[CLOSE] OSVDB ID : 5716 - Disclosed: 2004-04-23

Description:

Zonet ZSR1104WE wireless router contains a flaw that may allow a remote attacker to bypass security settings. The problem is that the NAT implementation modifies the source address of inbound connections so that the origin address of forwarded traffic is that of the router, which may prevent identification of remote attackers resulting in a loss of integrity.

[CLOSE] OSVDB ID : 27775 - Disclosed: 2006-08-03

Description:

(Description Provided by CVE) : PHP remote file inclusion vulnerability in includes/usercp_register.php in ZoneMetrics ZoneX Publishers Gold Edition 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

[CLOSE] OSVDB ID : 16864 - Disclosed: 2005-05-27

Description:

ZonGG contains a flaw that may allow a remote attacker to inject arbitrary SQL queries. The issue is due to the 'password' field in the 'login.asp' script not being properly sanitized and may allow a remote attacker to inject or manipulate SQL queries.

[CLOSE] OSVDB ID : 37302 - Disclosed: 2007-05-04

Description:

(Description Provided by CVE) : zoo decoder 2.10 (zoo-2.10), as used in multiple products including (1) Barracuda Spam Firewall 3.4 and later with virusdef before 2.0.6399, (2) Spam Firewall before 3.4 20070319 with virusdef before 2.0.6399o, and (3) AMaViS 2.4.1 and earlier, allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.

[CLOSE] OSVDB ID : 23460 - Disclosed: 2006-02-22

Description:

(Description Provided by CVE) : Stack-based buffer overflow in the fullpath function in misc.c for zoo 2.10 and earlier, as used in products such as Barracuda Spam Firewall, allows user-assisted attackers to execute arbitrary code via a crafted ZOO file that causes the combine function to return a longer string than expected.

[CLOSE] OSVDB ID : 23934 - Disclosed: 2006-02-28

Description:

(Description Provided by CVE) : Buffer overflow in the parse function in parse.c in zoo 2.10 might allow local users to execute arbitrary code via long filename command line arguments, which are not properly handled during archive creation. NOTE: since this issue is local and not setuid, the set of attack scenarios is limited, although is reasonable to expect that there are some situations in which the zoo user might automatically list attacker-controlled filenames to add to the zoo archive.

[CLOSE] OSVDB ID : 77648 - Disclosed: 2011-11-30

Description:

1pluginjquery contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'page' parameter upon submission to the wp-content/plugins/1-jquery-photo-gallery-slideshow-flash/wp-1pluginjquery.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61464 - Disclosed: 2009-09-04

Description:

zoom Component for Mambo contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'catid' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 39872 - Disclosed: 2007-12-24

Description:

(Description Provided by CVE) : Buffer overflow in Zoom Player 6.00 beta 2 and earlier allows user-assisted remote attackers to execute arbitrary code via an HTTP link to a PLS file in a crafted ZPL file, which causes an overflow in Unicode handling when generating an error message.

[CLOSE] OSVDB ID : 89099 - Disclosed: 2012-12-30

Description:

Zoom Player contains a flaw that is triggered when an error occurs during the handling of a specially crafted JPG files. This may allow a context-dependent attacker to execute arbitrary code.

[CLOSE] OSVDB ID : 67333 - Disclosed: 2010-08-24

Description:

Zoom Portfolio Component for Joomla! contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 2669 - Disclosed: 2003-10-15

Description:

Zoom Search Engine contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate input variables upon submission to the search.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 83709 - Disclosed: 2011-04-22

Description:

Zoombak Assisted-GPS (A-GPS) Locator devices contain a flaw that allow a remote attacker to retrieve sensitive information. By sending crafted SMS messages to the device, the device can be instructed to send precise GPS location data to an arbitrary server. This attack requires knowledge of the cellular phone number associated with the device and the basic protocol information used for communication. Due to a lack of authentication, a variety of commands can be sent to the device revealing information or spoofing data sent by the device.

[CLOSE] OSVDB ID : 20899 - Disclosed: 2005-11-04

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 59671 - Disclosed: 2009-11-04

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in the Zoomify module 5.x before 5.x-2.2 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the node title.

[CLOSE] OSVDB ID : 37207 - Disclosed: 2007-06-11

Description:

(Description Provided by CVE) : Multiple stack-based buffer overflows in the Zoomify Viewer ActiveX control in ZActiveX.dll might allow remote attackers to execute arbitrary code via unspecified vectors.

[CLOSE] OSVDB ID : 31431 - Disclosed: 2006-09-24

Description:

(Description Provided by CVE) : PHP remote file inclusion vulnerability in libs/dbmax/mysql.php in ZoomStats 1.0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[lib][db][path] parameter.

[CLOSE] OSVDB ID : 58282 - Disclosed: 2003-06-19

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 58281 - Disclosed: 2003-06-19

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 58284 - Disclosed: 2003-06-19

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 58283 - Disclosed: 2003-06-19

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 10325 - Disclosed: 2004-01-08

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 6286 - Disclosed: 2001-02-23

Description:

Digital Creations Zope contains a flaw that may allow a malicious user to alter the method return values for affected classes. The issue is triggered because of a vulnerability in the handling of the method return values for the ObjectManager, PropertyManager, and PropertySheet classes. It is possible that the flaw may allow data manipulation in the classes resulting in a loss of integrity.

[CLOSE] OSVDB ID : 347 - Disclosed: 2000-06-15

Description:

(Description Provided by CVE) : The DocumentTemplate package in Zope 2.2 and earlier allows a remote attacker to modify DTMLDocuments or DTMLMethods without authorization.

[CLOSE] OSVDB ID : 28891 - Disclosed: 2006-08-21

Description:

(Description Provided by CVE) : The docutils module in Zope (Zope2) 2.7.0 through 2.7.9 and 2.8.0 through 2.8.8 does not properly handle web pages with reStructuredText (reST) markup, which allows remote attackers to read arbitrary files via a csv_table directive, a different vulnerability than CVE-2006-3458.

[CLOSE] OSVDB ID : 27125 - Disclosed: 2006-07-05

Description:

(Description Provided by CVE) : Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.

[CLOSE] OSVDB ID : 468 - Disclosed: 2000-01-04

Description:

(Description Provided by CVE) : The DTML implementation in the Z Object Publishing Environment (Zope) allows remote attackers to conduct unauthorized activities.

[CLOSE] OSVDB ID : 10320 - Disclosed: 2004-01-08

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 1973 - Disclosed: 2001-10-01

Description:

(Description Provided by CVE) : Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags.

[CLOSE] OSVDB ID : 10323 - Disclosed: 2004-01-08

Description:

Unknown / Incomplete