[CLOSE] OSVDB ID : 46821 - Disclosed: 2008-06-21

Description:

(Description Provided by CVE) : SQL injection vulnerability in item.php in PHPAuction 3.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

[CLOSE] OSVDB ID : 46849 - Disclosed: 2008-06-21

Description:

(Description Provided by CVE) : SQL injection vulnerability in index.php in KbLance allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a comment action.

[CLOSE] OSVDB ID : 48114 - Disclosed: 2008-06-21

Description:

(Description Provided by CVE) : Integer overflow in the sctp_getsockopt_local_addrs_old function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) functionality in the Linux kernel before 2.6.25.9 allows local users to cause a denial of service (resource consumption and system outage) via vectors involving a large addr_num field in an sctp_getaddrs_old data structure.

[CLOSE] OSVDB ID : 77236 - Disclosed: 2008-06-21

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 46540 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Stack-based buffer overflow in NConvert 4.92, GFL SDK 2.82, and XnView 1.93.6 on Windows and 1.70 on Linux and FreeBSD allows user-assisted remote attackers to execute arbitrary code via a crafted format keyword in a Sun TAAC file.

[CLOSE] OSVDB ID : 46541 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Stack-based buffer overflow in NConvert 4.92, GFL SDK 2.82, and XnView 1.93.6 on Windows and 1.70 on Linux and FreeBSD allows user-assisted remote attackers to execute arbitrary code via a crafted format keyword in a Sun TAAC file.

[CLOSE] OSVDB ID : 46539 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Stack-based buffer overflow in NConvert 4.92, GFL SDK 2.82, and XnView 1.93.6 on Windows and 1.70 on Linux and FreeBSD allows user-assisted remote attackers to execute arbitrary code via a crafted format keyword in a Sun TAAC file.

[CLOSE] OSVDB ID : 46563 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : The rmtree function in lib/File/Path.pm in Perl 5.10 does not properly check permissions before performing a chmod, which allows local users to modify the permissions of arbitrary files via a symlink attack, a different vulnerability than CVE-2005-0448 and CVE-2004-0452.

[CLOSE] OSVDB ID : 46537 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Directory traversal vulnerability in the FTP client in AceBIT WISE-FTP 4.1.0 and 5.5.8 allows remote FTP servers to create or overwrite arbitrary files via a ..\ (dot dot backslash) in a response to a LIST command, a related issue to CVE-2002-1345.

[CLOSE] OSVDB ID : 46538 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Directory traversal vulnerability in the FTP client in NCH Software Classic FTP 1.02 for Windows allows remote FTP servers to create or overwrite arbitrary files via a .. (dot dot) in a response to a LIST command, a related issue to CVE-2002-1345.

[CLOSE] OSVDB ID : 46550 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Multiple integer overflows in the rb_str_buf_append function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors that trigger memory corruption, a different issue than CVE-2008-2663, CVE-2008-2664, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. This CVE description should be regarded as authoritative, although it is likely to change.

[CLOSE] OSVDB ID : 46551 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Multiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors, a different issue than CVE-2008-2662, CVE-2008-2664, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.

[CLOSE] OSVDB ID : 46552 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : The rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger memory corruption via unspecified vectors related to alloca, a different issue than CVE-2008-2662, CVE-2008-2663, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.

[CLOSE] OSVDB ID : 46553 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22; and (2) the rb_ary_replace function in 1.6.x allows context-dependent attackers to trigger memory corruption via unspecified vectors, aka the "REALLOC_N" variant, a different issue than CVE-2008-2662, CVE-2008-2663, and CVE-2008-2664. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.

[CLOSE] OSVDB ID : 46554 - Disclosed: 2008-06-20

Description:

A buffer overflow exists in Ruby. The rb_ary_splice function fails to validate unspecified data resulting in an integer overflow. With a specially crafted request, a context-dependent attacker can cause arbitrary code execution resulting in a loss of integrity.

[CLOSE] OSVDB ID : 46459 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) topic and (2) button parameters to ansFAQ.asp and the (3) id and (4) txtEmail parameters to login.asp.

[CLOSE] OSVDB ID : 46460 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) topic and (2) button parameters to ansFAQ.asp and the (3) id and (4) txtEmail parameters to login.asp.

[CLOSE] OSVDB ID : 46461 - Disclosed: 2008-06-20

Description:

eLineStudio Site Composer contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'ansFAQ.asp' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 46462 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Multiple absolute path traversal vulnerabilities in eLineStudio Site Composer (ESC) 2.6 allow remote attackers to create or delete arbitrary directories via a full pathname in the inpCurrFolder parameter to (1) folderdel_.asp or (2) foldernew.asp in cms/assetmanager/.

[CLOSE] OSVDB ID : 46463 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Multiple absolute path traversal vulnerabilities in eLineStudio Site Composer (ESC) 2.6 allow remote attackers to create or delete arbitrary directories via a full pathname in the inpCurrFolder parameter to (1) folderdel_.asp or (2) foldernew.asp in cms/assetmanager/.

[CLOSE] OSVDB ID : 46473 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Directory traversal vulnerability in index.php in chaozz@work FubarForum 1.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.

[CLOSE] OSVDB ID : 46481 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : SQL injection vulnerability in index.php in eMuSOFT emuCMS 0.3 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a category action.

[CLOSE] OSVDB ID : 46503 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : SQL injection vulnerability in links-extern.php in CiBlog 3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

[CLOSE] OSVDB ID : 46521 - Disclosed: 2008-06-20

Description:

eTicket contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'pri' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 46522 - Disclosed: 2008-06-20

Description:

eTicket contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'open.php' script not properly sanitizing user-supplied input to the 'pri' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 46523 - Disclosed: 2008-06-20

Description:

eTicket contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'open_raw.php' script not properly sanitizing user-supplied input to the 'pri' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 46524 - Disclosed: 2008-06-20

Description:

eTicket contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'newticket.php' script not properly sanitizing user-supplied input to the 'pri' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 46640 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Stack-based buffer overflow in tmsnc allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an MSN packet with a UBX command containing a large UBX payload length field.

[CLOSE] OSVDB ID : 46818 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Directory traversal vulnerability in index.php in FireAnt 1.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.

[CLOSE] OSVDB ID : 46846 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in viewforum.php in JaxUltraBB (JUBB) 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the forum parameter.

[CLOSE] OSVDB ID : 46847 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Directory traversal vulnerability in viewprofile.php in JaxUltraBB 2.0 and earlier allows remote attackers to read arbitrary local files via a .. (dot dot) in the user parameter. party information.

[CLOSE] OSVDB ID : 46907 - Disclosed: 2008-06-20

Description:

eLineStudio Site Composer contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'preview.asp' script not properly sanitizing user-supplied input to the 'template_id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 53468 - Disclosed: 2008-06-20

Description:

PHPAuctions contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'PHPAuctions.info' script not properly sanitizing user-supplied input to the 'auction_id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 57814 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Lightweight news portal (LNP) 1.0b does not properly restrict access to administrator functionality, which allows remote attackers to gain administrator privileges via direct requests to admin.php with the (1) potd_delete, (2) potd, (3) vote_update, (4) vote, or (5) modifynews actions.

[CLOSE] OSVDB ID : 57815 - Disclosed: 2008-06-20

Description:

Lightweight news portal (LNP) contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'photo' parameters upon submission to the 'show_photo.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 57816 - Disclosed: 2008-06-20

Description:

Lightweight news portal (LNP) contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'potd' parameters upon submission to the 'show_potd.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 57817 - Disclosed: 2008-06-20

Description:

Lightweight news portal (LNP) contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'Current Question' fields upon submission to the 'admin.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 57877 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in Diigo Toolbar and Diigolet allows remote attackers to inject arbitrary web script or HTML via a public comment.

[CLOSE] OSVDB ID : 57878 - Disclosed: 2008-06-20

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in Diigo Toolbar and Diigolet allows remote attackers to inject arbitrary web script or HTML via a public comment.

[CLOSE] OSVDB ID : 46545 - Disclosed: 2008-06-19

Description:

Unknown / Incomplete