[CLOSE] OSVDB ID : 72578 - Disclosed: 2011-05-31

Description:

(Description Provided by CVE) : FFmpeg before 0.5.4, as used in MPlayer and other products, allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a malformed RealMedia file.

[CLOSE] OSVDB ID : 72975 - Disclosed: 2011-05-31

Description:

(Description Provided by CVE) : The dissect_dcm_main function in epan/dissectors/packet-dcm.c in the DICOM dissector in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service (infinite loop) via an invalid PDU length.

[CLOSE] OSVDB ID : 72893 - Disclosed: 2011-05-31

Description:

HP LoadRunner is prone to an overflow condition. The program fails to properly sanitize user-supplied input resulting in a buffer overflow. With specially crafted parsing directives within a Virtual User Script (USR) file, a context-dependent attacker can potentially execute arbitrary code.

[CLOSE] OSVDB ID : 72976 - Disclosed: 2011-05-31

Description:

(Description Provided by CVE) : Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Diameter dictionary file.

[CLOSE] OSVDB ID : 72977 - Disclosed: 2011-05-31

Description:

(Description Provided by CVE) : The snoop_read function in wiretap/snoop.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 does not properly handle certain virtualizable buffers, which allows remote attackers to cause a denial of service (application crash) via a large length value in a snoop file that triggers a stack-based buffer over-read.

[CLOSE] OSVDB ID : 72978 - Disclosed: 2011-05-31

Description:

(Description Provided by CVE) : Double free vulnerability in the tvb_uncompress function in epan/tvbuff.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service (application crash) via a packet with malformed data that uses zlib compression.

[CLOSE] OSVDB ID : 72979 - Disclosed: 2011-05-31

Description:

(Description Provided by CVE) : Integer underflow in the visual_read function in wiretap/visual.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service (application crash) via a malformed Visual Networks file that triggers a heap-based buffer over-read.

[CLOSE] OSVDB ID : 73223 - Disclosed: 2011-05-31

Description:

(Description Provided by CVE) : Tivoli Endpoint in IBM Tivoli Management Framework 3.7.1, 4.1, 4.1.1, and 4.3.1 has an unspecified "built-in account" that is "trivially" accessed, which makes it easier for remote attackers to send requests to restricted pages via a session on TCP port 9495, a different vulnerability than CVE-2011-1220.

[CLOSE] OSVDB ID : 72579 - Disclosed: 2011-05-31

Description:

A memory corruption flaw exists in ffmpeg . The function fails to sanitize user-supplied file resulting in memory corruption. With a specially crafted file, an attacker can execute arbitrary code.

[CLOSE] OSVDB ID : 72731 - Disclosed: 2011-05-31

Description:

Kentico CMS contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the [PARAMETER | FIELD] [parameter | field] upon submission to the examples/webparts/membership/users-viewer.aspx script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 73250 - Disclosed: 2011-05-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 72974 - Disclosed: 2011-05-31

Description:

(Description Provided by CVE) : The bytes_repr_len function in Wireshark 1.4.5 uses an incorrect pointer argument, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via arbitrary TCP traffic.

[CLOSE] OSVDB ID : 72969 - Disclosed: 2011-05-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 76338 - Disclosed: 2011-05-31

Description:

WebKit contains a use-after-free error in the 'XMLDocumentParser::insertErrorMessageBlock' function in WebCore/dom/XMLDocumentParser.cpp when handling errors and displaying an error block. With a specially crafted SVG document, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.

[CLOSE] OSVDB ID : 76414 - Disclosed: 2011-05-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 76415 - Disclosed: 2011-05-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 76416 - Disclosed: 2011-05-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 87944 - Disclosed: 2011-05-31

Description:

IBM WebSphere MQ contains an unspecified flaw. No further details have been provided.

[CLOSE] OSVDB ID : 89588 - Disclosed: 2011-05-31

Description:

Opera contains an overflow condition that is triggered as certain unspecified user-supplied input is not properly validated. With This may allow a remote attacker to cause an unspecified overflow, resulting in a denial of service or potentially execution of arbitrary code.

[CLOSE] OSVDB ID : 73035 - Disclosed: 2011-05-30

Description:

(Description Provided by CVE) : GNOME Display Manager (gdm) before 2.32.2, when glib 2.28 is used, enables execution of a web browser with the uid of the gdm account, which allows local users to gain privileges via vectors involving the x-scheme-handler/http MIME type.

[CLOSE] OSVDB ID : 72640 - Disclosed: 2011-05-30

Description:

Html-edit CMS contains a flaw that allows a remote Cross-site Request Forgery (CSRF / XSRF) attack. The flaw exists because the application does not require multiple steps or explicit confirmation for sensitive transactions for the addition of pages. By using a crafted URL (e.g., a crafted GET request inside an "img" tag), an attacker may trick the victim into clicking on the image to take advantage of the trust relationship between the authenticated victim and the application. Such an attack could trick the victim into executing arbitrary commands in the context of their session with the application, without further prompting or verification.

[CLOSE] OSVDB ID : 72645 - Disclosed: 2011-05-30

Description:

Ajax File Manager contains a flaw related to the upload function. The issue is triggered when a remote attacker uploads arbitrary PHP files. This may allow an attacker to execute arbitrary PHP code in the context of the server.

[CLOSE] OSVDB ID : 74824 - Disclosed: 2011-05-30

Description:

(Description Provided by CVE) : fetchmail 5.9.9 through 6.3.19 does not properly limit the wait time after issuing a (1) STARTTLS or (2) STLS request, which allows remote servers to cause a denial of service (application hang) by acknowledging the request but not sending additional packets.

[CLOSE] OSVDB ID : 73243 - Disclosed: 2011-05-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 72726 - Disclosed: 2011-05-30

Description:

Freetag Plugin for Serendipity contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the plugins/serendipity_event_freetag/serendipity_event_freetag.php script does not validate input passed via the URL upon submission to the ndex.php?/plugin/tag/ script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 74378 - Disclosed: 2011-05-30

Description:

(Description Provided by CVE) : The X.509 certificate validation functionality in Mozilla Firefox 4.0.x through 4.0.1 does not properly implement single-session security exceptions, which might make it easier for user-assisted remote attackers to spoof an SSL server via an untrusted certificate that triggers potentially unwanted local caching of documents from that server.

[CLOSE] OSVDB ID : 72733 - Disclosed: 2011-05-30

Description:

Guru JustAnswer Professional contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the profile.php script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 72732 - Disclosed: 2011-05-30

Description:

sh404SEF Component for Joomla!contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate certain unspecified input before returning it to the user. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 72980 - Disclosed: 2011-05-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 72734 - Disclosed: 2011-05-30

Description:

Guru JustAnswer Professional contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the forum_answer.php script not properly sanitizing user-supplied input to the 'que_id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 72811 - Disclosed: 2011-05-30

Description:

CodeMeter WebAdmin contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'BoxSerial' parameter upon submission to the Licenses.html script in WebAdmin. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 72772 - Disclosed: 2011-05-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 72773 - Disclosed: 2011-05-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 72774 - Disclosed: 2011-05-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 72775 - Disclosed: 2011-05-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 72776 - Disclosed: 2011-05-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 72777 - Disclosed: 2011-05-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 79163 - Disclosed: 2011-05-29

Description:

By default, multiple Allied Telesis routers install with a default password. The 'manager' account has a password that can be computed using a special program and the MAC address of the router. The programs used to calculate the passwords were inadvertently leaked by the vendor. This allows attackers to trivially access the program or system and gain privileged access.

[CLOSE] OSVDB ID : 73599 - Disclosed: 2011-05-29

Description:

(Description Provided by CVE) : The destroy_one_secret function in nm-setting-vpn.c in libnm-util in the NetworkManager package 0.8.999-3.git20110526 in Fedora 15 creates a log entry containing a certificate password, which allows local users to obtain sensitive information by reading a log file.

[CLOSE] OSVDB ID : 72741 - Disclosed: 2011-05-29

Description:

Joomnik Gallery Component for Joomla! contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script not properly sanitizing user-supplied input to the 'album' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.