[CLOSE] OSVDB ID : 62724 - Disclosed: 2009-12-16

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 63027 - Disclosed: 2009-12-16

Description:

(Description Provided by CVE) : Unspecified vulnerability in the ClickHeat plugin, as used in phpMyVisites before 2.4, has unknown impact and attack vectors. NOTE: due to lack of details from the vendor, it is not clear whether this is related to CVE-2008-5793.

[CLOSE] OSVDB ID : 64510 - Disclosed: 2009-12-16

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61055 - Disclosed: 2009-12-15

Description:

daloRADIUS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'error' parameter upon submission to the 'daloradius-users/login.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61211 - Disclosed: 2009-12-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 67684 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : The Relational Data Services component in IBM DB2 9.5 before FP5 allows attackers to obtain the password argument from the SET ENCRYPTION PASSWORD statement via vectors involving the GET SNAPSHOT FOR DYNAMIC SQL command.

[CLOSE] OSVDB ID : 61049 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.

[CLOSE] OSVDB ID : 61305 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.

[CLOSE] OSVDB ID : 61306 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.

[CLOSE] OSVDB ID : 61308 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.

[CLOSE] OSVDB ID : 67680 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : Unspecified vulnerability in the DRDA Services component in IBM DB2 9.5 before FP5 allows remote authenticated users to cause a denial of service (server trap) by calling a SQL stored procedure in unknown circumstances.

[CLOSE] OSVDB ID : 67681 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : Unspecified vulnerability in the Engine Utilities component in IBM DB2 9.5 before FP5 allows remote authenticated users to cause a denial of service (segmentation fault) by modifying the db2ra data stream sent in a request from the Load Utility.

[CLOSE] OSVDB ID : 67682 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : Unspecified vulnerability in db2licm in the Engine Utilities component in IBM DB2 9.5 before FP5 has unknown impact and local attack vectors.

[CLOSE] OSVDB ID : 67683 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : The Install component in IBM DB2 9.5 before FP5 and 9.7 before FP1 configures the High Availability (HA) scripts with incorrect file-permission and authorization settings, which has unknown impact and local attack vectors.

[CLOSE] OSVDB ID : 63325 - Disclosed: 2009-12-15

Description:

IntelliCom NetBiterConfig utility version 1.3.0 and earlier are prone to an overflow condition. The NetBiterConfig utility fails to properly sanitize user-supplied input (e.g., a hostname of 0x60 bytes) resulting in a stack-based overflow. With a specially crafted HICP-protocol UDP packet., a remote attacker can potentially cause the affected application to crash or execute arbitrary code.

[CLOSE] OSVDB ID : 60980 - Disclosed: 2009-12-15

Description:

Acrobat and Reader contain a flaw that may allow an attacker to execute arbitrary code. The issue is triggered by a use-after-free condition in Doc.media.newPlayer when parsing a specially crafted PDF file.

[CLOSE] OSVDB ID : 61023 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : Unspecified vulnerability in the Watchdog (aba_watchdog) extension 2.0.2 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.

[CLOSE] OSVDB ID : 61024 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in the ListMan (nl_listman) extension 1.2.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

[CLOSE] OSVDB ID : 60984 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : Directory traversal vulnerability in Pforum.php in Rocomotion P forum before 1.28 allows remote attackers to read arbitrary files via directory traversal sequences in unspecified vectors.

[CLOSE] OSVDB ID : 61043 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) phpshell.php, (2) cmdshell.php, or (3) sqlshell.php in admin/, related to the PHP_SELF variable.

[CLOSE] OSVDB ID : 61180 - Disclosed: 2009-12-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61050 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : Multiple cross-site request forgery (CSRF) vulnerabilities in PyForum 1.0.3 and possibly earlier versions, and possibly zForum, allow remote attackers to hijack the authentication of victims for requests that change passwords, and other unspecified requests, via unknown vectors.

[CLOSE] OSVDB ID : 61053 - Disclosed: 2009-12-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61054 - Disclosed: 2009-12-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61057 - Disclosed: 2009-12-15

Description:

Linkster contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'linkster.php' script not properly sanitizing user-supplied input to the 'CID' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 61051 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in models.parser in PyForum 1.0.3 and possibly earlier versions, and possibly zForum, allow remote attackers to inject arbitrary web script or HTML via crafted BBcode (1) img or (2) url tags, which are not properly handled when a post is viewed.

[CLOSE] OSVDB ID : 61061 - Disclosed: 2009-12-15

Description:

SitioOnline contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'lista_articulos.php' script not properly sanitizing user-supplied input to the 'id_categoria' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 61062 - Disclosed: 2009-12-15

Description:

SitioOnline contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'detalle_articulo.php' script not properly sanitizing user-supplied input to the 'id_producto' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 61134 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : CQWeb (aka the web interface) in IBM Rational ClearQuest before 7.1.1 does not properly handle use of legacy URLs for automatic login, which might allow attackers to discover the passwords for user accounts via unspecified vectors.

[CLOSE] OSVDB ID : 61115 - Disclosed: 2009-12-15

Description:

Ez Faq Maker contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'sid' parameter upon submission to the 'index.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61157 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : The D-Link DIR-615 with firmware 3.10NA does not require administrative authentication for apply.cgi, which allows remote attackers to (1) change the admin password via the admin_password parameter, (2) disable the security requirement for the Wi-Fi network via unspecified vectors, or (3) modify DNS settings via unspecified vectors.

[CLOSE] OSVDB ID : 61143 - Disclosed: 2009-12-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61250 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in the Diocese of Portsmouth Calendar (pd_calendar) extension 0.4.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

[CLOSE] OSVDB ID : 61251 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : SQL injection vulnerability in the Diocese of Portsmouth Calendar (pd_calendar) extension 0.4.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors, a different issue than CVE-2008-6691.

[CLOSE] OSVDB ID : 61252 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : SQL injection vulnerability in the Flash SlideShow (slideshow) extension 0.2.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

[CLOSE] OSVDB ID : 61253 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : SQL injection vulnerability in the Subscription (mf_subscription) extension 0.2.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

[CLOSE] OSVDB ID : 61254 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in the No indexed Search (no_indexed_search) extension 0.2.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

[CLOSE] OSVDB ID : 61255 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : SQL injection vulnerability in the No indexed Search (no_indexed_search) extension 0.2.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

[CLOSE] OSVDB ID : 61256 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : SQL injection vulnerability in the Job Exchange (jobexchange) extension 0.0.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

[CLOSE] OSVDB ID : 61257 - Disclosed: 2009-12-15

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in the Training Company Database (trainincdb) extension 0.4.7 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.