[CLOSE] OSVDB ID : 24464 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : Unspecified vulnerabilities in Zen Cart before 1.2.7 allow remote attackers to cause unknown impact via unspecified vectors related to "other attempted exploits" other than SQL injection.

[CLOSE] OSVDB ID : 27983 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : imageVue 16.1 allows remote attackers to obtain folder permission settings via a direct request to dir.php, which returns an XML document that lists folders and their permissions.

[CLOSE] OSVDB ID : 27980 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : Zen Cart before 1.2.7 does not protect the admin/includes directory, which allows remote attackers to cause unknown impact via unspecified vectors, probably direct requests.

[CLOSE] OSVDB ID : 23066 - Disclosed: 2006-02-11

Description:

Verity KeyView Viewer SDK contains a flaw that allows a remote attacker to delete arbitrary files. The issue is due to 'kvarcve.dll' not properly checking the filenames of compressed files in ZIP, UUE, and TAR archives for traversal style attacks (../../) when generating their previews.

[CLOSE] OSVDB ID : 23068 - Disclosed: 2006-02-11

Description:

An overflow exists in the HTML speed reader component of the KeyView Viewer SDK. The software fails to properly validate file names passed to the 'htmsr.dll' library when a link is clicked, resulting in a buffer overflow. With a specially crafted long file name starting with a 'http', 'ftp' or '//' prefix, an attacker can execute arbitrary code, resulting in a loss of integrity. Note that the vulnerable component is used by IBM Lotus Notes for viewing HTML files.

[CLOSE] OSVDB ID : 23122 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : process.php in DocMGR 0.54.2 does not initialize the $siteModInfo variable when a direct request is made, which allows remote attackers to include arbitrary local files or possibly remote files via a modified includeModule and siteModInfo variable.

[CLOSE] OSVDB ID : 23112 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) lang parameter in docs/index.php and the language parameter in (2) install/install.php, (3) install/sec_stage_install.php, (4) install/third_stage_install.php, and (5) install/forth_stage_install.php. NOTE: direct static code injection is resultant from this issue, as demonstrated by inserting PHP code into the username, which is inserted into linpha.log, which is accessible from the directory traversal.

[CLOSE] OSVDB ID : 23113 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) lang parameter in docs/index.php and the language parameter in (2) install/install.php, (3) install/sec_stage_install.php, (4) install/third_stage_install.php, and (5) install/forth_stage_install.php. NOTE: direct static code injection is resultant from this issue, as demonstrated by inserting PHP code into the username, which is inserted into linpha.log, which is accessible from the directory traversal.

[CLOSE] OSVDB ID : 23114 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) lang parameter in docs/index.php and the language parameter in (2) install/install.php, (3) install/sec_stage_install.php, (4) install/third_stage_install.php, and (5) install/forth_stage_install.php. NOTE: direct static code injection is resultant from this issue, as demonstrated by inserting PHP code into the username, which is inserted into linpha.log, which is accessible from the directory traversal.

[CLOSE] OSVDB ID : 23115 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) lang parameter in docs/index.php and the language parameter in (2) install/install.php, (3) install/sec_stage_install.php, (4) install/third_stage_install.php, and (5) install/forth_stage_install.php. NOTE: direct static code injection is resultant from this issue, as demonstrated by inserting PHP code into the username, which is inserted into linpha.log, which is accessible from the directory traversal.

[CLOSE] OSVDB ID : 23116 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) lang parameter in docs/index.php and the language parameter in (2) install/install.php, (3) install/sec_stage_install.php, (4) install/third_stage_install.php, and (5) install/forth_stage_install.php. NOTE: direct static code injection is resultant from this issue, as demonstrated by inserting PHP code into the username, which is inserted into linpha.log, which is accessible from the directory traversal.

[CLOSE] OSVDB ID : 23089 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : IBM Tivoli Directory Server 6.0 allows remote attackers to cause a denial of service (crash) via a crafted LDAP request, as demonstrated by test 2532 in the ProtoVer Sample LDAP test suite.

[CLOSE] OSVDB ID : 23104 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : SQL injection vulnerability in deleteSession() in DB_eSession library 1.0.2 and earlier, as used in multiple products, allows remote attackers to execute arbitrary SQL commands via the $_sess_id_set variable, which is usually derived from PHPSESSID.

[CLOSE] OSVDB ID : 23107 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : change_password.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not verify the old password when a user changes the password, which may allow remote attackers to gain unauthorized access.

[CLOSE] OSVDB ID : 23108 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : The check_login function in login.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not exit when authentication fails, which allows remote attackers to gain unauthorized access.

[CLOSE] OSVDB ID : 23109 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : add_user.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not check user privileges when adding a new administrative user, which allows remote attackers to gain unauthorized access.

[CLOSE] OSVDB ID : 23102 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in search.php in Siteframe 5.0.1 allows remote attackers to inject arbitrary web script or HTML via the q parameter.

[CLOSE] OSVDB ID : 23100 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : Unspecified vulnerability in the loaders (load_*.php) in Ansilove before 1.03 allows remote attackers to read arbitrary files via unspecified vectors involving "converting files accessible by the webserver".

[CLOSE] OSVDB ID : 23101 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : Ansilove before 1.03 does not filter uploaded file extensions, which allows remote attackers to execute arbitrary code by uploading arbitrary files with dangerous extensions, then accessing them directly in the upload directory.

[CLOSE] OSVDB ID : 23167 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : readfolder.php in imageVue 16.1 allows remote attackers to list directories via modified path and ext parameters.

[CLOSE] OSVDB ID : 23168 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : Unspecified vulnerability in index.php in imageVue 16.1 has unknown impact, probably a cross-site scripting (XSS) vulnerability involving the query string that is not quoted when inserted into style and body tags, as demonstrated using a bgcol parameter.

[CLOSE] OSVDB ID : 23169 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : admin/upload.php in imageVue 16.1 allows remote attackers to upload arbitrary files to certain allowed folders via .. (dot dot) sequences in the path parameter. NOTE: due to the lack of details, the specific vulnerability type cannot be determined, although it might be due to directory traversal.

[CLOSE] OSVDB ID : 23239 - Disclosed: 2006-02-11

Description:

MyBulletinBoard (MyBB) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'managegroup.php' script not properly sanitizing user-supplied input to the 'gid' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 23240 - Disclosed: 2006-02-11

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 23283 - Disclosed: 2006-02-11

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 23067 - Disclosed: 2006-02-11

Description:

A remote overflow exists in Verity KeyView Viewer SDK. 'tarrdr.dll' fails to perform bounds checking on filenames of files contained by TAR archives, resulting in a stack based overflow. With a specially crafted TAR archive, an attacker can cause arbitrary code execution when the archive is extracted with an application using the vulnerable viewer, resulting in a loss of integrity.

[CLOSE] OSVDB ID : 23181 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : Absolute path traversal vulnerability in convert.cgi in Quirex 2.0.2 and earlier allows remote attackers to read arbitrary files, and possibly execute arbitrary code, via the (1) quiz_head, (2) quiz_foot, and (3) template variables.

[CLOSE] OSVDB ID : 23182 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter.

[CLOSE] OSVDB ID : 23183 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : Unspecified vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to execute arbitrary shell commands via the email parameter, possibly involving shell metacharacters.

[CLOSE] OSVDB ID : 23184 - Disclosed: 2006-02-11

Description:

(Description Provided by CVE) : SQL injection vulnerability in functions.php in Teca Diary PE 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) yy, (2) mm, and (3) dd parameters.

[CLOSE] OSVDB ID : 23064 - Disclosed: 2006-02-10

Description:

A remote overflow exists in Verity KeyView Viewer SDK. 'kvarcve.dll' fails to perform bounds checking when constructing the full pathname of a compressed file before extracting it from a ZIP archive, resulting in a stack based overflow. With a specially crafted ZIP archive, an attacker can cause arbitrary code execution when a compressed file with a long filename is extracted from within an application using the vulnerable viewer, resulting in a loss of integrity.

[CLOSE] OSVDB ID : 23065 - Disclosed: 2006-02-10

Description:

A remote overflow exists in Verity KeyView Viewer SDK. 'uudrdr.dll' fails to perform bounds checking on filenames of UUE files, resulting in a stack based overflow. With a specially crafted UUE file, an attacker can cause arbitrary code execution when the file is opened in an application using the vulnerable viewer, resulting in a loss of integrity.

[CLOSE] OSVDB ID : 48887 - Disclosed: 2006-02-10

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 48888 - Disclosed: 2006-02-10

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 28142 - Disclosed: 2006-02-10

Description:

(Description Provided by CVE) : index.php in Invision Power Board (IPB) 2.0.1, with Code Confirmation disabled, allows remote attackers to cause an unspecified denial of service by registering a large number of users.

[CLOSE] OSVDB ID : 86679 - Disclosed: 2006-02-10

Description:

By default, AS/400 iSeries installs with multiple default accounts and passwords, which are publicly known and documented. This allows attackers to trivially access the program or system and gain privileged access.

[CLOSE] OSVDB ID : 27961 - Disclosed: 2006-02-10

Description:

(Description Provided by CVE) : Unspecified vulnerability in HP PSC 1210 All-in-One Drivers before 1.0.06 has unknown impact and attack vectors.

[CLOSE] OSVDB ID : 51221 - Disclosed: 2006-02-10

Description:

IBM AS/400 systems contain a flaw that may allow a remote attacker to gain access to information. The issue is due to the telnet error message giving different error messages when a user login fails. By using these different error messages, an attacker can enumerate valid account names. While this information is often low risk, it is useful in carrying out additional, more focused attacks.

[CLOSE] OSVDB ID : 23721 - Disclosed: 2006-02-10

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 23722 - Disclosed: 2006-02-10

Description:

Unknown / Incomplete