[CLOSE] OSVDB ID : 73465 - Disclosed: 2009-01-19

Description:

(Description Provided by CVE) : Monkey's Audio before 4.02 allows remote attackers to cause a denial of service (application crash) via a malformed APE file.

[CLOSE] OSVDB ID : 51499 - Disclosed: 2009-01-18

Description:

SCMS Simple Content Management System contains a flaw that allows a remote attacker to view files outside of the web path. The issue is due to the index.php script not properly sanitizing user input, specifically directory traversal style attacks (../../) supplied via the p parameter.

[CLOSE] OSVDB ID : 53551 - Disclosed: 2009-01-18

Description:

(Description Provided by CVE) : Integer overflow in Ralink Technology USB wireless adapter (RT73) 3.08 for Windows, and other wireless card drivers including rt2400, rt2500, rt2570, and rt61, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Probe Request packet with a long SSID, possibly related to an integer signedness error.

[CLOSE] OSVDB ID : 51611 - Disclosed: 2009-01-18

Description:

(Description Provided by CVE) : listing.php in WebSVN 2.0 and possibly 1.7 beta, when using an SVN authz file, allows remote authenticated users to read changelogs or diffs for restricted projects via a modified repname parameter.

[CLOSE] OSVDB ID : 51455 - Disclosed: 2009-01-18

Description:

(Description Provided by CVE) : ROBS-PROJECTS Digital Sales IPN (aka DS-IPN.NET or DS-IPN Paypal Shop) stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request for Database/Sales.mdb.

[CLOSE] OSVDB ID : 51473 - Disclosed: 2009-01-18

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 51470 - Disclosed: 2009-01-18

Description:

(Description Provided by CVE) : Directory traversal vulnerability in entries/index.php in Ninja Blog 4.8, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the cat parameter.

[CLOSE] OSVDB ID : 51474 - Disclosed: 2009-01-18

Description:

PHPads contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'ad_name' parameter upon submission to the 'admin.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 51671 - Disclosed: 2009-01-18

Description:

(Description Provided by CVE) : Directory traversal vulnerability in gallery/comment.php in Enhanced Simple PHP Gallery (ESPG) 1.72 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. NOTE: the vulnerability may be in my little homepage Comment script. If so, then this should not be treated as a vulnerability in ESPG.

[CLOSE] OSVDB ID : 57423 - Disclosed: 2009-01-17

Description:

Expat contains a flaw in the handling of XML files that may allow a remote denial of service. The issue is due to an error within the updatePosition() function in lib/xmltok_impl.c. With a specially crafted XML file, a context-dependent attacker can cause the application that uses the library to crash.

[CLOSE] OSVDB ID : 59737 - Disclosed: 2009-01-17

Description:

Expat contains a flaw in the handling XML files that may allow a remote denial of service. The issue is due to the 'updatePosition()' function in lib/xmltok_impl.c. With a specially crafted XML file containing malformed UTF-8 sequences, a context-dependent attacker can cause the service to crash.

[CLOSE] OSVDB ID : 57424 - Disclosed: 2009-01-17

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 51501 - Disclosed: 2009-01-17

Description:

(Description Provided by CVE) : Memory leak in the keyctl_join_session_keyring function (security/keys/keyctl.c) in Linux kernel 2.6.29-rc2 and earlier allows local users to cause a denial of service (kernel memory consumption) via unknown vectors related to a "missing kfree."

[CLOSE] OSVDB ID : 55650 - Disclosed: 2009-01-16

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 51500 - Disclosed: 2009-01-16

Description:

ActionCalendar contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the admin.asp script not properly sanitizing user-supplied input to the pass parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51562 - Disclosed: 2009-01-16

Description:

BibCiter contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'reports/projects.php' script not properly sanitizing user-supplied input to the 'idp' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51563 - Disclosed: 2009-01-16

Description:

BibCiter contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'reports/contacts.php' script not properly sanitizing user-supplied input to the 'idc' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51564 - Disclosed: 2009-01-16

Description:

BibCiter contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'reports/users.php' script not properly sanitizing user-supplied input to the 'idu' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51620 - Disclosed: 2009-01-16

Description:

eFAQ contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the default.asp script not properly sanitizing user-supplied input to the str_Login and str_Password parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51617 - Disclosed: 2009-01-16

Description:

Blog Manager contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the inc_webblogmanager.asp script not properly sanitizing user-supplied input to the ItemID parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51618 - Disclosed: 2009-01-16

Description:

Blog Manager contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the CategoryID parameter upon submission to the inc_webblogmanager.asp script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 51493 - Disclosed: 2009-01-16

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 51494 - Disclosed: 2009-01-16

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 51495 - Disclosed: 2009-01-16

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 52197 - Disclosed: 2009-01-16

Description:

(Description Provided by CVE) : The inotify_read function in the Linux kernel 2.6.27 to 2.6.27.13, 2.6.28 to 2.6.28.2, and 2.6.29-rc3 allows local users to cause a denial of service (OOPS) via a read with an invalid address to an inotify instance, which causes the device's event list mutex to be unlocked twice and prevents proper synchronization of a data structure for the inotify instance.

[CLOSE] OSVDB ID : 51401 - Disclosed: 2009-01-16

Description:

Visuplay CMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'news_article.php' script not properly sanitizing user-supplied input to the 'press_id' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51456 - Disclosed: 2009-01-16

Description:

eReservations contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the default.asp script not properly sanitizing user-supplied input to the 'Login' and 'Password' parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 51457 - Disclosed: 2009-01-16

Description:

(Description Provided by CVE) : SQL injection vulnerability in index.asp in Katy Whitton BlogIt! allows remote attackers to execute arbitrary SQL commands via the day parameter in an archive action.

[CLOSE] OSVDB ID : 51453 - Disclosed: 2009-01-16

Description:

Ping IP contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the login.aspx script not properly sanitizing user-supplied input to the 'txtUserName' and 'txtPassword' parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 51454 - Disclosed: 2009-01-16

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 53509 - Disclosed: 2009-01-16

Description:

(Description Provided by CVE) : ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

[CLOSE] OSVDB ID : 51458 - Disclosed: 2009-01-16

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in index.asp in Katy Whitton BlogIt! allows remote attackers to inject arbitrary web script or HTML via the view parameter.

[CLOSE] OSVDB ID : 51533 - Disclosed: 2009-01-16

Description:

RankEm contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'siteID' parameters upon submission to the 'rankup.asp' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 51534 - Disclosed: 2009-01-16

Description:

(Description Provided by CVE) : Katy Whitton RankEm stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for database/topsites.mdb.

[CLOSE] OSVDB ID : 51640 - Disclosed: 2009-01-16

Description:

Walking Club contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the login.aspx script not properly sanitizing user-supplied input to the 'username' and 'password' parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 51668 - Disclosed: 2009-01-16

Description:

(Description Provided by CVE) : Multiple directory traversal vulnerabilities in Simple PHP Newsletter 1.5 allow remote attackers to read arbitrary files via a .. (dot dot) in the olang parameter to (1) mail.php and (2) mailbar.php.

[CLOSE] OSVDB ID : 51669 - Disclosed: 2009-01-16

Description:

(Description Provided by CVE) : Multiple directory traversal vulnerabilities in Simple PHP Newsletter 1.5 allow remote attackers to read arbitrary files via a .. (dot dot) in the olang parameter to (1) mail.php and (2) mailbar.php.

[CLOSE] OSVDB ID : 51670 - Disclosed: 2009-01-16

Description:

(Description Provided by CVE) : Katy Whitton BlogIt! stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request for database/Blog.mdb. NOTE: some of these details are obtained from third party information.

[CLOSE] OSVDB ID : 51764 - Disclosed: 2009-01-16

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in Active Bids allow remote attackers to inject arbitrary web script or HTML via the (1) search parameter to search.asp and the (2) URL parameter to tellafriend.asp.

[CLOSE] OSVDB ID : 51765 - Disclosed: 2009-01-16

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in Active Bids allow remote attackers to inject arbitrary web script or HTML via the (1) search parameter to search.asp and the (2) URL parameter to tellafriend.asp.