OSVDB: Open Sourced Vulnerability Database

Browse Database

Browsing Vulnerabilities Disclosed in January of 2010

« Previous 1 2 3 4 5 6 7 8 9 … 18 19 Next »

OSVDB ID	Disclosure Date	Title
62130 [CLOSE] OSVDB ID : 62130 - Disclosed: 2010-01-31 Description: (Description Provided by CVE) : kuddb2 in Tivoli Monitoring for DB2, as distributed in IBM DB2 9.7 FP1 on Linux, allows remote attackers to cause a denial of service (daemon crash) via a certain byte sequence.	2010-01-31	IBM Tivoli Monitoring for DB2 kuddb2 Unspecified Byte Sequence Remote DoS
67546 [CLOSE] OSVDB ID : 67546 - Disclosed: 2010-01-31 Description: Microsoft Visio is prone to a flaw in the way it loads dynamic-link libraries (e.g., mfc71enu.dll). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening a .vtx file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Microsoft Visio Path Subversion Arbitrary DLL Injection Code Execution
67483 [CLOSE] OSVDB ID : 67483 - Disclosed: 2010-01-31 Description: Microsoft Office PowerPoint is prone to a flaw in the way it loads dynamic-link libraries (e.g. pptimpconv.dll and pp7x32.dll). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening a .odp, .pot, .potm, .potx, .ppa, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .pwz, .sldm or .sldx file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Microsoft Office PowerPoint Path Subversion Arbitrary DLL Injection Code Execution
67595 [CLOSE] OSVDB ID : 67595 - Disclosed: 2010-01-31 Description: Microsoft Office Access is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an unspecified file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Microsoft Office Access Path Subversion Arbitrary DLL Injection Code Execution
67596 [CLOSE] OSVDB ID : 67596 - Disclosed: 2010-01-31 Description: Microsoft Office Excel is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an unspecified file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Microsoft Office Excel Path Subversion Arbitrary DLL Injection Code Execution
67597 [CLOSE] OSVDB ID : 67597 - Disclosed: 2010-01-31 Description: Microsoft Office Word is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an unspecified file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Microsoft Office Word Path Subversion Arbitrary DLL Injection Code Execution
67594 [CLOSE] OSVDB ID : 67594 - Disclosed: 2010-01-31 Description: Microsoft Office Outlook is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an unspecified file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Microsoft Outlook Path Subversion Arbitrary DLL Injection Code Execution
67598 [CLOSE] OSVDB ID : 67598 - Disclosed: 2010-01-31 Description: Microsoft Office OneNote is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an unspecified file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Microsoft Office OneNote Path Subversion Arbitrary DLL Injection Code Execution
67607 [CLOSE] OSVDB ID : 67607 - Disclosed: 2010-01-31 Description: Adobe Acrobat Reader is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an unspecified file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Adobe Acrobat Reader Path Subversion Arbitrary DLL Injection Code Execution
67599 [CLOSE] OSVDB ID : 67599 - Disclosed: 2010-01-31 Description: Microsoft Windows Live Messenger is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an unspecified file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Microsoft Windows Live Messenger Path Subversion Arbitrary DLL Injection Code Execution
67605 [CLOSE] OSVDB ID : 67605 - Disclosed: 2010-01-31 Description: Google Talk is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an unspecified file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Google Talk (gTalk) Path Subversion Arbitrary DLL Injection Code Execution
67600 [CLOSE] OSVDB ID : 67600 - Disclosed: 2010-01-31 Description: Microsoft Windows Media Player (WMP) is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an unspecified file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Microsoft Windows Media Player Path Subversion Arbitrary DLL Injection Code Execution
62032 [CLOSE] OSVDB ID : 62032 - Disclosed: 2010-01-31 Description: (Description Provided by CVE) : Unspecified vulnerability in DocumentManager before 4.0 has unknown impact and attack vectors, related to file rights.	2010-01-31	Document Manager File Rights Unspecified Issue
62035 [CLOSE] OSVDB ID : 62035 - Disclosed: 2010-01-31 Description: Unknown / Incomplete	2010-01-31	snif index.php download Parameter Arbitrary PHP File Access
62148 [CLOSE] OSVDB ID : 62148 - Disclosed: 2010-01-31 Description: (Description Provided by CVE) : Bugzilla 3.3.1 through 3.4.4, 3.5.1, and 3.5.2 does not allow group restrictions to be preserved throughout the process of moving a bug to a different product category, which allows remote attackers to obtain sensitive information via a request for a bug in opportunistic circumstances.	2010-01-31	Bugzilla Product Category Group Restriction Weakness Remote Information Disclosure
62043 [CLOSE] OSVDB ID : 62043 - Disclosed: 2010-01-31 Description: (Description Provided by CVE) : Unspecified vulnerability in MoinMoin 1.5.x through 1.7.x, 1.8.x before 1.8.7, and 1.9.x before 1.9.2 has unknown impact and attack vectors, related to configurations that have a non-empty superuser list, the xmlrpc action enabled, the SyncPages action enabled, or OpenID configured.	2010-01-31	MoinMoin Superuser Definition Unspecified Issue
62046 [CLOSE] OSVDB ID : 62046 - Disclosed: 2010-01-31 Description: (Description Provided by CVE) : The ucode_ioctl function in intel/io/ucode_drv.c in Sun Solaris 10 and OpenSolaris snv_69 through snv_133, when running on x86 architectures, allows local users to cause a denial of service (panic) via a request with a 0 size value to the UCODE_GET_VERSION IOCTL, which triggers a NULL pointer dereference in the ucode_get_rev function, related to retrieval of the microcode revision.	2010-01-31	Solaris Microcode Device UCODE_GET_VERSION IOCTL NULL Dereference Local DoS
62084 [CLOSE] OSVDB ID : 62084 - Disclosed: 2010-01-31 Description: (Description Provided by CVE) : Buffer overflow in the GMIME_UUENCODE_LEN macro in gmime/gmime-encodings.h in GMime before 2.4.15 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via input data for a uuencode operation.	2010-01-31	GMime gmime/gmime-encodings.h GMIME_UUENCODE_LEN() Macro Uuencode Operation Overflow
62149 [CLOSE] OSVDB ID : 62149 - Disclosed: 2010-01-31 Description: (Description Provided by CVE) : Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom installations, which allows remote attackers to obtain sensitive information via requests for (1) CVS/, (2) contrib/, (3) docs/en/xml/, (4) t/, or (5) old-params.txt.	2010-01-31	Bugzilla Multiple Directory Access Restriction Weakness Remote Information Disclosure
64894 [CLOSE] OSVDB ID : 64894 - Disclosed: 2010-01-31 Description: Unknown / Incomplete	2010-01-31	RaakCms pic.aspx Arbitrary File Upload
64895 [CLOSE] OSVDB ID : 64895 - Disclosed: 2010-01-31 Description: Unknown / Incomplete	2010-01-31	RaakCms browse.asp dir Parameter Traversal Arbitrary Directory Listing
64896 [CLOSE] OSVDB ID : 64896 - Disclosed: 2010-01-31 Description: Unknown / Incomplete	2010-01-31	RaakCms browseFile.asp dir Parameter Traversal Arbitrary Directory Listing
67329 [CLOSE] OSVDB ID : 67329 - Disclosed: 2010-01-31 Description: Apple iTunes is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Apple iTunes for Windows Path Subversion Arbitrary DLL Injection Code Execution
67540 [CLOSE] OSVDB ID : 67540 - Disclosed: 2010-01-31 Description: Skype is prone to a flaw in the way it loads dynamic-link libraries (e.g., wab32.dll). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening a .skype file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Skype Path Subversion Arbitrary DLL Injection Code Execution
67539 [CLOSE] OSVDB ID : 67539 - Disclosed: 2010-01-31 Description: Google Earth is prone to a flaw in the way it loads dynamic-link libraries (e.g., quserex.dll). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening a .kmz file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Google Earth Path Subversion Arbitrary DLL Injection Code Execution
67547 [CLOSE] OSVDB ID : 67547 - Disclosed: 2010-01-31 Description: Apple Safari on Windows is prone to a flaw in the way it loads dynamic-link libraries (e.g., dwmapi.dll). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening a .htm, .mht, .mhtml, .xht, .xhtm or .xhtl file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Apple Safari on Windows Path Subversion Arbitrary DLL Injection Code Execution
67606 [CLOSE] OSVDB ID : 67606 - Disclosed: 2010-01-31 Description: Google Chrome is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an unspecified file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Google Chrome Path Subversion Arbitrary DLL Injection Code Execution
67601 [CLOSE] OSVDB ID : 67601 - Disclosed: 2010-01-31 Description: Foxit Reader is prone to a flaw in the way it loads dynamic-link libraries (e.g., rpawinet.dll). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an unspecified file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Foxit Reader Path Subversion Arbitrary DLL Injection Code Execution
67608 [CLOSE] OSVDB ID : 67608 - Disclosed: 2010-01-31 Description: Pidgin on Windows is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an unspecified file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Pidgin Path Subversion Arbitrary DLL Injection Code Execution
67609 [CLOSE] OSVDB ID : 67609 - Disclosed: 2010-01-31 Description: Yahoo! Messenger is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an unspecified file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Yahoo! Messenger Path Subversion Arbitrary DLL Injection Code Execution
67604 [CLOSE] OSVDB ID : 67604 - Disclosed: 2010-01-31 Description: Google Picasa is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an unspecified file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Google Picasa Path Subversion Arbitrary DLL Injection Code Execution
67610 [CLOSE] OSVDB ID : 67610 - Disclosed: 2010-01-31 Description: Irfan View is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an unspecified file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Irfan View Path Subversion Arbitrary DLL Injection Code Execution
67602 [CLOSE] OSVDB ID : 67602 - Disclosed: 2010-01-31 Description: Apple QuickTime on Windows is prone to a flaw in the way it loads dynamic-link libraries (e.g., rpawinet.dll). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening a media file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Apple QuickTime on Windows Path Subversion Arbitrary DLL Injection Code Execution
67603 [CLOSE] OSVDB ID : 67603 - Disclosed: 2010-01-31 Description: Google Desktop is prone to a flaw in the way it loads dynamic-link libraries (e.g., GoogleDesktopCommon.dll). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an unspecified file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.	2010-01-31	Google Desktop Path Subversion Arbitrary DLL Injection Code Execution
62025 [CLOSE] OSVDB ID : 62025 - Disclosed: 2010-01-30 Description: Unknown / Incomplete	2010-01-30	C++ Sockets HTTP Header Handling Remote DoS
62036 [CLOSE] OSVDB ID : 62036 - Disclosed: 2010-01-30 Description: phpunity.newsmanager contains a flaw that allows a remote attacker to traverse outside of a restricted path. The issue is due to the 'misc/tell_a_friend/tell.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied via the 'id' parameter. This directory traversal attack would allow the attacker to access arbitrary files.	2010-01-30	phpunity.newsmanager misc/tell_a_friend/tell.php id Parameter Traversal Arbitrary File Access
62038 [CLOSE] OSVDB ID : 62038 - Disclosed: 2010-01-30 Description: JE Event Calendars Component for Joomla! contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'event_id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.	2010-01-30	JE Event Calendars Component for Joomla! index.php event_id Parameter SQL Injection
62040 [CLOSE] OSVDB ID : 62040 - Disclosed: 2010-01-30 Description: Documents Seller Component for Joomla! contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'category_id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.	2010-01-30	Documents Seller Component for Joomla! index.php category_id Parameter SQL Injection
62065 [CLOSE] OSVDB ID : 62065 - Disclosed: 2010-01-30 Description: (nv2) Awards contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.	2010-01-30	(nv2) Awards index.php id Parameter SQL Injection
62341 [CLOSE] OSVDB ID : 62341 - Disclosed: 2010-01-30 Description: SimpleFAQ Component for Joomla! contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'catid' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.	2010-01-30	SimpleFAQ Component for Joomla! index.php catid Parameter SQL Injection

« Previous 1 2 3 4 5 6 7 8 9 … 18 19 Next »

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.