[CLOSE] OSVDB ID : 66063 - Disclosed: 2010-06-25

Description:

(Description Provided by CVE) : feh before 1.8, when the --wget-timestamp option is enabled, might allow remote attackers to execute arbitrary commands via shell metacharacters in a URL.

[CLOSE] OSVDB ID : 66119 - Disclosed: 2010-06-25

Description:

(Description Provided by CVE) : Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via an invalid offset in an unspecified undocumented opcode in ActionScript Virtual Machine 2, related to getouterscope, a different vulnerability than CVE-2010-2165, CVE-2010-2166, CVE-2010-2171, CVE-2010-2175, CVE-2010-2176, CVE-2010-2177, CVE-2010-2178, CVE-2010-2180, CVE-2010-2182, CVE-2010-2184, CVE-2010-2187, and CVE-2010-2188.

[CLOSE] OSVDB ID : 66014 - Disclosed: 2010-06-25

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 76886 - Disclosed: 2010-06-25

Description:

JExtensions JE Story Submit Component for Joomla! contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script not properly sanitizing user-supplied input to the 'view' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 67264 - Disclosed: 2010-06-24

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 67265 - Disclosed: 2010-06-24

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 67263 - Disclosed: 2010-06-24

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 65845 - Disclosed: 2010-06-24

Description:

(Description Provided by CVE) : Multiple unspecified vulnerabilities in IBM Rational ClearQuest before 7.1.1.02 have unknown impact and attack vectors, as demonstrated by an AppScan report.

[CLOSE] OSVDB ID : 65809 - Disclosed: 2010-06-24

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in the paste.httpexceptions implementation in Paste before 1.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving a 404 status code, related to (1) paste.urlparser.StaticURLParser, (2) paste.urlparser.PkgResourcesParser, (3) paste.urlmap.URLMap, and (4) HTTPNotFound.

[CLOSE] OSVDB ID : 65730 - Disclosed: 2010-06-24

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 65746 - Disclosed: 2010-06-24

Description:

2daybiz Web Template contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'keyword' parameter upon submission to the 'category.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 65747 - Disclosed: 2010-06-24

Description:

2daybiz Web Template contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'password' parameter upon submission to the 'memberlogin.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 65748 - Disclosed: 2010-06-24

Description:

2daybiz Web Template contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'customize.php' script not properly sanitizing user-supplied input to the 'tid' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 65728 - Disclosed: 2010-06-24

Description:

2daybiz Real Estate Portal Script contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'viewpropertydetails.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 65770 - Disclosed: 2010-06-24

Description:

Limny contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'q' parameter upon submission to the 'index.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 65712 - Disclosed: 2010-06-24

Description:

2daybiz Matrimonial Script contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'customprofile.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 65759 - Disclosed: 2010-06-24

Description:

2daybiz B2B Portal contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'companyinfo.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 65713 - Disclosed: 2010-06-24

Description:

2daybiz Freelance Script contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'project_details.php' script not properly sanitizing user-supplied input to the 'pid' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 65714 - Disclosed: 2010-06-24

Description:

2daybiz Job Site Script contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'view_current_job.php' script not properly sanitizing user-supplied input to the 'jid' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 65715 - Disclosed: 2010-06-24

Description:

2daybiz Job Site Script contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'show_search_more.php' script not properly sanitizing user-supplied input to the 'job_iid' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 65716 - Disclosed: 2010-06-24

Description:

2daybiz Job Site Script contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'show_search_result.php' script not properly sanitizing user-supplied input to the 'left_cat' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 66203 - Disclosed: 2010-06-24

Description:

OneCMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the search.php script not properly sanitizing user-supplied input to the 'search' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 66204 - Disclosed: 2010-06-24

Description:

OneCMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 66205 - Disclosed: 2010-06-24

Description:

OneCMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'Short1' parameter upon submission to the 'admin/admin.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 65711 - Disclosed: 2010-06-24

Description:

2daybiz Photo Sharing Script contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'search' parameter upon submission to the 'freesearch.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 65710 - Disclosed: 2010-06-24

Description:

2daybiz Photo Sharing Script contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'freesearch.php' script not properly sanitizing user-supplied input to the 'search' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 67297 - Disclosed: 2010-06-24

Description:

(Description Provided by CVE) : Red Hat libvirt, possibly 0.6.1 through 0.8.2, looks up disk backing stores without referring to the user-defined main disk format, which might allow guest OS users to read arbitrary files on the host OS, and possibly have unspecified other impact, via unknown vectors.

[CLOSE] OSVDB ID : 67298 - Disclosed: 2010-06-24

Description:

(Description Provided by CVE) : Red Hat libvirt, possibly 0.7.2 through 0.8.2, recurses into disk-image backing stores without extracting the defined disk backing-store format, which might allow guest OS users to read arbitrary files on the host OS, and possibly have unspecified other impact, via unknown vectors.

[CLOSE] OSVDB ID : 67299 - Disclosed: 2010-06-24

Description:

(Description Provided by CVE) : Red Hat libvirt, possibly 0.6.0 through 0.8.2, creates new images without setting the user-defined backing-store format, which allows guest OS users to read arbitrary files on the host OS via unspecified vectors.

[CLOSE] OSVDB ID : 65738 - Disclosed: 2010-06-24

Description:

(Description Provided by CVE) : Off-by-one error in Novell iManager 2.7, 2.7.3, and 2.7.3 FTF2 allows remote attackers to cause a denial of service (daemon crash) via a long tree parameter in a login request to nps/servlet/webacc.

[CLOSE] OSVDB ID : 65757 - Disclosed: 2010-06-24

Description:

(Description Provided by CVE) : The S2 Security NetBox 2.5, 3.3, and 4.0, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, stores sensitive information under the web root with insufficient access control, which allows remote attackers to download node logs, photographs of persons, and backup files via unspecified HTTP requests.

[CLOSE] OSVDB ID : 65877 - Disclosed: 2010-06-24

Description:

(Description Provided by CVE) : Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6 and 3.7, when use_suexec is enabled, uses world-readable permissions for the localconfig files, which allows local users to read sensitive configuration fields, as demonstrated by the database password field and the site_wide_secret field.

[CLOSE] OSVDB ID : 65800 - Disclosed: 2010-06-24

Description:

activeCollab contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'index.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'module', 'action' and 'controller' parameters. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 65802 - Disclosed: 2010-06-24

Description:

2daybiz Video Community Portal Script contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'user-profile.php' script not properly sanitizing user-supplied input to the 'userid' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 65803 - Disclosed: 2010-06-24

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 65857 - Disclosed: 2010-06-24

Description:

2daybiz Multi Level Marketing Software contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'username' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 65878 - Disclosed: 2010-06-24

Description:

(Description Provided by CVE) : Search.pm in Bugzilla 2.17.1 through 3.2.6, 3.3.1 through 3.4.6, 3.5.1 through 3.6, and 3.7 allows remote attackers to obtain potentially sensitive time-tracking information via a crafted search URL, related to a "boolean chart search."

[CLOSE] OSVDB ID : 65904 - Disclosed: 2010-06-24

Description:

(Description Provided by CVE) : Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6.1 and 3.7 through 3.7.1, when use_suexec is enabled, uses world-readable permissions within (1) .bzr/ and (2) data/webdot/, which allows local users to obtain potentially sensitive data by reading files in these directories, a different vulnerability than CVE-2010-0180.

[CLOSE] OSVDB ID : 65963 - Disclosed: 2010-06-24

Description:

AdaptCMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'inc/smarty/libs/init.php' script not properly sanitizing user input supplied to the 'sitepath' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 65976 - Disclosed: 2010-06-24

Description:

Unknown / Incomplete