[CLOSE] OSVDB ID : 51585 - Disclosed: 2009-01-25

Description:

WB News contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'news.php' script not properly sanitizing user input supplied to the 'config[installdir]' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 51586 - Disclosed: 2009-01-25

Description:

WB News contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'base/News.php' script not properly sanitizing user input supplied to the 'config[installdir]' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 51587 - Disclosed: 2009-01-25

Description:

WB News contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'base/SendFriend.php' script not properly sanitizing user input supplied to the 'config[installdir]' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 51588 - Disclosed: 2009-01-25

Description:

WB News contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'base/Archive.php' script not properly sanitizing user input supplied to the 'config[installdir]' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 51589 - Disclosed: 2009-01-25

Description:

WB News contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'base/Comments.php' script not properly sanitizing user input supplied to the 'config[installdir]' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 51595 - Disclosed: 2009-01-25

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 51635 - Disclosed: 2009-01-25

Description:

(Description Provided by CVE) : Directory traversal vulnerability in upgrade/index.php in OpenGoo 1.1, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the form_data[script_class] parameter.

[CLOSE] OSVDB ID : 51846 - Disclosed: 2009-01-25

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

[CLOSE] OSVDB ID : 52013 - Disclosed: 2009-01-25

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 52012 - Disclosed: 2009-01-25

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 78773 - Disclosed: 2009-01-24

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 52239 - Disclosed: 2009-01-24

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 52240 - Disclosed: 2009-01-24

Description:

Downloads Module for w3b|cms contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'includes/module/downloads/index.inc.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 52241 - Disclosed: 2009-01-24

Description:

News Module for w3b|cms contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'includes/module/news/index.inc.php' script not properly sanitizing user-supplied input to the 'action' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 52242 - Disclosed: 2009-01-24

Description:

Portfolio Module for w3b|cms contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'includes/module/portfolio/index.inc.php' script not properly sanitizing user-supplied input to the 'action' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 52243 - Disclosed: 2009-01-24

Description:

Partner Module for w3b|cms contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'includes/module/partner/index.inc.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 52244 - Disclosed: 2009-01-24

Description:

Mediathek Module for w3b|cms contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'includes/module/mediathek/index.inc.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 52245 - Disclosed: 2009-01-24

Description:

Sitemap Module for w3b|cms contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'includes/module/sitemap/index.inc.php' script not properly sanitizing user-supplied input to the 'seite' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 52246 - Disclosed: 2009-01-24

Description:

Links Module for w3b|cms contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'includes/module/links/index.inc.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 52247 - Disclosed: 2009-01-24

Description:

Blog Module for w3b|cms contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'includes/module/blog/index.inc.php' script not properly sanitizing user-supplied input to the 'action' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 52248 - Disclosed: 2009-01-24

Description:

Suche Module for w3b|cms contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'includes/module/suche/index.inc.php' script not properly sanitizing user-supplied input to the 'suchbegriff' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 52249 - Disclosed: 2009-01-24

Description:

Gallery Module for w3b|cms contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'includes/module/gallery/index.inc.php' script not properly sanitizing user-supplied input to the 'action' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 52078 - Disclosed: 2009-01-24

Description:

VirtueMart contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script (when "option" is set to "com_virtuemart" and "page" is set to "shop.browse") not properly sanitizing user-supplied input to the DescOrderBy parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 52079 - Disclosed: 2009-01-24

Description:

VirtueMart contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script (when "option" is set to "com_virtuemart", "page" is set to "shipping.carrier_form", and "pshop_mode" is set to "admin") not properly sanitizing user-supplied input to the shipping_carrier_name and shipping_carrier_list_order parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 52080 - Disclosed: 2009-01-24

Description:

VirtueMart contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script (when "page" is set to "shipping.carrier_list", "func" is set to "carrierDelete", "option" is set to "com_virtuemart", and "vmtoken" is set to a valid value) not properly sanitizing user-supplied input to the shipping_carrier_id parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51653 - Disclosed: 2009-01-24

Description:

(Description Provided by CVE) : drivers/firmware/dell_rbu.c in the Linux kernel before 2.6.27.13, and 2.6.28.x before 2.6.28.2, allows local users to cause a denial of service (system crash) via a read system call that specifies zero bytes from the (1) image_type or (2) packet_size file in /sys/devices/platform/dell_rbu/.

[CLOSE] OSVDB ID : 51596 - Disclosed: 2009-01-24

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 52937 - Disclosed: 2009-01-24

Description:

(Description Provided by CVE) : CUPS on Mandriva Linux 2008.0, 2008.1, 2009.0, Corporate Server (CS) 3.0 and 4.0, and Multi Network Firewall (MNF) 2.0 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pdf.log temporary file.

[CLOSE] OSVDB ID : 53533 - Disclosed: 2009-01-24

Description:

(Description Provided by CVE) : Microsoft Windows XP, Server 2003 and 2008, and Vista exposes I/O activity measurements of all processes, which allows local users to obtain sensitive information, as demonstrated by reading the I/O Other Bytes column in Task Manager (aka taskmgr.exe) to estimate the number of characters that a different user entered at a runas.exe password prompt, related to a "benchmarking attack."

[CLOSE] OSVDB ID : 57107 - Disclosed: 2009-01-23

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 52201 - Disclosed: 2009-01-23

Description:

(Description Provided by CVE) : The audit_syscall_entry function in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass certain syscall audit configurations via crafted syscalls, a related issue to CVE-2009-0342 and CVE-2009-0343.

[CLOSE] OSVDB ID : 52641 - Disclosed: 2009-01-23

Description:

(Description Provided by CVE) : Cross-domain vulnerability in the V8 JavaScript engine in Google Chrome before 1.0.154.46 allows remote attackers to bypass the Same Origin Policy via a crafted script that accesses another frame and reads its full URL and possibly other sensitive information, or modifies the URL of this frame.

[CLOSE] OSVDB ID : 51623 - Disclosed: 2009-01-23

Description:

KEEP Toolkit contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the patUser.php script not properly sanitizing user-supplied input to the username and password parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 53548 - Disclosed: 2009-01-23

Description:

(Description Provided by CVE) : Unspecified vulnerability in futomi's CGI Cafe Fulltext search CGI 1.1.2 allows remote attackers to gain administrative privileges via unknown vectors.

[CLOSE] OSVDB ID : 52027 - Disclosed: 2009-01-23

Description:

LDF contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the login.asp script not properly sanitizing user-supplied input to the user parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 52030 - Disclosed: 2009-01-23

Description:

Lootan System contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the login.asp script not properly sanitizing user-supplied input to the username parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 52003 - Disclosed: 2009-01-23

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 51532 - Disclosed: 2009-01-23

Description:

(Description Provided by CVE) : Heap-based buffer overflow in the CamImage.CamImage.1 ActiveX control in AxisCamControl.ocx in AXIS Camera Control 2.40.0.0 allows remote attackers to execute arbitrary code via a long image_pan_tilt property value.

[CLOSE] OSVDB ID : 51566 - Disclosed: 2009-01-23

Description:

EMC AutoStart contains a flaw that may allow a malicious user to execute arbitrary code. The issue is triggered when a specific DWORD value are sent to the Backbone service (ftbackbone.exe), which listens on TCP port 8042 by default. It is possible that the flaw may allow arbitrary execution of code with SYSTEM privileges, resulting in a loss of integrity.

[CLOSE] OSVDB ID : 51571 - Disclosed: 2009-01-23

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in Web Help Desk before 9.1.18 allows remote attackers to inject arbitrary web script or HTML via vectors related to "encoded JavaScript" and Helpdesk.woa.