[CLOSE] OSVDB ID : 51167 - Disclosed: 2008-04-15

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in Gallarific Free Edition allow remote attackers to inject arbitrary web script or HTML via (1) the e-mail address, (2) a comment, which is not properly handled during moderation, and (3) the tag parameter to gallery/tags.php.

[CLOSE] OSVDB ID : 51168 - Disclosed: 2008-04-15

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in Gallarific Free Edition allow remote attackers to inject arbitrary web script or HTML via (1) the e-mail address, (2) a comment, which is not properly handled during moderation, and (3) the tag parameter to gallery/tags.php.

[CLOSE] OSVDB ID : 52934 - Disclosed: 2008-04-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 44421 - Disclosed: 2008-04-15

Description:

(Description Provided by CVE) : db2dasrrm in the DB2 Administration Server (DAS) in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to overwrite arbitrary files via a symlink attack on files used for initialization.

[CLOSE] OSVDB ID : 44420 - Disclosed: 2008-04-15

Description:

(Description Provided by CVE) : Stack-based buffer overflow in db2dasrrm in the DB2 Administration Server (DAS) in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to execute arbitrary code via a long DASPROF environment variable.

[CLOSE] OSVDB ID : 44454 - Disclosed: 2008-04-15

Description:

A remote overflow exists in BigAnt IM Server. The AntServer.exe process fails to use bounds checking resulting in a stack overflow. With a specially crafted request, an attacker can execute arbitrary code resulting in a loss of confidentiality, integrity, and/or availability.

[CLOSE] OSVDB ID : 50228 - Disclosed: 2008-04-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 50227 - Disclosed: 2008-04-15

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.3.4 might allow remote attackers to inject arbitrary web script or HTML via (1) new_images.php, (2) login.php, and unspecified vectors.

[CLOSE] OSVDB ID : 44441 - Disclosed: 2008-04-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 44465 - Disclosed: 2008-04-15

Description:

(Description Provided by CVE) : Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two minor security-related bugs."

[CLOSE] OSVDB ID : 44466 - Disclosed: 2008-04-15

Description:

(Description Provided by CVE) : Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two minor security-related bugs."

[CLOSE] OSVDB ID : 44520 - Disclosed: 2008-04-15

Description:

(Description Provided by CVE) : ClamAV before 0.93 allows remote attackers to cause a denial of service (CPU consumption) via a crafted ARJ archive, as demonstrated by the PROTOS GENOME test suite for Archive Formats.

[CLOSE] OSVDB ID : 48865 - Disclosed: 2008-04-15

Description:

(Description Provided by CVE) : cookiecheck.php in CookieCheck 1.0 stores tmp/cc_sessions under the web root with insufficient access control, which allows remote attackers to obtain session data via a direct request related to the "default session save path."

[CLOSE] OSVDB ID : 44374 - Disclosed: 2008-04-15

Description:

(Description Provided by CVE) : Nortel MG1000S, Signaling Server, and Call Server on the Communications Server 1000 (CS1K) 4.50.x contain multiple unspecified hard-coded accounts and passwords, which allows remote attackers to gain privileges.

[CLOSE] OSVDB ID : 44373 - Disclosed: 2008-04-15

Description:

WORK system e-commerce contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate "day", "month", and "year" variables upon submission to the module/main.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 44424 - Disclosed: 2008-04-15

Description:

(Description Provided by CVE) : lib/prefs.tcl in Cecilia 2.0.5 allows local users to overwrite arbitrary files via a symlink attack on the csvers temporary file.

[CLOSE] OSVDB ID : 44402 - Disclosed: 2008-04-15

Description:

A local overflow exists in DivX Player. The video player fails to check bounds on subtitle lines resulting in a stack-based overflow. With a specially crafted SRT file, an attacker can cause arbitrary code execution resulting in a loss of integrity.

[CLOSE] OSVDB ID : 44401 - Disclosed: 2008-04-15

Description:

LASERnet CMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script not properly sanitizing user-supplied input to the 'new' variable and that variable is assigned to the 'id' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 44448 - Disclosed: 2008-04-15

Description:

(Description Provided by CVE) : Integer overflow in the ws_getpostvars function in Firefly Media Server (formerly mt-daapd) 0.2.4.1 (0.9~r1696-1.2 on Debian) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP POST request with a large Content-Length.

[CLOSE] OSVDB ID : 44453 - Disclosed: 2008-04-15

Description:

W2B Online Banking contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'index.php' script not properly sanitizing user input supplied to the 'ilang' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 44541 - Disclosed: 2008-04-15

Description:

(Description Provided by CVE) : SQL injection vulnerability in index.php in Classifieds Caffe allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in an add action. NOTE: this issue might be site-specific.

[CLOSE] OSVDB ID : 44545 - Disclosed: 2008-04-15

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in AMFPHP 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) class parameter to (a) methodTable.php, (b) code.php, and (c) details.php in browser/; and the (2) location parameter to browser/code.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

[CLOSE] OSVDB ID : 44546 - Disclosed: 2008-04-15

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in AMFPHP 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) class parameter to (a) methodTable.php, (b) code.php, and (c) details.php in browser/; and the (2) location parameter to browser/code.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

[CLOSE] OSVDB ID : 44547 - Disclosed: 2008-04-15

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in AMFPHP 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) class parameter to (a) methodTable.php, (b) code.php, and (c) details.php in browser/; and the (2) location parameter to browser/code.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

[CLOSE] OSVDB ID : 44682 - Disclosed: 2008-04-15

Description:

(Description Provided by CVE) : Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing (1) + (plus), (2) %2b (encoded plus), (3) . (dot), (4) %2e (encoded dot), or (5) %20 (encoded space) character in the URI, possibly related to the WEBrick::HTTPServlet::FileHandler and WEBrick::HTTPServer.new functionality and the :DocumentRoot option.

[CLOSE] OSVDB ID : 44986 - Disclosed: 2008-04-15

Description:

(Description Provided by CVE) : Multiple unspecified vulnerabilities in eGroupWare before 1.4.004 have unspecified attack vectors and "grave" impact when the web server has write access to a directory under the web document root.

[CLOSE] OSVDB ID : 45515 - Disclosed: 2008-04-15

Description:

(Description Provided by CVE) : SubSonic allows remote attackers to bypass pagesize limits and cause a denial of service (CPU consumption) via a pageindex (aka data page number) of -1.

[CLOSE] OSVDB ID : 49565 - Disclosed: 2008-04-15

Description:

Istant-Replay contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to 'read.php' not properly sanitizing user input supplied to the 'data' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.

[CLOSE] OSVDB ID : 51683 - Disclosed: 2008-04-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 91098 - Disclosed: 2008-04-15

Description:

IBM WebSphere Application Server (WAS) contains a flaw that may allow a remote denial of service. The issue is triggered during the handling of a GET for an esi:include JSP and waiting for the AppServer response. With a specially crafted request that contains duplicate request headers, a remote attacker can crash the server.

[CLOSE] OSVDB ID : 92723 - Disclosed: 2008-04-15

Description:

Trashbin Plugin for WordPress contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'mtb_undelete' parameter upon submission to the mtb_trashbin/trashbin.php script. This may allow an attacker to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 44380 - Disclosed: 2008-04-14

Description:

(Description Provided by CVE) : Unspecified vulnerability in the "session limitation technique" in the FTP service on Nortel Communications Server 1000 (CS1K) 4.50.x, when running on VGMC or signaling nodes, allows remote attackers to cause a denial of service (resource exhaustion and failed updates) via unknown vectors that causes consumption of all available sessions.

[CLOSE] OSVDB ID : 44379 - Disclosed: 2008-04-14

Description:

(Description Provided by CVE) : Nortel UNIStim protocol, as used in Communication Server 1000 and other products, uses predictable sequence numbers, which allows remote attackers to hijack sessions via sniffing or brute force attacks.

[CLOSE] OSVDB ID : 44377 - Disclosed: 2008-04-14

Description:

(Description Provided by CVE) : Nortel Communication Server 1000 4.50.x allows remote attackers to obtain Web application structure via unknown vectors related to "web resources to phones and administrators."

[CLOSE] OSVDB ID : 44375 - Disclosed: 2008-04-14

Description:

(Description Provided by CVE) : Multiple unspecified vulnerabilities in Nortel Communication Server 1000 4.50.x allow remote attackers to execute arbitrary commands to gain privileges, obtain sensitive information, or cause a denial of service via unknown vectors.

[CLOSE] OSVDB ID : 46090 - Disclosed: 2008-04-14

Description:

(Description Provided by CVE) : Off-by-one error in the ppscan function (preproc.c) in Netwide Assembler (NASM) 2.02 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted file that triggers a stack-based buffer overflow.

[CLOSE] OSVDB ID : 50225 - Disclosed: 2008-04-14

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.3.4 might allow remote attackers to inject arbitrary web script or HTML via (1) new_images.php, (2) login.php, and unspecified vectors.

[CLOSE] OSVDB ID : 50226 - Disclosed: 2008-04-14

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.3.4 might allow remote attackers to inject arbitrary web script or HTML via (1) new_images.php, (2) login.php, and unspecified vectors.

[CLOSE] OSVDB ID : 44519 - Disclosed: 2008-04-14

Description:

(Description Provided by CVE) : Heap-based buffer overflow in spin.c in libclamav in ClamAV 0.92.1 allows remote attackers to execute arbitrary code via a crafted PeSpin packed PE binary with a modified length value.

[CLOSE] OSVDB ID : 44518 - Disclosed: 2008-04-14

Description:

(Description Provided by CVE) : Directory traversal vulnerability in help.php in the eskuel module in KwsPHP 1.3.456, as available before 20080416, allows remote attackers to execute arbitrary commands via the action parameter. NOTE: some of these details are obtained from third party information.