[CLOSE] OSVDB ID : 15082 - Disclosed: 2005-03-25

Description:

Deplate contains a flaw related to the elements.rb script not sanitizing the IDs and filename creation. No further details have been provided.

[CLOSE] OSVDB ID : 14997 - Disclosed: 2005-03-25

Description:

Koobi CMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'area' , 'q', or 'p' parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 15115 - Disclosed: 2005-03-25

Description:

The Linux kernel EXT2 filesystem contains a flaw that may lead to an unauthorized information disclosure. The problem is that the 'ext2_make_empty()' function does not properly clear filesystem contents when creating a directory and the block written to store the '.' and '..' directory entries remains uninitialized. Up to 4,072 bytes of kernel memory may be leaked on each directory creation, which may allow a malicious user to disclose sensitive kernel memory contents resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 15103 - Disclosed: 2005-03-24

Description:

(Description Provided by CVE) : Webmasters-Debutants WD Guestbook 2.8 allows remote attackers to bypass authentication and perform certain administrator actions via a direct HTTP POST request to (1) ajout_admin2.php or (2) suppr.php.

[CLOSE] OSVDB ID : 15104 - Disclosed: 2005-03-24

Description:

(Description Provided by CVE) : Webmasters-Debutants WD Guestbook 2.8 allows remote attackers to bypass authentication and perform certain administrator actions via a direct HTTP POST request to (1) ajout_admin2.php or (2) suppr.php.

[CLOSE] OSVDB ID : 15050 - Disclosed: 2005-03-24

Description:

Oracle Reports Server contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'desname' or 'repprod' variables upon submission to the test.jsp script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 19314 - Disclosed: 2005-03-24

Description:

(Description Provided by CVE) : xattr.c in the ext2 and ext3 file system code for Linux kernel 2.6 does not properly compare the name_index fields when sharing xattr blocks, which could prevent default ACLs from being applied.

[CLOSE] OSVDB ID : 15195 - Disclosed: 2005-03-24

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 15488 - Disclosed: 2005-03-24

Description:

A local overflow exists in Linux Kernel. The "sysfs_write_file" function fails to validate the integer. By overwriting kernel memory by writing to a sysfs file, an attacker may cause a denial of service or run arbitrary commands with root privileges.

[CLOSE] OSVDB ID : 15004 - Disclosed: 2005-03-24

Description:

A remote overflow exists in Trillian. Trillian fails to properly validate HTTP 1.1 response headers resulting in a buffer overflow. With a specially crafted request, an attacker can cause the execution of malicious code resulting in a loss of integrity.

[CLOSE] OSVDB ID : 15002 - Disclosed: 2005-03-24

Description:

(Description Provided by CVE) : OpenmosixCollector and OpenMosixView in OpenMosixView 1.5 allow local users to overwrite or delete arbitrary files via a symlink attack on (1) temporary files in the openmosixcollector directory or (2) nodes.tmp.

[CLOSE] OSVDB ID : 15478 - Disclosed: 2005-03-24

Description:

(Description Provided by CVE) : Buffer overflow in the kimgio library for KDE 3.4.0 allows remote attackers to execute arbitrary code via a crafted PCX image file.

[CLOSE] OSVDB ID : 15010 - Disclosed: 2005-03-24

Description:

(Description Provided by CVE) : FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar, a variant of CVE-2005-0527, aka "Firescrolling 2."

[CLOSE] OSVDB ID : 15009 - Disclosed: 2005-03-24

Description:

Mozilla Firefox contains a flaw that may allow a malicious user to inject script code in the browser environment with the privleges of the locally-logged on user. The issue is triggered when a malicious web site is bookmarked as a sidebar panel. It is possible that the flaw may allow an attacker to run arbitrary code on the victim's machine, resulting in a loss of integrity.

[CLOSE] OSVDB ID : 15125 - Disclosed: 2005-03-24

Description:

(Description Provided by CVE) : Buffer overflow in Sylpheed before 1.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attachments with MIME-encoded file names.

[CLOSE] OSVDB ID : 15075 - Disclosed: 2005-03-24

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 16604 - Disclosed: 2005-03-23

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in Invision Power Board 2.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an HTTP POST request.

[CLOSE] OSVDB ID : 14935 - Disclosed: 2005-03-23

Description:

Mathopd contains a flaw that may allow a malicious local user to append content to arbitrary files on the system. The issue is due to the internal_dump() function (dump.c) creating temporary files insecurely when a SIGWINCH signal is caught. It is possible for a local attacker to use a symlink attack to cause the program to unexpectedly append dump data to an attacker specified file.

[CLOSE] OSVDB ID : 14942 - Disclosed: 2005-03-23

Description:

phpSysInfo contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when an attacker directly requests the class.OpenBSD.inc.php file, which will disclose installation path information resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 14943 - Disclosed: 2005-03-23

Description:

phpSysInfo contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when an attacker directly requests the class.NetBSD.inc.php file, which will disclose installation path information resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 14944 - Disclosed: 2005-03-23

Description:

phpSysInfo contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when an attacker directly requests the class.FreeBSD.inc.php file, which will disclose installation path information resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 14945 - Disclosed: 2005-03-23

Description:

phpSysInfo contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when an attacker directly requests the class.Darwin.inc.php file, which will disclose installation path information resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 14946 - Disclosed: 2005-03-23

Description:

phpSysInfo contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when an attacker directly requests the XPath.class.php file, which will disclose installation path information resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 14947 - Disclosed: 2005-03-23

Description:

phpSysInfo contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when an attacker directly requests the system_header.php file, which will disclose installation path information resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 14948 - Disclosed: 2005-03-23

Description:

phpSysInfo contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when an attacker directly requests the system_footer.php file, which will disclose installation path information resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 14949 - Disclosed: 2005-03-23

Description:

phpSysInfo contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'sensor_program' variable upon submission to the index.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 14950 - Disclosed: 2005-03-23

Description:

phpSysInfo contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'text[language]', 'text[template]', or 'VERSION' variables upon submission to the system_footer.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 14954 - Disclosed: 2005-03-23

Description:

(Description Provided by CVE) : Eval injection vulnerability in Double Choco Latte before 0.9.4.3 allows remote attackers to execute arbitrary PHP code via the menuAction variable in (1) functions.inc.php or (2) main.php, which causes code to be injected into an eval statement.

[CLOSE] OSVDB ID : 14955 - Disclosed: 2005-03-23

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in functions.inc.php for Double Choco Latte 0.9.4.3 allow remote attackers to inject arbitrary web script or HTML via the (1) class or (2) method name.

[CLOSE] OSVDB ID : 15074 - Disclosed: 2005-03-23

Description:

(Description Provided by CVE) : AS/400 Telnet 5250 terminal emulation clients, as implemented by (1) IBM client access, (2) Bosanova, (3) PowerTerm, (4) Mochasoft, and possibly other emulations, allows malicious AS/400 servers to execute arbitrary commands via a STRPCO (Start PC Organizer) command followed by STRPCCMD (Start PC command), as demonstrated by creating a backdoor account using REXEC.

[CLOSE] OSVDB ID : 14936 - Disclosed: 2005-03-23

Description:

MercuryBoard contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the "title" field upon sending private messages to users. This may allow a user to create a specially crafted private message that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 14992 - Disclosed: 2005-03-23

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 15081 - Disclosed: 2005-03-23

Description:

Smarty contains a flaw that may allow a remote attacker to execute arbitrary PHP code. The issue is due to the regex_replace modifier being called insecurely from templates. With a specially crafted request, an attacker can execute arbitrary code even with template security enabled.

[CLOSE] OSVDB ID : 15000 - Disclosed: 2005-03-23

Description:

(Description Provided by CVE) : Dnsmasq before 2.21 allows remote attackers to poison the DNS cache via answers to queries that were not made by Dnsmasq.

[CLOSE] OSVDB ID : 15001 - Disclosed: 2005-03-23

Description:

(Description Provided by CVE) : Off-by-one buffer overflow in Dnsmasq before 2.21 may allow attackers to execute arbitrary code via the DHCP lease file.

[CLOSE] OSVDB ID : 14938 - Disclosed: 2005-03-23

Description:

(Description Provided by CVE) : OllyDbg 1.10 and earlier allows remote attackers to cause a denial of service (application crash) via a dynamic link library (DLL) with a long filename.

[CLOSE] OSVDB ID : 23707 - Disclosed: 2005-03-23

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 18730 - Disclosed: 2005-03-23

Description:

Microsoft Windows XP contains a flaw that may allow a local denial of service. The issue is triggered, for certain protocols, when a raw IP empty datagram is sent and will result in loss of availability for the local system.

[CLOSE] OSVDB ID : 14998 - Disclosed: 2005-03-23

Description:

(Description Provided by CVE) : calendar_scheduler.php in Topic Calendar 1.0.1 module for phpBB, when running on a Microsoft IIS server, allows remote attackers to obtain sensitive information via invalid parameters, which reveal the path in an error message.

[CLOSE] OSVDB ID : 14999 - Disclosed: 2005-03-23

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in calendar_scheduler.php in the Topic Calendar 1.0.1 module for phpBB allows remote attackers to inject arbitrary web script or HTML via the start parameter.