[CLOSE] OSVDB ID : 80794 - Disclosed: 2012-03-31

Description:

SocialCMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the my_admin/admin1_list_pages.php script not properly sanitizing user-supplied input to the 'TR_title' parameter and the 'title' field. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80746 - Disclosed: 2012-03-31

Description:

SyndeoCMS contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'Email Address' field upon submission to the starnet/index.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 80914 - Disclosed: 2012-03-31

Description:

World Graphics contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the blog-detail.php script not properly sanitizing user-supplied input to the 'id_post' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80915 - Disclosed: 2012-03-31

Description:

Flock contains a flaw that may allow a denial of service. The issue is triggered when handling unicode, and will result in loss of availability for the application.

[CLOSE] OSVDB ID : 80764 - Disclosed: 2012-03-31

Description:

[WN]KT KickTipp Addon for Woltlab Burning Board contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the kt_main.php script not properly sanitizing user-supplied input to the 'liga_id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80916 - Disclosed: 2012-03-31

Description:

Anden sal contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the page.php script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80819 - Disclosed: 2012-03-30

Description:

QuickBooks contains a flaw related to HelpAsyncPluggableProtocol.dll that may lead to an unauthorized information disclosure. The issue is triggered when a attacker supplies the path and file name of a .ZIP help file which uses backslashes, which will disclose sensitive information to a remote attacker.

[CLOSE] OSVDB ID : 80871 - Disclosed: 2012-03-30

Description:

IBM Tivoli Directory Server contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because certain unspecified input passed via the web admin tool is not properly sanitized before being returned to the user. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 80745 - Disclosed: 2012-03-30

Description:

Dalbum contains a flaw that allows a remote Cross-site Request Forgery (CSRF / XSRF) attack. The flaw exists because the application does not require multiple steps or explicit confirmation for sensitive transactions for the addition of a user, removal of a user, or changing the password of a user. By using a crafted URL (e.g., a crafted GET request inside an "img" tag), an attacker may trick the victim into clicking on the image to take advantage of the trust relationship between the authenticated victim and the application. Such an attack could trick the victim into executing arbitrary commands in the context of their session with the application, without further prompting or verification.

[CLOSE] OSVDB ID : 80768 - Disclosed: 2012-03-30

Description:

Havalite CMS contains a flaw related to the hava_upload.php script. The issue may allow an attack to upload arbitrary files.

[CLOSE] OSVDB ID : 80769 - Disclosed: 2012-03-30

Description:

Havalite CMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the hava_post.php script not properly sanitizing user-supplied input to the 'postId' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80770 - Disclosed: 2012-03-30

Description:

Havalite CMS contains a flaw that may lead to an unauthorized information disclosure.  The issue is triggered when an error in data/havalite.db3 occurs, which will disclose database information to a remote attacker.

[CLOSE] OSVDB ID : 80778 - Disclosed: 2012-03-30

Description:

PHP contains a flaw related to the eregi() function. By exhausting available memory, the memory_limit directive restrictions can be bypassed.

[CLOSE] OSVDB ID : 80796 - Disclosed: 2012-03-30

Description:

LandShop contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the landshop/admin/action/objects.php script not properly sanitizing user-supplied input to the 'OB_ID' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80799 - Disclosed: 2012-03-30

Description:

Landshop contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate input passed to the create object function. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 80800 - Disclosed: 2012-03-30

Description:

Landshop contains a flaw that allows a remote Cross-site Request Forgery (CSRF / XSRF) attack. The flaw exists because the application does not require multiple steps or explicit confirmation for sensitive transactions for the manipulation of the user form. By using a crafted URL (e.g., a crafted GET request inside an "img" tag), an attacker may trick the victim into clicking on the image to take advantage of the trust relationship between the authenticated victim and the application. Such an attack could trick the victim into executing arbitrary commands in the context of their session with the application, without further prompting or verification.

[CLOSE] OSVDB ID : 80891 - Disclosed: 2012-03-30

Description:

Multiple products for Invensys are prone to an overflow condition related to the WWCabFile ActiveX control. The Open() and AddFile() methods fail to properly sanitize user-supplied input resulting in a heap-based buffer overflow. With a specially crafted overly long string, a remote attacker can potentially execute arbitrary code.

[CLOSE] OSVDB ID : 81807 - Disclosed: 2012-03-30

Description:

Intuit QuickBooks contains a flaw that may allow a remote denial of service. The issue is triggered when an error in intu-help-qb helpers within HelpAsyncPluggableProtocol.dll occurs when parsing inpt passed via the URL, and will result in loss of availability for the program.

[CLOSE] OSVDB ID : 80744 - Disclosed: 2012-03-30

Description:

MailMax is prone to an overflow condition. The program fails to properly sanitize user-supplied input resulting in a buffer overflow. With a specially crafted POP3 USER command, a remote attacker can potentially execute arbitrary code.

[CLOSE] OSVDB ID : 80772 - Disclosed: 2012-03-30

Description:

GetSimple CMS contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when backups/pages/ is accessed, which will disclose backup information to a remote attacker.

[CLOSE] OSVDB ID : 80773 - Disclosed: 2012-03-30

Description:

PTK contains a flaw that may lead to an unauthorized information disclosure.  The issue may allow a remote attacker uses a direct request to gain access to log, evidence, and report files.

[CLOSE] OSVDB ID : 80774 - Disclosed: 2012-03-30

Description:

PTK contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'arg4' parameter upon submission to the ptk/lib/modal_bookmark.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 80781 - Disclosed: 2012-03-30

Description:

ArticleSetup contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the upload/feed.php script not properly sanitizing user-supplied input to the 'cat' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80782 - Disclosed: 2012-03-30

Description:

ArticleSetup contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the upload/search.php script not properly sanitizing user-supplied input to the 's' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80791 - Disclosed: 2012-03-30

Description:

WebMatter CMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the subcategoria.asp script not properly sanitizing user-supplied input to the 'id_subcat' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80792 - Disclosed: 2012-03-30

Description:

WebMatter CMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the lista_productos.asp script not properly sanitizing user-supplied input to the 'id_cat' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80795 - Disclosed: 2012-03-30

Description:

JAMWiki contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'num' parameter upon submission to Special:AllPages. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 80797 - Disclosed: 2012-03-30

Description:

LandShop contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the landshop/admin/action/pdf.php script not properly sanitizing user-supplied input to the 'start' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80798 - Disclosed: 2012-03-30

Description:

Landshop contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the landshop/admin/action/areas.php script not properly sanitizing user-supplied input to the 'AREA_ID' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80793 - Disclosed: 2012-03-30

Description:

Php Agenda contains a flaw that allows a remote Cross-site Request Forgery (CSRF / XSRF) attack. The flaw exists because the application does not require multiple steps or explicit confirmation for sensitive transactions for the Add Administrator, Delete Existing Administrator, Add a New Event, Delete an Existing Event. By using a crafted URL (e.g., a crafted GET request inside an "img" tag), an attacker may trick the victim into clicking on the image to take advantage of the trust relationship between the authenticated victim and the application. Such an attack could trick the victim into executing arbitrary commands in the context of their session with the application, without further prompting or verification.

[CLOSE] OSVDB ID : 80727 - Disclosed: 2012-03-30

Description:

VMware contains a flaw in multiple products that may allow an attacker to gain access to unauthorized privileges. The issue is triggered when a local attacker may direct input via REP INSB instructions to the high-bandwidth backdoor in order to modify the content of read-only memory, leading to an escalation of privileges.

[CLOSE] OSVDB ID : 80779 - Disclosed: 2012-03-30

Description:

ArticleSetup contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the upload/login.php script not properly sanitizing user-supplied input to the 'userid' and 'password' parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80775 - Disclosed: 2012-03-30

Description:

PTK contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when the HTTPOnly attribute is not set on a cookie, allowing the value to be read or set, allowing a remote attacker to obtain sensitive information via accessing the cookie.

[CLOSE] OSVDB ID : 80776 - Disclosed: 2012-03-30

Description:

PHP Designer contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the announce.php script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80777 - Disclosed: 2012-03-30

Description:

PHP Designer contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the read_news.php script not properly sanitizing user-supplied input to the 'news_id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80780 - Disclosed: 2012-03-30

Description:

ArticleSetup contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the upload/admin/login.php script not properly sanitizing user-supplied input to the 'userid' and 'password' parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80783 - Disclosed: 2012-03-30

Description:

ArticleSetup contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the upload/admin/pageedit.php script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80784 - Disclosed: 2012-03-30

Description:

ArticleSetup contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the upload/admin/authoredit.php script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80785 - Disclosed: 2012-03-30

Description:

ArticleSetup contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the admin/categoryedit.php script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80786 - Disclosed: 2012-03-30

Description:

ArticleSetup contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the upload/search.php script not properly sanitizing user-supplied input to the 's' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.