[CLOSE] OSVDB ID : 39781 - Disclosed: 2007-12-31

Description:

(Description Provided by CVE) : SQL injection vulnerability in faq.php in MyPHP Forum 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the member.php vector is already covered by CVE-2005-0413.

[CLOSE] OSVDB ID : 39782 - Disclosed: 2007-12-31

Description:

(Description Provided by CVE) : SQL injection vulnerability in faq.php in MyPHP Forum 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the member.php vector is already covered by CVE-2005-0413.

[CLOSE] OSVDB ID : 39786 - Disclosed: 2007-12-31

Description:

Zenphoto contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'rss.php' script not properly sanitizing user-supplied input to the 'albumnr' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.

[CLOSE] OSVDB ID : 39787 - Disclosed: 2007-12-31

Description:

(Description Provided by CVE) : SQL injection vulnerability in (1) Puarcade.php and (2) PUarcade.html.php in Pragmatic Utopia PU Arcade (com_puarcade) 2.0.3, 2.1.2, and 2.1.3 Beta component for Joomla! allows remote attackers to execute arbitrary SQL commands via the fid parameter to index.php.

[CLOSE] OSVDB ID : 39881 - Disclosed: 2007-12-31

Description:

(Description Provided by CVE) : SQL injection vulnerability in index.php in IPTBB 0.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewdir action.

[CLOSE] OSVDB ID : 39886 - Disclosed: 2007-12-31

Description:

(Description Provided by CVE) : SQL injection vulnerability in (1) Puarcade.php and (2) PUarcade.html.php in Pragmatic Utopia PU Arcade (com_puarcade) 2.0.3, 2.1.2, and 2.1.3 Beta component for Joomla! allows remote attackers to execute arbitrary SQL commands via the fid parameter to index.php.

[CLOSE] OSVDB ID : 39887 - Disclosed: 2007-12-31

Description:

(Description Provided by CVE) : SQL injection vulnerability in index.php in WebPortal CMS 0.6.0 and earlier allows remote attackers to execute arbitrary SQL commands via the m parameter.

[CLOSE] OSVDB ID : 39893 - Disclosed: 2007-12-31

Description:

(Description Provided by CVE) : SQL injection vulnerability in admin/login.asp in Netchemia oneSCHOOL allows remote attackers to execute arbitrary SQL commands via the txtLoginID parameter.

[CLOSE] OSVDB ID : 39756 - Disclosed: 2007-12-30

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in LiveCart 1.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the return parameter to user/remindPassword, (2) the q parameter to the category script, (3) the return parameter to the order script, or (4) the email parameter to user/remindComplete.

[CLOSE] OSVDB ID : 39756 - Disclosed: 2007-12-30

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in LiveCart 1.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the return parameter to user/remindPassword, (2) the q parameter to the category script, (3) the return parameter to the order script, or (4) the email parameter to user/remindComplete.

[CLOSE] OSVDB ID : 39757 - Disclosed: 2007-12-30

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in LiveCart 1.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the return parameter to user/remindPassword, (2) the q parameter to the category script, (3) the return parameter to the order script, or (4) the email parameter to user/remindComplete.

[CLOSE] OSVDB ID : 39758 - Disclosed: 2007-12-30

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in LiveCart 1.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the return parameter to user/remindPassword, (2) the q parameter to the category script, (3) the return parameter to the order script, or (4) the email parameter to user/remindComplete.

[CLOSE] OSVDB ID : 39766 - Disclosed: 2007-12-30

Description:

(Description Provided by CVE) : SQL injection vulnerability in login_form.asp in Instant Softwares Dating Site allows remote attackers to execute arbitrary SQL commands via the Password parameter, a different product than CVE-2006-6021. NOTE: some of these details are obtained from third party information.

[CLOSE] OSVDB ID : 39784 - Disclosed: 2007-12-30

Description:

(Description Provided by CVE) : Directory traversal vulnerability in index.php in SanyBee Gallery 0.1.0 and 0.1.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter.

[CLOSE] OSVDB ID : 39788 - Disclosed: 2007-12-30

Description:

(Description Provided by CVE) : SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.

[CLOSE] OSVDB ID : 39836 - Disclosed: 2007-12-30

Description:

Kontakt Formular contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to 'includes/function.php' not properly sanitizing user input supplied to the 'root_path' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.

[CLOSE] OSVDB ID : 39882 - Disclosed: 2007-12-30

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in dir.php in milliscripts Redirection allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a browse action.

[CLOSE] OSVDB ID : 39883 - Disclosed: 2007-12-30

Description:

(Description Provided by CVE) : SQL injection vulnerability in index.php in w-Agora 4.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cat parameter.

[CLOSE] OSVDB ID : 39884 - Disclosed: 2007-12-30

Description:

(Description Provided by CVE) : Directory traversal vulnerability in download.php in Mihalism Multi Host 2.0.7 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

[CLOSE] OSVDB ID : 39915 - Disclosed: 2007-12-30

Description:

(Description Provided by CVE) : Directory traversal vulnerability in wiki/edit.php in Bitweaver R2 CMS allows remote attackers to obtain sensitive information (script source code) via a .. (dot dot) in the suck_url parameter.

[CLOSE] OSVDB ID : 39916 - Disclosed: 2007-12-30

Description:

(Description Provided by CVE) : PHP remote file inclusion vulnerability in includes/tumbnail.php in MatPo Bilder Galerie 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter.

[CLOSE] OSVDB ID : 40155 - Disclosed: 2007-12-30

Description:

(Description Provided by CVE) : Unrestricted file upload vulnerability in fisheye/upload.php in Bitweaver R2 CMS allows remote attackers to upload arbitrary files by using the image/gif content type, and possibly other image and PDF content types, as demonstrated by uploading a .htaccess file.

[CLOSE] OSVDB ID : 40277 - Disclosed: 2007-12-30

Description:

(Description Provided by CVE) : cpie.php in XCMS 1.83 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct direct static code injection attacks and execute arbitrary code via the testo_0 parameter in a cpie admin action to index.php, which writes to dati/generali/footer.dtb (aka the XCMS footer).

[CLOSE] OSVDB ID : 42293 - Disclosed: 2007-12-29

Description:

(Description Provided by CVE) : Unspecified vulnerability in the bzip2 decompression algorithm in nsis/bzlib_private.h in ClamAV before 0.92 has unknown impact and remote attack vectors.

[CLOSE] OSVDB ID : 39885 - Disclosed: 2007-12-29

Description:

(Description Provided by CVE) : Directory traversal vulnerability in file.php in CuteNews 2.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, as demonstrated by reading the admin username and password hash in data/users.db.php.

[CLOSE] OSVDB ID : 39894 - Disclosed: 2007-12-29

Description:

(Description Provided by CVE) : SQL injection vulnerability in admin.php/vars.php in CustomCMS (CCMS) 3.1 Demo allows remote attackers to execute arbitrary SQL commands via the p parameter in the Console page.

[CLOSE] OSVDB ID : 39895 - Disclosed: 2007-12-29

Description:

(Description Provided by CVE) : PHP remote file inclusion vulnerability in source/includes/load_forum.php in Mihalism Multi Forum Host 3.0.x and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mfh_root_path parameter.

[CLOSE] OSVDB ID : 43339 - Disclosed: 2007-12-29

Description:

(Description Provided by CVE) : ClamAV 0.92 does not recognize Base64 UUEncoded archives, which allows remote attackers to bypass the scanner via a Base64-UUEncoded file.

[CLOSE] OSVDB ID : 43337 - Disclosed: 2007-12-29

Description:

(Description Provided by CVE) : ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on (1) temporary files used by the cli_gentempfd function in libclamav/others.c or on (2) .ascii files used by sigtool, when utf16-decode is enabled.

[CLOSE] OSVDB ID : 43338 - Disclosed: 2007-12-29

Description:

(Description Provided by CVE) : ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on (1) temporary files used by the cli_gentempfd function in libclamav/others.c or on (2) .ascii files used by sigtool, when utf16-decode is enabled.

[CLOSE] OSVDB ID : 39866 - Disclosed: 2007-12-28

Description:

Mongrel contains a flaw that allows a remote attacker to browse outside of the web path. The issue is due to Mongrel not properly sanitizing user input, specifically encoded directory traversal style attacks (/.%252e/.%252e/).

[CLOSE] OSVDB ID : 40534 - Disclosed: 2007-12-28

Description:

(Description Provided by CVE) : LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via (1) a malformed Transport header, which triggers misparsing in parse_transport_header in RTSP_setup.c, as demonstrated by a Transport header that contains only a "RTP/AVP;unicast;client_port" sequence; or (2) a malformed Range header, which triggers misparsing in parse_play_time_range in RTSP_Play, as demonstrated by an empty Range header.

[CLOSE] OSVDB ID : 40535 - Disclosed: 2007-12-28

Description:

(Description Provided by CVE) : LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via (1) a malformed Transport header, which triggers misparsing in parse_transport_header in RTSP_setup.c, as demonstrated by a Transport header that contains only a "RTP/AVP;unicast;client_port" sequence; or (2) a malformed Range header, which triggers misparsing in parse_play_time_range in RTSP_Play, as demonstrated by an empty Range header.

[CLOSE] OSVDB ID : 42797 - Disclosed: 2007-12-28

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 42798 - Disclosed: 2007-12-28

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 39726 - Disclosed: 2007-12-28

Description:

March Networks 3204 DVR contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when specific logfiles are downloaded, which contain sensitive information by accessing a specific URL resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 41252 - Disclosed: 2007-12-28

Description:

(Description Provided by CVE) : Unspecified vulnerability in RunCMS before 1.6.1 has unknown impact and attack vectors, related to "pagetype using."

[CLOSE] OSVDB ID : 41253 - Disclosed: 2007-12-28

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 39664 - Disclosed: 2007-12-28

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to inject arbitrary web script or HTML via (1) the cat_name parameter to faq.php; and unspecified parameters to the (2) add categories, (3) edit categories, (4) delete categories, (5) add faq, (6) edit faq, and (7) delete faq Admin scripts.

[CLOSE] OSVDB ID : 39665 - Disclosed: 2007-12-28

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to execute arbitrary SQL commands via the category_id parameter to faq.php, and unspecified other vectors involving additional scripts.