[CLOSE] OSVDB ID : 53247 - Disclosed: 2008-12-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 53306 - Disclosed: 2008-12-31

Description:

(Description Provided by CVE) : An ActiveX control in prtstb06.dll in Microsoft Money 2006, when used with WScript in Windows Script Host (WSH) on Windows Vista, allows remote attackers to cause a denial of service (access violation and application crash) via a zero value for the Startup property.

[CLOSE] OSVDB ID : 53307 - Disclosed: 2008-12-31

Description:

(Description Provided by CVE) : Memory leak in Libxul, as used in Mozilla Firefox 3.0.5 and other products, allows remote attackers to cause a denial of service (memory consumption and browser hang) via a long CLASS attribute in an HR element in an HTML document.

[CLOSE] OSVDB ID : 53308 - Disclosed: 2008-12-31

Description:

(Description Provided by CVE) : Memory leak in WebKit.dll in WebKit, as used by Apple Safari 3.2 on Windows Vista SP1, allows remote attackers to cause a denial of service (memory consumption and browser crash) via a long ALINK attribute in a BODY element in an HTML document.

[CLOSE] OSVDB ID : 51161 - Disclosed: 2008-12-30

Description:

FlexPHPic contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the admin/index.php script not properly sanitizing user-supplied input to the checkuser and checkpass parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51160 - Disclosed: 2008-12-30

Description:

Vacation Script contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the properties_view.php script not properly sanitizing user-supplied input to the editid1 parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 52033 - Disclosed: 2008-12-30

Description:

Sections Module for PHP-Nuke contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'modules.php' script not properly sanitizing user-supplied input to the 'artid' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 59019 - Disclosed: 2008-12-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 51147 - Disclosed: 2008-12-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 51026 - Disclosed: 2008-12-30

Description:

OpenEdit DAM contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'name' parameter upon submission to the 'archive/savedqueries/savequeryfinish.html'. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 51028 - Disclosed: 2008-12-30

Description:

OpenEdit DAM contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate "catalogid" variables upon submission to data/views/index.html. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 51027 - Disclosed: 2008-12-30

Description:

OpenEdit DAM contains a flaw that allows a remote Cross-Site Request Forgery (CSRF / XSRF) attack. The flaw exists because the application does not require multiple steps and/or confirmation for sensitive transactions. By using a crafted URL (e.g. a crafted GET request inside an "img" tag), an attacker may trick the victim into clicking on the image to take advantage of the trust relationship between the authenticated victim and the application. Such an attack could trick the victim into executing arbitrary commands in the context of their session with the application, without further prompting or verification.

[CLOSE] OSVDB ID : 51081 - Disclosed: 2008-12-30

Description:

Pixel8 Web Photo Album contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'Photo.asp' script not properly sanitizing user-supplied input to the 'AlbumID' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51069 - Disclosed: 2008-12-30

Description:

(Description Provided by CVE) : Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile 0.2.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WAV file.

[CLOSE] OSVDB ID : 51118 - Disclosed: 2008-12-30

Description:

CMScout contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'id' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51106 - Disclosed: 2008-12-30

Description:

(Description Provided by CVE) : Eval injection vulnerability in Megacubo 5.0.7 allows remote attackers to inject and execute arbitrary PHP code via the play action in a mega:// URI.

[CLOSE] OSVDB ID : 51119 - Disclosed: 2008-12-30

Description:

CMScout contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'admin.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'bit' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 51120 - Disclosed: 2008-12-30

Description:

CMScout contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'index.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'bit' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 53294 - Disclosed: 2008-12-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 51015 - Disclosed: 2008-12-29

Description:

webClassifieds contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script, when the page parameter is set to "sign_in", not properly sanitizing user-supplied input to the password variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51013 - Disclosed: 2008-12-29

Description:

eDNews contains a flaw that allows a remote attacker to view local files outside of the web path. The issue is due to the 'eDNews_archive.php' not properly sanitizing user input, specifically directory traversal style attacks (../../) supplied via the 'lg' parameter.

[CLOSE] OSVDB ID : 51014 - Disclosed: 2008-12-29

Description:

eDNews contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the eDNews_view.php script not properly sanitizing user-supplied input to the newsid parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51054 - Disclosed: 2008-12-29

Description:

Sepcity Shopping Mall contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the shpdetails.php script not properly sanitizing user-supplied input to the ID Parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51012 - Disclosed: 2008-12-29

Description:

eDContainer contains a flaw that allows a remote attacker to view local files outside of the web path. The issue is due to the index.php not properly sanitizing user input, specifically directory traversal style attacks (../../) supplied via the lg parameter.

[CLOSE] OSVDB ID : 51055 - Disclosed: 2008-12-29

Description:

Sepcity Classified Ads contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the classdis.asp script not properly sanitizing user-supplied input to the ID Parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 53281 - Disclosed: 2008-12-29

Description:

(Description Provided by CVE) : ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to obtain sensitive information via a URL in the POST_DATA parameter to manuals_search.php, which reveals the installation path in an error message.

[CLOSE] OSVDB ID : 53282 - Disclosed: 2008-12-29

Description:

(Description Provided by CVE) : ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to obtain sensitive information via an unauthenticated add and save action for a shopping cart in cart_save.php, which reveals the SQL table names in an error message, related to code that mishandles the lack of a user_id parameter.

[CLOSE] OSVDB ID : 53283 - Disclosed: 2008-12-29

Description:

ViArt Shop contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'cart_name' parameter upon submission to the 'cart_save.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 53284 - Disclosed: 2008-12-29

Description:

ViArt Shop contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'manuals_search' parameter upon submission to the 'manuals_search.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 53285 - Disclosed: 2008-12-29

Description:

(Description Provided by CVE) : cart_save.php in ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to cause a denial of service (excessive shopping carts) via a flood of requests.

[CLOSE] OSVDB ID : 51011 - Disclosed: 2008-12-29

Description:

Ultimate PHP Board contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the User-Agent Header. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 51056 - Disclosed: 2008-12-29

Description:

Sepcity Faculty Portal contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the deptdisplay.asp script not properly sanitizing user-supplied input to the ID Parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 55708 - Disclosed: 2008-12-29

Description:

NetCat contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'modules/poll/index.php' script not properly sanitizing user-supplied input to the 'PollID' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51029 - Disclosed: 2008-12-29

Description:

(Description Provided by CVE) : Cross-site request forgery (CSRF) vulnerability in cart_save.php in ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to hijack the authentication of arbitrary users for requests that conduct persistent cross-site scripting (XSS) attacks via the cart_name parameter in a save action.

[CLOSE] OSVDB ID : 51302 - Disclosed: 2008-12-29

Description:

FlexPHPDirectory contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the admin/usercheck.php script not properly sanitizing user-supplied input to the 'checkuser' and 'checkpass' parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 51034 - Disclosed: 2008-12-29

Description:

FlexPHPSite contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the admin/index.php script not properly sanitizing user-supplied input to the 'checkuser' and 'checkpass' parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 51143 - Disclosed: 2008-12-29

Description:

(Description Provided by CVE) : Unrestricted file upload vulnerability in admin/galeria.php in ThePortal2 2.2 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in galeria/.

[CLOSE] OSVDB ID : 51053 - Disclosed: 2008-12-29

Description:

PHP-Fusion contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate unspecified parameters upon submission to the messages.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 51139 - Disclosed: 2008-12-29

Description:

phpAlumni contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'Acomment.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51261 - Disclosed: 2008-12-29

Description:

(Description Provided by CVE) : Stack-based buffer overflow in IntelliTamper 2.07 and 2.08 allows user-assisted attackers to execute arbitrary code via a long ProxyLogin value in a configuration (.cfg) file.