[CLOSE] OSVDB ID : 16162 - Disclosed: 2005-05-08

Description:

(Description Provided by CVE) : Directory traversal vulnerability in easymsgb.pl in Easy Message Board allows remote attackers to read arbitrary files via a .. (dot dot) in the print parameter.

[CLOSE] OSVDB ID : 16163 - Disclosed: 2005-05-08

Description:

(Description Provided by CVE) : easymsgb.pl in Easy Message Board allows remote attackers to execute arbitrary commands via shell metacharacters in the print parameter.

[CLOSE] OSVDB ID : 16168 - Disclosed: 2005-05-08

Description:

(Description Provided by CVE) : DataTrac Activity Console 1.1 allows remote attackers to cause a denial of service via a long HTTP GET request.

[CLOSE] OSVDB ID : 16165 - Disclosed: 2005-05-08

Description:

(Description Provided by CVE) : Multiple buffer overflows in Orenosv HTTP/FTP Server 0.8.1 allow remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via long arguments to FTP commands such as MKD, RMD, or DELE, which are processed by the (1) ftp_xlate_path, (2) ftp_is_canonical, or (3) os_fn_nativize functions, or (4) a long SSI command that is processed by the parse_cmd function in cgissi.exe.

[CLOSE] OSVDB ID : 16166 - Disclosed: 2005-05-08

Description:

(Description Provided by CVE) : Multiple buffer overflows in Orenosv HTTP/FTP Server 0.8.1 allow remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via long arguments to FTP commands such as MKD, RMD, or DELE, which are processed by the (1) ftp_xlate_path, (2) ftp_is_canonical, or (3) os_fn_nativize functions, or (4) a long SSI command that is processed by the parse_cmd function in cgissi.exe.

[CLOSE] OSVDB ID : 17966 - Disclosed: 2005-05-08

Description:

(Description Provided by CVE) : The InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote attackers to execute a callback function in the context of another domain by forcing a page navigation after the install method has been called, which causes the callback to be run in the context of the new page and results in a same origin violation.

[CLOSE] OSVDB ID : 28296 - Disclosed: 2005-05-08

Description:

(Description Provided by CVE) : MySQL before 4.1.13 allows local users to cause a denial of service (persistent replication slave crash) via a query with multiupdate and subselects.

[CLOSE] OSVDB ID : 16572 - Disclosed: 2005-05-08

Description:

Advanced Guestbook contains a flaw that may allow a remote attacker to inject arbitrary SQL queries. The issue is due to the 'entry' variable in the 'index.php' script not being properly sanitized and may allow a remote attacker to inject or manipulate SQL queries.

[CLOSE] OSVDB ID : 74790 - Disclosed: 2005-05-08

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 16186 - Disclosed: 2005-05-07

Description:

(Description Provided by CVE) : The install function in Firefox 1.0.3 allows remote web sites on the browser's whitelist, such as update.mozilla.org or addon.mozilla.org, to execute arbitrary Javascript with chrome privileges, leading to arbitrary code execution on the system when combined with vulnerabilities such as CVE-2005-1476, as demonstrated using a javascript: URL as the package icon and a cross-site scripting (XSS) attack on a vulnerable whitelist site.

[CLOSE] OSVDB ID : 79346 - Disclosed: 2005-05-07

Description:

(Description Provided by CVE) : The install function in Firefox 1.0.3 allows remote web sites on the browser's whitelist, such as update.mozilla.org or addon.mozilla.org, to execute arbitrary Javascript with chrome privileges, leading to arbitrary code execution on the system when combined with vulnerabilities such as CVE-2005-1476, as demonstrated using a javascript: URL as the package icon and a cross-site scripting (XSS) attack on a vulnerable whitelist site.

[CLOSE] OSVDB ID : 16228 - Disclosed: 2005-05-07

Description:

PwsPHP contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'month' or 'annee' variables upon submission to the News module. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16229 - Disclosed: 2005-05-07

Description:

PwsPHP contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'nbractif' or 'annee' variables upon submission to the Stats module. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16230 - Disclosed: 2005-05-07

Description:

PwsPHP contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'chaine_search' or 'auteur_search' variables upon submission to the Recherche module. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16231 - Disclosed: 2005-05-07

Description:

PwsPHP contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'id' variable upon submission to the profil.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16232 - Disclosed: 2005-05-07

Description:

PwsPHP contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'mb_lettre' or 'lettre' variables upon submission to the memberlist.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16233 - Disclosed: 2005-05-07

Description:

PwsPHP contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the 'id' variable in the profil.php script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.

[CLOSE] OSVDB ID : 16234 - Disclosed: 2005-05-07

Description:

PwsPHP contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker directly requests the /admin/ directory, which will disclose the full installation path resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 16235 - Disclosed: 2005-05-07

Description:

(Description Provided by CVE) : PwsPHP 1.2.2 allows remote attackers to bypass authentication and post arbitrary comments via the Pseudo cookie.

[CLOSE] OSVDB ID : 16236 - Disclosed: 2005-05-07

Description:

(Description Provided by CVE) : The Admin panel in PwsPHP 1.2.2 does not properly verify uploaded picture files, which allows remote attackers to upload and possibly execute arbitrary files.

[CLOSE] OSVDB ID : 16458 - Disclosed: 2005-05-07

Description:

Net Portal Dynamic System (NPDS) contains a flaw that allows a remote HTML injection. This flaw exists because the application does not validate 'query' variables upon submission to the 'search.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16459 - Disclosed: 2005-05-07

Description:

Net Portal Dynamic System (NPDS) contains a flaw that allows a remote HTML injection. This flaw exists because the application does not validate 'order' variables upon submission to the 'pollBooth.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16460 - Disclosed: 2005-05-07

Description:

Net Portal Dynamic System (NPDS) contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'sdv' variables upon submission to the 'sdv.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16461 - Disclosed: 2005-05-07

Description:

Net Portal Dynamic System (NPDS) contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'sortby' variables upon submission to the 'memberslist.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16462 - Disclosed: 2005-05-07

Description:

Net Portal Dynamic System (NPDS) contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'uname' variables upon submission to the 'user.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16463 - Disclosed: 2005-05-07

Description:

Net Portal Dynamic System (NPDS) contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'to_userid' variables upon submission to the 'powerpack.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16464 - Disclosed: 2005-05-07

Description:

Net Portal Dynamic System (NPDS) contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'categories' variables upon submission to the 'faq.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16465 - Disclosed: 2005-05-07

Description:

Net Portal Dynamic System (NPDS) contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate user-supplied input in the 'Mot-clé' field upon submission to the 'searchbb.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16466 - Disclosed: 2005-05-07

Description:

Net Portal Dynamic System (NPDS) contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate user-supplied input in the search box in the Annuaires page. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16467 - Disclosed: 2005-05-07

Description:

Net Portal Dynamic System (NPDS) contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate user-supplied input in the 'member' field in the Comments section page. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16468 - Disclosed: 2005-05-07

Description:

Net Portal Dynamic System (NPDS) contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate user-supplied input in multiple fields in the Member section page. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16469 - Disclosed: 2005-05-07

Description:

Net Portal Dynamic System (NPDS) contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate user-supplied input in the 'ID Article' field in the Administrator section page. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 16470 - Disclosed: 2005-05-07

Description:

Net Portal Dynamic System (NPDS) contains a flaw that may allow a remote attacker to inject arbitrary SQL queries. The issue is due to the 'thold' variable in the 'pollBooth.php' script not being properly sanitized and may allow a remote attacker to inject or manipulate SQL queries.

[CLOSE] OSVDB ID : 16471 - Disclosed: 2005-05-07

Description:

Net Portal Dynamic System (NPDS) contains a flaw that may lead to an unauthorized information disclosure.  This flaw exists because the application does not validate 'thold' variables upon submission to the 'pollBooth.php' script, which will disclose the installation path resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 82580 - Disclosed: 2005-05-07

Description:

Eterm is prone to an overflow condition. This issue is triggered by an error in non-MMX 16bpp shading code that will result in an overflow. This may allow an attacker to potentially cause a denial of service or execute arbitrary code.

[CLOSE] OSVDB ID : 91769 - Disclosed: 2005-05-07

Description:

Newscoop contains a flaw that allows the injection of PHP tags in to fields that are displayed on the frontend. This may allow a remote attacker to execute arbitrary PHP code.

[CLOSE] OSVDB ID : 16184 - Disclosed: 2005-05-06

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 16154 - Disclosed: 2005-05-06

Description:

A remote overflow exists in 4D WebSTAR. The Tomcat plugin fails to validate URLs resulting in a buffer overflow. With a specially crafted request, an attacker can cause arbitrary code execution or denial of service resulting in a loss of integrity, and/or availability.

[CLOSE] OSVDB ID : 16164 - Disclosed: 2005-05-06

Description:

A remote overflow exists in the RSA SecurID Web Agent. The Web Agent fails to large "chunks" of data sent via the chunked-encoding mechanism resulting in a heap overflow. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.

[CLOSE] OSVDB ID : 16160 - Disclosed: 2005-05-06

Description:

(Description Provided by CVE) : PHP Advanced Transfer Manager (phpATM) 1.21 allows remote attackers to upload arbitrary files via filenames containing multiple file extensions, as demonstrated using a filename ending in "php.ns", which allows execution of arbitrary PHP code.