[CLOSE] OSVDB ID : 77102 - Disclosed: 2011-11-14

Description:

(Description Provided by CVE) : APIFTP Server in Optimalog Optima PLC 1.5.2 and earlier allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.

[CLOSE] OSVDB ID : 77161 - Disclosed: 2011-11-14

Description:

(Description Provided by CVE) : IBM AIX 6.1 and 7.1 does not restrict the wpar_limits_config and wpar_limits_modify system calls, which allows local users to cause a denial of service (system crash) via a crafted call.

[CLOSE] OSVDB ID : 77174 - Disclosed: 2011-11-14

Description:

(Description Provided by CVE) : IBM WebSphere MQ 6.0 on OpenVMS, when the default rights of the MQM group are established, does not properly verify User Authorization File (UAF) data, which allows local users to kill listener processes and the command server via a control command.

[CLOSE] OSVDB ID : 77177 - Disclosed: 2011-11-14

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 87718 - Disclosed: 2011-11-14

Description:

CodeIgniter contains a flaw that may allow a remote attacker to inject an unspecified parameter in to the security library. No further details have been provided.

[CLOSE] OSVDB ID : 87717 - Disclosed: 2011-11-14

Description:

CodeIgniter contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate certain unspecified input passed via common functions before returning it to the user. This may allow a user to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 87716 - Disclosed: 2011-11-14

Description:

CodeIgniter contains a flaw that may allow a remote attacker to inject unspecified input to the database driver. No further details have been provided.

[CLOSE] OSVDB ID : 89940 - Disclosed: 2011-11-14

Description:

By default, Delta Controls ENTELITOUCH installs with default user credentials (username/password combination). The 'DELTA' account has a password of 'LOGIN', which is publicly known and documented. This allows remote attackers to trivially access the program or system and gain privileged access.

[CLOSE] OSVDB ID : 77183 - Disclosed: 2011-11-13

Description:

(Description Provided by CVE) : Unrestricted file upload vulnerability in includes/inline_image_upload.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in temp/.

[CLOSE] OSVDB ID : 86003 - Disclosed: 2011-11-13

Description:

BBShop contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the bbshop/admin/admin.php script not properly sanitizing user input supplied to the '_shop_path' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 86002 - Disclosed: 2011-11-13

Description:

BBShop contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the bbshop/admin/index.php script not properly sanitizing user input supplied to the '_shop_path' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 77091 - Disclosed: 2011-11-13

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 77095 - Disclosed: 2011-11-13

Description:

Search Plugin for Hotaru CMS contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'return' and 'search' parameters upon submission to the index.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 77180 - Disclosed: 2011-11-13

Description:

V-CMS contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'p' parameter upon submission to the redirect.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 77181 - Disclosed: 2011-11-13

Description:

V-CMS contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the includes/TrueColorPicker/class.TrueColorPicker.php script does not validate the 'box' parameter upon submission to the includes/TrueColorPicker/index.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 77182 - Disclosed: 2011-11-13

Description:

V-CMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the process.php script not properly sanitizing user-supplied input to the 'user' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 77680 - Disclosed: 2011-11-13

Description:

Search Plugin for Hotaru CMS contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'SITE_NAME' parameter upon submission to the admin_index.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 86001 - Disclosed: 2011-11-13

Description:

BBShop contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the bbshop/shop/index.php script not properly sanitizing user input supplied to the '_shop_path' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 86000 - Disclosed: 2011-11-13

Description:

BBShop contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the bbshop/shop/main.php script not properly sanitizing user input supplied to the '_shop_path' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 77156 - Disclosed: 2011-11-11

Description:

Tiki Wiki CMS/Groupware contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the templates/tiki-admin_system.tpl script does not validate input passed via the URL upon submission to the tiki-admin_system.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 77167 - Disclosed: 2011-11-11

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in SAP/BW/DOC/METADATA in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via the page parameter.

[CLOSE] OSVDB ID : 80827 - Disclosed: 2011-11-11

Description:

Tiki contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the input passed via the URL upon submission to the tiki-remind_password.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 80828 - Disclosed: 2011-11-11

Description:

Tiki contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate input passed via the URL upon submission to the tiki-index.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 80829 - Disclosed: 2011-11-11

Description:

Tiki contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate input passed via the url upon submission to the tiki-login_scr.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 80830 - Disclosed: 2011-11-11

Description:

Tiki contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate input passed via the URL upon submission to the tiki-removepage.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 80831 - Disclosed: 2011-11-11

Description:

Tiki contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate input passed via the URL upon submission to the tiki-rename_page.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 84875 - Disclosed: 2011-11-11

Description:

By default, HP Virtual SAN Appliance HP SAN/iQ installs with a default password. The global$agent account has a password of L0CAlu53R which is publicly known and documented. This allows attackers to trivially access hydra.exe and gain privileged access.

[CLOSE] OSVDB ID : 77099 - Disclosed: 2011-11-11

Description:

DLGuard contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'searchCart' parameter upon submission to the index.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 77155 - Disclosed: 2011-11-11

Description:

Tiki Wiki CMS/Groupware contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the lib/smarty_tiki/function.query.php script does not validate input passed via the URL upon submission to the tiki-pagehistory.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 77166 - Disclosed: 2011-11-11

Description:

SAP NetWeaver contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the program does not validate certain unspecified input upon submission to BAPI explorer. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 77165 - Disclosed: 2011-11-11

Description:

SAP NetWeaver contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'instname' parameter upon submission to the VsiTestScan servlet. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 77168 - Disclosed: 2011-11-11

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 77169 - Disclosed: 2011-11-11

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 77170 - Disclosed: 2011-11-11

Description:

SAP NetWeaver contains a flaw that allows a remote Cross-site Request Forgery (CSRF / XSRF) attack. The flaw exists because the SPML Service does not require multiple steps or explicit confirmation for sensitive transactions for the addition of new users. By using a crafted URL (e.g., a crafted GET request inside an "img" tag), an attacker may trick the victim into clicking on the image to take advantage of the trust relationship between the authenticated victim and the application. Such an attack could trick the victim into executing arbitrary commands in the context of their session with the application, without further prompting or verification.

[CLOSE] OSVDB ID : 77171 - Disclosed: 2011-11-11

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 77164 - Disclosed: 2011-11-11

Description:

SAP NetWeaver contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'name' parameter upon submission to the VsiTestServlet servlet. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 77372 - Disclosed: 2011-11-11

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 82087 - Disclosed: 2011-11-11

Description:

HP StorageWorks P4000 Virtual SAN Appliance Software contains a flaw that is related to hard-coded credentials in the management service on TCP port 13838, which may allow a remote attacker to bypass authentication and execute arbitrary commands.

[CLOSE] OSVDB ID : 83318 - Disclosed: 2011-11-11

Description:

Kool Media Converter contains a flaw that may allow for a denial of service. The issue is triggered when a user opens a malformed OGG file, resulting in a loss of availability for the program. This can be exploited remotely by tricking a user into opening the crafted file (e.g., via email), or locally by placing it in a location that may seem safe (e.g., a network share).

[CLOSE] OSVDB ID : 84543 - Disclosed: 2011-11-11

Description:

wxBitcoin and bitcoind contain a flaw that is triggered when the encrypt wallet feature fails to properly communicate with the deletion functionality of BSDDB. This may allow a context-dependent attacker to bypass the BSDDB interface and gain access to potentially sensitive private key information.