[CLOSE] OSVDB ID : 37732 - Disclosed: 2007-06-23

Description:

(Description Provided by CVE) : Sergey Lyubka Simple HTTPD (shttpd) 1.38 allows remote attackers to obtain sensitive information (script source code) via a URL with a trailing encoded space (%20).

[CLOSE] OSVDB ID : 36331 - Disclosed: 2007-06-23

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in index.wkf in KeyFocus (KF) web server 3.1.0 allows remote attackers to inject arbitrary web script or HTML via the opsubmenu parameter.

[CLOSE] OSVDB ID : 39010 - Disclosed: 2007-06-23

Description:

(Description Provided by CVE) : LiteWEB 2.7 allows remote attackers to cause a denial of service (hang) via a large number of requests for nonexistent pages.

[CLOSE] OSVDB ID : 39014 - Disclosed: 2007-06-23

Description:

(Description Provided by CVE) : ** DISPUTED ** Microsoft Windows XP SP2 allows local users, who have sessions created by another user's RunAs (run as) command, to kill arbitrary processes of this other user, as demonstrated by the taskkill program. NOTE: the researcher claims a vendor dispute in which the vendor states that "RunAs and UAC are convenience features, not security boundaries. If you need a security guarantee, please log out and log back in with a different account."

[CLOSE] OSVDB ID : 45364 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : PHP remote file inclusion vulnerability in download.php in the Adam van Dongen Forum (com_forum) component (aka phpBB component) 1.2.4RC3 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

[CLOSE] OSVDB ID : 37729 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : ageet AGEphone before 1.6.2, running on Windows Mobile 5 on the HTC HyTN Pocket PC device, allows remote attackers to (1) cause a denial of service (call disruption and device hang) via a SIP message with a malformed header and (2) cause a denial of service (call disruption, false ring indication, and device outage) via a SIP message with a malformed SDP delimiter.

[CLOSE] OSVDB ID : 37730 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Multiple unspecified vulnerabilities in ageet AGEphone before 1.6.3 allow remote attackers to have an unknown impact via malformed SIP packets.

[CLOSE] OSVDB ID : 45379 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Memory leak in the token OCR functionality in ekg before 1:1.7~rc2-1etch1 on Debian GNU/Linux Etch allows remote attackers to cause a denial of service.

[CLOSE] OSVDB ID : 45378 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : ekg before 1:1.7~rc2-1etch1 on Debian GNU/Linux Etch allows remote attackers to cause a denial of service (NULL pointer dereference) via a vector related to the token OCR functionality.

[CLOSE] OSVDB ID : 45377 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Memory leak in the image message functionality in ekg before 1:1.7~rc2-1etch1 on Debian GNU/Linux Etch allows remote attackers to cause a denial of service.

[CLOSE] OSVDB ID : 36450 - Disclosed: 2007-06-22

Description:

Mac OS X contains a flaw related to the WebKit that may allow a remote attacker to execute arbitrary code via a specially crafted web page. No further details have been provided.

[CLOSE] OSVDB ID : 36452 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Race condition in Apple Safari 3 Beta before 3.0.2 on Mac OS X, Windows XP, Windows Vista, and iPhone before 1.0.1, allows remote attackers to bypass the JavaScript security model and modify pages outside of the security domain and conduct cross-site scripting (XSS) attacks via vectors related to page updating and HTTP redirects.

[CLOSE] OSVDB ID : 37805 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Buffer overflow in bbs100 before 3.2 allows remote attackers to cause a denial of service (crash) by attempting to login as the Guest user when another Guest user is already logged in, possibly related to the state_login_prompt function in state_login.c.

[CLOSE] OSVDB ID : 37806 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Multiple unspecified vulnerabilities in bbs100 before 3.2 allow remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving certain v*printf and shift_StringIO functions. NOTE: some details were obtained from third party information.

[CLOSE] OSVDB ID : 37807 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Multiple unspecified vulnerabilities in bbs100 before 3.2 allow remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving certain v*printf and shift_StringIO functions. NOTE: some details were obtained from third party information.

[CLOSE] OSVDB ID : 41635 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : SlackRoll before 8 accepts gpg exit codes other than 0 and 1 as evidence of a valid signature, which allows remote Slackware mirror sites or man-in-the-middle attackers to cause a denial of service (data inconsistency) or possibly install Trojan horse packages via malformed gpg signatures.

[CLOSE] OSVDB ID : 37750 - Disclosed: 2007-06-22

Description:

access2asp contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'od' and 'search' variables upon submission to the suppliersList.asp script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 37751 - Disclosed: 2007-06-22

Description:

access2asp contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'od' and 'search' variables upon submission to the contactsList.asp script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 37614 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Xythos Enterprise Document Manager (XEDM), Digital Locker (XDL), and possibly WebFile Server before 6.0.46.1 allow remote authenticated users to associate arbitrary Content-Type HTTP headers with documents, which might facilitate malware distribution.

[CLOSE] OSVDB ID : 37615 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Multiple cross-site request forgery (CSRF) vulnerabilities in Xythos Enterprise Document Manager (XEDM) before 5.0.25.8, and 6.x before 6.0.46.1, allow remote authenticated users to execute commands as arbitrary users via (1) a saved Workflow name or (2) the Content-Type HTTP header. NOTE: item 2 also affects the same version numbers of Xythos Digital Locker (XDL). One or both vectors might also affect Xythos WebFile Server.

[CLOSE] OSVDB ID : 37616 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Multiple cross-site request forgery (CSRF) vulnerabilities in Xythos Enterprise Document Manager (XEDM) before 5.0.25.8, and 6.x before 6.0.46.1, allow remote authenticated users to execute commands as arbitrary users via (1) a saved Workflow name or (2) the Content-Type HTTP header. NOTE: item 2 also affects the same version numbers of Xythos Digital Locker (XDL). One or both vectors might also affect Xythos WebFile Server.

[CLOSE] OSVDB ID : 37621 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in Xythos Enterprise Document Manager (XEDM) before 5.0.25.8, and 6.x before 6.0.46.1, allow remote authenticated users to inject arbitrary web script or HTML via (1) a saved Workflow name; (2) a Workflow name, related to deletion of a Workflow template; (3) the Content-Type HTTP header; or (4) the name of an uploaded file. NOTE: items 3 and 4 also affect the same version numbers of Xythos Digital Locker (XDL). Some or all vectors might also affect Xythos WebFile Server.

[CLOSE] OSVDB ID : 37622 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in Xythos Enterprise Document Manager (XEDM) before 5.0.25.8, and 6.x before 6.0.46.1, allow remote authenticated users to inject arbitrary web script or HTML via (1) a saved Workflow name; (2) a Workflow name, related to deletion of a Workflow template; (3) the Content-Type HTTP header; or (4) the name of an uploaded file. NOTE: items 3 and 4 also affect the same version numbers of Xythos Digital Locker (XDL). Some or all vectors might also affect Xythos WebFile Server.

[CLOSE] OSVDB ID : 37623 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in Xythos Enterprise Document Manager (XEDM) before 5.0.25.8, and 6.x before 6.0.46.1, allow remote authenticated users to inject arbitrary web script or HTML via (1) a saved Workflow name; (2) a Workflow name, related to deletion of a Workflow template; (3) the Content-Type HTTP header; or (4) the name of an uploaded file. NOTE: items 3 and 4 also affect the same version numbers of Xythos Digital Locker (XDL). Some or all vectors might also affect Xythos WebFile Server.

[CLOSE] OSVDB ID : 37624 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in Xythos Enterprise Document Manager (XEDM) before 5.0.25.8, and 6.x before 6.0.46.1, allow remote authenticated users to inject arbitrary web script or HTML via (1) a saved Workflow name; (2) a Workflow name, related to deletion of a Workflow template; (3) the Content-Type HTTP header; or (4) the name of an uploaded file. NOTE: items 3 and 4 also affect the same version numbers of Xythos Digital Locker (XDL). Some or all vectors might also affect Xythos WebFile Server.

[CLOSE] OSVDB ID : 37507 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : The Avahi daemon in Avahi before 0.6.20 allows attackers to cause a denial of service (exit) via empty TXT data over D-Bus, which triggers an assert error.

[CLOSE] OSVDB ID : 35860 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in Simple CGI Wrapper (scgiwrap) in cPanel before 10.9.1, and 11.x before 11.4.19-R14378, allows remote attackers to inject arbitrary web script or HTML via the URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

[CLOSE] OSVDB ID : 35861 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Simple CGI Wrapper (scgiwrap) in cPanel before 10.9.1, and 11.x before 11.4.19-R14378, allows remote attackers to obtain sensitive information via a direct request, which reveals the path in an error message. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

[CLOSE] OSVDB ID : 36281 - Disclosed: 2007-06-22

Description:

Sun Board contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'include.php' script not properly sanitizing user input supplied to the 'sunPath' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 36282 - Disclosed: 2007-06-22

Description:

Sun Board contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'skin/board/default/doctype.php' script not properly sanitizing user input supplied to the 'dir' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 36325 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Multiple PHP remote file inclusion vulnerabilities in SerWeb 0.9.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the _SERWEB[serwebdir] parameter to (1) html/load_apu.php or (2) html/mail_prepend.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

[CLOSE] OSVDB ID : 36326 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Multiple PHP remote file inclusion vulnerabilities in SerWeb 0.9.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the _SERWEB[serwebdir] parameter to (1) html/load_apu.php or (2) html/mail_prepend.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

[CLOSE] OSVDB ID : 36368 - Disclosed: 2007-06-22

Description:

Powl contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'plugins/widgets/htmledit/htmledit.php' script not properly sanitizing user input supplied to the '_POWL[installPath]' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 36721 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Buffer overflow in Warzone 2100 Resurrection before 2.0.7 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long filename when setting background music.

[CLOSE] OSVDB ID : 38222 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in index.php in phpRaider 1.0.0 rc8 allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) type parameter.

[CLOSE] OSVDB ID : 38226 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in bosDataGrid 2.50 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) GridSearch, (2) gsearch, or (3) ParentID parameter to an unspecified component.

[CLOSE] OSVDB ID : 38227 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in eNdonesia 8.4 allow remote attackers to execute arbitrary SQL commands via the (1) artid parameter to mod.php in a viewarticle action (publisher mod) and the (2) bid parameter to banners.php in a click action. NOTE: the mod.php viewdisk and viewlink vectors are already covered by CVE-2006-6873.

[CLOSE] OSVDB ID : 38228 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in eNdonesia 8.4 allow remote attackers to execute arbitrary SQL commands via the (1) artid parameter to mod.php in a viewarticle action (publisher mod) and the (2) bid parameter to banners.php in a click action. NOTE: the mod.php viewdisk and viewlink vectors are already covered by CVE-2006-6873.

[CLOSE] OSVDB ID : 41644 - Disclosed: 2007-06-22

Description:

(Description Provided by CVE) : The web container in IBM WebSphere Application Server (WAS) before 6.0.2.21, and 6.1.x before 6.1.0.9, sends response data intended for a different request in certain circumstances after a closed connection error, which might allow remote attackers to obtain sensitive information.

[CLOSE] OSVDB ID : 42189 - Disclosed: 2007-06-21

Description:

(Description Provided by CVE) : Integer overflow in the __status_Update function in stats.c VideoLAN VLC Media Player before 0.8.6c allows remote attackers to cause a denial of service (crash) via a WAV file with a large sample rate.