-2006:068925697DSA-1103DSA-1097http://support.avaya.com/elmodocs2/security/ASA-2006-249.htm22945222922147620991209142067120185oval:org.mitre.oval:def:10309http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.17GNOME Evolution 2.4.2.1 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a text e-mail with a large number of URLs, possibly due to unknown problems in gtkhtml.ADV-2006-080120060301 Evolution Emailer DoSevolution-email-dos(25050)1689919094Unspecified vulnerability in (1) apreq_parse_headers and (2) apreq_parse_urlencoded functions in Apache2::Request (Libapreq2) before 2.07 allows remote attackers cause a denial of service (CPU consumption) via unknown attack vectors that result in quadratic computational complexity.16710DSA-10001913918846libapreq2-parsing-dos(24917)ADV-2006-0645GLSA-200604-08http://svn.apache.org/viewcvs.cgi/httpd/apreq/tags/v2_07/CHANGES?rev=376998&view=markup73719658Buffer overflow in the realpath function in nfs-server rpc.mountd, as used in SUSE Linux 9.1 through 10.0, allows local users to execute arbitrary code via unspecified vectors involving mount requests and symlinks.18638SUSE-SA:2006:005nfs-rpcmountd-realpath-bo(24347)ADV-2006-03481638818614DSA-97518889http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=350020Unspecified vulnerability in context.py in Albatross web application toolkit before 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the "handling of submitted form fields".DSA-94218457ADV-2006-019616252http://www.object-craft.com.au/projects/albatross/news.htmlhttp://security.debian.org/pool/updates/main/a/albatross/albatross_1.20-2.diff.gzalbatross-context-command-execution(24130)2245118496crawl before 4.0.0 does not securely call programs when saving and loading games, which allows local users to gain privileges.DSA-949ADV-2006-03031633718545crawl-insecure-command-execution(24262)2269018573squid_redirect script in adzapper before 2006-01-29 allows remote attackers to cause a denial of service (CPU consumption) via a URL with a large number of trailing / (forward slashes), which might produce inefficient regular expressions.DSA-9661877718771ADV-2006-0491http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=350308http://bugs.debian.org/cgi-bin/bugreport.cgi/squid_redirect.diff?bug=350308;msg=5;att=1http://adzapper.sourceforge.net/cvslog.htmladzapper-squid-redirect-dos(24640)1655822900packets.c in Freeciv 2.0 before 2.0.8 allows remote attackers to cause a denial of service (server crash) via crafted packets with negative compressed size values.1697520060306 Out of memory crash in Freeciv 2.0.719120freeciv-packets-dos(25166)ADV-2006-0838MDKSA-2006:053GLSA-200603-11DSA-9941925319227http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=355211Francesco Stablum tcpick 0.2.1 allows remote attackers to cause a denial of service (segmentation fault) via certain fragmented packets, possibly involving invalid headers and an attacker-controlled payload length. NOTE: this issue might be a buffer overflow or overread.ADV-2006-146617665http://sourceforge.net/mailarchive/forum.php?thread_id=9989610&forum_id=37151tcpick-writec-dos(26090)gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455.1705820060309 GnuPG does not detect injection of unsigned data23790GLSA-200603-08DSA-993101574919173[gnupg-announce] 20060309 [Announce] GnuPG does not detect injection of unsigned dataADV-2006-0915USN-264-1oval:org.mitre.oval:def:10063gnupg-nondetached-sig-verification(25184)2006-0014SSA:2006-072-02FLSA-2006:185355RHSA-2006:0266FEDORA-2006-147MDKSA-2006:055568450195321928719249192441923419232192311920319197SUSE-SA:2006:01420060401-01-Usnmptrapfmt in Debian 3.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary log file.DSA-10131931817182snmptrapfmt-log-temprary-file(25442)Buffer overflow in playlistimport.cpp in Kaffeine Player 0.4.2 through 0.7.1 allows user-assisted attackers to execute arbitrary code via long HTTP request headers when Kaffeine is "fetching remote playlists", which triggers the overflow in the http_peek function.http://www.kde.org/info/security/advisory-20060404-1.txt19525kaffeine-http-peek-bo(25631)ADV-2006-1229USN-268-11737220060405 [Kaffeine Security Advisory] Heap based buffer overflow in http_peek()SUSE-SR:2006:008GLSA-200604-04DSA-102310158631957119557195491954219540MDKSA-2006:065The attachment scrubber (Scrubber.py) in Mailman 2.1.5 and earlier, when using Python's library email module 2.5, allows remote attackers to cause a denial of service (mailing list delivery failure) via a multipart MIME message with a single part that has two blank lines between the first boundary and the end boundary.17311http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=358892oval:org.mitre.oval:def:9475USN-267-1RHSA-2006:048624367SUSE-SR:2006:008MDKSA-2006:061DSA-10271015851207822062419571195451952220060602-01-UImager (libimager-perl) before 0.50 allows user-assisted attackers to cause a denial of service (segmentation fault) by writing a 2- or 4-channel JPEG image (or a 2-channel TGA image) to a scalar, which triggers a NULL pointer dereference.17415DSA-10281957719575imager-jpeg-tga-dos(25717)ADV-2006-1294http://rt.cpan.org/Public/Bug/Display.html?id=18397http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=359661The ipfw firewall in FreeBSD 6.0-RELEASE allows remote attackers to cause a denial of service (firewall crash) via ICMP IP fragments that match a reset, reject or unreach action, which leads to an access of an uninitialized pointer.1620918378FreeBSD-SA-06:04ipfw-icmp-fragment-dos(24073)223191015477The ispell_op function in ee on FreeBSD 4.10 to 6.0 uses predictable filenames and does not confirm which file is being written, which allows local users to overwrite arbitrary files via a symlink attack when ee invokes ispell.1620718404FreeBSD-SA-06:02ee-ispell-op-symlink(24074)223201015469Double free vulnerability in the authentication and authentication token alteration code in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted passwords, which lead to a double free of a pointer that was created by the pam_get_item function. NOTE: this issue only occurs in certain configurations in which there are multiple PAM modules, PAM-MySQL is not evaluated first, and there are no requisite modules before PAM-MySQL.VU#69390916564101560318598ADV-2006-04902299522994GLSA-200606-18http://sourceforge.net/forum/forum.php?forum_id=49939420690http://jvn.jp/cert/JVNVU%23693909/index.htmlMicrosoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to bypass the Kill bit settings for dangerous ActiveX controls via unknown vectors involving crafted HTML, which can expose the browser to attacks that would otherwise be prevented by the Kill bit setting. NOTE: CERT/CC claims that MS05-054 fixes this issue, but it is not described in MS05-054.VU#998297http://www.microsoft.com/technet/security/bulletin/ms05-054.mspxie-activex-killbit-bypass(24379)1640923657Signal handler race condition in Sendmail 8.13.x before 8.13.6 allows remote attackers to execute arbitrary code by triggering timeouts in a way that causes the setjmp and longjmp function calls to be interrupted and modify unexpected memory locations.TA06-081AVU#834865RHSA-2006:0265RHSA-2006:0264ADV-2006-2490ADV-2006-2189ADV-2006-1529ADV-2006-1157ADV-2006-1139ADV-2006-1072ADV-2006-1068ADV-2006-1051ADV-2006-1049http://www.sendmail.com/company/advisory/index.shtml20060322 sendmail vuln advisories (CVE-2006-0058)OpenPKG-SA-2006.00720060322 Sendmail Remote Signal Handling VulnerabilityGLSA-200603-21DSA-1015200494193671936319342oval:org.mitre.oval:def:11074HPSBTU02116HPSBUX02108smtp-timeout-bo(24584)http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=2751http://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v52.Readme.html#MH0068817192FLSA:186277FEDORA-2006-193FEDORA-2006-19424037[3.8] 006: SECURITY FIX: March 25, 2006SUSE-SA:2006:017MDKSA-2006:058http://www.f-secure.com/security/fsc-2006-2.shtmlQ-151IY82994IY82993IY82992http://support.avaya.com/elmodocs2/security/ASA-2006-078.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-074.htm102324102262SSA:2006-081-011015801743612207232024319774196761953319532194661945019407194041939419368193611936019356193491934619345HPSBTU02116HPSBUX0210820060401-01-U20060302-01-PSCOSA-2006.24NetBSD-SA2006-010FreeBSD-SA-06:13oval:org.mitre.oval:def:1689Heap-based buffer overflow in the ISO Transport Service over TCP (RFC 1006) implementation of LiveData ICCP Server before 5.00.035 allows remote attackers to cause a denial of service or execute arbitrary code via malformed packets.This vulnerability is addressed in the following product release:
LiveData, ICCP Server, 5.00.035VU#190617ADV-2006-1830http://www.kb.cert.org/vuls/id/JGEI-6MMS9Tlivedata-iccp-rfc1006-bo(26490)18010http://www.digitalbond.com/SCADA_Blog/2006/05/us-cert-livedata-iccp-vulnerability.html101611320146Cross-site scripting (XSS) vulnerability in phpBB 2.0.19, when "Allowed HTML tags" is enabled, allows remote attackers to inject arbitrary web script or HTML via a permitted HTML tag with ' (single quote) characters and active attributes such as onmouseover, a variant of CVE-2005-4357.ADV-2006-005122672313http://securityreason.com/securityalert/31320060105 phpBB 2.0.19 XSSPHP remote file include vulnerability in includes/orderSuccess.inc.php in CubeCart allows remote attackers to execute arbitrary PHP code via a URL in the glob[rootDir] parameter.ADV-2006-00161398SQL injection vulnerability in (1) functions.php, (2) functions_update.php, and (3) functions_display.php in VEGO Web Forum 1.26 and earlier allows remote attackers to execute arbitrary SQL commands via the theme_id parameter in index.php.ADV-2006-000320060101 [eVuln] VEGO Web Forum SQL Injection Vulnerability18273http://evuln.com/vulns/1/summary.html1610722140315SQL injection vulnerability in index.php in PHPjournaler 1.0 allows remote attackers to execute arbitrary SQL commands via the readold parameter.ADV-2006-00061611120060101 [eVuln] PHPjournaler SQL Injection Vulnerability2214918265http://evuln.com/vulns/9/summary.htmlSQL injection vulnerability in login.php in VEGO Links Builder 2.00 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.ADV-2006-000418272http://evuln.com/vulns/2/summary.html1610822139SQL injection vulnerability in Primo Cart 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) q parameter to search.php and (2) email parameter to user.php.ADV-2006-000818264161252214722146http://pridels0.blogspot.com/2006/01/primo-cart-sql-inj.htmlCross-site scripting (XSS) vulnerability in addentry.php in Chipmunk Guestbook 1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the homepage parameter.190871611220060101 [eVuln] Chipmunk Guestbook XSS Vulnerability18270http://evuln.com/vulns/4/summary.html** DISPUTED ** Drupal allows remote attackers to conduct cross-site scripting (XSS) attacks via an IMG tag with an unusual encoded Javascript function name, as demonstrated using variations of the alert() function. NOTE: a followup by the vendor suggests that the issue does not exist in 4.5.6 or 4.6.4 when "Filtered HTML" is enabled, and since "Full HTML" would not filter HTML by design, perhaps this should not be included in CVE.20060103 Re: Drupal all versiyon xss cehennem.org20060102 Drupal all versiyon xss cehennem.orgThe ebuild for pinentry before 0.7.2-r2 on Gentoo Linux sets setgid bits for pinentry programs, which allows local users to read or overwrite arbitrary files as gid 0.16120GLSA-200601-012221118284Buffer overflow in termsh on SCO OpenServer 5.0.7 allows remote attackers to execute arbitrary code via a long -o command line argument. NOTE: this is probably a different vulnerability than CVE-2005-0351 since it involves a distinct attack vector.1612220060102 SCO Openserver 5.0.x exploithttp://downloads.securityfocus.com/vulnerabilities/exploits/Openserver_bof.cCross-site scripting (XSS) vulnerability in DiscusWare Discus Freeware 3.10.5 and Professional 3.10.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a URL, which is not properly sanitized from the resulting error message. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.161192215318283SQL injection vulnerability in profile.php in PHPenpals allows remote attackers to execute arbitrary SQL commands via the personalID parameter. NOTE: it was later reported that 1.1 and earlier are affected.ADV-2006-00051610920060101 [eVuln] PHPenpals SQL Injection Vulnerabilit22150870618269http://evuln.com/vulns/5/summary.htmlDirect static code injection vulnerability in phpBook 1.3.2 and earlier allows remote attackers to execute arbitrary PHP code via the e-mail field (mail variable) in a new message, which is written to a PHP file.1610620060101 [eVuln] phpBook PHP Code Executionhttp://evuln.com/vulns/6/summary.htmlADV-2006-000218268PHP remote file include vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter.1610520060531 Re: OaBoard 1.0 Remote File inclusion20060530 OaBoard 1.0 Remote File inclusion20060101 [eVuln] oaBoard PHP Code Execution1016211http://evuln.com/vulns/3/summary.htmlOff-by-one error in the getfattr function in File::ExtAttr before 0.03 allows attackers to trigger a buffer overflow via unspecified attack vectors.16118http://sourceforge.net/project/shownotes.php?release_id=382199&group_id=15311618253ADV-2006-001322160Multiple cross-site scripting (XSS) vulnerabilities in B-net Software 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) shout variables to (a) shout.php, or the (3) title and (4) message variables to (b) guestbook.php.ADV-2006-00181611420060102 [eVuln] B-net Software Multiple XSS Vulnerabilities18271http://evuln.com/vulns/10/summary.html20060825 Re: [eVuln] B-net Software Multiple XSS Vulnerabilities2219122190http://sourceforge.net/project/shownotes.php?release_id=442067&group_id=117067316SQL injection vulnerability in auth.php in ScozNet ScozBook BETA 1.1 allows remote attackers to execute arbitrary SQL commands via the username field (adminname variable).ADV-2006-00271611520060102 [eVuln] ScozBook "adminname" Authentication Bypasshttp://evuln.com/vulns/11/summary.html222213188476Cross-site scripting (XSS) vulnerability in vBulletin 3.5.2, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the title of an event, which is not properly filtered by (1) calendar.php and (2) reminder.php.ADV-2006-00331611620060108 Html_Injection in vBulletin 3.5.220060101 [KAPDA::#19] - Html Injection in vBulletin 3.5.2222202221018299http://kapda.ir/advisory-177.htmlialmnt5.sys in the ialmrnt5 display driver in Intel Graphics Accelerator Driver 6.14.10.4308 allows attackers to cause a denial of service (crash or screen resolution change) via a long text field, as demonstrated using a long window title.ADV-2006-001716127221961828620060103 Re: Buffer Overflow vulnerability in Windows Display Manager [Suspected]20060103 Re: Buffer Overflow vulnerability in Windows Display Manager [Suspected]20060102 Buffer Overflow vulnerability in Windows Display Manager [Suspected]Format string vulnerability in the SetImageInfo function in image.c for ImageMagick 6.2.3 and other versions, and GraphicsMagick, allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a numeric format string specifier such as %d in the file name, a variant of CVE-2005-0397, and as demonstrated using the convert program.12717GLSA-200602-13.xmlGLSA-200602-06SSA:2006-045-031918319030188511860720060301-01-Uhttps://issues.rpath.com/browse/RPL-389ADV-2008-0412USN-246-120061127 rPSA-2006-0218-1 ImageMagickSUSE-SR:2006:006MDKSA-2006:024DSA-12132313211015623500288002309022998194081887118261RHSA-2006:0178oval:org.mitre.oval:def:10717http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=345876Format string vulnerability in the logging code of SMS Server Tools (smstools) 1.14.8 and earlier allows local users to execute arbitrary code via unspecified attack vectors.18357smstools-logging-format-string(24034)1618822287DSA-93018343Cross-site scripting vulnerability in index.php in raSMP 2.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the $_SERVER[HTTP_USER_AGENT] variable (User-Agent header).ADV-2006-0030161382219818292http://evuln.com/vulns/13/summary.html101543220060116 vendor ack/fix: 22198: raSMP index.php User-Agent Field XSS (fwd)SQL injection vulnerability in Nkads 1.0 alfa 3 allows remote attackers to execute arbitrary SQL commands via the (1) usuario_nkads_admin or (2) password_nkads_admin parameters.ADV-2006-0040http://www.soulblack.com.ar/repo/papers/advisory/nkads_advisory.txt1830222206Cross-site scripting vulnerability in index.php in Next Generation Image Gallery 0.0.1 Lite Edition allows remote attackers to inject arbitrary web script or HTML via the page parameter.ADV-2006-00371830922202http://osvdb.org/ref/22/22202-nextgen.txtSQL injection vulnerability in (1) pages.php and (2) detail.php in Lizard Cart CMS 1.04 allows remote attackers to execute arbitrary SQL commands via the id parameter.ADV-2006-00291614020060104 [eVuln] Lizard Cart CMS SQL Injection Vulnerability182972220022199http://www.evuln.com/vulns/12/summary.html1015435314SQL injection vulnerability in intouch.lib.php in inTouch 0.5.1 Alpha allows remote attackers to execute arbitrary SQL commands via the user parameter.ADV-2006-00261611020060101 [eVuln] inTouch Authentication Bypasshttp://evuln.com/vulns/8/summary.htmlintouch-intouch-sql-injection(23954)22382Buffer overflow in ESRI ArcPad 7.0.0.156 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a .amp file with a COORDSYS tag with a long string attribute.ADV-2006-003216136http://users.pandora.be/bratax/advisories/b007.html1829422208Directory traversal vulnerability in index.php in IDV Directory Viewer before 2005.1 allows remote attackers to view arbitrary directory contents via a .. (dot dot) in the dir parameter.http://sourceforge.net/project/shownotes.php?release_id=382593&group_id=152499ADV-2006-00311829816137Cross-site scripting (XSS) vulnerability in webmail in Open-Xchange 0.8.1-6 and earlier, with "Inline HTML" enabled, allows remote attackers to inject arbitrary web script or HTML via e-mail attachments, which are rendered inline.ADV-2006-00341828520060103 Open Xchange XSS1015431** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-0992, CVE-2006-0158. Reason: this candidate was intended for one issue, but a typo caused it to be associated with a Novell/Groupwise issue. In addition, this issue was a duplicate of a SiteSuite issue that was also assigned CVE-2006-0158. Notes: All CVE users should consult CVE-2006-0992 and CVE-2006-0158 to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage.Cross-site scripting (XSS) vulnerability in index.php in @Card ME PHP allows remote attackers to inject arbitrary web script or HTML via the cat parameter.ADV-2006-00392220318306http://osvdb.org/ref/22/22203-ecardmax.txtPHP remote file include vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc_stat parameter, a different vulnerability than CVE-2006-0076. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-002817373dm-crypt in Linux kernel 2.6.15 and earlier does not clear a structure before it is freed, which leads to a memory disclosure that could allow local users to obtain sensitive information about a cryptographic key.[linux-kernel] 20060104 [Patch 2.6] dm-crypt: zero key before freeing itADV-2006-0235oval:org.mitre.oval:def:11192[linux-kernel] 20060104 [Patch 2.6] dm-crypt: Zero key material before free to avoid information leakkernel-dmcrypt-information-disclosure(24189)USN-244-12006-000416301FLSA:157459-4RHSA-2006:0132FEDORA-2006-10222418SUSE-SA:2006:028MDKSA-2006:040DSA-10171015740388203981937419160187741852718487wan/sdla.c in Linux kernel 2.6.x before 2.6.11 and 2.4.x before 2.4.29 does not require the CAP_SYS_RAWIO privilege for an SDLA firmware upgrade, with unknown impact and local attack vectors. NOTE: further investigation suggests that this issue requires root privileges to exploit, since it is protected by CAP_NET_ADMIN; thus it might not be a vulnerability, although capabilities provide finer distinctions between privilege levels.MDKSA-2006:044USN-244-116304http://www.kernel.org/git/?p=linux/kernel/git/tglx/history.git;a=commitdiff;h=0f1d4813a4a65296e1131f320a60741732bc068fDSA-1017193741897718527http://linux.bkbits.net:8080/linux-2.4/cset@1.1448.91.23?nav=index.html|src/|src/drivers|src/drivers/net|src/drivers/net/wan|related/drivers/net/wan/sdla.cStack-based buffer overflow in the create_named_pipe function in libmysql.c in PHP 4.3.10 and 4.4.x before 4.4.3 for Windows allows attackers to execute arbitrary code via a long (1) arg_host or (2) arg_unix_socket argument, as demonstrated by a long named pipe variable in the host argument to the mysql_connect function.ADV-2006-00461614520060105 Windows PHP 4.x http://www.php.net/ChangeLog-4.php#4.4.3222321827520060105 Windows PHP 4.x 20060108 RE: Windows PHP 4.x The dupfdopen function in sys/kern/kern_descrip.c in OpenBSD 3.7 and 3.8 allows local users to re-open arbitrary files by using setuid programs to access file descriptors using /dev/fd/.16144[3.7] 20060105 008: SECURITY FIX: January 5, 200618296ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/008_fd.patch222311015437PHP remote file include vulnerability in (1) include/templates/categories/default.php and (2) certain other include/templates/categories/ PHP scripts in Valdersoft Shopping Cart 3.0 allows remote attackers to execute arbitrary code via a URL in the catalogDocumentRoot parameter.16126http://downloads.securityfocus.com/vulnerabilities/exploits/cijfer-vscxpl.pl1401Buffer overflow in NicoFTP 3.0.1.19 and earlier might allow local users to execute arbitrary code via a long string in the "Name of site" field of an FTP account. NOTE: because this program executes with the privileges of the invoking user, and because remote programs do not normally have the ability to create or modify FTP accounts in this program, there may not be a typical attack vector for the issue that crosses privilege boundaries. Therefore this may not be a vulnerability.20060102 NicoFTP Stack Overflow317Multiple cross-site scripting (XSS) vulnerabilities in sBLOG 0.7.1 Beta 20051202 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) p and (2) keyword parameters in (a) index.php and (b) search.php.sblog-multiple-scripts-xss(23979)ADV-2006-00412237422373http://osvdb.org/ref/22/22373-sblog.txtCross-site scripting (XSS) vulnerability in TinyPHPForum (TPF) 3.6 and earlier allows remote attackers to inject arbitrary web script via a javascript: scheme in an "[a]" bbcode tag, possibly the txt parameter to action.php.ADV-2006-005420060105 [eVuln] TinyPHPForum Multiple Vulnerabilities22256101543618293http://evuln.com/vulns/14/summary.html320TinyPHPForum 3.6 and earlier stores the (1) users/[USERNAME].hash and (2) users/[USERNAME].email files under the web root with insufficient access control, which allows remote attackers to list all registered users and possibly obtain other sensitive information.tinyphpforum-users-information-disclosure(24016)ADV-2006-005420060417 Tiny PHP forum - vulns20060105 [eVuln] TinyPHPForum Multiple Vulnerabilities22257101543632018293http://evuln.com/vulns/14/summary.htmlDirectory traversal vulnerability in TinyPHPForum 3.6 and earlier allows remote attackers to create a new user account, create a new topic, or view the profile of a user account, as demonstrated via a .. (dot dot) in the uname parameter to profile.php.ADV-2006-005420060105 [eVuln] TinyPHPForum Multiple Vulnerabilities18293http://evuln.com/vulns/14/summary.htmlhttp://evuln.com/vulns/14/exploit.html16163222581015436320PostgreSQL 8.0.x before 8.0.6 and 8.1.x before 8.1.2, when running on Windows, allows remote attackers to cause a denial of service (postmaster exit and no new connections) via a large number of simultaneous connection requests.[pgsql-announce] 20060109 CRITICAL RELEASE: Minor Releases to Fix DoS VulnerabilityADV-2006-0114postgresql-connection-request-dos(24049)1620120060111 PostgreSQL security releases 8.0.6 and 8.1.2http://www.postgresql.org/about/news.456101548232718419gdi/driver.c and gdi/printdrv.c in Wine 20050930, and other versions, implement the SETABORTPROC GDI Escape function call for Windows Metafile (WMF) files, which allows attackers to execute arbitrary code, the same vulnerability as CVE-2005-4560 but in a different codebase.18323http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=346197ADV-2006-0098[Dailydave] 20060105 WMF goes away :<win-wmf-execute-code(23846)20060117 ERRATA: [ GLSA 200601-09 ] Wine: Windows Metafile SETABORTPROC vulnerabilitySUSE-SR:2006:002MDKSA-2006:014GLSA-200601-09DSA-954185781854918451SQL injection vulnerability in Timecan CMS allows remote attackers to execute arbitrary SQL commands via the viewID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Due to the unavailability of the original source, it cannot be determined if this is the same issue as identified by CVE-2006-0108.161592225218324timecancms-sql-injection(24014)SQL injection vulnerability in mcl_login.asp in Timecan CMS allows remote attackers to execute arbitrary SQL commands via the email parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Due to the unavailability of the original source, it cannot be determined if this is the same issue as identified by CVE-2006-0107.ADV-2006-00782225322252timecancms-sql-injection(24014)Cross-site scripting vulnerability in category.php in Modular Merchant Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the cat parameter.18320ADV-2006-00761616022243http://www.modularmerchant.com/forums/viewtopic.php?t=46http://osvdb.org/ref/22/22243-modular.txt20060214 vendor ack/fix 22243: Modular Merchant Marketplace Shopping Cart category.php cat Variable XSS (fwd)Cross-site scripting (XSS) vulnerability in escribir.php in Foro Domus 2.10 allows remote attackers to inject arbitrary web script via the email parameter.ADV-2006-00731615420060106 [eVuln] Proyecto Domus 'email' XSS Vulnerability2226318327http://evuln.com/vulns/16/summary.htmldomus-escribir-xss(24020)Cross-site scripting vulnerability in index.php in Boxcar Media Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the (1) parent or (2) pg parameter.boxcar-index-xss(24019)ADV-2006-008022360http://osvdb.org/ref/22/22360-boxcar.txtCross-site scripting (XSS) vulnerability in index.php in Enhanced Simple PHP Gallery 1.7 allows remote attackers to inject arbitrary web script or HTML via the dir parameter.ADV-2006-00362220118310http://osvdb.org/ref/22/22201-espg.txtEnhanced Simple PHP Gallery 1.7 allows remote attackers to obtain the full path of the application via a direct request to sp_helper_functions.php, which leaks the pathname in an error message.18310http://osvdb.org/ref/22/22201-espg.txt22417The vCard functions in Joomla! 1.0.5 use predictable sequential IDs for vcards and do not restrict access to them, which allows remote attackers to obtain valid e-mail addresses to conduct spam attacks by modifying the contact_id parameter to index2.php.joomla-vcard-information-disclosure(24042)ADV-2006-00971618518361http://forum.joomla.org/index.php/topic,29031.0.htmlhttp://forge.joomla.org/sf/go/artf2950Multiple SQL injection vulnerabilities in OnePlug Solutions OnePlug CMS allow remote attackers to execute arbitrary SQL commands via the (1) Press_Release_ID parameter in press/details.asp, (2) Service_ID parameter in services/details.asp, and (3) Product_ID parameter in products/details.asp.ADV-2006-00791615522250222492224818325http://osvdb.org/ref/22/22248-oneplug.txtCross-site scripting vulnerability search.inetstore in iNETstore Ebusiness Software 2.0 allows remote attackers to inject arbitrary web script or HTML via the searchterm parameter.ADV-2006-00751615620060126 Re: [OSVDB Mods] iNETstore E Commerce Solution - Cross Site Scripting2225120060127 vendor confirms versions: iNETstore E Commerce Solution - Cross Site Scripting (fwd)18322http://osvdb.org/ref/22/22251-inetstore.txtBuffer overflow in IBM Lotus Notes and Domino Server before 6.5.5 allows attackers to cause a denial of service (router crash or hang) via unspecified vectors involving "CD to MIME Conversion".1615818328ADV-2006-0081http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/21d8fd7989fdf78d852570e4001bae68?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/50c634bfe193efa5852570e4001baace?OpenDocumenthttp://www-1.ibm.com/support/docview.wss?uid=swg27007054lotus-cdtomime-dos(24205)Unspecified vulnerability in IBM Lotus Notes and Domino Server before 6.5.5, when running on AIX, allows attackers to cause a denial of service (deep recursion leading to stack overflow and crash) via long formulas.1615818328ADV-2006-0081http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/21d8fd7989fdf78d852570e4001bae68?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/50c634bfe193efa5852570e4001baace?OpenDocumenthttp://www-1.ibm.com/support/docview.wss?uid=swg27007054lotus-long-formula-bo(24206)Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before 6.5.5 have unknown impact and attack vectors, due to "potential security issues" as identified by SPR numbers (1) GPKS6C9J67 in Agents, (2) JGAN6B6TZ3 and (3) KSPR699NBP in the Router, (4) GPKS5YQGPT in Security, or (5) HSAO6BNL6Y in the Web Server. NOTE: vector 3 is related to an issue in NROUTER in IBM Lotus Notes and Domino Server before 6.5.4 FP1, 6.5.5, and 7.0, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted vCal meeting request sent via SMTP (aka SPR# KSPR699NBP).1615818328domino-smtp-nrouter-dos(27413)lotus-web-unspecified-xss(24211)lotus-multiple-unspecified(24207)ADV-2006-2564ADV-2006-00811802020060626 SYMSA-2006-006: Lotus Domino SMTP Based Denial of Servicehttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/f97fe7cfd9a8113b8525709200001db4?OpenDocument&Highlight=0,GPKS6C9J67http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/e4deb1cbb011c747852570e4001ba9bb?OpenDocument&Highlight=0,GPKS5YQGPThttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/de2ab57a5b9547848525701b00420c2c?OpenDocument&Highlight=0,KSPR699NBPhttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/d1150fc9c5dec8b18525709200001da6?OpenDocument&Highlight=0,GPKS6C9J67http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/9a1650d1a771f3078525702a00420def?OpenDocument&Highlight=0,HSAO6BNL6Yhttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/94a77eb898843aca8525709200001de1?OpenDocument&Highlight=0,JGAN6B6TZ3http://www-1.ibm.com/support/docview.wss?uid=swg27007054101639020855Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before 6.5.5 allow attackers to cause a denial of service (application crash) via multiple vectors, involving (1) a malformed message sent to an "Out Of Office" agent (SPR LPEE6DMQWJ), (2) the compact command (RTIN5U2SAJ), (3) malformed bitmap images (MYAA6FH5HW), (4) the "Delete Attachment" action (YPHG6844LD), (5) parsing certificates from a remote Certificate Table (AELE6DZFJW), and (6) creating a SSL key ring with the Domino Administration client (NSUA4FQPTN).1615818328ADV-2006-0081http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/ced5f873baea4e8b852570e4001baa6d?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/ad0dd14aa109f96b852570e4001bb08c?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/5f166a44ee743b2c852570e4001baf31?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/4118a1f266afb26c852570e4001baf5e?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/2bb4f466a9e986ae852570e4001babbb?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/040482aeb1416bb7852570e4001badd6?OpenDocumenthttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/258394eaa824f2c08525708a004209d3?OpenDocumenthttp://www-1.ibm.com/support/docview.wss?uid=swg27007054lotus-ssl-keyring-dos(24217)lotus-certificate-parsing-dos(24216)lotus-delete-attachment-dos(24215)lotus-bmp-dos(24214)lotus-compact-dos(24213)lotus-outofoffice-dos(24212)Multiple memory leaks in IBM Lotus Notes and Domino Server before 6.5.5 allow attackers to cause a denial of service (memory consumption and crash) via unknown vectors related to (1) unspecified vectors during the SSL handshake (SPR# MKIN67MQVW), (2) the stash file during the SSL handshake (SPR# MKIN693QUT), and possibly other vectors. NOTE: due to insufficient information in the original vendor advisory, it is not clear whether there is an attacker role in other memory leaks that are specified in the advisory.1615818328ADV-2006-0081http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/2221243535d88a2b8525701b00420cd6?OpenDocument&Highlight=0,MKIN693QUThttp://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/20f66e356a76c90f8525702a00420e08?OpenDocument&Highlight=0,MKIN67MQVWhttp://www-1.ibm.com/support/docview.wss?uid=swg27007054lotus-ssl-handshake-dos(24223)Cross-site scripting (XSS) vulnerability in Public/Index.asp in Aquifer CMS allows remote attackers to inject arbitrary web script or HTML via the Keyword parameter.Vendor provided solution:
"Liquid Development has identified this vulnerability in all shipping versions of AquiferCMS and coded a software fix. The fix will be included in all releases of AquiferCMS built on or after January 24, 2006. Customers should contact Liquid Development to obtain the fix for this vulnerability. For more information visit www.aquifercms.com."
22247ADV-2006-00741616218326http://osvdb.org/ref/22/22247-aquifer.txt20060124 vendor ack/fix: Aquifer CMS Index.asp Keyword Variable XSS (fwd)Multiple SQL injection vulnerabilities in ADN Forum 1.0b allow remote attackers to execute arbitrary SQL commands via the (1) fid parameter in index.php and (2) pagid parameter in verpag.php, and possibly other vectors.ADV-2006-00771615720060105 [eVuln] ADNForum Multiple Vulnerabilities2224122240101544518300http://evuln.com/vulns/15/summary.htmlCross-site scripting (XSS) vulnerability in crear.php in ADN Forum 1.0b allows remote attackers to inject arbitrary web script or HTML via the titulo parameter, which is used by the "Topic name" field.ADV-2006-00771615720060105 [eVuln] ADNForum Multiple Vulnerabilities18300http://evuln.com/vulns/15/summary.html222421015445Unspecified vulnerability in appserv/main.php in AppServ 2.4.5 allows remote attackers to include arbitrary files via the appserv_root parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. There is not enough detail from these third party sources to know whether this is directory traversal, remote file include, or another issue.ADV-2006-0053222281816316166rxvt-unicode before 6.3, on certain platforms that use openpty and non-Unix pty devices such as Linux and most BSD platforms, does not maintain the intended permissions of tty devices, which allows local users to gain read and write access to the devices.2222318301ADV-2006-0052http://dist.schmorp.de/rxvt-unicode/ChangesDirectory traversal vulnerability in the IMAP service of Rockliffe MailSite before 6.1.22.1 allows remote authenticated users to rename the folders of other users via a .. (dot dot) in the RENAME command.http://zur.homelinux.com/Advisories/RockliffeMailsiteDirTransveral.txt222291831820060104 Rockliffe Directory Transversal VulnerabilityADV-2006-005520060105 Re: Rockliffe Directory Transversal VulnerabilityBuffer overflow in the IMAP service of Rockliffe MailSite before 6.1.22.1 allows remote attackers to have an unknown impact via unknown attack vectors.http://zur.homelinux.com/Advisories/RockliffeMailsiteDirTransveral.txt20060104 Rockliffe Directory Transversal Vulnerabilityrockliffe-imap-unspecified-bo(39991)Mail Management Agent (MAILMA) (aka Mail Management Server) in Rockliffe MailSite 7.0.3.1 and earlier generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames via user requests to TCP port 106.18318http://zur.homelinux.com/Advisories/RockliffeMailsiteUserEnum.txtADV-2006-00552223020060104 Rockliffe Mailsite User Enumeration FlawMail Management Agent (MAILMA) (aka Mail Management Server) in Rockliffe MailSite 7.0.3.1 and earlier allows remote attackers to attempt authentication with an unlimited number of user account names and passwords without denying connections, limiting the rate of connections, or locking out an account.http://zur.homelinux.com/Advisories/RockliffeMailsiteUserEnum.txt20060104 Rockliffe Mailsite User Enumeration FlawboastMachine 3.1 allows remote attackers to obtain sensitive information via a direct request to (1) footer.php and (2) side_menu.php, which reveals the path in an error message.20060105 [ECHO_ADV_25$2006] Full path disclosure on boastMachine v3.1http://echo.or.id/adv/adv26-K-159-2006.txtDirectory traversal vulnerability in webftp.php in SysCP WebFTP 1.2.6 and possibly earlier allows remote attackers to include and execute arbitrary local PHP scripts, and possibly read other types of files, via a .. (dot dot) and a trailing null in the webftp_language parameter.18355ADV-2006-00901617520060104 SysCP WebFTP local file inclusion vulnerabilitywebftp-language-file-include(24018)Multiple directory traversal vulnerabilities in AIX 5.3 ML03 allow local users to determine the existence of files and read partial contents of certain files via a .. (dot dot) in the argument to (1) getCommand.new (aka getCommand) and (2) getShell, a different vulnerability than CVE-2005-4273.161031610220060101 [xfocus-SD-060101]AIX getCommand&getShell two vulnerabilities1015429Cross-site scripting (XSS) vulnerability in register.php in TheWebForum (twf) 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the www parameter.ADV-2006-00931616120060106 [eVuln] TheWebForum Script Insertion and Authentication Bypass101545018392http://evuln.com/vulns/17/summary.htmlhttp://evuln.com/vulns/17/exploit.htmlthewebforum-register-xss(24007)22295SQL injection vulnerability in login.php in TheWebForum (twf) 1.2.1 allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the username parameter (aka the u variable).ADV-2006-00931616120060106 [eVuln] TheWebForum Script Insertion and Authentication Bypass101545018392http://evuln.com/vulns/17/summary.htmlhttp://evuln.com/vulns/17/exploit.htmlthewebforum-login-sql-injection(24027)22294321Multiple cross-site scripting (XSS) vulnerabilities in the guestbook module in modules.php in Phanatic Softwares Chimera Web Portal System 0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) comment_poster, (2) comment_poster_email, (3) comment_poster_homepage, and (4) comment_text parameters.ADV-2006-00251611320060101 [eVuln] Chimera Web Portal System Multiple Vulnerabilitieshttp://evuln.com/vulns/7/summary.htmlhttp://evuln.com/vulns/7/exploit.htmlSQL injection vulnerability in linkcategory.php in Phanatic Softwares Chimera Web Portal System 0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.ADV-2006-00251611320060101 [eVuln] Chimera Web Portal System Multiple Vulnerabilitieshttp://evuln.com/vulns/7/summary.htmlhttp://evuln.com/vulns/7/exploit.htmlchimera-linkcategory-sql-injection(23963)22420aMSN (aka Alvaro's Messenger) allows remote attackers to cause a denial of service (client hang and termination of client's instant-messaging session) by repeatedly sending crafted data to the default file-transfer port (TCP 6891).http://www.securiteam.com/exploits/5JP090KHFQ.html22186The send-private-message functionality (send-private-message.asp) in PD9 Software MegaBBS 2.1 allows remote attackers to read private messages of other users via a modified replyid parameter.16168http://www.pd9soft.com/megabbs/forums/thread-view.asp?tid=4924http://www.hamid.ir/security/megabbs.txt18342ADV-2006-0095megabbs-sendprivatemessage-disclosure(24050)1015452Cross-site scripting (XSS) vulnerability in post.php in NavBoard V16 Stable(2.6.0) and V17beta2 allows remote attackers to inject arbitrary web script or HTML via the (1) b, (2) textlarge, and (3) url bbcode tags.navboard-post-xss(24021)ADV-2006-00921616520060107 [eVuln] NavBoard BBcode XSS Vulnerability2227718345http://evuln.com/vulns/19/summary.htmlQualcomm Eudora Internet Mail Server (EIMS) before 3.2.8 allows remote attackers to cause a denial of service (crash) via (1) malformed NTLM authentication requests, or a malformed (2) Incoming Mail X or (3) Temporary Mail file.http://www.eudora.co.nz/updates.html18356ADV-2006-009916179eims-corrupted-mail-dos(24033)eims-ntlm-auth-dos(24032)Cross-site scripting (XSS) vulnerability in andromeda.php in Andromeda 1.9.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the s parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-00961618318359andromeda-script-xss(24031)Microsoft Windows Graphics Rendering Engine (GRE) allows remote attackers to corrupt memory and cause a denial of service (crash) via a WMF file containing (1) ExtCreateRegion or (2) ExtEscape function calls with arguments with inconsistent lengths.1015453win-gre-wmf-dos(24044)ADV-2006-01151616720060109 [UPDATE]Microsoft Windows GRE WMF Format Multiple Unauthorized Memory Access Vulnerabilities20060107 Microsoft Windows GRE WMF Format Multiple Memory Overrun Vulnerabilitieshttp://lostmon.blogspot.com/2007/08/windows-extended-file-attributes-buffer.htmlhttp://blogs.technet.com/msrc/archive/2006/01/09/417198.aspxThe proxy server feature in go-pear.php in PHP PEAR 0.2.2, as used in Apache2Triad, allows remote attackers to execute arbitrary PHP code by redirecting go-pear.php to a malicious proxy server that provides a modified version of Tar.php with a malicious extractModify function.18390gopear-proxy-redirection(24076)ADV-2006-01481617420060109 New PEAR / Apache2Triad Exploithttp://apache2triad.net/forums/viewtopic.php?p=14670The kernfs_xread function in kernfs in NetBSD 1.6 through 2.1, and OpenBSD 3.8, does not properly validate file offsets against negative 32-bit values that occur as a result of truncation, which allows local users to read arbitrary kernel memory and gain privileges via the lseek system call.16173http://www.securitylab.net/research/2006/02/advisory_netbsd_openbsd_kernfs.html20060202 [SLAB] NetBSD / OpenBSD kernfs_xread patch evasion222931871218388NetBSD-SA2006-001netbsd-kernfs-memory-disclosure(24035)405The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.http://www.xaraya.com/index.php/news/5691618720060202 Bug for libs in php link directory 2.022290GLSA-200604-07DSA-1031DSA-1030DSA-1029http://secunia.com/secunia_research/2005-64/advisory/19699195911959019563195551872018276182601823317418adodb-server-command-execution(24051)ADV-2006-1419ADV-2006-1305ADV-2006-1304ADV-2006-0447ADV-2006-0370ADV-2006-0105ADV-2006-0104ADV-2006-0103ADV-2006-0102ADV-2006-010120070418 MediaBeez Sql query Execution .. Wear isn't ?? :)20060409 PhpOpenChat 3.0.x ADODB Server.php http://www.maxdev.com/Article550.phtml7132495419691196001826718254http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.htmlDynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo.22291GLSA-200604-07DSA-1030DSA-1029http://secunia.com/secunia_research/2005-64/advisory/196281959119590195551827618260182541823317418ADV-2006-1332ADV-2006-1305ADV-2006-0104ADV-2006-0103ADV-2006-0102ADV-2006-010120060412 Simplog <=0.9.2 multiple vulnerabilities20060409 PhpOpenChat 3.0.x ADODB Server.php "sql" SQL injectionDSA-10311960018267http://retrogod.altervista.org/simplog_092_incl_xpl.htmlhttp://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html1663adodb-tmssql-command-execution(24052)19691NetSarang Xlpd 2.1 allows remote attackers to cause a denial of service (crash) via a large number of connections from the same IP address.16164http://www.ipomonis.com/advisories/xlpd.txt1015444xlpd-connection-dos(24041)Cross-site scripting (XSS) vulnerability in SimpBook 1.0, with html_enable on (the default), allows remote attackers to inject arbitrary web script or HTML via the message field.101545120060106 SimpBook "message" Remote Cross-Site Scripting VulnerabilityMultiple format string vulnerabilities in the auth_ldap_log_reason function in Apache auth_ldap 1.6.0 and earlier allows remote attackers to execute arbitrary code via various vectors, including the username.MDKSA-2006:01716177RHSA-2006:0179DSA-95218568184121840518382apache-authldap-format-string(24030)ADV-2006-011720060109 Digital Armaments Security Advisory 01.09.2006: Apache auth_ldap module Multiple Format Strings Vulnerabilityhttp://www.rudedog.org/auth_ldap/Changes.htmlhttp://www.digitalarmaments.com/2006090173928420.html1015456sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158.18363USN-235-216184183582006-0010SUSE-SR:2006:002MDKSA-2006:159DSA-946SSA:2006-045-082169219016189061855818549Cross-site scripting (XSS) in search_result.php in phpChamber 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the needle parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-00941618018360phpchamber-searchresult-xss(24029)22282427BB 2.2 and 2.2.1 verifies authentication credentials based on the username, authenticated, and usertype cookies, which allows remote attackers to bypass authentication by using a valid username and usertype and setting the authenticated cookie.ADV-2006-00911617820060107 [eVuln] 427BB Multiple Vulnerabilities (Cookie-based Authentication Bypass, SQL Injections, XSS)18354http://evuln.com/vulns/18/summary.html427bb-scripts-security-bypass(24038)22274SQL injection vulnerability in showthread.php in 427BB 2.2 and 2.2.1 allows remote attackers to execute arbitrary SQL commands via the ForumID parameter.ADV-2006-00911616920060107 [eVuln] 427BB Multiple Vulnerabilities (Cookie-based Authentication Bypass, SQL Injections, XSS)18354http://evuln.com/vulns/18/summary.html427bb-showthread-sql-injection(24039)22275Cross-site scripting (XSS) vulnerability in posts.php in 427BB 2.2 and 2.2.1 allows remote attackers to inject arbitrary Javascript via a new message with a url bbcode tag containing a javascript URI.ADV-2006-009120060107 [eVuln] 427BB Multiple Vulnerabilities (Cookie-based Authentication Bypass, SQL Injections, XSS)18354http://evuln.com/vulns/18/summary.html427bb-posts-xss(24040)22276Cross-site scripting (XSS) vulnerability in Foxrum 4.0.4f allows remote attackers to inject arbitrary Javascript via the javascript URI in bbcode url tags in (1) addpost1.php and (2) addtopic1.php.ADV-2006-01211617220060109 [eVuln] Foxrum BBCode XSS Vulnerabilty18386http://evuln.com/vulns/20foxrum-bbcode-xss(24043)325settings.php in Reamday Enterprises Magic News Plus 1.0.3 allows remote attackers to change the administrator password via a change action that specifies identical values for the passwd and admin_password parameters, then declares the new password string in the new_passwd and confirm_passwd parameters.16182http://downloads.securityfocus.com/vulnerabilities/exploits/MagicNewsPlus-pw-change.pl18601SQL injection vulnerability in index.php in CyberDoc SiteSuite CMS allows remote attackers to execute arbitrary SQL commands via the page parameter.ADV-2006-00382220518305http://osvdb.org/ref/22/22205-sitesuite.txtSQL injection vulnerability in escribir.php in Foro Domus 2.10 allows remote attackers to execute arbitrary SQL commands via the email parameter. NOTE: the provenance of this information is unknown, although it may be based on post-disclosure analysis of CVE-2006-0110; the details are obtained solely from third party information.domus-escribir-sql-injection(24017)ADV-2006-00732226418327SQL injection vulnerability in add_post.php3 in Venom Board 1.22 allows remote attackers to execute arbitrary SQL commands via the (1) parent, (2) root, and (3) topic_id parameters to post.php3.venomboard-addpost-sql-injection(24046)ADV-2006-012216176222973261838320060109 [eVuln] Venom Board SQL Injection Vulnerabilityhttp://evuln.com/vulns/21/summary.htmlUnspecified vulnerability in uucp in Sun Solaris 8 and 9 has unknown impact and attack vectors. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this is related to CVE-2004-0780.101933ADV-2006-0113http://support.avaya.com/elmodocs2/security/ASA-2006-056.htm10154551908718371oval:org.mitre.oval:def:1534Heap-based buffer overflow in libclamav/upx.c in Clam Antivirus (ClamAV) before 0.88 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted UPX files.VU#3859081619118379ADV-2006-0116http://www.clamav.net/doc/0.88/ChangeLogclamav-libclamav-upx-bo(24047)http://www.zerodayinitiative.com/advisories/ZDI-06-001.html2006-000222318MDKSA-2006:016GLSA-200601-07DSA-94710154573421854818478184631845320060112 ZDI-06-001: Clam AntiVirus UPX Unpacking Code Execution VulnerabilitySQL injection vulnerability in the search module (modules/Search/index.php) of PHPNuke EV 7.7 -R1 allows remote attackers to execute arbitrary SQL commands via the query parameter, which is used by the search field. NOTE: This is a different vulnerability than CVE-2005-3792.phpnukeev-search-sql-injection(44978)ADV-2006-0120161862231618394http://lostmon.blogspot.com/2006/01/phpnuke-ev-77-search-module-query.htmlphgstats.inc.php in phgstats before 0.5.1, if register_globals is enabled, allows remote attackers to include arbitrary files and execute arbitrary PHP code by modifying the PHGDIR variable.http://sourceforge.net/project/shownotes.php?release_id=38423218346ADV-2006-0123phgstats-php-file-include(24062)1746922302Cross-site scripting (XSS) vulnerability in the DataForm Entries functionality in Plain Black WebGUI before 6.8.4 (gamma) allows remote attackers to inject arbitrary Javascript via the (1) url and (2) name field of the default email form.http://sourceforge.net/project/shownotes.php?release_id=384153&group_id=5141718372ADV-2006-0126http://sourceforge.net/tracker/index.php?func=detail&aid=1395371&group_id=51417&atid=463213webgui-forms-xss(24053)Symantec Norton SystemWorks and SystemWorks Premier 2005 and 2006 stores temporary copies of files in the Norton Protected Recycle Bin NProtect directory, which is hidden from the FindFirst and FindNext Windows APIs and allows remote attackers to hide arbitrary files from virus scanners and other products.1015462http://securityresponse.symantec.com/avcenter/security/Content/2006.01.10.html18402systemworks-nprotect-hidden(24061)ADV-2006-0143SQL injection vulnerability in MyPhPim 01.05 allows remote attackers to execute arbitrary SQL commands via the (1) cal_id parameter in calendar.php3 and the (2) password field on the login page.myphpim-login-sql-injection(24075)myphpim-calendar-sql-injection(24066)ADV-2006-01471621020060111 [eVuln] MyPhPim Multiple SQL Injection and XSS Vulnerabilities223252232418399http://evuln.com/vulns/22/summary.htmlCross-site scripting (XSS) vulnerability in MyPhPim 01.05 allows remote attackers to inject arbitrary web script or HTML via the description field on the "Create New todo" page.myphpim-todo-xss(24071)ADV-2006-01471621020060111 [eVuln] MyPhPim Multiple SQL Injection and XSS Vulnerabilities2232618399http://evuln.com/vulns/22/summary.htmladdresses.php3 in MyPhPim 01.05 does not restrict uploaded files, which allows remote attackers to execute arbitrary PHP code via the pdbfile variable, then directly accessing those files from the uploads directory.myphpim-addresses-file-upload(24070)ADV-2006-01471620820060111 [eVuln] MyPhPim Arbitrary File Upload18399http://evuln.com/vulns/23/summary.html** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-0035. Reason: This candidate is a duplicate of CVE-2006-0035. Notes: All CVE users should reference CVE-2006-0035 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.PHP remote file include vulnerability in index.php in OrjinWeb E-commerce allows remote attackers to execute arbitrary code via a URL in the page parameter. NOTE: it is not clear, but OrjinWeb might be an application service, in which case it should not be included in CVE.1619920060106 Orjinweb E-commerceorjinweb-url-file-include(24097)22387Cross-site scripting (XSS) vulnerability in the file manager utility in Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to inject arbitrary web script or HTML in an uploaded page, which is published without a check for hostile scripting.ADV-2006-01451619520060110 Multiple Vulnerabilities in Hummingbird Collaborationhttp://www.securenetwork.it/advisories/sn-2006-01.html18411hummingbird-enterprise-xss(24067)Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to misrepresent the type and name of a file via modified doc_ext and id parameters, which might trick a user into downloading dangerous or unexpected content.ADV-2006-01451619520060110 Multiple Vulnerabilities in Hummingbird Collaborationhttp://www.securenetwork.it/advisories/sn-2006-01.html18411hummingbird-enterprise-file-download(24068)Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to obtain sensitive information (intranet IP addresses and enumerations of valid parameter values) via a direct request to hc, which reveals the information in an error message or a cookie.ADV-2006-01451619520060110 Multiple Vulnerabilities in Hummingbird Collaborationhttp://www.securenetwork.it/advisories/sn-2006-01.html18411hummingbird-enterprise-information-disclosure(24069)328Cross-site scripting (XSS) vulnerability in search_form.asp in Web Wiz Forums 6.34 allows remote attackers to inject arbitrary web script or HTML via the search parameter.16196webwizforums-searchform-xss(24048)20060111 Advisory:XSS vulnerability on WebWiz Forums <= 6.34(search_form.asp)2239820060109 Advisory:XSS vulnerability on WebWiz Forums <= 6.34 (search_form.asp)Buffer overflow in certain functions in src/fileio.c and src/unix/fileio.c in xmame before 11 January 2006 may allow local users to gain privileges via a long (1) -lang, (2) -ctrlr, (3) -pb, or (4) -rec argument on many operating systems, and via a long (5) -jdev argument on Ubuntu Linux.1620320060110 mysec.org Security Advisory : Xmame buffer overflow, with a possibility of privilege escalation20060110 mysec.org Security Advisory : Xmame buffer overflow, with a possibility of privilege escalation.xmame-multiple-parameters-bo(24102)http://x.mame.net/changes-unix.htmlMultiple buffer overflows in Cray UNICOS 9.0.2.2 might allow local users to gain privileges by (1) invoking /usr/bin/script with a long command line argument or (2) setting the -c option of /etc/nu to the name of a file containing a long line.1620520060110 SUID root overflows in UNICOS and partial shellcodeunicos-command-line-bo(24276)Format string vulnerability in /bin/ftp in UNICOS 9.0.2.2 allows local users to have an unknown impact via format string specifiers in the quote command. NOTE: because the program is not setuid and not normally called from remote programs, there may not be a typical attack vector for the issue that crosses privilege boundaries. Therefore this may not be a vulnerability.1620520060110 SUID root overflows in UNICOS and partial shellcodeunicos-ftp-format-string(24277)The Cisco IP Phone 7940 allows remote attackers to cause a denial of service (reboot) via a large amount of TCP SYN packets (syn flood) to arbitrary ports, as demonstrated to port 80.101548818479cisco-ipphone-synflood-dos(24117)ADV-2006-0202162002246920060113 Response to Cisco IP Phone 7940 DoS Exploit posted on milw0rm.comhttp://downloads.securityfocus.com/vulnerabilities/exploits/cisco_ip7940_dos.plCross-site scripting (XSS) vulnerability in CaLogic Calendars 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the Title field on the "Adding New Event" page, and possibly other vectors, involving iframe tags.ADV-2006-01491620618417http://evuln.com/vulns/24/summary.htmlcalogic-newevent-xss(24077)20060116 [eVuln] CaLogic Calendars Multiple XSS Vulnerabilities22322Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.1.3 has an undocumented administrative account with a default password, which allows local users to gain privileges via the expert command.1621120060111 Default Administrative Password in Cisco Security Monitoring, Analysis and Response System (CS-MARS)ADV-2006-0154cisco-csmars-default-password(24065)22346101547133518424login.php in ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside".ADV-2006-0152http://evuln.com/vulns/25/summary.htmlacal-login-auth-bypass(24104)20060112 [eVuln] ACal Authentication Bypass & PHP Code Insertion2234434318432Direct static code injection vulnerability in edit.php in ACal Calendar Project 2.2.5 allows authenticated users to execute arbitrary PHP code via (1) the edit=header value, which modifies header.php, or (2) the edit=footer value, which modifies footer.php. NOTE: this issue might be resultant from the poor authentication as identified by CVE-2006-0182. Since the design of the product allows the administrator to edit the code, perhaps this issue should not be included in CVE, except as a consequence of CVE-2006-0182.ADV-2006-0152http://evuln.com/vulns/25/summary.htmlacal-header-footer-code-execute(24107)20060112 [eVuln] ACal Authentication Bypass & PHP Code Insertion2234534318432Multiple SQL injection vulnerabilities in AspTopSites allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to goto.asp or (2) password parameter to includeloginuser.asp.ADV-2006-0146http://www.exploitlabs.com/files/advisories/EXPL-A-2006-001-asptopsites.txt18408asptopsites-goto-sql-injection(24072)2233020060110 AspTopSites SQL injectionMultiple cross-site scripting vulnerabilities in the (1) Pool or (2) News Modules in Php-Nuke allow remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of an IMG tag.ADV-2006-01251619220060107 Php-Nuke Pool and News Module IMG Tag Cross Site18374** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-4500. Reason: This candidate is a duplicate of CVE-2005-4500. Notes: All CVE users should reference CVE-2005-4500 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.By design, Microsoft Visual Studio 2005 automatically executes code in the Load event of a user-defined control (UserControl1_Load function), which allows user-assisted attackers to execute arbitrary code by tricking the user into opening a malicious Visual Studio project file.ADV-2006-01511622520060113 Visual Studio Remote Code Execution18409visualstudio-usercontrol-code-execution(24116)webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the right_frame parameter. NOTE: this has been called a cross-site scripting (XSS) issue, but it is different than what is normally identified as XSS.squirrelmail-webmail-xss(24847)ADV-2006-0689http://www.squirrelmail.org/security/issue/2006-02-0116756101566218985oval:org.mitre.oval:def:10419RHSA-2006:0283FEDORA-2006-133SUSE-SR:2006:005MDKSA-2006:049GLSA-200603-09DSA-98820210199601920519176191311913020060501-01-UBuffer overflow in eStara Softphone 3.0.1.14 through 3.0.1.46 allows remote attackers to execute arbitrary code via a long attribute (aka "a") field in the SDP data of a SIP packet on UDP port 5060.This is the vendor provided solution:
"eStara has released Softphone version 3.0.1.47 to resolve the buffer overflow demonstrated in parsing SDP with long "a=" lines. Licensed customers can download a new version via the email sent to them with purchase, customers testing may go back to http://www.estara.com/softphone/ to obtain a new free trial. Version information can be gathered by going to Help->About. eStara highly recommends all customers upgrade to avoid this issue. If there's further questions please email us: softphone@estara.com.
eStara would like to thank ZwelL for bringing the issue to our attention."estara-sip-sdp-bo(24090)ADV-2006-01671621320060111 eStara Softphone SIP stack Buffer Overflow Vulnerability10154811841022348Unspecified vulnerability in Sun Solaris 9 and 10 for the x86 platform allows local users to gain privileges or cause a denial of service (panic) via unspecified vectors, possibly involving functions from the mm driver.10206618421ADV-2006-0165solaris-unspecified-root-access(24084)16224http://support.avaya.com/elmodocs2/security/ASA-2006-056.htm101547819087oval:org.mitre.oval:def:702Unspecified vulnerability in Sun Solaris 10 allows local users to cause a denial of service (null dereference) via unspecified vectors involving the use of the find command on the "/proc" filesystem. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this is related to CVE-2005-3250.10210818420ADV-2006-0166solaris-find-proc-dos(24085)1622222347http://support.avaya.com/elmodocs2/security/ASA-2006-056.htm101547919087oval:org.mitre.oval:def:1608SQL injection vulnerability in Login_Validate.asp in ASPSurvey 1.10 allows remote attackers to execute arbitrary SQL commands via the Password parameter to login.asp.aspsurvey-loginvalidate-sql-injection(24087)ADV-2006-01641649620060204 sql injection in ASP Survey2234241418422Cross-site scripting (XSS) vulnerability in the Hosting Control Panel (psoft.hsphere.CP) in Positive Software H-Sphere 2.4.3 Patch 8 and earlier allows remote attackers to inject arbitrary web script or HTML via the login parameter in a login action.20060112 H-Sphere Security VulnerabilityADV-2006-0172http://www.psoft.net/HSdocumentation/versions/?v=all&p=rhsphere-login-xss(24096)http://www.psoft.net/HSdocumentation/versions/index.php?v=243p9&p=r2237218447Cross-site scripting (XSS) vulnerability in default.asp in FogBugz 4.029, and other versions before 4.0.33, allows remote attackers to inject arbitrary web script or HTML via the dest parameter in the pgLogon page.16216ADV-2006-017420060112 FogBugz Cross Site Scripting Vulnerabilityhttp://www.fogcreek.com/FogBugz/KB/releaseNotes/WhatsNewInFogBugz4.0.33.htmlfogbugz-login-xss(24103)2237018443Interpretation conflict in the MagicHTML filter in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via style sheet specifiers with invalid (1) "/*" and "*/" comments, or (2) a newline in a "url" specifier, which is processed by certain web browsers including Internet Explorer.squirrelmail-magichtml-xss(24848)ADV-2006-0689http://www.squirrelmail.org/security/issue/2006-02-1016756101566218985oval:org.mitre.oval:def:9548RHSA-2006:0283FEDORA-2006-133SUSE-SR:2006:005MDKSA-2006:049GLSA-200603-09DSA-98820210199601920519176191311913020060501-01-UUnspecified vulnerability in Serial line sniffer (aka slsnif) 0.4.4 allows local users to gain privileges via a long value of the HOME environment variable, possibly because of a buffer overflow.slsnif-home-bo(24082)ADV-2006-021220060111 Serial Line Sniffer 0.4.4 Buffer Overflowhttp://shellcoders.com/sintigan/slsnif-ploit.pl18497The XClientMessageEvent struct used in certain components of X.Org 6.8.2 and earlier, possibly including (1) the X server and (2) Xlib, uses a "long" specifier for elements of the l array, which results in inconsistent sizes in the struct on 32-bit versus 64-bit platforms, and might allow attackers to cause a denial of service (application crash) and possibly conduct other attacks.20060108 xorg server 6.8.2 and below on 64bit archCross-site scripting (XSS) vulnerability in a certain module, possibly poll or Pool, for XOOPS allows remote attackers to inject arbitrary web script or HTML via JavaScript in the SRC attribute of an IMG element in a comment.http://www.xoops.org/modules/newbb/viewtopic.php?topic_id=45637&forum=2&post_id=2004811618920060107 Xoops Pool Module IMG Tag Cross Site Scriptingxoops-pool-imagetag-xss(24091)SQL injection vulnerability in news.asp in Mini-Nuke CMS System 1.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the hid parameter.mininuke-news-sql-injection(24098)ADV-2006-017320060113 Advisory: MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injectionvulnerability22384http://www.nukedx.com/?viewdoc=73401843920060112 Advisory: MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injection vulnerabilityFormat string vulnerability in the error-reporting feature in the mysqli extension in PHP 5.1.0 and 5.1.1 might allow remote attackers to execute arbitrary code via format string specifiers in MySQL error messages.php-extmysqli-format-string(24095)16219http://www.php.net/release_5_1_2.php18431ADV-2006-0369ADV-2006-017720060112 Advisory 02/2006: PHP ext/mysqli Format String Vulnerabilityhttp://www.hardened-php.net/advisory_022006.113.html1015485337Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50, and possibly earlier versions, allows remote attackers to enter false payment entries into the log file via HTTP POST requests to ipn_success.php.ADV-2006-0183http://www.uinc.ru/articles/vuln/ptpaypal050.shtml1621820060112 Multiple PHP Toolkit for PayPal Vulnerabilities1844422378Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50 and possibly earlier has (1) world-readable permissions for ipn/logs/ipn_success.txt, which allows local users to view sensitive information (payment data), and (2) world-writable permissions for ipn/logs, which allows local users to delete or replace payment data.ADV-2006-0183http://www.uinc.ru/articles/vuln/ptpaypal050.shtml1621820060112 Multiple PHP Toolkit for PayPal Vulnerabilities1844422379membership.asp in Mini-Nuke CMS System 1.8.2 and earlier does not verify the old password when changing a password, which allows remote attackers to change the passwords of other members via a lostpassnew action with a modified x parameter.mininuke-membership-change-password(24101)ADV-2006-017320060113 Advisory: MiniNuke CMS System <= 1.8.2 (membership.asp) remoteuser password change exploit223853441843920060112 Advisory: MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injection vulnerability20060112 Advisory: MiniNuke CMS System <= 1.8.2 (membership.asp) remote user password change exploit20060129 [xpl#2] MiniNuke 1.8.2 - change member's passwrod < Perl >Multiple cross-site scripting (XSS) vulnerabilities in Wordcircle 2.17 allow remote attackers to inject arbitrary web script or HTML via (1) the "Course name" field in index.php when the frm parameter has the value "mine" and (2) possibly certain other fields in unspecified scripts.wordcircle-index-xss(24106)ADV-2006-01851622720060112 [eVuln] Wordcircle Multiple SQL Injection & XSS Vulnerabilities2235918440http://evuln.com/vulns/28/summary.html345Multiple SQL injection vulnerabilities in Wordcircle 2.17 allow remote attackers to (1) execute arbitrary SQL commands and bypass authentication via the password field in the login action to index.php (involving v_login.php and s_user.php) and (2) have other unknown impact via certain other fields in unspecified scripts.wordcircle-login-security-bypass(24108)wordcircle-sql-injection(24105)ADV-2006-01851622720060112 [eVuln] Wordcircle Multiple SQL Injection & XSS Vulnerabilities20060112 [eVuln] Wordcircle Authentication Bypass2235834634518440http://evuln.com/vulns/28/summary.htmlhttp://evuln.com/vulns/27/summary.htmlEval injection vulnerability in Light Weight Calendar (LWC) 1.0 (20040909) and earlier allows remote attackers to execute arbitrary PHP code via the date parameter in cal.php, which is included by index.php.1622918450http://evuln.com/vulns/29/summary.htmlhttp://evuln.com/vulns/29/exploit.htmllwc-cal-execute-code(24110)2237620060318 Source VERIFY - Light Weight Calendar issue is eval injectionMultiple HTTP response splitting vulnerabilities in PHP 5.1.1 allow remote attackers to inject arbitrary HTTP headers via a crafted Set-Cookie header, related to the (1) session extension (aka ext/session) and the (2) header function.php-session-response-splitting(24094)16220GLSA-200603-22101548419355191791869718431ADV-2006-0369ADV-2006-0177USN-261-1http://www.php.net/release_5_1_2.phpMDKSA-2006:028http://www.hardened-php.net/advisory_012006.112.htmlDSA-13312594519012SUSE-SR:2006:004Multiple cross-site scripting (XSS) vulnerabilities in PHP 4.4.1 and 5.1.1, when display_errors and html_errors are on, allow remote attackers to inject arbitrary web script or HTML via inputs to PHP applications that are not filtered when they are included in the resulting error message.16803http://www.php.net/release_5_1_2.phpGLSA-200603-2219355191791869718431https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178028ADV-2006-2685ADV-2006-0369ADV-2006-0177USN-261-1RHSA-2006:0501http://www.php.net/ChangeLog-4.php#4.4.2MDKSA-2006:028http://support.avaya.com/elmodocs2/security/ASA-2006-160.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-129.htm21564212522095120222202101983219012RHSA-2006:0549RHSA-2006:0276oval:org.mitre.oval:def:10064SUSE-SR:2006:00420060501-01-USQL injection vulnerability in general_functions.php in TankLogger 2.4 allows remote attackers to execute arbitrary SQL commands via the (1) livestock_id parameter to showInfo.php and (2) tank_id parameter, possibly to livestock.php.ADV-2006-0153http://evuln.com/vulns/26/summary.htmltanklogger-generalfunctions-sql-injection(24080)1622820060112 [eVuln] TankLogger SQL Injection Vulnerability22369223683411844120060113 Verified TankLogger SQl inject by source inspectionCross-site scripting (XSS) vulnerability in index.php in Interspire TrackPoint NX before 0.1 allows remote attackers to inject arbitrary web script or HTML via the username parameter when using the Login page.ADV-2006-017516214http://www.interspire.com/forum/showthread.php?p=29606trackpointnx-login-xss(24112)20060112 Interspire TrackPoint NX XSS Vulnerability2237718445Cross-site scripting (XSS) vulnerability in forgotPassword.asp in Helm Hosting Control Panel 3.2.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the txtEmailAddress parameter.ADV-2006-020320060112 Helm XSS Vulnerabilityhelm-forgotpassword-xss(24139)http://www.webhostautomation.com/webhost-301162342245418492Directory traversal vulnerability in OBEX Push services in Toshiba Bluetooth Stack 4.00.23(T) and earlier allows remote attackers to upload arbitrary files to arbitrary remote locations specified by .. (dot dot) sequences, as demonstrated by ..\\ sequences in the RFILE argument of ussp-push.ADV-2006-018416236http://www.digitalmunition.com/DMA%5B2006-0112a%5D.txt1843720060113 DMA[2006-0112a] - 'Toshiba Bluetooth Stack Directory Transversal'20060113 DMA[2006-0112a] - 'Toshiba Bluetooth Stack Directory Transversal'223801015486http://aps.toshiba-tro.de/bluetooth/pages/driverinfo.php?txt=sp2Kolab Server 2.0.1, 2.0.2 and development versions pre-2.1-20051215 and earlier, when authenticating users via secure SMTP, stores authentication credentials in plaintext in the postfix.log file, which allows local users to gain privileges.18438http://kolab.org/security/kolab-vendor-notice-08.txtADV-2006-0186kolab-smtp-logging(24123)22381Eval injection vulnerability in ezDatabase 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the db_id parameter to visitorupload.php, as demonstrated using phpinfo and include function calls.ezdatabase-visitorupload-file-include(24136)1623735118043http://pridels0.blogspot.com/2006/01/ezdatabase-20-and-below.htmlCross-site scripting (XSS) vulnerability in admin.php in QualityEBiz Quality PPC (QPPC) 1.0 build 1644 allows remote attackers to inject arbitrary web script or HTML via the cpage parameter. NOTE: this issue might be resultant from CVE-2006-0216.22352http://osvdb.org/ref/22/22352-qualityppc.txtadmin.php in QualityEBiz Quality PPC (QPPC) 1.0 build 1644 allows remote attackers to obtain sensitive information, possibly the installation path of the application, via unspecified "meta characters" to the cpage parameter.22353http://osvdb.org/ref/22/22353-qualityppc.txthttp://osvdb.org/ref/22/22352-qualityppc.txtMultiple cross-site scripting (XSS) vulnerabilities in Ultimate Auction 3.67 allow remote attackers to inject arbitrary web script or HTML via the (1) item parameter in item.pl and (2) category parameter in itemlist.pl, which reflects the XSS in an error message. NOTE: the affected version might be wrong since the current version as of 20060116 is 3.6.1.ADV-2006-01871623922444224431847720060115 Ultimate Auction <=3.67ultimate-auction-item-xss(24138)16254Multiple unspecified vulnerabilities in MyBulletinBoard (MyBB) before 1.0.2 have unspecified impact and attack vectors, related to (1) admin/moderate.php, (2) admin/themes.php, (3) inc/functions.php, (4) inc/functions_upload.php, (5) printthread.php, and (6) usercp.php, and probably related to SQL injection. NOTE: it is likely that this issue subsumes CVE-2005-4602 and CVE-2005-4603. However, since the vendor advisory is vague and additional files are mentioned, is is likely that this contains at least one distinct vulnerability from CVE-2005-4602 and CVE-2005-4603.http://community.mybboard.net/showthread.php?tid=5852The original distribution of MyBulletinBoard (MyBB) to update from older versions to 1.0.2 omits or includes older versions of certain critical files, which allows attackers to conduct (1) SQL injection attacks via an attachment name that is not properly handled by inc/functions_upload.php (CVE-2005-4602), and possibly (2) other attacks related to threadmode in usercp.php.http://community.mybboard.net/showthread.php?tid=596016230http://community.mybboard.net/showthread.php?tid=5853&pid=35151#pid35151http://community.mybboard.net/showthread.php?tid=5853&pid=35088#pid35088mybb-usercp-script-sql-injection(24115)Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 5.3 through 6.1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the day parameter in calendar.php and (2) the input form in search.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. It is possible that this issue is resultant from an SQL injection problem in CVE-2005-4227.3 and CVE-2005-4227.13.1623220060113 DCP Portal Cross-Site Scripting Vulnerabilitydcpportal-calendar-search-xss(24153)SQL injection vulnerability in index.asp in the Admin Panel in Dragon Design Services Network (DDSN) cm3 content manager (CM3CMS) allows remote attackers to execute arbitrary SQL commands via the (1) username or (2) password.cm3-login-sql-injection(24266)1623120060113 DDSN CMS Admin Panel SQL Injection Vulnerability22696Cross-site scripting (XSS) vulnerability in fullview.php in AlstraSoft Template Seller Pro allows remote attackers to inject arbitrary web script or HTML via the tempid parameter.template-seller-fullview-xss(24235)1623320060113 AlstraSoft Template Seller Pro Cross-Site Scripting Vulnerability22746Directory traversal vulnerability in Shanghai TopCMM 123 Flash Chat Server Software 5.1 allows attackers to create or overwrite arbitrary files on the server via ".." (dot dot) sequences in the username field.16235http://www.123flashchat.com/flash-chat-server-v512.html123flashchat-user-directory-traversal(24137)ADV-2006-01982244018455Buffer overflow in Library of Assorted Spiffy Things (LibAST) 0.6.1 and earlier, as used in Eterm and possibly other software, allows local users to execute arbitrary code as the utmp user via a long -X command line argument (alternative configuration file name).20060123 [ Rosiello Security ] Eterm-LibAST Advisory20060125 Rosiello Security - Eterm-LibAST Advisoryhttp://www.rosiello.org/en/read_bugs.php?id=25ADV-2006-03141635020060123 LibAST 0.7 Release Fixes Security Vulnerabilityhttp://freshmeat.net/projects/libast/?branch_id=17907&release_id=217840eterm-libast-filename-bo(24303)22735MDKSA-2006:029GLSA-200601-14DSA-976373189161863218586scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.TA07-072A18595https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=174026openssh-scp-command-execution(24305)ADV-2007-2120ADV-2007-0930ADV-2006-4869ADV-2006-2490ADV-2006-0306USN-255-12006-000416369FLSA-2006:168935RHSA-2006:004422692OpenPKG-SA-2006.003SUSE-SA:2006:008GLSA-200602-11SSA:2006-045-06101554019159189701896918964189101885018798187361865018579oval:org.mitre.oval:def:9962HPSBUX0217820060212 [3.8] 005: SECURITY FIX: February 12, 2006http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=2751http://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v52.Readme.html#MH00688http://www.vmware.com/support/vi3/doc/esx-9986131-patch.htmlhttp://www.vmware.com/support/vi3/doc/esx-3069097-patch.htmlRHSA-2006:0698RHSA-2006:0298MDKSA-2006:034http://support.avaya.com/elmodocs2/security/ASA-2007-246.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-262.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-174.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-158.htm102961462259362560724479236802334023241221962172421492212622112920723APPLE-SA-2007-03-13HPSBUX02178http://docs.info.apple.com/article.html?artnum=305214http://blogs.sun.com/security/entry/sun_alert_102961_security_vulnerability20060703-01-Poval:org.mitre.oval:def:1138Integer overflow in IEEE 802.11 network subsystem (ieee80211_ioctl.c) in FreeBSD before 6.0-STABLE, while scanning for wireless networks, allows remote attackers to execute arbitrary code by broadcasting crafted (1) beacon or (2) probe response frames.1629618353http://www.signedness.org/advisories/sps-0x1.txtFreeBSD-SA-06:05bsd-ieee80211-bo(24192)22537http://www.blackhat.com/html/bh-europe-07/bh-eu-07-speakers.html#Eriksson1015518http://kernelwars.blogspot.com/2007/01/alive.htmlMultiple unspecified vulnerabilities in lpsched in Sun Solaris 8, 9, and 10 allow local users to delete arbitrary files or disable the LP print service via unknown attack vectors.102033101549218498ADV-2006-0200solaris-lpsched-dos(24127)162452244222441http://support.avaya.com/elmodocs2/security/ASA-2006-056.htm19087oval:org.mitre.oval:def:662The RBAC functionality in grsecurity before 2.1.8 does not properly handle when the admin role creates a service and then exits the shell without unauthenticating, which causes the service to be restarted with the admin role still active.1626118458ADV-2006-0199http://www.grsecurity.org/news.php#grsec218grsecurity-rbac-admin-privileges(24156)Unquoted Windows search path vulnerability in Wehntrust might allow local users to gain privileges via a malicious "program.exe" file in the C: folder, which is run when Wehntrust creates the autostart key.20060116 Re: [Full-disclosure] WehnTrust - When you have to trust Wehntrust1626820060116 WehnTrust - When you have to trust Wehntrustwehntrust-service-start-file-execution(24315)http://www.wehnus.com/downloads.plSymantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a password, which allows remote attackers to gain administrator privileges via a modified client that sends certain XML requests.VU#11838820060421 Rapid7 Advisory R7-0021: Symantec Scan Engine Authentication Fundamental Design ErrorADV-2006-1464sse-unauth-admin-access(25972)http://www.symantec.com/avcenter/security/Content/2006.04.21.html1763720060421 [Symantec Security Advisor] Symantec Scan Engine Multiple Vulnerabilities20060421 Rapid7 Advisory R7-0021: Symantec Scan Engine Authentication Fundamental Design Error19734Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses the same private DSA key for each installation, which allows remote attackers to conduct man-in-the-middle attacks and decrypt communications.20060421 Rapid7 Advisory R7-0022: Symantec Scan Engine Known Immutable DSA Private KeyADV-2006-1464sse-insecure-private-key(25973)http://www.symantec.com/avcenter/security/Content/2006.04.21.html1763720060421 [Symantec Security Advisor] Symantec Scan Engine Multiple Vulnerabilities20060421 Rapid7 Advisory R7-0022: Symantec Scan Engine Known Immutable DSA Private Key101597419734Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, stores sensitive log and virus definition files under the web root with insufficient access control, which allows remote attackers to obtain the information via direct requests.20060421 Rapid7 Advisory R7-0023: Symantec Scan Engine File Disclosure VulnerabilityADV-2006-1464sse-unauth-file-access(25974)http://www.symantec.com/avcenter/security/Content/2006.04.21.html1763720060421 [Symantec Security Advisor] Symantec Scan Engine Multiple Vulnerabilities20060421 Rapid7 Advisory R7-0023: Symantec Scan Engine File Disclosure Vulnerability101597475975819734Cross-site scripting (XSS) vulnerability in functions.php in microBlog 2.0 RC-10 allows remote attackers to inject arbitrary web script and HTML via a javascript: URI in a [url] BBcode tag.microblog-functions-xss(24140)1627220060117 [eVuln] microBlog BBCode XSS Vulnerability1015496http://evuln.com/vulns/36/summary.htmlSQL injection vulnerability in index.php in microBlog 2.0 RC-10 allows remote attackers to execute arbitrary SQL commands via the (1) month and (2) year parameters.ADV-2006-02391627020060117 [eVuln] microBlog SQL Injection Vulnerabilitymicroblog-index-sql-injection(24132)22512101549618442http://evuln.com/vulns/35/summary.htmlSQL injection vulnerability in WhiteAlbum 2.5 allows remote attackers to execute arbitrary SQL commands via the dir parameter to pictures.php.ADV-2006-02411624720060116 White Album Sql İnjection biyosecurity.bewhitealbum-pictures-sql-injection(24271)22520http://www.biyosecurity.be/bugs/whitealbum.txt18460GUI display truncation vulnerability in Mozilla Thunderbird 1.0.2, 1.0.6, and 1.0.7 allows user-assisted attackers to execute arbitrary code via an attachment with a filename containing a large number of spaces ending with a dangerous extension that is not displayed by Thunderbird, along with an inconsistent Content-Type header, which could be used to trick a user into downloading dangerous content by dragging or saving the attachment.1627120060117 Secunia Research: Mozilla Thunderbird Attachment SpoofingVulnerabilityhttp://secunia.com/secunia_research/2005-22/advisory15907https://bugzilla.mozilla.org/show_bug.cgi?id=300246thunderbird-attachment-ext-spoofing(24164)ADV-2006-0230MDKSA-2006:021Cross-site scripting (XSS) vulnerability in index.php in GTP iCommerce allows remote attackers to inject arbitrary web script or HTML via the (1) cat and (2) subcat parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-02141625518470gtpicommerce-index-xss(24150)SQL injection vulnerability in wp-stats.php in GaMerZ WP-Stats 2.0 allows remote attackers to execute arbitrary SQL commands via the author parameter.http://www.lesterchan.net/blogs/18471ADV-2006-019216241wpstats-script-sql-injection(24163)22450http://www.lesterchan.net/blogs/archives/2006/01/18/wp-stats-sql-injection-vulnerabilityhttp://osvdb.org/ref/22/22450-wpstats.txtMultiple cross-site scripting (XSS) vulnerabilities in Simple Blog 2.1 allow remote attackers to inject arbitrary web script or HTML via (1) a comment to comments.asp and (2) possibly certain other fields in unspecified scripts.ADV-2006-01941624320060114 [HSC Security Group] Multiple SQL injection/XSS in SimpleBlog 2.118488simpleblog-comment-xss(24154)22448http://www.hackerscenter.com/archive/view.asp?id=21926Multiple SQL injection vulnerabilities in Simple Blog 2.1 allow remote attackers to execute arbitrary SQL commands via the month parameter in an archives view operation and possibly certain other parameters in unspecified scripts.simpleblog-month-sql-injection(24155)ADV-2006-01941624320060114 [HSC Security Group] Multiple SQL injection/XSS in SimpleBlog 2.122447http://www.hackerscenter.com/archive/view.asp?id=2192618488Cross-site scripting vulnerability in WBNews 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the Name field.ADV-2006-02371627720060117 XSS in WBNews < = v1.1.018499Cross-site scripting vulnerability in index.php in PHP Fusebox 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter.20060117 IndonesiaHack Advisory HTML injection in PHP Fusebox16274355Cross-site scripting (XSS) vulnerability in SMBCMS 2.1 allows remote attackers to inject arbitrary web script or HTML via the text parameter, which is used by the "Search Site" field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.ADV-2006-02291628118454smbcms-sitesearch-xss(24187)22494** DISPUTED ** Directory traversal vulnerability in workspaces.php in phpXplorer 0.9.33 allows remote attackers to include arbitrary files via a .. (dot dot) and trailing null byte (%00) in the sShare parameter. NOTE: a followup post claims that this is not a vulnerability since the functionality of phpXplorer supports the upload of PHP files, which would not cross privilege boundaries since the PHP functionality would support read access outside the web root.ADV-2006-02321626320060116 Re: Directory traversal in phpXplorer20060116 Directory traversal in phpXplorerhttp://www.arrelnet.com/advisories/adv20060116.html18518phpxplorer-sshare-directory-traversal(39982)353Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.7-pl1 allow remote attackers to inject arbitrary web script or HTML via the (3) redir, (4) productId, (5) docId, (6) act, and (7) catId parameters in index.php; and the (8) username field in a login action in index.php. NOTE: the cart.php/redir and index.php/searchStr vectors are already covered by CVE-2005-3152.ADV-2006-0227162592247118519http://lostmon.blogspot.com/2006/01/cubecart-307-pl1-indexphp-multiple.htmlhttp://bugs.cubecart.com/?do=details&id=459cubecart-index-script-xss(24177)Cross-site scripting (XSS) vulnerability in down.pl in Widexl Download Tracker 1.06 allows remote attackers to inject arbitrary web script or HTML via the ID parameter.ADV-2006-0213162652246218472http://osvdb.org/ref/22/22462-widexl.txtdownloadtracker-down-xss(24161)Cross-site scripting (XSS) vulnerability in anyboard.cgi in Netbula Anyboard 9.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the tK parameter in a find command.ADV-2006-0188162642246118469http://osvdb.org/ref/22/22461-anyboard.txtnetbula-anyboard-script-xss(24167)Virata-EmWeb web server 6_1_0, as used in (1) Intracom JetSpeed 500 and 520 and (2) Allied Data Technologies CopperJet 811 RouterPlus, allows remote attackers to access privileged information, such as user lists and configuration settings, via direct HTTP requests.ADV-2006-021818483http://blog.globalnetworks.gr/?p=4virata-emweb-unauth-access(24304)SQL injection vulnerability in viewcat.php in BitDamaged geoBlog MOD_1.0 allows remote attackers to execute arbitrary SQL commands, then steal credentials and upload files, via the cat parameter ($tmpCategory variable).geoBlog-viewcat-sql-injection(24146)ADV-2006-01911624922463101549318504http://evuln.com/vulns/33/summary.htmlFormat string vulnerability in the snmp_input function in snmptrapd in CMU SNMP utilities (cmu-snmp) allows remote attackers to execute arbitrary code by sending crafted SNMP messages to UDP port 162.ADV-2006-02341626720060116 Digital Armaments Security Advisory 01.16.2006: CMU SNMP utilities snmptrad Format String Vulnerabilityhttp://www.digitalarmaments.com/2006040164883273.html18525cmusnmp-snmpinput-format-string(24178)22493Cross-site scripting (XSS) vulnerability in fom.cgi in Faq-O-Matic 2.711 allows remote attackers to inject arbitrary web script or HTML via the (1) _duration, (2) file, and (3) cmd parameters.ADV-2006-0189162512243918468http://osvdb.org/ref/22/22439-faqomatic.txtfaqomatic-fom-xss(24165)SQL injection vulnerability in Benders Calendar 1.0 allows remote attackers to execute arbitrary SQL commands via multiple parameters, as demonstrated by the (1) year, (2) month, and (3) day parameters.ADV-2006-01901624220060115 [eVuln] Benders Calendar SQL Injection22449101549118462http://evuln.com/vulns/30/summary.htmlbenderscalendar-sql-injection(24120)Buffer overflow in the Bluetooth OBEX Object Push service in "Blue Neighbors.EXE" in AmbiCom Blue Neighbors 2.50 Build 2500 and earlier allows remote attackers to execute arbitrary code via a long file name, as demonstrated via a long RFILE argument to ussp-push.ADV-2006-021920060120 DMA[2006-0115a] - 'AmbiCom Bluetooth Object Push Overflow'http://www.digitalmunition.com/DMA%5B2006-0115a%5D.txt18466ambicom-bluetooth-objectpush-bo(24179)16258366Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12310181&styleName=Html&projectId=10220&Create=CreateADV-2006-02171626020060115 Apache Geronimo 1.0 - CSS and persistent HTML-Injectionvulnerabilitieshttp://www.oliverkarow.de/research/geronimo_css.txt18485http://issues.apache.org/jira/browse/GERONIMO-1474geronimo-webaccesslog-viewer-xss(24159)geronimo-jspexamples-xss(24158)RHSA-2008:026131493RHSA-2008:0630Unquoted Windows search path vulnerability in Check Point VPN-1 SecureClient might allow local users to gain privileges via a malicious "program.exe" file in the C: folder, which is run when SecureClient attempts to launch the Sr_GUI.exe program.ADV-2006-02581629020060117 [ TZO-012006 ] Checkpoint VPN-1 SecureClient insecure usage of CreateProcess()http://secdev.zoller.lu/research/checkpoint.txtUnspecified vulnerability in the Advanced Queuing component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.6, 10.1.0.3 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB01.VU#545804ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Unspecified vulnerability in the Change Data Capture component of Oracle Database server 9.2.0.7, 10.1.0.5, and 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB02. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the CDC_ALLOCATE_LOCK function of the DBMS_CDC_UTILITY package.VU#5458041015499oracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628722540http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html1860818493Unspecified vulnerability in the Connection Manager component of Oracle Database server 8.1.7.4 and 9.0.1.5 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB03.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Multiple unspecified vulnerabilities in Oracle Database server 10.1.0.5 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB04 and (2) DB06 in the (a) Data Pump component; (3) DB10 in the (b) Net Listener component; and (4) DB16 in the (c) Oracle Text component. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that DB06 is SQL injection in the GENERATE_JOB_NAME, GET_WORKERSTATUSLIST1010, GET_PARAMVALUES1010, GET_DUMPFILESET1010, GET_JOBSTATUS1010, ATTACH, and ESTABLISH_REMOTE_CONTEXT functions in DBMS_DATAPUMP.VU#5458041628718493oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024322544http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html101549918608Multiple unspecified vulnerabilities in Oracle Database server 9.2.0.7 and 10.1.0.5 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB05 in the (a) Data Pump component; (2) DB15 in the (b) Oracle Text component; (3) DB22 in the (c) Streams Apply component; (4) DB23 and (5) DB24 in the (d) Streams Capture component; and (6) DB26 in the (e) Streams Subcomponent. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that DB05 involves SQL injection in the (f) LONG2VARCHAR, LONG2VCMAX, LONG2VCNT, and LONG2CLOB functions in the DBMS_METADATA_UTIL package; (g) MAKE_FILTER, FETCH_VIEWS_ERROR, FETCH_FILTERS, FETCH_VIEWS, SET_FILTER_COMMON, DO_FILTER_SCRIPT, SET_TABLE_FILTERS, and MAKE_FILTER_TEXT functions in the DBMS_METADATA_INT package; and (h) GET_PREPOST_TABLE_ACT function in the DBMS_METADATA package.VU#545804101549918608oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287226432263722543http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html18493Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.5 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB07 in the Dictionary component and (2) DB14 in the Oracle Label Security component. NOTE: Oracle has not disputed reliable researcher claims that DB07 involves plaintext storage of the TDE wallet password in a trace file by event 10053.VU#545804oracle-january2006-update(24321)oracle-masterkey-plaintext(24168)ADV-2006-0323ADV-2006-02431628720060117 Oracle Database 10g Rel. 2 - Event 10053 logs TDE wallet password in cleartexthttp://www.red-database-security.com/advisory/oracle_tde_wallet_password.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Unspecified vulnerability in the Net Foundation Layer component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.6, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB08.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, 10.1.0.5, and 10.2.0.1 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB09 in the (a) Net Listener component; and (2) DB12 and (3) DB13 in the Network Communications (RPC) component.TA06-018AVU#870172VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287225512255022547http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-0259. Reason: This candidate is subsumed by CVE-2006-0259. An error during initial CVE analysis used the wrong set of affected versions for "DB10". Notes: All CVE users should reference CVE-2006-0259 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.1 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB17 in the Oracle Text component and (2) DB18 in the Program Interface Network component. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that DB17 involves SQL injection in the (a) VALIDATE_STATEMENT and BUILD_DML functions in CTXSYS.DRILOAD; (b) CLEAN_DML function in CTXSYS.DRIDML; (c) GET_ROWID function in CTXSYS.CTX_DOC; (d) BROWSE_WORDS function in CTXSYS.CTX_QUERY; and (e) ODCIINDEXTRUNCATE, ODCIINDEXDROP, and ODCIINDEXDELETE functions in CATINDEXMETHODS.VU#545804101549918608oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html2264222641226402263922555http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html18493Unspecified vulnerability in the Query Optimizer component of Oracle Database server 9.0.1.5, 9.2.0.7, and 10.1.0.5 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB19.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Unspecified vulnerability in the Query Optimizer component of Oracle Database server 9.2.0.6 and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB20.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Unspecified vulnerability in the Security component of Oracle Database server 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.6, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB21.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Unspecified vulnerability in the Streams Capture component of Oracle Database server 10.1.0.5 and 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB25. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the SET_DIRECTORY_ROOT function in the DBMS_CDC_PUBLISH package.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html22563http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Unspecified vulnerability in the Transparent Data Encryption (TDE) Wallet component of Oracle Database server 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB27. NOTE: Oracle has not disputed a reliable researcher report that TDA stores the master key without encryption, which allows local users to obtain the key via the SGA.VU#545804oracle-january2006-update(24321)oracle-sga-masterkey-plaintext(24186)ADV-2006-0323ADV-2006-02431628720060117 Oracle Database 10g Rel. 2- Transparent Data Encryption plaintext masterkey in SGAhttp://www.red-database-security.com/advisory/oracle_tde_unencrypted_sga.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Unspecified vulnerability in the Upgrade & Downgrade component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB28. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the DBMS_REGISTRY package in certain parameters to the (1) IS_COMPONENT, (2) GET_COMP_OPTION, (3) DISABLE_DDL_TRIGGERS, (4) SCRIPT_EXISTS, (5) COMP_PATH, (6) GATHER_STATS, (7) NOTHING_SCRIPT, and (8) VALIDATE_COMPONENTS functions.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html22566http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Unspecified vulnerability in the XML Database component of Oracle Database server 9.2.0.7 and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB29. NOTE: based on mutual credits by the relevant sources, it is highly likely that this issue is a buffer overflow in the (a) DBMS_XMLSCHEMA and (b) DBMS_XMLSCHEMA_INT packages, as exploitable via long arguments to (1) XDB.DBMS_XMLSCHEMA.GENERATESCHEMA or (2) XDB.DBMS_XMLSCHEMA.GENERATESCHEMAS.TA06-018AVU#891644VU#545804oracle-xdbdbmx-xmlschema-bo(24376)oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2006-082403.htmlhttp://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdfhttp://www.argeniss.com/research/ARGENISS-ADV-010601.txt1015499186081849320060126 [Argeniss] Oracle Database Buffer overflows vulnerabilities in public procedures of XDB.DBMS_XMLSCHEMA{_INT}Unspecified vulnerability in the Portal component of Oracle Application Server 9.0.4.2 and 10.1.2.0 has unspecified impact and attack vectors, as identified by Oracle Vuln# AS01.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server 9.0.4.2 and 10.1.2.0.2 has unspecified impact and attack vectors, as identified by Oracle Vuln# REP03.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server 9.0.4.2 has unspecified impact and attack vectors, as identified by Oracle Vuln# REP04. NOTE: Oracle has not disputed reliable researcher claims that this issue is related to directory traversal that allows reading of portions of arbitrary XML files via the customize parameter.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628720060117 Oracle Reports - Read parts of files via customize(fixed after 875 days)http://www.red-database-security.com/advisory/oracle_reports_read_any_xml_file.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Multiple unspecified vulnerabilities in Oracle Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i) have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) OCS01, 2) OCS02, 3) OCS03, 4) OCS04, 5) OCS05, 6) OCS06, 7) OCS07, (8) OCS08, and (9) OCS09 in the (a) Email Server component; 10) OCS10 (and (11) OCS11 in the (b) Oracle Collaboration Suite Wireless & Voice (component; 12) OCS12 and (13) OCS13 in the (c) Oracle Content (Management SDK component; 14) OCS14 and (15) OCS15 in the (d) Oracle (Content Services component.VU#545804101549918608oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html18493Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) APPS01 in the (a) Application Install component; (2) APPS07 in the (b) Oracle Applications Framework component; (3) APPS08, (4) APPS09, (5) APPS10, and (6) APPS11 in the (c) Oracle Applications Technology Stack component; (7) APPS12 in the (d) Oracle Human Resources component; (8) APPS15 and (9) APPS16 in the (e) Oracle Marketing component; (10) APPS17 in the (f) Marketing Encyclopedia System component; (11) APPS18 in the (g) Oracle Trade Management component; and (12) APPS19 in the (h) Oracle Web Applications Desktop Integration component.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.9 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) APPS02 in the (a) CRM Technical Foundation component; (2) APPS03 in the (b) iProcurement component; and (3) APPS04, (4) APPS05, and (5) APPS06 in the Oracle Application Object Library component.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 4.3 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) APPS13 and (2) APPS14 in the Oracle iLearning component.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Unspecified vulnerability in Oracle PeopleSoft Enterprise Portal 8.4 Bundle 15, 8.8 Bundle 10, and 8.9 Bundle 2 has unspecified impact and attack vectors, as identified by Oracle Vuln# PSE01.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Unspecified vulnerability in Oracle JD Edwards HTML Server 8.95.F1 SP23_L1 has unspecified impact and attack vectors, as identified by Oracle Vuln# JDE01.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, and 10.1.0.5, Application Server 1.0.2.2, 9.0.4.2, and 10.1.2.0.2, and Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i) has unspecified impact and attack vectors, as identified by Oracle Vuln# DBC01 in the Protocol Support component.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Unspecified vulnerability in Oracle Database Server 10.1.0.4.2, Application Server 10.1.2.0.2, and Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i) has unspecified impact and attack vectors, as identified by Oracle Vuln# DBC02 in the Reorganize Objects & Convert Tablespace component.VU#545804101549918608oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html18493Multiple unspecified vulnerabilities in Oracle Application Server 9.0.4.2 and 10.1.2.0.2, and E-Business Suite and Applications 11.5.10, have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) FORM01 and (2) FORM02 in the Oracle Forms component.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Unspecified vulnerability in the Java Net component of Oracle Database Server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, and 10.1.0.4, and Application Server 1.0.2.2, 9.0.4.2, and 10.1.2.0.2, has unspecified impact and attack vectors, as identified by Oracle Vuln# JN01.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Unspecified vulnerability in the Oracle HTTP Server component of Oracle Database Server 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, and 10.1.0.5, and Application Server 1.0.2.2, 9.0.4.2, and 10.1.2.0.2, has unspecified impact and attack vectors, as identified by Oracle Vuln# OHS01.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Unspecified vulnerability in the Oracle HTTP Server component of Oracle Database Server 10.1.0.5 and Application Server 10.1.2.0.2 has unspecified impact and attack vectors, as identified by Oracle Vuln# OHS02.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Multiple unspecified vulnerabilities in the Oracle Reports Developer component of Oracle Application Server 9.0.4.1 and E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) REP01 and (2) REP02.VU#545804101549918608oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html18493Multiple unspecified vulnerabilities in Oracle Application Server 6.0.8.26(PS17) and E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) REP05 and (2) REP06 in the Oracle Reports Developer component. NOTE: Oracle has not disputed reliable researcher claims that REP05 is the same as CVE-2005-2378 and REP06 is the same as CVE-2005-2371, both of which involve directory traversal.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-02431628720060117 Oracle Reports - Overwrite any application server file via desname (fixed after 889 days)20060117 Oracle Reports - Read parts of files via desname (fixed after 874 days)http://www.red-database-security.com/advisory/oracle_reports_read_any_file.htmlhttp://www.red-database-security.com/advisory/oracle_reports_overwrite_any_file.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Unspecified vulnerability in Oracle Database Server 9.2.0.7, Application Server 9.0.4.2 and 10.1.2.1, Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i), and E-Business Suite and Applications 11.5.10 has unspecified impact and attack vectors, as identified by Oracle Vuln# WF01 in the Oracle Workflow Cartridge component.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493Multiple unspecified vulnerabilities in Oracle Database Server 10.2.0.1, Application Server 9.0.4.2 and 10.1.2.1, Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i), and E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) WF02 and (2) WF03 in the Oracle Workflow Cartridge component.VU#545804oracle-january2006-update(24321)ADV-2006-0323ADV-2006-024316287http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html10154991860818493The Javascript interpreter (jsinterp.c) in Mozilla and Firefox before 1.5.1 does not properly dereference objects, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via unknown attack vectors related to garbage collection.https://bugzilla.mozilla.org/show_bug.cgi?id=316885ADV-2006-3749ADV-2006-3391ADV-2006-0413HPSBUX02156SSRT061158RHSA-2006:0200RHSA-2006:0199SUSE-SA:2006:004228526oval:org.mitre.oval:def:10016mozilla-javascript-memory-corruption(24430)USN-276-1USN-275-1USN-271-116476HPSBUX02156HPSBUX02122FLSA-2006:180036-2FLSA:180036-1RHSA-2006:0330FEDORA-2006-076FEDORA-2006-075SUSE-SA:2006:004http://www.mozilla.org/security/announce/2006/mfsa2006-01.htmlMDKSA-2006:078MDKSA-2006:037MDKSA-2006:036GLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm1025501015570220652162221033200511995019941199021986319862198521982319821197801975919746192301870918708187061870518704187031870020060201-01-USCOSA-2006.26oval:org.mitre.oval:def:670The function allocation code (js_NewFunction in jsfun.c) in Firefox 1.5 allows attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via user-defined methods that trigger garbage collection in a way that operates on freed objects.https://bugzilla.mozilla.org/show_bug.cgi?id=322045ADV-2006-3749ADV-2006-3391ADV-2006-0413SSRT061236SSRT061158228526firefox-function-allocation-code-execution(42654)mozilla-javascript-memory-corruption(24430)16476SSRT061236SSRT061158http://www.mozilla.org/security/announce/2006/mfsa2006-01.htmlGLSA-200604-18DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm10255010155702206521622199411990219863198621870418700oval:org.mitre.oval:def:1494Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 allow remote attackers to execute arbitrary code by changing an element's style from position:relative to position:static, which causes Gecko to operate on freed memory.https://bugzilla.mozilla.org/show_bug.cgi?id=317934ADV-2006-3749ADV-2006-0413SSRT061236mozilla-element-change-memory-corruption(24431)16476HPSBUX02156http://www.mozilla.org/security/announce/2006/mfsa2006-02.html1015570220651870418700oval:org.mitre.oval:def:1514Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code via the QueryInterface method of the built-in Location and Navigator objects, which leads to memory corruption.TA06-038AVU#759273https://bugzilla.mozilla.org/show_bug.cgi?id=319296ADV-2006-3749ADV-2006-0413SSRT061236mozilla-queryinterface-memory-corruption(24433)16476HPSBUX02156http://www.mozilla.org/security/announce/2006/mfsa2006-04.html1015570220651870418700oval:org.mitre.oval:def:1562The XULDocument.persist function in Mozilla, Firefox before 1.5.0.1, and SeaMonkey before 1.0 does not validate the attribute name, which allows remote attackers to execute arbitrary Javascript by injecting RDF data into the user's localstore.rdf file.TA06-038AVU#592425https://bugzilla.mozilla.org/show_bug.cgi?id=319847ADV-2006-3749ADV-2006-3391ADV-2006-0413SSRT061236SSRT061158RHSA-2006:0200RHSA-2006:0199SUSE-SA:2006:004228526oval:org.mitre.oval:def:11803mozilla-xuldocument-command-execution(24434)USN-276-1USN-275-1USN-271-116476HPSBUX02156SSRT061158FLSA-2006:180036-2FLSA:180036-1RHSA-2006:0330FEDORA-2006-076FEDORA-2006-075SUSE-SA:2006:004http://www.mozilla.org/security/announce/2006/mfsa2006-05.htmlMDKSA-2006:078MDKSA-2006:037MDKSA-2006:036GLSA-200605-09GLSA-200604-18GLSA-200604-12DSA-1051DSA-1046DSA-1044http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm1025501015570220652162221033200511995019941199021986319862198521982319821197801975919746192301870918708187061870518704187031870020060201-01-USCOSA-2006.26oval:org.mitre.oval:def:1493Multiple integer overflows in Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code via the (1) EscapeAttributeValue in jsxml.c for E4X, (2) nsSVGCairoSurface::Init in SVG, and (3) nsCanvasRenderingContext2D.cpp in Canvas.https://bugzilla.mozilla.org/show_bug.cgi?id=322215https://bugzilla.mozilla.org/show_bug.cgi?id=319872mozilla-component-integer-overflow(24435)ADV-2006-3749ADV-2006-041316476SSRT06123610155701870418700HPSBUX02156http://www.mozilla.org/security/announce/2006/mfsa2006-06.html22065oval:org.mitre.oval:def:1339The XML parser in Mozilla Firefox before 1.5.0.1 and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly read sensitive data via unknown attack vectors that trigger an out-of-bounds read.mozilla-xml-parser-dos(24436)1647610155701870418700ADV-2006-3749ADV-2006-0413SSRT061236SSRT061236http://www.mozilla.org/security/announce/2006/mfsa2006-07.html22065oval:org.mitre.oval:def:677The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes the internal "AnyName" object to external interfaces, which allows multiple cooperating domains to exchange information in violation of the same origin restrictions.https://bugzilla.mozilla.org/show_bug.cgi?id=322312ADV-2006-3749ADV-2006-0413SSRT061236mozilla-e4x-security-bypass(24437)16476SSRT061236http://www.mozilla.org/security/announce/2006/mfsa2006-08.html1015570220651870418700oval:org.mitre.oval:def:1625Buffer overflow in tar 1.14 through 1.15.90 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute code via unspecified vectors involving PAX extended headers.TA07-109ATA07-072AMDKSA-2006:046233711899918976gnu-tar-pax-headers-bo(24855)ADV-2008-2518ADV-2007-1470ADV-2007-0930ADV-2006-0684USN-257-12006-001016764FLSA:183571-2RHSA-2006:0232OpenPKG-SA-2006.006SUSE-SR:2006:005GLSA-200603-06DSA-9872416461015705192361915219130190931901618973oval:org.mitre.oval:def:9295oval:org.mitre.oval:def:6094oval:org.mitre.oval:def:5993oval:org.mitre.oval:def:5978oval:org.mitre.oval:def:5252[Bug-tar] 20060220 tar 1.15.90 released543480249662447920042APPLE-SA-2007-03-13APPLE-SA-2007-04-19http://docs.info.apple.com/article.html?artnum=305391http://docs.info.apple.com/article.html?artnum=305214Heap-based buffer overflow in Splash.cc in xpdf, as used in other products such as (1) poppler, (2) kdegraphics, (3) gpdf, (4) pdfkit.framework, and others, allows attackers to cause a denial of service and possibly execute arbitrary code via crafted splash images that produce certain values that exceed the width or height of the associated bitmap.xpdf-splash-bo(24391)USN-249-1FLSA:17540420060202 [KDE Security Advisory] kpdf/xpdf heap based buffer overflowRHSA-2006:0201FEDORA-2006-103http://www.kde.org/info/security/advisory-20060202-1.txtGLSA-200602-12GLSA-200602-05GLSA-200602-04DSA-974DSA-972DSA-971SSA:2006-045-04SSA:2006-045-09101557619377189831891318908188821886418862188601883918838188371883418826188251870718677RHSA-2006:0206SCOSA-2006.15https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179046https://bugzilla.novell.com/show_bug.cgi?id=141242ADV-2006-0422ADV-2006-0389MDKSA-2006:032MDKSA-2006:031MDKSA-2006:0304701887518274oval:org.mitre.oval:def:10850ZyXel P2000W VoIP 802.11b Wireless Phone running firmware WV.00.02 allows remote attackers to obtain sensitive information, such as MAC address and software version, by directly accessing UDP port 9090.162851851120060116 ZyXel P2000W (Version 2) VoIP wireless phone undocumented port UDP/9090zyxel-p2000w-default-port(24145)22516Multiple unspecified vulnerabilities in the (1) publishing component, (2) Contact Component, (3) TinyMCE Compressor, and (4) other components in Joomla! 1.0.5 and earlier have unknown impact and attack vectors.18513http://www.joomla.org/content/view/738/66/Buffer overflow in Dual DHCP DNS Server 1.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via the DHCP options field.18486http://aluigi.altervista.org/adv/dualsbof-adv.txtADV-2006-0245dualdhcpdns-options-field-bo(24191)162981015495Clipcomm CPW-100E VoIP 802.11b Wireless Handset Phone running firmware 1.1.12 (051129) and CP-100E VoIP 802.11b Wireless Phone running firmware 1.1.60 allows remote attackers to gain unauthorized access via the debug service on TCP port 60023.162891850520060116 Clipcomm CP-100E VoIP wireless desktop phone open debug service TCP/6002320060116 Clipcomm CPW-100E VoIP wireless handset phone open debug service TCP/60023clipcomm-cp100e-default-port(24144)The DM Primer (dmprimer.exe) in the DM Deployment Common Component in Computer Associates (CA) BrightStor Mobile Backup r4.0, BrightStor ARCserve Backup for Laptops & Desktops r11.0, r11.1, r11.1 SP1, Unicenter Remote Control 6.0, 6.0 SP1, CA Desktop Protection Suite r2, CA Server Protection Suite r2, and CA Business Protection Suite r2 allows remote attackers to cause a denial of service (CPU consumption or application hang) via a large network packet, which causes a WSAEMESGSIZE error code that is not handled, leading to a thread exit.http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33756ADV-2006-02361627620060118 CAID 33756 - DM Deployment Common Component Vulnerabilities22529http://www.designfolks.com.au/karma/DMPrimer/http://supportconnectw.ca.com/public/ca_common_docs/dmdeploysecurity_notice.asp101550418531The DM Primer in the DM Deployment Common Component in Computer Associates (CA) BrightStor Mobile Backup r4.0, BrightStor ARCserve Backup for Laptops & Desktops r11.0, r11.1, r11.1 SP1, Unicenter Remote Control 6.0, 6.0 SP1, CA Desktop Protection Suite r2, CA Server Protection Suite r2, and CA Business Protection Suite r2 allows remote attackers to cause a denial of service (CPU consumption and log file consumption) via unspecified "unrecognized network messages" that are not properly handled.1015504http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33756ADV-2006-02361627620060118 CAID 33756 - DM Deployment Common Component Vulnerabilities22529http://supportconnectw.ca.com/public/ca_common_docs/dmdeploysecurity_notice.asp18531PHP remote file inclusion vulnerability in htmltonuke.php in the htmltonuke 2.0 alpha, and possibly other versions, module for PHP-Nuke allows remote attackers to execute arbitrary PHP code via a URL in the filnavn parameter.htmltonuke-htmltonuke-file-include(33092)162823524Linksys BEFVP41 VPN Router 2.0 with firmware 1.01.04 allows remote attackers on the local network, to cause a denial of service via IP packets with a null IP option length.ADV-2006-023820060116 Re: Linksys VPN Router (BEFVP41) DoS Vulnerability20060113 Linksys VPN Router (BEFVP41) DoS Vulnerability101549018461linksys-null-length-dos(24125)1630720060117 Re: Linksys VPN Router (BEFVP41) DoS VulnerabilityCross-site scripting (XSS) vulnerability in aoblogger 2.3 allows remote attackers to inject arbitrary Javascript via a javascript URI in the BBcode url tag.ADV-2006-02401628616889http://evuln.com/vulns/37/summary.htmlaoblogger-url-xss(24141)22526http://mikeheltonisawesome.com/viewcomments.php?idd=4620060117 [eVuln] aoblogger Multiple VulnerabilitiesSQL injection vulnerability in login.php in aoblogger 2.3 allows remote attackers to execute arbitrary SQL commands via the username parameter.ADV-2006-02401628616889http://evuln.com/vulns/37/summary.htmlaoblogger-login-sql-injection(24142)22527http://mikeheltonisawesome.com/viewcomments.php?idd=4620060117 [eVuln] aoblogger Multiple Vulnerabilitiescreate.php in aoblogger 2.3 allows remote attackers to bypass authentication and create new blog entries by setting the uza parameter to 1.ADV-2006-02401628616889http://evuln.com/vulns/37/summary.htmlaoblogger-create-security-bypass(24143)http://mikeheltonisawesome.com/viewcomments.php?idd=4620060117 [eVuln] aoblogger Multiple VulnerabilitiesMultiple SQL injection vulnerabilities in PDFdirectory before 1.0 allow remote attackers to execute arbitrary SQL commands via multiple unspecified vectors involving (1) util.php, (2) userpref.php, (3) user.php, (4) uploadfrm.php, (5) title.php, (6) team.php, (7) stats.php, (8) page.php, (9) org.php, (10) member.php, (11) index.php, (12) group.php, or (13) anniv.php.1627322415224142241322412224112241022409224082240722406224052240422403http://sourceforge.net/project/shownotes.php?release_id=382411&group_id=12268218459ADV-2006-0231PDFdirectory before 1.0 stores sensitive data in plaintext, which allows remote attackers to obtain arbitrary users' passwords by direct queries to the database, possibly via one of the SQL injection vulnerabilities.22402http://sourceforge.net/project/shownotes.php?release_id=382411&group_id=122682index.php in EZDatabase before 2.1.2 does not properly cleanse the p parameter before constructing and including a .php filename, which allows remote attackers to conduct directory traversal attacks, and produces resultant cross-site scripting (XSS) and path disclosure.http://zur.homelinux.com/Advisories/ezdatabase_dir_trans.txt1625720060115 EZDatabase Directory Transversal, XSS and Path Disclosure Vulnerability1804320060115 EZDatabase Directory Transversal, XSS and Path Disclosure Vulnerabilityezdatabase-index-p-path-disclosure(24135)ezdatabase-index-p-xss(24134)22684Buffer overflow in YGPPicFinder.DLL in AOL You've Got Pictures (YGP) Picture Finder Tool ActiveX Control, as used in AOL 8.0, 8.0 Plus, and 9.0 Classic, allows remote attackers to execute arbitrary code via unspecified vectors.VU#7157301626218521aol-youvegotpictures-activex-bo(24160)ADV-2006-022122486http://www.kb.cert.org/vuls/id/MIMG-6KRSQP1015494http://news.com.com/2061-10789_3-6027865.html?part=rss&tag=6027865&subj=newsCross-site scripting (XSS) vulnerability in rkrt_stats.php in RedKernel Referrer Tracker 1.1.0-3 allows remote attackers to inject arbitrary web script or HTML via a query string value as a GET, which is stored in the $QUERY_STRING variable. NOTE: the provenance of this information is unknown; portions of the details are obtained from third party information.ADV-2006-01971626618473referertracker-rkrtstats-xss(24151)SQL injection vulnerability in index.php in BlogPHP 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter in a login action.blogphp-index-bypass-security(24131)ADV-2006-02041626920060117 [eVuln] BlogPHP Authentication Bypass2249518467http://evuln.com/vulns/34/summaryDirectory traversal vulnerability in the FTP server (port 22003/tcp) in Farmers WIFE 4.4 SP1 allows remote attackers to create arbitrary files via ".." (dot dot) sequences in a (1) PUT, (2) SIZE, and possibly other commands.22496http://www.lort.dk/DSR-farmerswife44sp1.pl1850820060113 Farmers wife 4.4 sp1 remote SYSTEM accessfarmerswife-ftp-directory-traversal(24190)16321SQL injection vulnerability in admin/processlogin.php in Bit 5 Blog 8.01 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username and (2) password parameter.ADV-2006-01951624420060115 [eVuln] Bit 5 Blog SQL Injection & Authentication Bypass Vulnerability18464http://evuln.com/vulns/31/summarybit5blog-processlogin-sql-injection(24124)22445fetchmail 6.3.0 and other versions before 6.3.2 allows remote attackers to cause a denial of service (crash) via crafted e-mail messages that cause a free of an invalid pointer when fetchmail bounces the message to the originator or local postmaster.TA06-214Ahttp://fetchmail.berlios.de/fetchmail-SA-2006-01.txtfetchmail-message-bounce-dos(24265)ADV-2006-3101ADV-2006-0300192891636520060122 fetchmail security announcement fetchmail-SA-2006-01 (CVE-2006-0321)22691SSA:2006-045-011015527212531889518571APPLE-SA-2006-08-01http://developer.berlios.de/project/shownotes.php?release_id=8784http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=348747Unspecified vulnerability the edit comment formatting functionality in MediaWiki 1.5.x before 1.5.6 and 1.4.x before 1.4.14 allows attackers to cause a denial of service (infinite loop) via "certain malformed links."http://sourceforge.net/project/shownotes.php?release_id=386609ADV-2006-0392mediawiki-comment-format-dos(24478)1871718711SUSE-SR:2006:003Buffer overflow in swfformat.dll in multiple RealNetworks products and versions including RealPlayer 10.x, RealOne Player, Rhapsody 3, and Helix Player allows remote attackers to execute arbitrary code via a crafted SWF (Flash) file with (1) a a size value that is less than the actual size, or (2) other unspecified manipulations.VU#231028http://www.service.real.com/realplayer/security/03162006_player/en/RHSA-2006:0257SUSE-SA:2006:018GLSA-200603-241936519362realnetworks-swf-bo(25408)ADV-2006-10571720220060411 Realplayer .SWF Multiple Remote Memory Corruption Vulnerabilities10158066901939019358SQL injection vulnerability in WebspotBlogging 3.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter to login.php.ADV-2006-02681631920060119 [eVuln] WebspotBlogging Authentication Bypass Vulnerabilityhttp://evuln.com/vulns/41/summary.htmlhttps://sourceforge.net/project/shownotes.php?release_id=387180&group_id=156586https://sourceforge.net/forum/forum.php?forum_id=532233webspotblogging-login-sql-injection(24222)22670101552235618560Etomite Content Management System 0.6, and possibly earlier versions, when downloaded from the web site in January 2006 after January 10, contains a back door in manager/includes/todo.inc.php, which allows remote attackers to execute arbitrary commands via the "cij" parameter.etomite-default-backdoor(24254)18556ADV-2006-02831633620060130 Etomite followup information20060127 Etomite CMS 22693http://www.lucaercoli.it/advs/etomite.txthttp://www.etomite.org/forums/index.php?showtopic=4291http://www.etomite.org/forums/index.php?showtopic=4185TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to (1) thumbs.php, (2) showpic.php, or (3) tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails.20060119 IRM 015: File system path disclosure on TYPO3 Web Content ManagerADV-2006-026920060119 Re: IRM 015: File system path disclosure on TYPO3 Web Content Manager20060119 Re: IRM 015: File system path disclosure on TYPO3 Web Content Managehttp://www.irmplc.com/advisory015.htm18546http://bugs.typo3.org/view.php?id=2248typo3-multiple-path-disclosure(24244)226672266622665361Format string vulnerability in Tftpd32 2.81 allows remote attackers to cause a denial of service via format string specifiers in a filename in a (1) GET or (2) SEND request.VU#632633ADV-2006-026320060119 Critical security advisory #006 tftpd32 Format stringhttp://www.critical.lt/research/tftpd32_281_dos.txthttp://www.critical.lt/?vulnerabilities/20018539tftpd32-request-format-string(24250)1633322661362SQL injection vulnerability in HITSENSER Data Mart Server BS, BS-S, BS-M, BS-L, and EX allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.18553ADV-2006-02661632622669http://www.hitachi-support.com/security_e/vuls_e/HS05-026_e/index-e.html1015519hitachi-hitsenser-sql-injection(24240)Cross-site scripting (XSS) vulnerability in Gallery before 1.5.2 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors, possibly involving the user name (fullname).gallery-unknown-xss(24247)1633422660GLSA-200601-131862718557ADV-2006-0282http://gallery.menalto.com/page/gallery_1_5_2_releaseDSA-114821502http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=325285Buffer overflow in Change passwd 3.1 (chpasswd) SquirrelMail plugin allows local users to execute arbitrary code via long command line arguments.http://www.squirrelmail.org/plugin_view.php?id=11720060119 Change passwd 3.1 (SquirrelMail plugin )changepassword-changepasswd-bo(24258)363Pantomime in Ecartis 1.0.0 snapshot 20050909 stores e-mail attachments in a publicly accessible directory, which may allow remote attackers to upload arbitrary files.1631718524ecartis-pantomime-bypass-security(24220)ADV-2006-0260[listar-dev] 20060119 [EDev] Re: Potential vulnerability -- who to contact?[listar-dev] 20060115 [EDev] Re: Potential vulnerability -- who to contact?Cross-site scripting (XSS) vulnerability in ar-blog 5.2 allows remote attackers to inject arbitrary web script or HTML via the (1) month or (2) year parameter to index.php.20060118 -2- [XSS] in ar-blog v 5.2arblog-index-xss(24246)20060527 Multiple Xss exploits in ar-blog v 5.2Cross-site scripting (XSS) vulnerability in search.php in My Amazon Store Manager 1.0 allows remote attackers to inject arbitrary web script or HTML via the Keywords parameter. NOTE: some sources claim that the affected parameter is "q", but the only public archive of the original researcher notification shows an XSS manipulation in "Keywords".masm-search-xss(24230)ADV-2006-0252163122262618535http://osvdb.org/ref/22/22626-my_amazon.txtMultiple unspecified vulnerabilities in Kerio WinRoute Firewall before 6.1.4 Patch 1 allow remote attackers to cause a denial of service via multiple unspecified vectors involving (1) long strings received from Active Directory and (2) the filtering of HTML.163142263118542kerio-winroute-activedirectory-dos(24233)kerio-winroute-html-dos(24232)ADV-2006-0247http://www.kerio.com/kwf_history.htmlKerio WinRoute Firewall before 6.1.4 Patch 2 allows attackers to cause a denial of service (CPU consumption and hang) via unknown vectors involving "browsing the web".ADV-2006-0324http://www.kerio.com/kwf_history.htmlkerio-winroute-browsing-dos(24317)163852263118589Buffer overflow in multiple F-Secure Anti-Virus products and versions for Windows and Linux, including Anti-Virus for Windows Servers 5.52 and earlier, Internet Security 2004, 2005 and 2006, and Anti-Virus for Linux Servers 4.64 and earlier, allows remote attackers to execute arbitrary code via crafted ZIP archives.http://www.f-secure.com/security/fsc-2006-1.shtml18529ADV-2006-025716309fsecure-zip-bo(24198)22632Q-1031015510101550910155081015507Multiple F-Secure Anti-Virus products and versions for Windows and Linux, including Anti-Virus for Windows Servers 5.52 and earlier, Internet Security 2004, 2005 and 2006, and Anti-Virus for Linux Servers 4.64 and earlier, allow remote attackers to hide arbitrary files and data via malformed (1) RAR and (2) ZIP archives, which are not properly scanned.16309http://www.f-secure.com/security/fsc-2006-1.shtml18529ADV-2006-025722633Q-1031015510101550910155081015507fsecure-rar-zip-scan-bypass(24199)Buffer overflow in BitComet Client 0.60 allows remote attackers to execute arbitrary code, when the publisher's name link is clicked, via a long publisher URI in a torrent file.1631118522ADV-2006-025120060118 Fortinet Advisory: BitComet URI Buffer Overflow Vulnerabilityhttp://www.fortinet.com/FortiGuardCenter/FSA-2006-07.htmlhttp://www.bitcomet.com/doc/changelog.htmbitcomet-torrent-publisher-bo(24229)2262535720060118 Fortinet Advisory: BitComet URI Buffer Overflow Vulnerability20060122 BitComet URI Proof of ConceptUnspecified vulnerability in Stack Group Bidding Protocol (SGBP) support in Cisco IOS 12.0 through 12.4 running on various Cisco products, when SGBP is enabled, allows remote attackers on the local network to cause a denial of service (device hang and network traffic loss) via a crafted UDP packet to port 9900.101550118490cisco-ios-sgbp-dos(24182)ADV-2006-0248163032262420060118 IOS Stack Group Bidding Protocol Crafted Packet DoS358Cross-site scripting (XSS) vulnerability in WCONSOLE.DLL in Rockliffe MailSite 5.x and 6.1.22 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string.1855120060120 RockLiffe MailSite wconsole.dll Denial of Service/Script Injection VulnerabilityADV-2006-0284mailsite-wconsole-xss(24256)1633022677RockLiffe MailSite HTTP Mail management agent (httpma) 7.0.3.1 allows remote attackers to cause a denial of service (CPU consumption and crash) via a malformed query string containing special characters such as "|".1855120060120 RockLiffe MailSite wconsole.dll Denial of Service/Script Injection Vulnerabilitymailsite-wconsole-dos(24255)ADV-2006-02841633122678Unspecified vulnerability in the Port Discovery Standard and Advanced features in Hitachi JP1/NetInsight II allows attackers to stop the Port Discovery service via unknown vectors involving "invalid format data".18538ADV-2006-02671632722676http://www.hitachi-support.com/security_e/vuls_e/HS05-027_e/index-e.html1015520hitachi-jp1netinsight-port-dos(24243)Directory traversal vulnerability in Intervations FileCOPA FTP Server 1.01 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the (1) STOR and (2) RETR commands.http://www.nii.co.in/vuln/filecopa.html18550filecopa-ftp-directory-traversal(24257)ADV-2006-02851633522694Multiple SQL injection vulnerabilities in SaralBlog 1.0 allow remote attackers to execute arbitrary SQL commands via the search parameter to search.php. NOTE: the id/viewprofile.php issue is already covered by CVE-2005-4058.16306http://evuln.com/vulns/40/summary.htmlsaralblog-search-sql-injection(24218)22740101551720060118 [eVuln] SaralBlog XSS & Multiple SQL Injection VulnerabilitiesCross-site scripting (XSS) vulnerability in SaralBlog 1.0 allows remote attackers to inject arbitrary web script or HTML via a website field in a new comment to view.php, which is not properly handled in the comment function in functions.php.16306http://evuln.com/vulns/40/summary.htmlsaralblog-view-xss(24219)27907101551720060118 [eVuln] SaralBlog XSS & Multiple SQL Injection VulnerabilitiesDirectory traversal vulnerability in ELOG before 2.6.1 allows remote attackers to access arbitrary files outside of the elog directory via "../" (dot dot) sequences in the URL.1631518533elog-dotdot-directory-traversal(24224)ADV-2006-0262http://midas.psi.ch/elog/download/ChangeLog22647DSA-96718783Format string vulnerability in the write_logfile function in ELOG before 2.6.1 allows remote attackers to cause a denial of service (server crash) via unknown attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.1631518533ADV-2006-0262http://midas.psi.ch/elog/download/ChangeLogelog-elogd-format-string(24221)22646DSA-96718783SQL injection vulnerability in eggblog 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to blog.php.16305101550518212http://evuln.com/vulns/39/summary.htmleggblog-blog-sql-injection(24210)2275120060118 [eVuln] eggblog Multiple SQL Injection & XSS VulnerabilitiesCross-site scripting (XSS) vulnerability in eggblog 2.0 allow remote attackers to inject arbitrary web script or HTML via the message field to topic.php.16305101550518212http://evuln.com/vulns/39/summary.htmleggblog-topic-xss(24209)2275220060118 [eVuln] eggblog Multiple SQL Injection & XSS VulnerabilitiesUnspecified "critical denial-of-service vulnerability" in MyDNS before 1.1.0 has unknown impact and attack vectors.2263618532ADV-2006-0256http://mydns.bboy.net/download/changelog.htmlmydns-query-dos(24228)16431GLSA-200601-16DSA-96310155211865318641The default configuration of Fluffington FLog 1.01 installs users.0.dat under the web document root with insufficient access control, which might allow remote attackers to obtain sensitive information (login credentials) via a direct request. NOTE: It was later reported that 1.1.2 is also affected.20070105 Flog 1.1.2 Remote Admin Password Disclosure20060117 [eVuln] Flog Information Disclosure Vulnerabilityhttp://evuln.com/vulns/38/summary/bt/flog-admin-info-disclosure(31307)flog-data-directory-insecure(24193)unix_random.c in lshd for lsh 2.0.1 leaks file descriptors related to the randomness generator, which allows local users to cause a denial of service by truncating the seed file, which prevents the server from starting, or obtain sensitive seed information that could be used to crack keys.16357DSA-9561862318564lsh-file-descriptor-leak(24263)ADV-2006-030122695[lsh-bugs] SECURITY: lshd leaks fd:s to user shellsCisco IOS before 12.3-7-JA2 on Aironet Wireless Access Points (WAP) allows remote authenticated users to cause a denial of service (termination of packet passing or termination of client connections) by sending the management interface a large number of spoofed ARP packets, which creates a large ARP table that exhausts memory, aka Bug ID CSCsc16644.101548318430cisco-aironet-arp-dos(24086)ADV-2006-0176162172237520060112 Access Point Memory Exhaustion from ARP Attacks339oval:org.mitre.oval:def:5680Helmsman Research (aka CoolUtils) HomeFtp 1.1 allows remote attackers to cause an unspecified denial of service via a long USER command combined with a long PASS command and an NLST command.20060114 [KAPDA::#21] - HomeFtp v1.1 Denial of Servicehttp://www.kapda.ir/advisory-202.htmlhomeftp-long-command-dos(24152)16238350Ari Pikivirta Home Ftp Server 1.0.7 allows remote attackers to cause an unspecified denial of service via a long USER command combined with a long PASS command.20060115 Homeftp r1.0.7 Denial of Servicehttp://www.kapda.ir/advisory-211.htmlhomeftpserver-long-command-dos(24227)Grant Averett Cerberus FTP Server 2.32, and possibly earlier versions, allows remote attackers to cause an unspecified denial of service via a long string that does not contain a valid FTP command.20060115 Cerberus FTP Server 2.32 Denial of Servicehttp://www.kapda.ir/advisory-210.htmlhttp://www.cerberusftp.com/cerberus-releasenotes.htmcerberus-long-command-dos(24226)Multiple SQL injection vulnerabilities in PowerPortal, possibly 1.1 beta through 1.3, allow remote attackers to execute arbitrary SQL commands via the search parameter in (1) index.php and (2) search.php. NOTE: This issue might overlap CVE-2004-0663.2.1627920060117 PowerPortal Cross-Site Scripting Vulnerabilityhttp://web.archive.org/web/20050303003128/http://powerportal.sourceforge.net/powerportal-search-index-xss(24196)279582795710172Buffer overflow in CounterPath eyeBeam SIP Softphone allows remote attackers to (1) cause a denial of service (device crash) via SIP INVITE commands with a long header field name sent during startup and (2) cause a denial of service (device hang or crash) via SIP INVITE commands with a long header field name sent during a call.eyebeam-sip-header-bo(24181)ADV-2006-02591625320060921 Re: CounterPath eyeBeam Handing SIP header Vulnerabilities20060116 CounterPath eyeBeam Handing SIP header Vulnerabilities35418516http://blog.donews.com/zwell/archive/2006/01/17/698810.aspxMPM SIP HP-180W Wireless IP Phone WE.00.17 allows remote attackers to obtain sensitive information and possibly cause a denial of service via a direct connection to UDP port 9090, which is undocumented and does not require authentication.162851851220060116 MPM HP-180W VoIP wireless desktop phone undocumented port UDP/9090mpn-hp180w-default-port(24147)Cross-site scripting (XSS) vulnerability in addcomment.php in Bit 5 Blog 8.01 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in an <a> tag in the comment parameter, which strips most tags but not <a>.ADV-2006-01951624620060115 [eVuln] Bit 5 Blog JavaScript Insertion Vulnerability2244618464http://evuln.com/vulns/32/summary/http://evuln.com/vulns/32/exploitbit5blog-addcomment-xss(24129)TippingPoint Intrusion Prevention System (IPS) TOS before 2.1.4.6324, and TOS 2.2.x before 2.2.1.6506, allow remote attackers to cause a denial of service (CPU consumption) via an unknown vector, probably involving an HTTP request with a negative number in the Content-Length header.22504http://www.eweek.com/article2/0,1759,1912048,00.asphttp://isc.sans.org/diary.php?storyid=1042tippingpoint-ips-http-traffic-dos(24200)16299101551118515The "Remember my Password" feature in MSN Messenger 7.5 stores passwords in an encrypted format under the HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Creds registry key, which might allow local users to obtain the original passwords via a program that calls CryptUnprotectData, as demonstrated by the "MSN Password Recovery.exe" program. NOTE: it could be argued that local-only password recovery is inherently insecure because the decryption methods and keys must be stored somewhere on the local system, and are thus inherently accessible with varying degrees of effort. Perhaps this issue should not be included in CVE.20060117 Re: MSN Messenger Password Decrypter for WinXP/200320060113 Re: MSN Messenger Password Decrypter for WinXP/2003http://www.msn-password-recovery.com/Cross-site scripting (XSS) vulnerability in MyBulletinBoard (MyBB) allows remote attackers to inject arbitrary web script or HTML via a signature containing a JavaScript URI in the SRC attribute of an IMG element, in which the URI uses SGML numeric character references without trailing semicolons, as demonstrated by "javascript".18544mybb-html-signature-xss(24225)ADV-2006-0255163082262820060118 MyBB Signature HTML Code InjectionCross-site scripting (XSS) vulnerability in XMB (aka extreme message board) allows remote attackers to inject arbitrary web script or HTML via JavaScript in the SRC attribute of an IMG element.20060118 XMB Forum HTML Code Injectionxmbforum-imgsrc-xss(24208)27920Cross-site scripting (XSS) vulnerability in Phpclanwebsite (aka PCW) allows remote attackers to inject arbitrary web script or HTML via a javascript URI in a BBCode img tag.A simple fix has been released on the Main PCW site available directly at <a href="http://www.phpclanwebsite.com/index.php?page=downloads&func=browselist&par=1">http://www.phpclanwebsite.com/index.php?page=downloads&func=browselist&par=1
</a>Please download and install imediately. 1630018541ADV-2006-025420060117 Phpclanwebsite BBCode IMG Tag XSS VulnerabilityUnspecified vulnerability in Cisco CallManager 3.2 and earlier, 3.3 before 3.3(5)SR1, 4.0 before 4.0(2a)SR2c, and 4.1 before 4.1(3)SR2 allows remote authenticated users with read-only administrative privileges to obtain full administrative privileges via a "crafted URL on the CCMAdmin web page."2262120060118 Cisco Call Manager Privilege Escalation101550218501cisco-callmanager-ccmadmin-gain-priv(24172)ADV-2006-025016293Cisco CallManager 3.2 and earlier, 3.3 before 3.3(5)SR1, 4.0 before 4.0(2a)SR2c, and 4.1 before 4.1(3)SR2 allow remote attackers to (1) cause a denial of service (CPU and memory consumption) via a large number of open TCP connections to port 2000 and (2) cause a denial of service (fill the Windows Service Manager communication queue) via a large number of TCP connections to port 2001, 2002, or 7727.18494ADV-2006-02491629520060118 Cisco Call Manager Denial of Servicecisco-callmanager-port-connection-dos(24180)22623226221015503359** DISPUTED ** MySQL 5.0.18 allows local users with access to a VIEW to obtain sensitive information via the "SELECT * FROM information_schema.views;" query, which returns the query that created the VIEW. NOTE: this issue has been disputed by third parties, saying that the availability of the schema is a normal and sometimes desired aspect of database access.20060128 Re: MySQL 5.0 information leak?20060123 RE: MySQL 5.0 information leak?20060124 Re: MySQL 5.0 information leak?20060122 Re: MySQL 5.0 information leak?20060120 MySQL 5.0 information leak?20060121 Re: MySQL 5.0 information leak?20060121 RE: MySQL 5.0 information leak?Noah Medling RCBlog 1.03 stores the data and config directories under the web root with insufficient access control, which allows remote attackers to view account names and MD5 password hashes.20060120 [eVuln] RCBlog Directory Traversal & Sensitive Information Disclosurehttp://www.fluffington.com/index.php?page=rcblog18547http://evuln.com/vulns/42/summary.htmlrcblog-data-config-insecure-directories(24249)226791015523Directory traversal vulnerability in index.php in Noah Medling RCBlog 1.03 allows remote attackers to read arbitrary .txt files, possibly including one that stores the administrator's account name and password, via a .. (dot dot) in the post parameter.1634220060120 [eVuln] RCBlog Directory Traversal & Sensitive Information Disclosurehttp://www.fluffington.com/index.php?page=rcblog18547http://evuln.com/vulns/42/summary.htmlrcblog-index-file-include(27042)rcblog-index-directory-traversal(24248)20060611 RCblog 1.03 Directory Traversal [index.php]20060218 RCblog exploit [fun]226801015523Multiple SQL injection vulnerabilities in config.php in Insane Visions BlogPHP, possibly 1.0, allow remote attackers to execute arbitrary SQL commands via the (1) blogphp_username or (2) blogphp_password parameter in a cookie.BlogPHP version 2.0 was released to fix the config.php exploit and is available for download at <a href="http://sourceforge.net/project/showfiles.php?group_id=156043">http://sourceforge.net/project/showfiles.php?group_id=156043</a>.1634020060121 BlogPHP config.php SQL injection login bypassed20060120 BlogPHP config.php SQL injection login bypass20060120 BlogPHP config.php SQL injection login bypass22738blogphp-index-bypass-security(24131)365Cross-site scripting (XSS) vulnerability in register.aspx in Douran FollowWeb allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.1630227918Advantage Century Telecommunication (ACT) P202S IP Phone 1.01.21 running firmware 1.1.21 has multiple undocumented ports available, which (1) might allow remote attackers to obtain sensitive information, such as memory contents and internal operating-system data, by directly accessing the VxWorks WDB remote debugging ONCRPC (aka wdbrpc) on UDP 17185, (2) reflect network data using echo (TCP 7), or (3) gain access without authentication using rlogin (TCP 513).act-p202s-default-port(24149)162881851420060116 ACT P202S VoIP wireless phone multiple undocumented ports/servicesAdvantage Century Telecommunication (ACT) P202S IP Phone 1.01.21 running firmware 1.1.21 on VxWorks uses a hardcoded Network Time Protocol (NTP) server in Taiwan, which could allow remote attackers to provide false time information, block access to time information, or conduct other attacks.1851420060116 ACT P202S VoIP wireless phone multiple undocumented ports/servicesact-p202s-default-port(24149)16288The 802.11 wireless client in certain operating systems including Windows 2000, Windows XP, and Windows Server 2003 does not warn the user when (1) it establishes an association with a station in ad hoc (aka peer-to-peer) mode or (2) a station in ad hoc mode establishes an association with it, which allows remote attackers to put unexpected wireless communication into place.http://www.theta44.org/karma/20060114 [NMRC Advisory] Microsoft Windows Wireless Exposure on Laptopshttp://www.securiteam.com/windowsntfocus/5YP0D2KHHO.htmlhttp://www.nmrc.org/pub/advise/20060114.txt1015489windows-wireless-adhoc-unauth-access(24157)349CRLF injection vulnerability in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMAP commands via newline characters in the mailbox parameter of the sqimap_mailbox_select command, aka "IMAP injection."http://www.squirrelmail.org/security/issue/2006-02-151015662squirrelmail-mailbox-imap-injection(24849)ADV-2006-06891675618985oval:org.mitre.oval:def:11470RHSA-2006:0283FEDORA-2006-133SUSE-SR:2006:005MDKSA-2006:049GLSA-200603-09DSA-98820210199601920519176191311913020060501-01-UCross-site scripting (XSS) vulnerability in Netrix X-Site Manager allows remote attackers to inject arbitrary web script or HTML via the product_id parameter, as originally demonstrated for a custom mp3players_details.php program. NOTE: the name of the affected program might be installation-dependent, but it has been identified as "product_details.php" by some sources.ADV-2006-0253163132263418537http://osvdb.org/ref/22/22634-x-site.txtxsitemanager-productdetails-xss(24234)FreeBSD kernel 5.4-STABLE and 6.0 does not completely initialize a buffer before making it available to userland, which could allow local users to read portions of kernel memory.1859916373FreeBSD-SA-06:06bsd-buffer-initialization-disclosure(24338)227301015541A logic error in FreeBSD kernel 5.4-STABLE and 6.0 causes the kernel to calculate an incorrect buffer length, which causes more data to be copied to userland than intended, which could allow local users to read portions of kernel memory.1859916373FreeBSD-SA-06:06bsd-buffer-length-disclosure(24340)227311015541A logic error in the IP fragment cache functionality in pf in FreeBSD 5.3, 5.4, and 6.0, and OpenBSD, when a 'scrub fragment crop' or 'scrub fragment drop-ovl' rule is being used, allows remote attackers to cause a denial of service (crash) via crafted packets that cause a packet fragment to be inserted twice.18609FreeBSD-SA-06:0716375http://www.openbsd.org/cgi-bin/cvsweb/src/sys/net/pf_norm.c.diff?r1=1.103&r2=1.104bsd-pf-fragment-dos(24337)227321015542NetBSD-SA2006-004Apple Mac OS X 10.4.5 and allows local users to cause a denial of service (crash) via an undocumented system call.ADV-2006-0597APPLE-SA-2006-02-14macosx-system-call-dos(24682)1665423190101563418907IPSec when used with VPN networks in Mac OS X 10.4 through 10.4.5 allows remote attackers to cause a denial of service (application crash) via unspecified vectors involving the "incorrect handling of error conditions".TA06-062A1690719064ADV-2006-0791APPLE-SA-2006-03-01macosx-vpn-dos(25025)23643http://docs.info.apple.com/article.html?artnum=303382automount in Mac OS X 10.4.5 and earlier allows remote file servers to cause a denial of service (unresponsiveness) or execute arbitrary code via unspecified vectors that cause automount to "mount file systems with reserved names".TA06-062A1690719064ADV-2006-0791APPLE-SA-2006-03-01macosx-automount-execute-code(25021)236401015709http://docs.info.apple.com/article.html?artnum=303382FileVault in Mac OS X 10.4.5 and earlier does not properly mount user directories when creating a FileVault image, which allows local users to access protected files when FileVault is enabled.TA06-062A1690719064APPLE-SA-2006-03-01ADV-2006-0791macosx-filevault-file-access(25024)23642http://docs.info.apple.com/article.html?artnum=303382Stack-based buffer overflow in Safari in Mac OS X 10.4.5 and earlier, and 10.3.9 and earlier, allows remote attackers to execute arbitrary code via unspecified vectors involving a web page with crafted JavaScript, a different vulnerability than CVE-2005-4504.TA06-062AVU#1767321690719064APPLE-SA-2006-03-01ADV-2006-0791macosx-safari-bo(25032)1015713http://docs.info.apple.com/article.html?artnum=303382Safari in Mac OS X 10.3 before 10.3.9 and 10.4 before 10.4.5 allows remote attackers to redirect users to local files and execute arbitrary JavaScript via unspecified vectors involving HTTP redirection to local resources.TA06-062A16907101571319064APPLE-SA-2006-03-01macosx-safari-http-redirect(25038)ADV-2006-0791http://docs.info.apple.com/article.html?artnum=303382Cross-site scripting (XSS) vulnerability in Syndication (Safari RSS) in Mac OS X 10.4 through 10.4.5 allows remote attackers to execute arbitrary JavaScript via unspecified vectors involving RSS feeds.TA06-062A1690719064APPLE-SA-2006-03-01ADV-2006-0791macosx-syndication-xss(25040)23649http://docs.info.apple.com/article.html?artnum=303382** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-4504. Reason: This candidate is a duplicate of CVE-2005-4504. Notes: All CVE users should reference CVE-2005-4504 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.Directory traversal vulnerability in the BOM framework in Mac OS X 10.x before 10.3.9 and 10.4 before 10.4.5 allows user-assisted attackers to overwrite or create arbitrary files via an archive that is handled by BOMArchiveHelper.TA06-062A20060302 Apple MacOS X BOMArchiveHelper Directory Traversal VulnerabilityAPPLE-SA-2006-03-01ADV-2006-0791169072364119064macosx-bom-directory-traversal(25023)http://docs.info.apple.com/article.html?artnum=303382Buffer overflow in Apple Mac OS X 10.4.7 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Canon RAW image.VU#527236TA06-214Amacosx-raw-image-bo(28142)ADV-2006-3101192892773921253APPLE-SA-2006-08-01OpenSSH in Apple Mac OS X 10.4.7 allows remote attackers to cause a denial of service or determine account existence by attempting to log in using an invalid user, which causes the server to hang.TA06-214Amacosx-openssh-nonexistent-user-dos(28147)ADV-2006-31011928927745101667221253APPLE-SA-2006-08-01** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-0848. Reason: This candidate is a duplicate of CVE-2006-0848. Notes: All CVE users should reference CVE-2006-0848 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.The Download Validation in Mail in Mac OS X 10.4 does not properly recognize attachment file types to warn a user of an unsafe type, which allows user-assisted remote attackers to execute arbitrary code via crafted file types.TA06-062AADV-2006-0791APPLE-SA-2006-03-01http://docs.info.apple.com/article.html?artnum=303382macosx-mail-bypass-security(25027)169072364519064Buffer overflow in Mail in Apple Mac OS X 10.4 up to 10.4.5, when patched with Security Update 2006-001, allows remote attackers to execute arbitrary code via a long Real Name value in an e-mail attachment sent in AppleDouble format, which triggers the overflow when the user double-clicks on an attachment.VU#98008417081101576219129ADV-2006-094920060314 DMA[2006-0313a] - 'Apple OSX Mail.app RFC1740 Real Name Buffer Overflow'http://www.digitalmunition.com/DMA%5B2006-0313a%5D.txtAPPLE-SA-2006-03-13http://docs.info.apple.com/article.html?artnum=303453macosx-mail-attachment-bo(25209)23872Unspecified vulnerability in Safari, LaunchServices, and/or CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows attackers to trick a user into opening an application that appears to be a safe file type. NOTE: due to the lack of specific information in the vendor advisory, it is not clear how CVE-2006-0397, CVE-2006-0398, and CVE-2006-0399 are different.Per Hyperlink 894663:
Vendor description specifies that the file is automatically opened by the application: Safari could automatically open a file which appears to be a safe file type.19129macosx-safefiletype-command-execution(25269)ADV-2006-0949238691015760APPLE-SA-2006-03-13http://docs.info.apple.com/article.html?artnum=303453Unspecified vulnerability in Safari, LaunchServices, and/or CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows attackers to trick a user into opening an application that appears to be a safe file type. NOTE: due to the lack of specific information in the vendor advisory, it is not clear how CVE-2006-0397, CVE-2006-0398, and CVE-2006-0399 are different.Hyperlink Record 894667 specifies: Safari could automatically open a file which appears to be a safe file type, such as an image or movie, but is actually an application.19129macosx-safefiletype-command-execution(25269)ADV-2006-0949238701015760APPLE-SA-2006-03-13http://docs.info.apple.com/article.html?artnum=303453Unspecified vulnerability in Safari, LaunchServices, and/or CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows attackers to trick a user into opening an application that appears to be a safe file type. NOTE: due to the lack of specific information in the vendor advisory, it is not clear how CVE-2006-0397, CVE-2006-0398, and CVE-2006-0399 are different.Per Hyperlink Record 894671:
Safari could automatically open a file which appears to be a safe file type, such as an image or movie, but is actually an application.19129macosx-safefiletype-command-execution(25269)ADV-2006-0949238711015760APPLE-SA-2006-03-13http://docs.info.apple.com/article.html?artnum=303453CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows remote attackers to bypass the same-origin policy and execute Javascript in other domains via unknown vectors involving "crafted archives."1708219129ADV-2006-0949APPLE-SA-2006-03-13http://docs.info.apple.com/article.html?artnum=303453macosx-sameorigin-policy-bypass(25208)238731015763Unspecified vulnerability in Mac OS X before 10.4.6, when running on an Intel-based computer, allows attackers with physical access to bypass the firmware password and log on in Single User Mode via unspecified vectors.19462ADV-2006-121517364http://docs.info.apple.com/article.html?artnum=303567macosx-firmware-password-bypass(25620)243991015859SQL injection vulnerability in Zoph before 0.5pre1 allows remote attackers to execute arbitrary SQL commands.zoph-sql-injection(24264)http://sourceforge.net/project/shownotes.php?group_id=69353&release_id=38732018563ADV-2006-02971634722743DSA-98919153Multiple SQL injection vulnerabilities in e-moBLOG 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) monthy parameter to index.php or (2) login parameter to admin/index.php. NOTE: some sources have reported item 1 as involving the "monthly" parameter, but this is incorrect.emoblog-index-sql-injection(24245)ADV-2006-02961634420060122 [eVuln] e-moBLOG SQL Injection Vulnerability2270122700101552437018567http://evuln.com/vulns/43/summary.html20060125 The parameter in e-moBLOG is Note-A-Day Weblog 2.2 stores sensitive data under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to archive/.phpass-admin, which contains encrypted passwords.noteaday-archive-directory-insecure(24270)noteaday-archive-information-disclosure(24270)ADV-2006-029918566http://evuln.com/vulns/44/summary.html22699101553937120060122 [eVuln] Note-A-Day Weblog Sensitive Information DisclosureThe TIFFFetchShortPair function in tif_dirread.c in libtiff 3.8.0 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers a NULL pointer dereference, possibly due to changes in type declarations and/or the TIFFVSetField function.Per: http://cwe.mitre.org/data/definitions/476.html
'CWE-476: NULL Pointer Dereference'libtiff-tiffvsetfield-dos(24275)ADV-2006-030218172GLSA-200605-172034518587http://bugzilla.remotesensing.org/show_bug.cgi?id=1034http://bugzilla.remotesensing.org/show_bug.cgi?id=1029search.php in MyBB 1.0.2 allows remote attackers to obtain sensitive information via a certain search request that reveals the table prefix in a SQL error message, possibly due to invalid parameters.mybb-search-information-disclosure(24272)20060114 MyBB 1.0.2 Sniffing table perfix bug in search.php2273618577Cross-site scripting (XSS) vulnerability in post.php in AZ Bulletin Board (AZbb) 1.1.00 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) nickname parameter and (2) an iframe tag in the topic parameter. NOTE: the original disclosure specified the name parameter, but a correction was later provided. NOTE: followup posts have both disputed and confirmed the original claim.azbulletinboard-post-xss(24274)ADV-2006-02981635120060309 Re: Re: [CORRECTIONS AND ADDITIONS ]Azbb v1.1.00 Cross-Site Scripting20060308 Re: [CORRECTIONS AND ADDITIONS ]Azbb v1.1.00 Cross-Site Scripting 20060128 [CORRECTIONS AND ADDITIONS ]Azbb v1.1.00 Cross-Site Scripting20060123 Azbb v1.1.00 Cross-Site Scripting18565http://kapda.ir/advisory-236.html20060308 Re: [CORRECTIONS AND ADDITIONS ]Azbb v1.1.00 Cross-Site Scriptingrsh utility in Sun Grid Engine (SGE) before 6.0u7_1 allows local users to gain privileges and execute arbitrary code via unspecified vectors, possibly involving command line arguments.18580ADV-2006-0308http://gridengine.sunsource.net/project/gridengine/60patches.txtsge-rsh-gain-privileges(24281)163661015531Cross-site scripting (XSS) vulnerability in index.php in Pixelpost Photoblog 1.4.3 allows remote attackers to inject arbitrary web script or HTML via the "Add Comment" field in a comment popup.pixelpost-index-xss(24261)ADV-2006-03091636218572http://evuln.com/vulns/45/summary.html20060123 [eVuln] Pixelpost Photoblog XSS Vulnerability1015529SQL injection vulnerability in ADOdb before 4.71, when using PostgreSQL, allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors involving binary strings.http://sourceforge.net/project/shownotes.php?release_id=387862&group_id=4271818575adodb-postgresql-sql-injection(24314)ADV-2006-0448ADV-2006-03151636422705GLSA-200604-07GLSA-200602-02DSA-1031DSA-1030DSA-1029195911959019555187451873219691claro_init_local.inc.php in Claroline 1.7.2 uses guessable session cookies (MD5 hash of connection time), which allows remote attackers to hijack sessions and possibly gain administrative privileges.ADV-2006-03201634120060120 Claroline 1.7.2, sso identification vulnerabilityclaroline-cookie-bypass-security(24326)18588SQL injection vulnerability in CyberShop allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter in a login action.cybershop-login-sql-injection(24005)2236520060105 CyberShop User Login Sql InjectionMultiple SQL injection vulnerabilities in index.php in NewsPHP allow remote attackers to execute arbitrary SQL commands via the (1) discuss, (2) tim, (3) id, (4) last, and (5) limit parameter.newsphp-index-sql-injection(24320)ADV-2006-03411633920060122 Newsphp Multiple SQL Injection Vulnerabilities2271718624Tor before 0.1.1.20 allows remote attackers to identify hidden services via a malicious Tor server that attempts a large number of accesses of the hidden service, which eventually causes a circuit to be built through the malicious server.18576http://archives.seul.org/or/announce/Jan-2006/msg00001.htmltor-service-information-disclosure(24285)1832322689http://tor.eff.org/cvs/tor/ChangeLogGLSA-200606-042051419795Cross-site scripting (XSS) vulnerability in index.php in SleeperChat 0.3f and earlier allows remote attackers to inject arbitrary web script or HTML via the pseudo parameter.163631015525sleeperchat-index-xss(24300)22784SleeperChat 0.3f and earlier allows remote attackers to bypass authentication and create new entries via the txt parameter to (1) chat_no.php and (2) chat_if.php.sleeperchat-txt-security-bypass(24357)1015525SQL injection vulnerability in login.php in miniBloggie 1.0 and earlier, when gpc_magic_quotes is disabled, allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username and (2) password parameters.ADV-2006-0310http://evuln.com/vulns/47/summary.htmlminibloggie-login-sql-injection(24280)1636720060124 [eVuln] miniBloggie Authentication Bypass22729101553418604Eval injection vulnerability in 123 Flash Chat Server 5.0 and 5.1 allows attackers to execute arbitrary code via a crafted username.1636020060124 [ISecAuditors Advisories] Arbitrary flash code remote execution in 123flashchatBEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6 allows anonymous binds to the embedded LDAP server, which allows remote attackers to read user entries or cause a denial of service (unspecified) via a large number of connections.1015528BEA06-81.01BEA WebLogic Server and WebLogic Express 8.1 through SP4 and 7.0 through SP6 does not properly handle when servlets use relative forwarding, which allows remote attackers to cause a denial of service (slowdown) via unknown attack vectors that cause "looping stack overflow errors."1015528BEA06-106.01By design, BEA WebLogic Server and WebLogic Express 7.0 and 6.1, when creating multiple domains from the same WebLogic instance on the same machine, allows administrators of any created domain to access other created domains, which could allow administrators to gain privileges that were not intended.101552818581BEA06-108.00weblogic-cross-domain-management(24286)ADV-2006-031316358Multiple unspecified vulnerabilities in BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allow remote attackers to access MBean attributes or cause an unspecified denial of service via unknown attack vectors.101552818592BEA06-109.00weblogic-java-mbean-access(24294)ADV-2006-031316358BEA WebLogic Portal 8.1 through SP3 stores the password for the RDBMS Authentication provider in cleartext in the config.xml file, which allows attackers to gain privileges.1015528BEA06-110.00weblogic-portal-config-info-disclosure(40705)weblogicportal-config-info-disclosure(24284)ADV-2008-0613ADV-2006-03121635818593BEA08-110.01BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allows remote authenticated guest users to read the server log and obtain sensitive configuration information.101552818592BEA06-111.00weblogic-server-log-disclosure(24295)ADV-2006-03131635822776BEA WebLogic Portal 8.1 through SP4 allows remote attackers to obtain the source for a deployment descriptor file via unknown vectors.1015528BEA06-112.00weblogic-deployment-descriptor-disclosure(24297)ADV-2006-03121635818593BEA WebLogic Server and WebLogic Express 8.1 through SP4, when configuration auditing is enabled and a password change occurs, stores the old and new passwords in cleartext in the DefaultAuditRecorder.log file, which could allow attackers to gain privileges.101552818592BEA06-113.00weblogic-password-information-disclosure(24290)ADV-2006-03131635822775Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious EJBs or servlet applications to decrypt system passwords, possibly by accessing functionality that should have been restricted.101552818592BEA06-114.00weblogic-servlets-obtain-information(24291)ADV-2006-03131635822774Unspecified vulnerability in BEA WebLogic Portal 8.1 SP3 through SP5, when using Web Services Remote Portlets (WSRP), allows remote attackers to access restricted web resources via crafted URLs.1015528BEA06-115.00weblogic-wsrp-gain-access(24293)ADV-2006-0312163582276718593BEA WebLogic Server and WebLogic Express 9.0 causes new security providers to appear active even if they have not been activated by a server reboot, which could cause an administrator to perform inappropriate, security-relevant actions.101552818592BEA06-116.00weblogic-security-provider-weakness(24298)ADV-2006-03131635822773Certain configurations of BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6, when connection filters are enabled, cause the server to run more slowly, which makes it easier for remote attackers to cause a denial of service (server slowdown).101552818592BEA06-117.00ADV-2006-031316358weblogic-connection-filter-dos(24301)Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP5 allows untrusted applications to obtain the server's SSL identity via unknown attack vectors.101552818592BEA06-118.00ADV-2006-031316358weblogic-ssl-identity-exposure(24302)Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0, when an Administrator uses the WebLogic Administration Console to add custom security policies, causes incorrect policies to be created, which prevents the server from properly protecting JNDI resources.101552818592BEA06-119.00weblogic-jdni-security-weakness(24299)ADV-2006-031316358Selective Acknowledgement (SACK) in FreeBSD 5.3 and 5.4 does not properly handle an incoming selective acknowledgement when there is insufficient memory, which might allow remote attackers to cause a denial of service (infinite loop).22861ADV-2006-040916466FreeBSD-SA-06:08bsd-sack-handling-dos(24453)101556639918696Directory traversal vulnerability in action.php in phpXplorer allows remote attackers to read arbitrary files via ".." (dot dot) sequences and null bytes in the sAction parameter, a different vulnerability than CVE-2006-0244. NOTE: if the functionality of phpXplorer supports the upload of PHP files, then this issue would not cross privilege boundaries and would not be a vulnerability.phpxplorer-sshare-directory-traversal(39982)1629220060118 phpXplorer file inclusion biyosecurity.beUnspecified vulnerability in Oracle PL/SQL (PLSQL), as used in Database Server DS 9.2.0.7 and 10.1.0.5, Application Server 1.0.2.2, 9.0.4.2, 10.1.2.0.2, 10.1.2.1.0, and 10.1.3.0.0, E-Business Suite and Applications 11.5.10, and Collaboration Suite 10.1.1, 10.1.2.0, 10.1.2.1, and 9.0.4.2, allows attackers to bypass the PLSQLExclusion list and access excluded packages and procedures, aka Vuln# PLSQL01.VU#16916420060125 Workaround for unpatched Oracle PLSQL Gateway flaw1015961oracle-plsql-command-execution(24363)ADV-2006-1571ADV-2006-1397ADV-2006-033816384HPSBMA02113HPSBMA0211320060208 Re: Workaround for unpatched Oracle PLSQL Gateway flaw20060202 More on the workaround for the unpatched Oracle PLSQL Gateway flaw20060202 The History of the Oracle PLSQL Gateway Flaw20060131 Re: Workaround for unpatched Oracle PLSQL Gateway flaw22719http://www.oracle.com/technology/deploy/security/pdf/public_vuln_to_advisory_mapping.htmlhttp://www.oracle.com/technetwork/topics/security/cpuapr2006-090826.html101554440340219859197121862120060125 Workaround for unpatched Oracle PLSQL Gateway flaw20060202 More on the workaround for the unpatched Oracle PLSQL Gateway flaw20060202 The History of the Oracle PLSQL Gateway FlawUnspecified vulnerability in HP HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain privileges via unknown attack vectors.1015530HPSBUX02091SSRT061099ADV-2006-0322hpux-unspecified-privilege-escalation(24318)http://support.avaya.com/elmodocs2/security/ASA-2006-025.htm1860018596oval:org.mitre.oval:def:1586oval:org.mitre.oval:def:1577oval:org.mitre.oval:def:1453Cross-site scripting (XSS) vulnerability in admin_smilies.php in phpBB 2.0.19 allows remote attackers to inject arbitrary web script or HTML via Javascript events such as "onmouseover" in the (1) smile_url or (2) smile_emotion parameters, which bypasses a check for "<" and ">" characters.phpbb-referer-header-http-xss(24497)ADV-2006-04452292820060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin1869320060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin406Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.19, when Link to off-site Avatar or bbcode (IMG) are enabled, allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag in a user profile, as demonstrated using links to (1) admin/admin_users.php and (2) modcp.php.ADV-2006-044520060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin18693phpbb-referer-header-http-xss(24497)2292940620060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS AdminText Rider 2.4 stores sensitive data in the data directory under the web document root with insufficient access control, which allows remote attackers to obtain usernames and password hashes by directly accessing data/userlist.txt.textrider-data-information-disclosure(24279)ADV-2006-032118605http://evuln.com/vulns/46/summary.html20060124 [eVuln] Text Rider Sensitive Information Disclosure1015533Text Rider 2.4 allows attackers to bypass authentication and upload files without providing a valid password by obtaining the MD5 hash of the password (possibly via another vulnerability that reads it from a data file), then including the hash in a cookie.http://evuln.com/vulns/46/summary.html20060124 [eVuln] Text Rider Sensitive Information Disclosure1015533Stack-based buffer overflow in Sami FTP Server 2.0.1 allows remote attackers to execute arbitrary code via a long USER command, which triggers the overflow when the log is viewed.ADV-2006-031716370http://www.critical.lt/?vulnerabilities/20818574samiftpserver-user-bo(24325)20060124 SamiFTPd buffer overflowhttp://www.karjasoft.com/samiftp/newshttp://downloads.securityfocus.com/vulnerabilities/exploits/sami_ftp_poc.plMultiple cross-site scripting (XSS) vulnerabilities in usercp.php in MyBulletinBoard (MyBB) 1.02 allow remote attackers to inject arbitrary web script or HTML via the (1) notepad parameter in a notepad action and (2) signature parameter in a editsig action. NOTE: These are different attack vectors, and probably a different vulnerability, than CVE-2006-0218 and CVE-2006-0219.ADV-2006-03161636120060124 [KAPDA::#25] - MyBB 1.x Cross_Site_Scripting101553518603http://kapda.ir/advisory-241.htmlCross-site scripting (XSS) vulnerability in archive.php in CheesyBlog 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) realname and (2) comment parameters, or (3) via a javascript URI in the url parameter, when adding a comment.ADV-2006-03261637620060125 [eVuln] CheesyBlog XSS Vulnerabilityhttp://evuln.com/vulns/49/summary.htmlcheesyblog-archive-xss(24292)2271636918610SQL injection vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.1 allows remote attackers to execute arbitrary SQL commands via the (1) par parameter in the post function on the forum page and possibly the (2) poll_id parameter on the poll page. NOTE: the poll_id vector can also allow resultant cross-site scripting (XSS) from an unquoted error message for invalid SQL syntax.A simple fix has been released on the Main PCW site available directly at <a href="http://www.phpclanwebsite.com/index.php?page=downloads&func=browselist&par=1">http://www.phpclanwebsite.com/index.php?page=downloads&func=browselist&par=1</a>
Please download and install imediately.
Tech note: Filters id number (par) to contain numbers only.
1639118597ADV-2006-034220060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities2272222720http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txtphpclanwebsite-index-sql-injection(24355)index.php in Phpclanwebsite 1.23.1 allows remote authenticated users to obtain the installation path by specifying an invalid file name to the uploader page, as demonstrated by "\", which will display the full path of uploader.php. NOTE: this might be the result of a file inclusion vulnerability.Please add the following to the config.php file to avoid all such exploits.
ini_set('display_errors', false);
1639120060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities22721http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txtUnspecified vulnerability in WeBWorK 2.1.3 and 2.2-pre1 allows remote privilged attackers to execute arbitrary commands as the web server via unknown attack vectors.18594http://devel.webwork.rochester.edu/twiki/bin/view/Webwork/WeBWorKRelease2pt1pt4ADV-2006-0319webwork-unknown-command-execution(24322)16371Multiple buffer overflows in E-Post Mail Server 4.10 and SPA-PRO Mail @Solomon 4.00 allow remote attackers to execute arbitrary code via a long username to the (1) AUTH PLAIN or (2) AUTH LOGIN SMTP commands, which is not properly handled by (a) EPSTRS.EXE or (b) SPA-RS.EXE; (3) a long username in the APOP POP3 command, which is not properly handled by (c) EPSTPOP4S.EXE or (d) SPA-POP3S.EXE; (4) a long IMAP DELETE command, which is not properly handled by (e) EPSTIMAP4S.EXE or (f) SPA-IMAP4S.EXE.http://secunia.com/secunia_research/2006-1/advisory/18480ADV-2006-0318epost-imap-mailbox-dos(24334)epost-pop3-username-bo(24333)epost-smtp-username-bo(24331)16379227632276222761Multiple directory traversal vulnerabilities in (1) EPSTIMAP4S.EXE and (2) SPA-IMAP4S.EXE in the IMAP service in E-Post Mail 4.05 and SPA-PRO Mail 4.05 allow remote attackers to (a) list arbitrary directories or cause a denial of service via the LIST command; or create arbitrary files via the (b) APPEND, (c) COPY, or (d) RENAME commands.http://secunia.com/secunia_research/2006-1/advisory/18480epost--append-copy-rename-file-creation(24336)ADV-2006-0318epost--append-copy-rename-file-creation(24336)epost-imap-list-directory-traversal(24335)163792276522764Early termination vulnerability in the IMAP service in E-Post Mail 4.05 and SPA-PRO Mail 4.05 allows remote attackers to cause a denial of service (infinite loop) by sending an APPEND command and disconnecting before the expected amount of data is sent.http://secunia.com/secunia_research/2006-1/advisory/18480ADV-2006-0318epost-imap-append-dos(24341)1637922766phpBB 2.0.19 and earlier allows remote attackers to cause a denial of service (application crash) by (1) registering many users through profile.php or (2) using search.php to search in a certain way that confuses the database.20060125 HYSA-2006-001 phpBB 2.0.19 search.php and profile.php DOS Vulnerabilityhttp://www.h4cky0u.org/advisories/HYSA-2006-001-phpbb.txthttp://h4cky0u.org/viewtopic.php?t=637phpbb-search-profile-dos(24327)368Multiple memory leaks in the LDAP component in Fedora Directory Server 1.0 allow remote attackers to cause a denial of service (memory consumption) via invalid BER packets that trigger an error, which might prevent memory from being freed if it was allocated during the ber_scanf call, as demonstrated using the ProtoVer LDAP test suite.http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179135fedora-ber-memory-leak-dos(24794)1667718960dn2ancestor in the LDAP component in Fedora Directory Server 1.0 allows remote attackers to cause a denial of service (CPU and memory consumption) via a ModDN operation with a DN that contains a large number of "," (comma) characters, which results in a large amount of recursion, as demonstrated using the ProtoVer LDAP test suite.http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179137fedora-dn2ancestor-dos(24796)1667718960The LDAP component in Fedora Directory Server 1.0 allow remote attackers to cause a denial of service (crash) via a certain "bad BER sequence" that results in a free of uninitialized memory, as demonstrated using the ProtoVer LDAP test suite.http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179135fedora-ber-bad-sequence-dos(24795)1667718960Linux kernel before 2.6.15.3 down to 2.6.12, while constructing an ICMP response in icmp_send, does not properly handle when the ip_options_echo function in icmp.c fails, which allows remote attackers to cause a denial of service (crash) via vectors such as (1) record-route and (2) timestamp IP options with the needaddr bit set and a truncated value.16532FLSA:157459-4FEDORA-2006-102SUSE-SA:2006:0061886118788187841877418766[dailydave] 20060207 Fun with Linux (2.6.12 -> 2.6.15.2)kernel-icmp-ipoptionsecho-dos(24575)ADV-2006-0464USN-250-12006-0006MDKSA-2006:040http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.15.3[linux-kernel] 20060207 Re: Linux 2.6.15.3[linux-kernel] 20060207 Linux 2.6.15.3gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded. Note: this also occurs when running the equivalent command "gpg --verify".DSA-978SSA:2006-072-0216663SUSE-SA:2006:009GLSA-200602-10189681895618955189421893418933[gnupg-devel] 20060215 [Announce] False positive signature verification in GnuPGgnupg-gpgv-improper-verification(24744)ADV-2006-0610USN-252-12006-0008FLSA-2006:18535520060215 False positive signature verification in GnuPGRHSA-2006:026623221OpenPKG-SA-2006.001SUSE-SA:2006:013SUSE-SR:2006:005MDKSA-2006:04319532192491913018845oval:org.mitre.oval:def:10084[gnupg-announce] 20060215 False positive signature verification in GnuPGFEDORA-2006-11620060401-01-UThe strnlen_user function in Linux kernel before 2.6.16 on IBM S/390 can return an incorrect value, which allows local users to cause a denial of service via unknown vectors.ADV-2006-2554http://www.mail-archive.com/kernel-svn-changes@lists.alioth.debian.org/msg01631.htmlhttp://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.16-rc6http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=331c46591414f7f92b1cec048009abe89892ee79http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=331c46591414f7f92b1cec048009abe89892ee79DSA-1103oval:org.mitre.oval:def:990918687RHSA-2006:0575http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm224172146520914Race condition in the (1) add_key, (2) request_key, and (3) keyctl functions in Linux kernel 2.6.x allows local users to cause a denial of service (crash) or read sensitive kernel memory by modifying the length of a string argument between the time that the kernel calculates the length and when it copies the data into kernel memory.USN-263-1oval:org.mitre.oval:def:9566kernel-addkey-dos(25354)17084RHSA-2006:057523894SUSE-SA:2006:028MDKSA-2006:059http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm22417214652039819220The DCC ACCEPT command handler in irssi before 0.8.9+0.8.10rc5-0ubuntu4.1 in Ubuntu Linux, and possibly other distributions, allows remote attackers to cause a denial of service (application crash) via certain crafted arguments in a DCC command.19090USN-259-116913irssi-dcc-accept-dos(25147)flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator (flex) before 2.5.33 does not allocate enough memory for grammars containing (1) REJECT statements or (2) trailing context rules, which causes flex to generate code that contains a buffer overflow that might allow context-dependent attackers to execute arbitrary code.flex-bypass-security(24995)DSA-102016896234401942419071ADV-2006-0770USN-260-1GLSA-200603-07[flex-announce] 20060222 flex 2.5.33 released5701922819126http://prdownloads.sourceforge.net/flex/flex-2.5.33.tar.bz2?downloadMultiple buffer overflows in BomberClone before 0.11.6.2 allow remote attackers to execute arbitrary code via long error messages.GLSA-200602-09ADV-2006-0643bomberclone-error-message-bo(24764)1669723263DSA-997192101891518914Cross-site scripting (XSS) vulnerability in core.input.php in ExpressionEngine 1.4.1 allows remote attackers to inject arbitrary web script or HTML via HTTP_REFERER (referer).http://evuln.com/vulns/48/summary.htmlADV-2006-0325expressionengine-coreinput-xss(24296)1637720060125 [eVuln] ExpressionEngine 'Referer' XSS Vulnerability37218602SQL injection vulnerability in comentarios.php in AndoNET Blog 2004.09.02 allows remote attackers to execute arbitrary SQL commands via the entrada parameter.ADV-2006-0327http://evuln.com/vulns/50/summary.htmlandonetblog-index-sql-injection(24309)1639320060126 [eVuln] AndoNET Blog SQL Injection Vulnerability2275537718633Cross-site scripting (XSS) vulnerability in IdeoContent Manager allows remote attackers to inject arbitrary web script or HTML via the (1) goto_id parameter to index.php or (2) page parameter to news_full.php.2271322712http://osvdb.org/ref/22/22712-ideocontent.txtMultiple SQL injection vulnerabilities in index.php in IdeoContent Manager allow remote attackers to execute arbitrary SQL commands via the (1) goto_id or (2) mid parameter.22714http://osvdb.org/ref/22/22712-ideocontent.txtCross-site scripting (XSS) vulnerability in risultati_ricerca.php in active121 Site Manager allows remote attackers to inject arbitrary web script or HTML via the cerca parameter.22715http://osvdb.org/ref/22/22715-active121.txtCross-site scripting (XSS) vulnerability in search.asp in Goldstag Content Management System allows remote attackers to inject arbitrary web script or HTML via the text parameter.22711http://osvdb.org/ref/22/22711-goldstag.txtgoldstag-search-xss(25198)Unspecified vulnerability in Pioneers (formerly gnocatan) before 0.9.49 allows remote attackers to cause a denial of service (application crash) via long chat messages.pioneers-chat-message-dos(24383)DSA-9641869218647ADV-2006-037616429http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=350237CommuniGate Pro Core Server before 5.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via LDAP messages with negative BER lengths, and possibly other vectors, as demonstrated by the ProtoVer LDAP test suite.1640720060128 Multiple vulnerabilities in CommuniGate Pro Serverhttp://www.gleg.net/advisory_cg.shtml18640ADV-2006-0364http://www.stalker.com/CommuniGatePro/History.htmlcommunigate-ldap-bo(24409)Cross-site scripting (XSS) vulnerability in UebiMiau 2.7.9, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG tag.uebimiau-html-xss(24375)ADV-2006-0388http://www.uebimiau.org/news.php1641320060129 UebiMiau Webmail System Security Vulnerability18655387Cross-site scripting (XSS) vulnerability in search.php in MyBulletinBoard (MyBB) 1.02 allows remote attackers to inject arbitrary web script or HTML via the (1) sortby and (2) sortordr parameters, which are not properly handled in a redirection.ADV-2006-035016387227501861720060125 MyBB 1.0.2 XSS attack in search.php redirectionhttp://community.mybboard.net/showthread.php?tid=6418http://community.mybboard.net/attachment.php?aid=2181mybb-search-xss(24466)374Cross-site scripting (XSS) vulnerability in the bbcode function in functions.php in my little homepage my little forum, as last modified in June 2005, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags.mylittlehomepage-link-tag-xss(24310)ADV-2006-03491639520060126 [eVuln] "my little homepage" products [link] BBCode XSS Vulnerability18628http://evuln.com/vulns/51/summary.html22856http://evuln.com/vulns/51/20060130 My Little Homepage - source verify of different productsCross-site scripting (XSS) vulnerability in guestbook.php in my little homepage my little guestbook, as last modified in March 2004, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags.mylittlehomepage-link-tag-xss(24310)ADV-2006-03491639520060126 [eVuln] "my little homepage" products [link] BBCode XSS Vulnerability18628http://evuln.com/vulns/51/summary.html22855http://evuln.com/vulns/51/20060130 My Little Homepage - source verify of different productsCross-site scripting (XSS) vulnerability in the bbcode function in weblog.php in my little homepage my little weblog, as last modified in April 2004, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags.mylittlehomepage-link-tag-xss(24310)ADV-2006-03491639520060126 [eVuln] "my little homepage" products [link] BBCode XSS Vulnerability18628http://evuln.com/vulns/51/summary.html22753378http://evuln.com/vulns/51/20060130 My Little Homepage - source verify of different productsMultiple integer overflows in Shareaza 2.2.1.0 allow remote attackers to execute arbitrary code via (1) a large packet length field, which causes an overflow in the ReadBuffer function in (a) BTPacket.cpp and (b) EDPacket.cpp, or (2) a large packet, which causes a heap-based overflow in the Write function in (c) Packet.h.1639920060127 Shareaza P2P Remote Vulnerabilityhttp://www.hustlelabs.com/shareaza_advisory.pdfhttp://cvs.sourceforge.net/viewcvs.py/shareaza/shareaza/EDPacket.cpp?r1=1.15&r2=1.15.2.1http://cvs.sourceforge.net/viewcvs.py/shareaza/shareaza/BTPacket.cpp?r1=1.5&r2=1.5.4.1shareaza-cpacket-bo(24344)shareaza-cedpacket-bo(24343)shareaza-btpacket-bo(24342)38220060126 Shareaza Remote VulnerabilityPHP-Ping 1.3 does not properly validate ping counts, which allows remote attackers to cause a denial of service (ping flood) via a negative count parameter.ADV-2006-0368http://www.kapda.ir/advisory-231.html18645phpping-negative-count-dos(24382)Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a playlist (pls) file with a long file name (File1 field).TA06-032AVU#60474518649winamp-playlist-filename-bo(24361)winamp-playlist-filename-bo(24361)http://www.winamp.com/player/version_history.phpADV-2006-03611641020060131 Re: Re: Winamp 5.12 - 0day exploit - code execution through playlist20060130 Winamp 5.12 - 0day exploit - code execution through playlist22789http://www.heise.de/newsticker/meldung/68981101555234223983861458oval:org.mitre.oval:def:1402Buffer overflow in git-checkout-index in GIT before 1.1.5 allows remote attackers to execute arbitrary code via an index file with a long symbolic link.18643http://lwn.net/Articles/169623/ADV-2006-0367git-gitcheckoutindex-bo(24360)16417CRE Loaded 6.15 allows remote attackers to perform privileged actions, including uploading and creating arbitrary files, via a direct request to files.php. NOTE: the vendor states "The initial announcement of this risk was made on our website... and it included a patch which will close the vulnerability on all known 6.0x and 6.1x releases. We strongly encourage users of CRE Loaded 6.x, osCMax, and other users of osCommerce who have installed HTMLArea based WYSIWYG editors and Admin Access with Levels to modify thier installations at the earliest possible moment."1641518648creloaded-files-auth-bypass(24377)ADV-2006-03732279320060203 vendor ack/fix: 22793: CRE Loaded files.php Unauthenticated Arbitrary File Upload (fwd)pmwiki.php in PmWiki 2.1 beta 20, with register_globals enabled, allows remote attackers to bypass protection mechanisms that deregister global variables by setting both a GPC variable and a GLOBALS[] variable with the same name, which causes PmWiki to unset the GLOBALS[] variable but not the GPC variable, which creates resultant vulnerabilities such as remote file inclusion and cross-site scripting (XSS).pmwiki-multiple-xss(24368)pmwiki-file-include(24367)pmwiki-path-