[CLOSE] OSVDB ID : 47294 - Disclosed: 2008-05-31

Description:

An unspecified memory coruption flaw exists in Firebird. With a specially crafted 'EXECUTE STATEMENT,' an attacker can cause a server crash resulting in a loss of availability.

[CLOSE] OSVDB ID : 45853 - Disclosed: 2008-05-31

Description:

(Description Provided by CVE) : Directory traversal vulnerability in passwiki.php in PassWiki 0.9.16 RC3 and earlier allows remote attackers to read arbitrary local files via a .. (dot dot) in the site_id parameter.

[CLOSE] OSVDB ID : 45856 - Disclosed: 2008-05-31

Description:

PrayerCenter Component for Joomla contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index2.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 45867 - Disclosed: 2008-05-31

Description:

A remote overflow exists in freeSSHd. The freeSSHd fails to check the bounds on the opendir variable resulting in a stack overflow. With a specially crafted request, an attacker can cause the execution of arbitrary code resulting in a loss of integrity, and/or availability.

[CLOSE] OSVDB ID : 45859 - Disclosed: 2008-05-31

Description:

Social Site Generator contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'display_blog.php' script not properly sanitizing user-supplied input to the 'sgc_id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 45858 - Disclosed: 2008-05-31

Description:

TorrentTrader contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'scrape.php' script not properly sanitizing user-supplied input to the 'info_hash' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 45866 - Disclosed: 2008-05-31

Description:

(Description Provided by CVE) : LokiCMS 0.3.4 and possibly earlier versions does not properly restrict access to administrative functions, which allows remote attackers to bypass intended restrictions and modify configuration settings via the LokiACTION parameter in a direct request to admin.php.

[CLOSE] OSVDB ID : 45860 - Disclosed: 2008-05-31

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in Social Site Generator (SSG) 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) sgc_id parameter to display_blog.php, (2) scm_mem_id parameter to social_my_profile_download.php, and the (3) catid parameter to social_forum_subcategories.php.

[CLOSE] OSVDB ID : 45861 - Disclosed: 2008-05-31

Description:

Social Site Generator contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'social_forum_subcategories.php' script not properly sanitizing user-supplied input to the 'catid' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 45862 - Disclosed: 2008-05-31

Description:

(Description Provided by CVE) : Social Site Generator (SSG) 2.0 allows remote attackers to read arbitrary files via the file parameter to (1) filedload.php, (2) webadmin/download.php, and (3) webadmin/download_file.php.

[CLOSE] OSVDB ID : 45863 - Disclosed: 2008-05-31

Description:

(Description Provided by CVE) : Social Site Generator (SSG) 2.0 allows remote attackers to read arbitrary files via the file parameter to (1) filedload.php, (2) webadmin/download.php, and (3) webadmin/download_file.php.

[CLOSE] OSVDB ID : 45864 - Disclosed: 2008-05-31

Description:

(Description Provided by CVE) : Social Site Generator (SSG) 2.0 allows remote attackers to read arbitrary files via the file parameter to (1) filedload.php, (2) webadmin/download.php, and (3) webadmin/download_file.php.

[CLOSE] OSVDB ID : 45865 - Disclosed: 2008-05-31

Description:

Social Site Generator contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'social_game_play.php' script not properly sanitizing user input supplied to the 'path' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 45868 - Disclosed: 2008-05-31

Description:

PsychoStats contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'weapon.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 45869 - Disclosed: 2008-05-31

Description:

PsychoStats contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'map.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 45910 - Disclosed: 2008-05-31

Description:

Bible Study Component for Joomla! contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 45911 - Disclosed: 2008-05-31

Description:

OtomiGenX contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'userAccount' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 45980 - Disclosed: 2008-05-31

Description:

BP Blog contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'template_permalink.asp' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 45981 - Disclosed: 2008-05-31

Description:

BP Blog contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'template_archives_cat.asp' script not properly sanitizing user-supplied input to the 'cat' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 48856 - Disclosed: 2008-05-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 88037 - Disclosed: 2008-05-31

Description:

phpTraffic Acontains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the Php/Functions/log_function.php not properly sanitizing user-supplied input before using it in SQL queries. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 45892 - Disclosed: 2008-05-30

Description:

(Description Provided by CVE) : Apple Safari on Mac OS X, and before 3.1.2 on Windows, does not prompt the user before downloading an object that has an unrecognized content type, which allows remote attackers to place malware into the (1) Desktop directory on Windows or (2) Downloads directory on Mac OS X, and subsequently allows remote attackers to execute arbitrary code on Windows by leveraging an untrusted search path vulnerability in (a) Internet Explorer 7 on Windows XP or (b) the SearchPath function in Windows XP, Vista, and Server 2003 and 2008, aka a "Carpet Bomb" and a "Blended Threat Elevation of Privilege Vulnerability," a different issue than CVE-2008-1032. NOTE: Apple considers this a vulnerability only because the Microsoft products can load application libraries from the desktop and, as of 20080619, has not covered the issue in an advisory for Mac OS X.

[CLOSE] OSVDB ID : 45890 - Disclosed: 2008-05-30

Description:

(Description Provided by CVE) : Heap-based buffer overflow in the VMware Host Guest File System (HGFS) in VMware Workstation 6 before 6.0.4 build 93057, VMware Player 2 before 2.0.4 build 93057, VMware ACE 2 before 2.0.2 build 93057, and VMware Fusion before 1.1.2 build 87978, when folder sharing is used, allows guest OS users to execute arbitrary code on the host OS via unspecified vectors.

[CLOSE] OSVDB ID : 45891 - Disclosed: 2008-05-30

Description:

(Description Provided by CVE) : Unspecified vulnerability in VMCI in VMware Workstation 6 before 6.0.4 build 93057, VMware Player 2 before 2.0.4 build 93057, and VMware ACE 2 before 2.0.2 build 93057 on Windows allows guest OS users to execute arbitrary code on the host OS via unspecified vectors.

[CLOSE] OSVDB ID : 51439 - Disclosed: 2008-05-30

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in Opencosmo VisualSentinel 0.7 allows remote attackers to inject arbitrary web script or HTML via the User-Agent header ($_SERVER ['HTTP_USER_AGENT']), which is not properly handled when displaying log files.

[CLOSE] OSVDB ID : 45893 - Disclosed: 2008-05-30

Description:

(Description Provided by CVE) : Plugin/passwordauth.pm (aka the passwordauth plugin) in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence.

[CLOSE] OSVDB ID : 45883 - Disclosed: 2008-05-30

Description:

(Description Provided by CVE) : The Sun Cluster Global File System in Sun Cluster 3.1 on Sun Solaris 8 through 10, when an underlying ufs filesystem is used, might allow local users to read data from arbitrary deleted files, or corrupt files in global filesystems, via unspecified vectors.

[CLOSE] OSVDB ID : 45884 - Disclosed: 2008-05-30

Description:

(Description Provided by CVE) : The Sun Cluster Global File System in Sun Cluster 3.1 on Sun Solaris 8 through 10, when an underlying ufs filesystem is used, might allow local users to read data from arbitrary deleted files, or corrupt files in global filesystems, via unspecified vectors.

[CLOSE] OSVDB ID : 88036 - Disclosed: 2008-05-30

Description:

IBM WebSphere Message Broker contains an unspecified flaw. No further details have been provided.

[CLOSE] OSVDB ID : 45729 - Disclosed: 2008-05-30

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in Kent Web Mart 1.61 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

[CLOSE] OSVDB ID : 45734 - Disclosed: 2008-05-30

Description:

DVBBS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'login.asp' script not properly sanitizing user-supplied input to the 'username' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 45857 - Disclosed: 2008-05-30

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in Default.aspx in DotNetNuke 4.8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

[CLOSE] OSVDB ID : 45916 - Disclosed: 2008-05-30

Description:

HiveMaker Professional contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'cid' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 45955 - Disclosed: 2008-05-30

Description:

CMS Easyway contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'mid' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 45978 - Disclosed: 2008-05-30

Description:

PHP Visit Counter contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'read.php' script not properly sanitizing user-supplied input to the 'datespan' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 45979 - Disclosed: 2008-05-30

Description:

EasyWay CMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'mid' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 55777 - Disclosed: 2008-05-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 53510 - Disclosed: 2008-05-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 53511 - Disclosed: 2008-05-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 45723 - Disclosed: 2008-05-29

Description:

(Description Provided by CVE) : The default configuration of consolehelper in system-config-network before 1.5.10-1 on Fedora 8 lacks the USER=root directive, which allows local users of the workstation console to gain privileges and change the network configuration.