[CLOSE] OSVDB ID : 16992 - Disclosed: 2005-05-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 16913 - Disclosed: 2005-05-30

Description:

NewLife Blogger contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to an unspecified variable not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.

[CLOSE] OSVDB ID : 16933 - Disclosed: 2005-05-30

Description:

StrongHold 2 contains a flaw that may allow a remote denial of service. The issue is triggered when an attacker sends a specially crafted Nickname which is padded with a large number of bytes to the server. The STLport Library on the server fails to properly allocate memory, and will result in loss of availability for the application.

[CLOSE] OSVDB ID : 16936 - Disclosed: 2005-05-30

Description:

X-Cart Gold contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'cat' or 'printable' variables upon submission to the home.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16937 - Disclosed: 2005-05-30

Description:

X-Cart Gold contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'productid' or 'mode' variables upon submission to the product.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16938 - Disclosed: 2005-05-30

Description:

X-Cart Gold contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'id' variable upon submission to the error_message.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16939 - Disclosed: 2005-05-30

Description:

X-Cart Gold contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'section' variable upon submission to the help.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16940 - Disclosed: 2005-05-30

Description:

X-Cart Gold contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'mode' variable upon submission to the orders.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16941 - Disclosed: 2005-05-30

Description:

X-Cart Gold contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'mode' variable upon submission to the register.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16942 - Disclosed: 2005-05-30

Description:

X-Cart Gold contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'mode' variable upon submission to the search.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16943 - Disclosed: 2005-05-30

Description:

X-Cart Gold contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'gcid' or 'gcindex' variables upon submission to the giftcert.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16944 - Disclosed: 2005-05-30

Description:

X-Cart Gold contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the 'cat' and 'printable' variables in the home.php script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.

[CLOSE] OSVDB ID : 16945 - Disclosed: 2005-05-30

Description:

X-Cart Gold contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the 'productid' and 'mode' variables in the product.php script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.

[CLOSE] OSVDB ID : 16946 - Disclosed: 2005-05-30

Description:

X-Cart Gold contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the 'id' variable in the error_message.php script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.

[CLOSE] OSVDB ID : 16947 - Disclosed: 2005-05-30

Description:

X-Cart Gold contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the 'section' variable in the help.php script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.

[CLOSE] OSVDB ID : 16948 - Disclosed: 2005-05-30

Description:

X-Cart Gold contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the 'mode' variable in the orders.php script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.

[CLOSE] OSVDB ID : 16949 - Disclosed: 2005-05-30

Description:

X-Cart Gold contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the 'mode' variable in the register.php script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.

[CLOSE] OSVDB ID : 16950 - Disclosed: 2005-05-30

Description:

X-Cart Gold contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the 'mode' variable in the search.php script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.

[CLOSE] OSVDB ID : 16951 - Disclosed: 2005-05-30

Description:

X-Cart Gold contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the 'gcid' and 'gcindex' variables in the giftcert.php script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.

[CLOSE] OSVDB ID : 16976 - Disclosed: 2005-05-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 16934 - Disclosed: 2005-05-30

Description:

MyBulletinBoard (MyBB) contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'website' field upon submission to the User Profile script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16935 - Disclosed: 2005-05-30

Description:

(Description Provided by CVE) : The Data function in class.smtp.php in PHPMailer 1.7.2 and earlier allows remote attackers to cause a denial of service (infinite loop leading to memory and CPU consumption) via a long header field.

[CLOSE] OSVDB ID : 16952 - Disclosed: 2005-05-30

Description:

PowerDownload contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to downloads.php not properly sanitizing user input supplied to the incdir variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.

[CLOSE] OSVDB ID : 17128 - Disclosed: 2005-05-29

Description:

(Description Provided by CVE) : Directory traversal vulnerability in ServersCheck Monitoring Software 5.9.0 to 5.10.0 allows remote attackers to read arbitrary files via .. (dot dot) sequences in an HTTP request.

[CLOSE] OSVDB ID : 17127 - Disclosed: 2005-05-29

Description:

(Description Provided by CVE) : SQL injection vulnerability in SignIn.asp in India Software Solution shopping cart allows remote attackers to execute arbitrary SQL commands via the password.

[CLOSE] OSVDB ID : 17223 - Disclosed: 2005-05-29

Description:

(Description Provided by CVE) : xmysqladmin 1.0 and earlier allows local users to delete arbitrary files via a symlink attack on a database backup file in /tmp.

[CLOSE] OSVDB ID : 16909 - Disclosed: 2005-05-29

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in Jaws Glossary gadget 0.4 to 0.5.1 allows remote attackers to inject arbitrary web script or HTML via the term parameter in a view or ViewTerm action to index.php.

[CLOSE] OSVDB ID : 16917 - Disclosed: 2005-05-29

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in NikoSoft WebMail before 0.11.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

[CLOSE] OSVDB ID : 16960 - Disclosed: 2005-05-29

Description:

(Description Provided by CVE) : Format string vulnerability in the curses_msg function in the Ncurses interface (ec_curses.c) for Ettercap before 0.7.3 allows remote attackers to execute arbitrary code.

[CLOSE] OSVDB ID : 16907 - Disclosed: 2005-05-29

Description:

(Description Provided by CVE) : The DbgMsg.sys driver in Compuware SoftICE DriverStudio 3.1 and 3.2 allows remote attackers to cause a denial of service (application crash) via an invalid Debug Message pointer.

[CLOSE] OSVDB ID : 16970 - Disclosed: 2005-05-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 21278 - Disclosed: 2005-05-29

Description:

(Description Provided by CVE) : Linux kernel before 2.6.12 allows remote attackers to poison the bridge forwarding table using frames that have already been dropped by filtering, which can cause the bridge to forward spoofed packets.

[CLOSE] OSVDB ID : 16912 - Disclosed: 2005-05-28

Description:

os4e contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the "Password" variable in the "login.asp" script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.

[CLOSE] OSVDB ID : 20495 - Disclosed: 2005-05-28

Description:

(Description Provided by CVE) : Invision Power Board (IPB) 1.0 through 1.3 allows remote attackers to edit arbitrary forum posts via a direct request to index.php with modified parameters.

[CLOSE] OSVDB ID : 16991 - Disclosed: 2005-05-28

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 16910 - Disclosed: 2005-05-28

Description:

A remote overflow exists in PicoWebServer. The application fails to perform proper bounds checking resulting in a buffer overflow. With an overly long HTTP GET request, a remote attacker can cause arbitrary code execution resulting in a loss of integrity.

[CLOSE] OSVDB ID : 16911 - Disclosed: 2005-05-28

Description:

(Description Provided by CVE) : Invision Power Board (IPB) 1.0 through 2.0.4 allows non-root admins to add themselves or other users to the root admin group via the "Move users in this group to" screen.

[CLOSE] OSVDB ID : 16916 - Disclosed: 2005-05-28

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 17131 - Disclosed: 2005-05-28

Description:

Microsoft Windows Remote Desktop Protocol contains a flaw that may lead to an unauthorized information disclosure. The issue is due to a private key used to sign the Terminal Server public key being hardcoded in a program library (mstlsapi.dll). This may allow an attacker to disclose the key and calculate a valid signature to carry out a man in the middle (MITM) attack.

[CLOSE] OSVDB ID : 17968 - Disclosed: 2005-05-28

Description:

(Description Provided by CVE) : Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 allows remote attackers to cause a denial of service (access violation and crash), and possibly execute arbitrary code, by calling InstallVersion.compareTo with an object instead of a string.