[CLOSE] OSVDB ID : 51766 - Disclosed: 2009-01-16

Description:

Active Bids contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'search.asp' script not properly sanitizing user-supplied input to the 'search' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51767 - Disclosed: 2009-01-16

Description:

Active Bids contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'auctionsended.asp' script not properly sanitizing user-supplied input to the 'SortDir' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51768 - Disclosed: 2009-01-16

Description:

Active Bids contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'wishlist.asp' script not properly sanitizing user-supplied input to the 'catid' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 52457 - Disclosed: 2009-01-16

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 53254 - Disclosed: 2009-01-16

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in SimpleCMMS before 0.1.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

[CLOSE] OSVDB ID : 53300 - Disclosed: 2009-01-16

Description:

Visuplay CMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'news_article.php' script not properly sanitizing user-supplied input to the 'press_id' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 90043 - Disclosed: 2009-01-16

Description:

By default, Heatmiser Netmonitor installs with default user credentials (username/password combination). The 'admin' account has a password of 'admin', which is publicly known and documented. This allows remote attackers to trivially access the program or system and gain privileged access.

[CLOSE] OSVDB ID : 53457 - Disclosed: 2009-01-15

Description:

(Description Provided by CVE) : Red Hat Certificate System 7.2 uses world-readable permissions for password.conf and unspecified other configuration files, which allows local users to discover passwords by reading these files.

[CLOSE] OSVDB ID : 53458 - Disclosed: 2009-01-15

Description:

(Description Provided by CVE) : Red Hat Certificate System 7.2 stores passwords in cleartext in the UserDirEnrollment log, the RA wizard installer log, and unspecified other debug log files, and uses weak permissions for these files, which allows local users to discover passwords by reading the files.

[CLOSE] OSVDB ID : 51415 - Disclosed: 2009-01-15

Description:

RD-Autos Component for Joomla! contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script not properly sanitizing user-supplied input to the id parameter, when the option parameter is set to com_rdautos. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 53499 - Disclosed: 2009-01-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 53500 - Disclosed: 2009-01-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 53501 - Disclosed: 2009-01-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 53502 - Disclosed: 2009-01-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 53503 - Disclosed: 2009-01-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 53504 - Disclosed: 2009-01-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 53505 - Disclosed: 2009-01-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 53506 - Disclosed: 2009-01-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 53507 - Disclosed: 2009-01-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 51380 - Disclosed: 2009-01-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 51432 - Disclosed: 2009-01-15

Description:

(Description Provided by CVE) : Unspecified vulnerability in IBM Hardware Management Console (HMC) 7 release 3.2.0 SP1 has unknown impact and attack vectors.

[CLOSE] OSVDB ID : 51372 - Disclosed: 2009-01-15

Description:

phpList contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'admin/index.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the '_SERVER[ConfigFile]' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 51377 - Disclosed: 2009-01-15

Description:

AN Guestbook contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'country' parameter upon submission to the 'sign1.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 51376 - Disclosed: 2009-01-15

Description:

Eventing Component for Joomla! contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'catid' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51414 - Disclosed: 2009-01-15

Description:

(Description Provided by CVE) : Directory traversal vulnerability in common.php in SIR GNUBoard 4.31.03 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the g4_path parameter. NOTE: in some environments, this can be leveraged for remote code execution via a data: URI or a UNC share pathname.

[CLOSE] OSVDB ID : 51410 - Disclosed: 2009-01-15

Description:

A code execution flaw exists in Appstream Client. The LaunchObj ActiveX control fails to validate data passed to the installAppMgr method. With a specially crafted website, a context-dependent attacker can cause arbitrary code execution resulting in a loss of integrity.

[CLOSE] OSVDB ID : 51409 - Disclosed: 2009-01-15

Description:

(Description Provided by CVE) : Syslserve 1.058 and earlier, and probably 1.059, allows remote attackers to cause a denial of service (hang) via a crafted UDP Syslog packet.

[CLOSE] OSVDB ID : 52474 - Disclosed: 2009-01-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 51486 - Disclosed: 2009-01-15

Description:

(Description Provided by CVE) : Stack-based buffer overflow in PXEService.exe in Fujitsu SystemcastWizard Lite 2.0A, 2.0, 1.9, and earlier allows remote attackers to execute arbitrary code via a large PXE protocol request in a UDP packet.

[CLOSE] OSVDB ID : 51487 - Disclosed: 2009-01-15

Description:

(Description Provided by CVE) : Directory traversal vulnerability in the TFTP service in Fujitsu SystemcastWizard Lite 2.0A, 2.0, 1.9, and earlier allows remote attackers to read arbitrary files via directory traversal sequences in unspecified vectors.

[CLOSE] OSVDB ID : 51597 - Disclosed: 2009-01-15

Description:

(Description Provided by CVE) : Buffer overflow in the Registry Setting Tool in Fujitsu SystemcastWizard Lite 2.0A, 2.0, 1.9, and earlier has unknown impact and attack vectors.

[CLOSE] OSVDB ID : 51763 - Disclosed: 2009-01-15

Description:

LinksPro contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'Default.asp' script not properly sanitizing user-supplied input to the 'OrderDirection' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51769 - Disclosed: 2009-01-15

Description:

Blue Eye CMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'clanek' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 55647 - Disclosed: 2009-01-15

Description:

(Description Provided by CVE) : Unquoted Windows search path vulnerability in the scheduler (sched.exe) in Avira AntiVir, AntiVir Premium, Premium Security Suite, and AntiVir Professional might allow local users to gain privileges via a malicious antivir.exe file in the "C:\Program Files\avira\" directory.

[CLOSE] OSVDB ID : 56513 - Disclosed: 2009-01-15

Description:

(Description Provided by CVE) : Microsoft Windows does not properly enforce the Autorun and NoDriveTypeAutoRun registry values, which allows physically proximate attackers to execute arbitrary code by (1) inserting CD-ROM media, (2) inserting DVD media, (3) connecting a USB device, and (4) connecting a Firewire device; (5) allows user-assisted remote attackers to execute arbitrary code by mapping a network drive; and allows user-assisted attackers to execute arbitrary code by clicking on (6) an icon under My Computer\Devices with Removable Storage and (7) an option in an AutoPlay dialog, related to the Autorun.inf file. NOTE: vectors 1 and 3 on Vista are already covered by CVE-2008-0951.

[CLOSE] OSVDB ID : 51343 - Disclosed: 2009-01-14

Description:

(Description Provided by CVE) : Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.1.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

[CLOSE] OSVDB ID : 51332 - Disclosed: 2009-01-14

Description:

(Description Provided by CVE) : Unspecified vulnerability in the OC4J component in Oracle Application Server 10.1.2.3 allows remote attackers to affect confidentiality via unknown vectors.

[CLOSE] OSVDB ID : 51344 - Disclosed: 2009-01-14

Description:

(Description Provided by CVE) : Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

[CLOSE] OSVDB ID : 51392 - Disclosed: 2009-01-14

Description:

(Description Provided by CVE) : Cisco ONS 15310-CL, 15310-MA, 15327, 15454, 15454 SDH, and 15600 with software 7.0.2 through 7.0.6, 7.2.2, 8.0.x, 8.5.1, and 8.5.2 allows remote attackers to cause a denial of service (control-card reset) via a crafted TCP session.

[CLOSE] OSVDB ID : 51395 - Disclosed: 2009-01-14

Description:

(Description Provided by CVE) : PXE Encryption in Cisco IronPort Encryption Appliance 6.2.4 before 6.2.4.1.1, 6.2.5, 6.2.6, 6.2.7 before 6.2.7.7, 6.3 before 6.3.0.4, and 6.5 before 6.5.0.2; and Cisco IronPort PostX 6.2.1 before 6.2.1.1 and 6.2.2 before 6.2.2.3; allows remote attackers to obtain the decryption key via unspecified vectors, related to a "logic error."