[CLOSE] OSVDB ID : 23891 - Disclosed: 2005-03-18

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 14863 - Disclosed: 2005-03-18

Description:

(Description Provided by CVE) : Buffer overflow in McAfee Scan Engine 4320 with DAT version before 4357 allows remote attackers to execute arbitrary code via crafted LHA files.

[CLOSE] OSVDB ID : 60161 - Disclosed: 2005-03-18

Description:

(Description Provided by CVE) : Viewcat.php in (1) RUNCMS 1.1A, (2) Ciamos 0.9.2 RC1, e-Xoops 1.05 Rev3, and possibly other products based on e-Xoops (exoops), allow remote attackers to obtain sensitive information via an invalid parameter to the convertorderbytrans function, which reveals the path in a PHP error message.

[CLOSE] OSVDB ID : 14906 - Disclosed: 2005-03-18

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in PHPOpenChat v3.x allows remote attackers to inject arbitrary web script or HTML via (1) the chatter parameter to regulars.php or (2) the chatter, chatter1, chatter2, chatter3, or chatter4 parameters to register.php.

[CLOSE] OSVDB ID : 14907 - Disclosed: 2005-03-18

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in PHPOpenChat v3.x allows remote attackers to inject arbitrary web script or HTML via (1) the chatter parameter to regulars.php or (2) the chatter, chatter1, chatter2, chatter3, or chatter4 parameters to register.php.

[CLOSE] OSVDB ID : 14996 - Disclosed: 2005-03-18

Description:

(Description Provided by CVE) : SQL injection vulnerability in index.php in Subdreamer Light, when magic_quotes_gpc is enabled, allows remote attackers to execute arbitrary SQL commands via certain parameters that are used as global variables, as demonstrated using the imageid parameter, which is not properly handled by imagegallery.php.

[CLOSE] OSVDB ID : 14933 - Disclosed: 2005-03-18

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 14939 - Disclosed: 2005-03-18

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in PHP-Post before 0.33 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

[CLOSE] OSVDB ID : 14940 - Disclosed: 2005-03-18

Description:

(Description Provided by CVE) : PHP-Post allows remote attackers to spoof the names of other users by registering with a username containing hex-encoded characters.

[CLOSE] OSVDB ID : 58702 - Disclosed: 2005-03-18

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 82787 - Disclosed: 2005-03-18

Description:

Appweb contains a flaw in the PHP handler component that may allow a remote denial of service. The issue is triggered when handling a form variable that is empty. With a specially crafted request, a remote attacker can cause the service to crash.

[CLOSE] OSVDB ID : 20734 - Disclosed: 2005-03-17

Description:

NetBSD IPSec contains a flaw that may allow a remote denial of service. The issue is triggered when certain IPSec AH packets are processed, and will result in loss of availability for the service.

[CLOSE] OSVDB ID : 16893 - Disclosed: 2005-03-17

Description:

(Description Provided by CVE) : Directory traversal vulnerability in includer.cgi in The Includer allows remote attackers to read arbitrary files via (1) a .. (dot dot) or (2) a full pathname in the URL.

[CLOSE] OSVDB ID : 14951 - Disclosed: 2005-03-17

Description:

CoolForum contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'img' variables upon submission to the 'avatar.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 14952 - Disclosed: 2005-03-17

Description:

CoolForum contains a flaw that may allow a remote attacker to inject arbitrary SQL queries. The issue is due to the 'pseudo' parameter in the 'entete.php' script not being properly sanitized and may allow a remote attacker to inject or manipulate SQL queries.

[CLOSE] OSVDB ID : 14953 - Disclosed: 2005-03-17

Description:

CoolForum contains a flaw that may allow a remote attacker to inject arbitrary SQL queries. The issue is due to the 'login' parameter in the 'register.php' script not being properly sanitized and may allow a remote attacker to inject or manipulate SQL queries.

[CLOSE] OSVDB ID : 14887 - Disclosed: 2005-03-17

Description:

(Description Provided by CVE) : PHP remote file inclusion vulnerability in install.php in mcNews 1.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the l parameter to reference a URL on a remote web server that contains the code, a different vulnerability than CVE-2005-0720.

[CLOSE] OSVDB ID : 82788 - Disclosed: 2005-03-17

Description:

Appweb reported an issue in the file upload handler related to "boundary conditions". This was originally interpreted by OSVDB to mean a possible overflow or boundary-related security issue. Since then, the vendor has clarified that the fix was not security related. As such, this is an invalid issue.

[CLOSE] OSVDB ID : 14862 - Disclosed: 2005-03-17

Description:

(Description Provided by CVE) : The GetEnhMetaFilePaletteEntries API in GDI32.DLL in Windows 2000 allows remote attackers to cause a denial of service (application crash) via a crafted Enhanced Metafile (EMF) file that causes invalid (1) end, (2) emreof, or (3) palent offsets to be used, aka "Enhanced Metafile Vulnerability."

[CLOSE] OSVDB ID : 14866 - Disclosed: 2005-03-17

Description:

(Description Provided by CVE) : Multiple "range checking flaws" in the ISO9660 filesystem handler in Linux 2.6.11 and earlier may allow attackers to cause a denial of service or corrupt memory via a crafted filesystem.

[CLOSE] OSVDB ID : 14867 - Disclosed: 2005-03-17

Description:

(Description Provided by CVE) : The web interface in NotifyLink 3.0 displays passwords in cleartext on the administrative page, which could allow remote attackers or local users to obtain sensitive information.

[CLOSE] OSVDB ID : 14868 - Disclosed: 2005-03-17

Description:

(Description Provided by CVE) : The web interface in NotifyLink 3.0 does not properly restrict access to functions that have been disabled in the GUI, which allows remote authenticated users to bypass intended restrictions via a direct request to certain URLs.

[CLOSE] OSVDB ID : 14869 - Disclosed: 2005-03-17

Description:

(Description Provided by CVE) : SQL injection vulnerability in NotifyLink before 3.0 allows remote attackers to execute arbitrary SQL commands via the URL.

[CLOSE] OSVDB ID : 14870 - Disclosed: 2005-03-17

Description:

(Description Provided by CVE) : NotifyLink, when configured for client key retrieval, allows remote attackers to obtain AES keys via a direct request to /hwp/get.asp, then uses a weak encryption scheme (fixed byte reordering) to protect the key, which allows remote attackers to obtain the key via a brute force attack.

[CLOSE] OSVDB ID : 14832 - Disclosed: 2005-03-17

Description:

IR contains a flaw related to an off-by-one error when passing overly long URLs that may allow an attacker to execute arbitrary code. No further details have been provided.

[CLOSE] OSVDB ID : 14858 - Disclosed: 2005-03-17

Description:

(Description Provided by CVE) : Format string vulnerability in MailEnable 1.8 allows remote attackers to cause a denial of service (application crash) via format string specifiers in the mailto field.

[CLOSE] OSVDB ID : 14861 - Disclosed: 2005-03-17

Description:

ACS Blog contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'search' variables upon submission to the 'search.asp' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 15013 - Disclosed: 2005-03-17

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 45592 - Disclosed: 2005-03-17

Description:

(Description Provided by CVE) : eZ publish 3.5 through 3.7 before 20050830 does not use a folder's read permissions to restrict notifications, which allows remote authenticated users to obtain sensitive information about changes to content in arbitrary folders.

[CLOSE] OSVDB ID : 14853 - Disclosed: 2005-03-17

Description:

Pavuk contains a flaw that may allow an attacker to execute arbitrary code due to unspecified buffer overflows. No further details have been provided.

[CLOSE] OSVDB ID : 15379 - Disclosed: 2005-03-17

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 14886 - Disclosed: 2005-03-17

Description:

(Description Provided by CVE) : Buffer overflow in newgrp in Solaris 7 through 9 allows local users to gain root privileges.

[CLOSE] OSVDB ID : 15111 - Disclosed: 2005-03-17

Description:

(Description Provided by CVE) : ImageMagick before 6.0 allows remote attackers to cause a denial of service (application crash) via a TIFF image with an invalid tag.

[CLOSE] OSVDB ID : 15112 - Disclosed: 2005-03-17

Description:

(Description Provided by CVE) : Heap-based buffer overflow in the SGI parser in ImageMagick before 6.0 allows remote attackers to execute arbitrary code via a crafted SGI image file.

[CLOSE] OSVDB ID : 15113 - Disclosed: 2005-03-17

Description:

(Description Provided by CVE) : Unknown vulnerability in ImageMagick before 6.1.8 allows remote attackers to cause a denial of service (application crash) via a crafted PSD file.

[CLOSE] OSVDB ID : 15114 - Disclosed: 2005-03-17

Description:

(Description Provided by CVE) : The TIFF decoder in ImageMagick before 6.0 allows remote attackers to cause a denial of service (crash) via a crafted TIFF file.

[CLOSE] OSVDB ID : 14899 - Disclosed: 2005-03-16

Description:

(Description Provided by CVE) : Argument injection vulnerability in Java Web Start for J2SE 1.4.2 up to 1.4.2_06 allows untrusted applications to gain privileges via the value parameter of a property tag in a JNLP file.

[CLOSE] OSVDB ID : 14838 - Disclosed: 2005-03-16

Description:

(Description Provided by CVE) : ThePoolClub (1) iPool and (2) iSnooker 1.6.81 and earlier stores usernames and passwords in cleartext in the MyDetails.txt file, which allows local users to gain privileges.

[CLOSE] OSVDB ID : 14837 - Disclosed: 2005-03-16

Description:

(Description Provided by CVE) : ThePoolClub (1) iPool and (2) iSnooker 1.6.81 and earlier stores usernames and passwords in cleartext in the MyDetails.txt file, which allows local users to gain privileges.

[CLOSE] OSVDB ID : 14859 - Disclosed: 2005-03-16

Description:

My Firewall Plus contains a flaw in the log viewer as it does not properly drop its privileges. The issue is triggered when using the log viewer's export functionality to save log files, allowing a local attacker to overwrite arbitrary files with logging information.