| OSVDB ID | Disclosure Date | Title |
|---|
|
68715
Description:
PCDJ Karaoki is prone to a flaw in the way it loads dynamic-link libraries (DLL), specifically how it loads 'saMon2.exe' while using 'ShellExecute()'. The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening a M3U file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.
|
2010-10-18
|
PCDJ Karaoki Path Subversion Arbitrary Executable Injection Code Execution
|
|
68708
Description:
Kisisel Radyo Script contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when the program stores sensitive information inside the web root with insecure access permissions, which will disclose database information to a remote attacker via a direct request for 'sevvo/eco23.mdb'.
|
2010-10-18
|
Kisisel Radyo Script sevvo/eco23.mdb Direct Request Database Disclosure
|
|
68707
Description:
IBM Informix Dynamic Server is prone to an overflow condition. The program fails to properly sanitize user-supplied input resulting in a stack-based buffer overflow. With specially crafted lengthy DBINFO keyword arguments in an SQL statement, a remote attacker can potentially execute arbitrary code.
|
2010-10-18
|
IBM Informix Dynamic Server DBINFO Keyword SQL Query Remote Overflow
|
|
68706
Description:
IBM Informix Dynamic Server is prone to an overflow condition. 'librpc.dll' in 'portmap.exe' fails to properly sanitize user-supplied input resulting in an integer overflow. With a specially crafted RPC packet with a crafted parameter size sent to TCP port 36890, a remote attacker can potentially execute arbitrary code.
|
2010-10-18
|
IBM Informix Dynamic Server portmap.exe librpc.dll Crafted RPC Packet Remote Overflow
|
|
68705
Description:
IBM Informix Dynamic Server is prone to an overflow condition. An unspecified logging function in 'oninit.exe' fails to properly sanitize user-supplied input resulting in a stack-based buffer overflow. With a specially crafted EXPLAIN directive, a remote attacker can potentially execute arbitrary code.
|
2010-10-18
|
IBM Informix Dynamic Server oninit.exe Logging Function Remote Overflow
|
|
68710
Description:
Adobe RoboHelp for Word contains a flaw while generating WebHelp that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate certain unspecified input before returning it to the user. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.
|
2010-10-18
|
Adobe RoboHelp for Word WebHelp Unspecified XSS
|
|
68709
Description:
Kisisel Radyo Script contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'radyo.asp' script not properly sanitizing user-supplied input to the 'Id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.
|
2010-10-18
|
Kisisel Radyo Script radyo.asp Id Parameter SQL Injection
|
|
68711
Description:
Adobe RoboHelp contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate certain unspecified input before returning it to the user. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.
|
2010-10-18
|
Adobe RoboHelp Multiple Unspecified XSS
|
|
68860
Description:
HP Systems Insight Manager contains a flaw that allows a remote Cross-site Request Forgery (CSRF / XSRF) attack. The flaw exists because the application does not require multiple steps or explicit confirmation for sensitive transactions for unspecified users. By using a crafted URL (e.g., a crafted GET request inside an "img" tag), an attacker may trick the victim into clicking on the image to take advantage of the trust relationship between the authenticated victim and the application. Such an attack could trick the victim into executing arbitrary commands in the context of their session with the application, without further prompting or verification.
|
2010-10-18
|
HP Systems Insight Manager Unspecified CSRF (2010-3288)
|
|
68766
Description:
TeraPad is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening a TXT or HTML file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.
|
2010-10-18
|
TeraPad Path Subversion Arbitrary DLL Injection Code Execution
|
|
68774
Description:
libguestfs contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a raw-format disk image is used, which will disclose arbitrary files to a local guest OS administrator via a crafted 'qcow2', 'VMDK' or 'VDI' header.
|
2010-10-18
|
libguestfs Image Format Qemu Propogation Weakness Arbitrary File Disclosure
|
|
68861
Description:
HP Systems Insight Manager contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate certain unspecified input before returning it to the user. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.
|
2010-10-18
|
HP Systems Insight Manager Unspecified XSS (2010-3289)
|
|
68862
Description:
HP Systems Insight Manager contains an unspecified flaw that may allow a remote attacker to gain elevated privileges. No further details have been provided.
|
2010-10-18
|
HP Systems Insight Manager Unspecified Remote Privilege Escalation (2010-3290)
|
|
70260
Description:
Linux Kernel is prone to an overflow condition. The 'econet_sendmsg' function in 'net/econet/af_econet.c' fails to properly sanitize user-supplied input resulting in a stack-based buffer overflow. By providing a large number of iovec structures, a local attacker can gain elevated privileges.
|
2010-10-18
|
Linux Kernel net/econet/af_econet.c econet_sendmsg Function iovec Structure Local Overflow
|
|
70261
Description:
Linux Kernel contains a flaw that may allow a local denial of service. The issue is triggered when the 'econet_sendmsg' function in 'net/econet/af_econet.c' alows local users to use a sendmsg call which specifies a NULL value for the remote address field to cause a denial of service via a NULL pointer dereference.
|
2010-10-18
|
Linux Kernel net/econet/af_econet.c econet_sendmsg Function sendmsg Call Local DoS
|
|
71086
Description:
MFC Applications made with Microsoft Visual Studio are prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening a .bp file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.
|
2010-10-18
|
Microsoft Visual Studio MFC Applications Path Subversion Arbitrary DLL Injection Code Execution
|
|
71084
Description:
Rafe 7 is prone to a flaw in the way it loads dynamic-link libraries (DLL), specifically idapi32.dll, idbat32.dll, idr20009.dll, idsql32.dll and odbc32.dll. The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an HTML file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.
|
2010-10-18
|
Rafe 7 Path Subversion Arbitrary DLL Injection Code Execution
|
|
71083
Description:
Brilliant Accounting System is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an HTML file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.
|
2010-10-18
|
Brilliant Accounting System Path Subversion Arbitrary DLL Injection Code Execution
|
|
71082
Description:
Sahar Money Manager is prone to a flaw in the way it loads dynamic-link libraries (DLL), specifically unicows.dll. The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an HTML file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.
|
2010-10-18
|
Sahar Money Manager Path Subversion Arbitrary DLL Injection Code Execution
|
|
71081
Description:
Holoo is prone to a flaw in the way it loads dynamic-link libraries (DLL), specifically 'idapi32.dll', 'idr20009.dll' and 'odbc32.dll'. The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an HTML file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.
|
2010-10-18
|
Holoo Path Subversion Arbitrary EXE Injection Code Execution
|
|
71080
Description:
Xilisoft Video Converter is prone to a flaw in the way it loads dynamic-link libraries (DLL), specifically 'quserex.dll' and 'wintab32.dll'. The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening an HTML file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.
|
2010-10-18
|
Xilisoft Video Converter Path Subversion Arbitrary DLL Injection Code Execution
|
|
75050
Description:
Unknown / Incomplete
|
2010-10-18
|
Ultimix permit::group_access Package Unspecified Issue
|
|
75186
Description:
(Description Provided by CVE) : Symantec Norton AntiVirus 2011 does not properly interact with the processing of hcp:// URLs by the Microsoft Help and Support Center, which makes it easier for remote attackers to execute arbitrary code via malware that is correctly detected by this product, but with a detection approach that occurs too late to stop the code execution. NOTE: the researcher indicates that a vendor response was received, stating that this issue "falls into the work of our Firewall and not our AV (per our methodology of layers of defense)."
|
2010-10-18
|
Symantec/Norton Protocol Handler (HCP) Malicious Code Execution Antivirus Scan Bypass
|
|
75187
Description:
(Description Provided by CVE) : AVG Anti-Virus does not properly interact with the processing of hcp:// URLs by the Microsoft Help and Support Center, which makes it easier for remote attackers to execute arbitrary code via malware that is correctly detected by this product, but with a detection approach that occurs too late to stop the code execution.
|
2010-10-18
|
AVG Protocol Handler (HCP) Malicious Code Execution Antivirus Scan Bypass
|
|
87682
Description:
ExpressionEngine contains a flaw that is triggered when an unspecified error occurs, which may allow a remote attacker to execute arbitrary code. No further details have been provided.
|
2010-10-18
|
ExpressionEngine Unspecified Arbitrary Code Execution
|
|
68936
Description:
IBM solidDB contains a flaw that may allow a remote denial of service. The issue is triggered when solid.exe suffers from an error when processing certian input, resulting in a stack consumption vulnerability, allowing a remote attacker to cause a denial of service by sending a crafted packet with multiple integer fields to TCP port 1315, which causes multiple recursive calls of a certain function.
|
2010-10-15
|
IBM solidDB solid.exe Packet Handling Recursive Function Remote DoS
|
|
68937
Description:
IBM solidDB contains a flaw that may allow a remote denial of service. The issue is triggered when solid.exe fails to properly perform a recursive call to a certain function when receiving packet data containing a single integer field. This may allow a remote attacker to cause a NULL pointer dereference denial of service via a TCP session on port 1315.
|
2010-10-15
|
IBM solidDB solid.exe Packet Handling NULL Dereference Remote DoS
|
|
68938
Description:
IBM solidDB contains a flaw that may allow a remote denial of service. The issue is triggered when solid.exe fails to properly perform a recursive call to a certain function when receiving packet data with multiple integer fields with two different values, allowing a remote attacker to cause an invalid memory access denial of service via a TCP session on port 1315.
|
2010-10-15
|
IBM solidDB solid.exe Packet Handling Memory Error Remote DoS
|
|
68750
Description:
Rocket U2 UniData contains a flaw that may allow a remote denial of service. The issue is triggered when an error in the 'uvrpc_read_message()' function in 'unirpc32.dll' occurs when processing packets, which may be exploited to reference an unallocated memory region to cause a denial of service.
|
2010-10-15
|
Rocket U2 UniData unirpc32.dll uvrpc_read_message() Function Packet Handling Remote DoS
|
|
68753
Description:
Rocket U2 UniData is prone to an overflow condition. The 'uvrpc_unpack_args()' function in 'unirpc32.dll' fails to properly sanitize user-supplied input resulting in an integer overflow. With a specially crafted packet, a remote attacker can potentially cause a denial of service.
|
2010-10-15
|
Rocket U2 UniData unirpc32.dll uvrpc_unpack_args() Function Overflow DoS
|
|
68752
Description:
Rocket U2 UniData contains a flaw that may allow a remote denial of service. The issue is triggered when an error in the 'uvrpc_unpack_args()' function in 'unirpc32.dll' occurs when processing packets, which may be exploited to reference an unallocated memory region to cause a denial of service.
|
2010-10-15
|
Rocket U2 UniData unirpc32.dll uvrpc_unpack_args() Function Invalid Memory Access DoS
|
|
68751
Description:
Rocket U2 UniData contains a flaw that may allow a remote denial of service. The issue is triggered when an unspecified error occurs when processing packets, which may be exploited to reference unallocated memory to cause a denial of service.
|
2010-10-15
|
Rocket U2 UniData unirpc.exe Unspecified Packet Handling Remote DoS
|
|
68812
Description:
RealWin is prone to an overflow condition. The program fails to properly sanitize user-supplied input resulting in a stack-based buffer overflow. With a specially crafted 'SCPC_INITIALIZE', 'SCPC_INITIALIZE_RF' or 'SCPC_TXTEVENT' packet, a remote attacker can potentially execute arbitrary code.
|
2010-10-15
|
DATAC RealWin Multiple Packet Type Processing Overflow
|
|
68664
Description:
STDU Explorer is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening a folder from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.
|
2010-10-15
|
STDU Explorer Path Subversion Arbitrary DLL Injection Code Execution
|
|
68663
Description:
MEO Encryption Software is prone to a flaw in the way it loads dynamic-link libraries (DLL). The program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. This can be done by tricking a user into opening a MEO or CRY file from the local file system or a USB drive in some cases. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source.
|
2010-10-15
|
MEO Encryption Software Path Subversion Arbitrary DLL Injection Code Execution
|
|
68671
Description:
RealPlayer is prone to an overflow condition. The program fails to properly sanitize user-supplied input resulting in a heap-based buffer overflow. With a specially crafted QCP file, a context-dependent attacker can potentially execute arbitrary code.
|
2010-10-15
|
RealPlayer Multiple Products Crafted QCP File Sample Chunk Parsing Overflow
|
|
68673
Description:
RealPlayer, Realplayer SP and RealPlayer Enterprise contain a flaw related to the improper initialization of an unspecified component while parsing a CDDA URI. This may allow a context-dependent attacker to execute arbitrary code via a long crafted URI.
|
2010-10-15
|
RealPlayer Multiple Products ActiveX Unspecified Object Component CDDA URI Handling Arbitrary Code Execution
|
|
68674
Description:
RealPlayer, RealPlayer SP and RealPlayer Enterprise are prone to an overflow condition. The RichFX component fails to properly sanitize user-supplied input resulting in a stack-based buffer overflow. This may allow a context-dependent attacker to execute arbitrary code.
|
2010-10-15
|
RealPlayer Multiple Products RichFX Component Unspecified Overflow
|
|
68712
Description:
Blue Coat ProxySG contains a flaw related to the Active Content Transformation or Removal feature failing to detect hex and UTF-8 encoded Javascript. This may allow a remote attacker to bypass policy rules that sanitize active content.
|
2010-10-15
|
Blue Coat ProxySG Active Content Transformation or Removal Feature JavaScript Detection Weakness Policy Rule Bypass
|
|
87497
Description:
XOOPS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the kernel/module.php script not properly sanitizing user-supplied input to the getByDirname() function that is passed to modules\system\admin\modulesadmin\main.php and include\cp_header.php. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.
|
2010-10-15
|
XOOPS kernel/module.php getByDirname() Function SQL Injection
|
