[CLOSE] OSVDB ID : 64891 - Disclosed: 2009-12-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 64893 - Disclosed: 2009-12-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61391 - Disclosed: 2009-12-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61393 - Disclosed: 2009-12-31

Description:

(Description Provided by CVE) : admin.php in dB Masters Multimedia Links Directory 3.1.3 allows remote attackers to bypass authentication and gain administrative access via a certain value of the admin_log cookie.

[CLOSE] OSVDB ID : 61402 - Disclosed: 2009-12-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61392 - Disclosed: 2009-12-31

Description:

FlashChat contains a flaw that may lead to an unauthorized information disclosure.  The issue is triggered when the attacker views the [chat_dir]/phpinfo.php script, which will disclose the server's phpinfo information to a remote attacker.

[CLOSE] OSVDB ID : 61394 - Disclosed: 2009-12-31

Description:

iDevAffiliate contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'payable' parameter upon submission to the 'signup.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61398 - Disclosed: 2009-12-31

Description:

PicMe contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the URL upon submission to the 'admin/banner.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61396 - Disclosed: 2009-12-31

Description:

UranyumSoft contains a flaw that may lead to an unauthorized information disclosure.  The issue is triggered when a malicious hacker requests the file "database/db.mdb" via browser, which will disclose the whole database to a remote attacker.

[CLOSE] OSVDB ID : 61400 - Disclosed: 2009-12-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61401 - Disclosed: 2009-12-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61445 - Disclosed: 2009-12-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61449 - Disclosed: 2009-12-31

Description:

HLstatsX contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'hlstats.php' script not properly sanitizing user-supplied input to the 'award' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 61453 - Disclosed: 2009-12-31

Description:

XOOPS PM module contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the op parameter upon submission to the 'modules/pm/readpmsg.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61454 - Disclosed: 2009-12-31

Description:

XOOPS news module contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'include/notification_update.php' script not properly sanitizing user-supplied input to the 'not_list' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 82826 - Disclosed: 2009-12-31

Description:

OpenConnect contains a flaw related to the NetworkManager that may allow a remote denial of service. The issue is triggered when a use-after-free error occurs within the authentication dialog, and will result in loss of availability for the program.

[CLOSE] OSVDB ID : 61459 - Disclosed: 2009-12-30

Description:

PDF-XChange Viewer contains a flaw that may allow an attacker to execute arbitrary code. The issue is triggered when PDFXCview.exe experiences an input validation error when processing a specially crafted PDF file.

[CLOSE] OSVDB ID : 61388 - Disclosed: 2009-12-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61389 - Disclosed: 2009-12-30

Description:

phpAuction contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'TPL_name','TPL_nick','TPL_email','TPL_birthdate','TPL_address','TPL_city','TPL_prov','TPL_zip' and 'TPL_phone' parameter upon submission to the register.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61385 - Disclosed: 2009-12-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61390 - Disclosed: 2009-12-30

Description:

Despe FreeCell contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'col1', 'col2', 'col3', 'col4', 'col5', 'col6', 'col7', 'col8', 'as21', 'as22', 'as23', 'as24', 'res11', 'res12', 'res13', and 'res14' parameters upon submission to the 'solitaire.php' script when 'nbcoup' is set to a number between 1 and 9. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61399 - Disclosed: 2009-12-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61397 - Disclosed: 2009-12-30

Description:

I-Escorts Directory contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'country_escorts.php' script not properly sanitizing user-supplied input to the 'country_id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 61561 - Disclosed: 2009-12-30

Description:

Artist avenue Component for Mambo / Joomla! contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'Itemid' parameter upon submission to the 'index.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61563 - Disclosed: 2009-12-30

Description:

RoseOnlineCMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'modules/admincp.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'admin' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 61564 - Disclosed: 2009-12-30

Description:

Dictionary Module for XOOPS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'detail.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 61386 - Disclosed: 2009-12-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61380 - Disclosed: 2009-12-29

Description:

CommonSense CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'q' parameter upon submission to the 'search.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61424 - Disclosed: 2009-12-29

Description:

AproxEngine contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script not properly sanitizing user-supplied input to the 'login', 'password', 'art', 'Referer', 'from', 'generator', 'author', 'description', 'keywords', 'mail' and 'betreff' parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 61384 - Disclosed: 2009-12-29

Description:

phpFK PHP Forum ohne contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'search' parameter upon submission to the 'search.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61387 - Disclosed: 2009-12-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61381 - Disclosed: 2009-12-29

Description:

Helpdesk Pilot contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'knowledgebase.php' script not properly sanitizing user-supplied input to the 'article_id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 61395 - Disclosed: 2009-12-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61419 - Disclosed: 2009-12-29

Description:

(Description Provided by CVE) : inc/functions_time.php in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, allows remote attackers to cause a denial of service (CPU consumption) via a crafted request with a large year value, which triggers a long loop, as reachable through member.php and possibly other vectors.

[CLOSE] OSVDB ID : 61425 - Disclosed: 2009-12-29

Description:

AproxEngine contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the login and password parameters upon submission to the index.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61426 - Disclosed: 2009-12-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61427 - Disclosed: 2009-12-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61428 - Disclosed: 2009-12-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61652 - Disclosed: 2009-12-29

Description:

(Description Provided by CVE) : Multiple unspecified vulnerabilities in Visualization Library before 2009.08.812 have unknown impact and attack vectors.

[CLOSE] OSVDB ID : 63881 - Disclosed: 2009-12-29

Description:

Unknown / Incomplete