| OSVDB ID | Disclosure Date | Title |
|---|
|
12517
Description:
(Description Provided by CVE) : Cross-site scripting vulnerability in the parser for Gadu-Gadu allows remote attackers to inject arbitrary web script or HTML via (1) http:// or (2) news:// URLs, a different vulnerability than CVE-2004-1410.
|
2004-12-13
|
Gadu-Gadu http: / news: HREF Script Injection
|
|
12519
Description:
(Description Provided by CVE) : Stack-based buffer overflow in the code that sends images in Gadu-Gadu allows remote attackers to execute arbitrary code via a large image filename.
|
2004-12-13
|
Gadu-Gadu Image Handling filename Overflow
|
|
21016
Description:
A remote overflow exists in Gadu-Gadu. The online chat system fails to check the length of the file name of images, resulting in a stack based buffer overflow. With a specially crafted request, an attacker can cause an overflow of 9 bytes resulting in a loss of availability.
|
2005-11-21
|
Gadu-Gadu Image Name Length Overflow DoS
|
|
12520
Description:
(Description Provided by CVE) : Gadu-Gadu allows remote attackers to bypass the "image send" option by sending a very small image file, which could be used in conjunction with image-related vulnerabilities.
|
2004-12-13
|
Gadu-Gadu image send Option Small Image Bypass
|
|
9901
Description:
A remote overflow exists in Gadu Gadu Instant Messenger. The Gadu Gadu Instant Messenger fails to properly check GG_SEND_MSG packet and the subsequent GG_MSG_IMAGE_REPLY resulting in a heap memory overflow. With a specially crafted request, an attacker can run arbitrary code in the context of the current user resulting in a loss of integrity.
|
2004-09-12
|
Gadu-Gadu Image Sending Overflow
|
|
19228
Description:
Unknown / Incomplete
|
2004-09-23
|
Gadu-Gadu Invisible User Status Disclosure Bypass
|
|
12525
Description:
(Description Provided by CVE) : Gadu-Gadu build 155 and earlier allows remote attackers to cause a denial of service (infinite loop) via a message that contains an image whose filename does not start with restricted characters.
|
2004-12-17
|
Gadu-Gadu Malformed Image Filename DoS
|
|
15978
Description:
(Description Provided by CVE) : Gadu-Gadu 6.1 build 156 allows remote attackers to cause a denial of service (application hang) via a message that contains many special strings that are converted to images.
|
2004-12-20
|
Gadu-Gadu Message Strings Image Conversion DoS
|
|
21015
Description:
Gadu-Gadu contains a flaw that may allow a remote denial of service. The issue is triggered when MS-DOS filenames ("LPT:", "AUX:") are used for image processing, and will result in loss of availability for the service.
|
2005-11-21
|
Gadu-Gadu MS-DOS Filename Transfer DoS
|
|
12524
Description:
(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in Gadu-Gadu build 155 and earlier allows remote attackers to inject arbitrary web script via a URL, which is echoed in a popup window that displays a parsing error message, a different vulnerability than CVE-2004-1229.
|
2004-12-17
|
Gadu-Gadu URL Parser Javascript XSS
|
|
76115
Description:
Gaestebuch contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'guestbook/gbook.php' script not properly sanitizing user input supplied to the 'script_pfad' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.
|
2010-08-26
|
Gaestebuch guestbook/gbook.php script_pfad Parameter Remote File Inclusion
|
|
43352
Description:
gaestebuch Module for PHP-Nuke contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'modules.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.
|
2008-03-01
|
gaestebuch Module for PHP-Nuke modules.php id Parameter SQL Injection
|
|
13302
Description:
(Description Provided by CVE) : showtemp.cfm for Gafware CFXImage 1.6.6 allows remote attackers to read arbitrary files via (1) a .. or (2) a C: style pathname in the FILE parameter.
|
2002-05-29
|
Gafware CFXImage showtemp.cfm Traversal Arbitrary File Access
|
|
5310
Description:
Gaim contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when Gaim is used to check web mail on startup, world readable files are created in /tmp which will disclose sensitive information, including authentication credentials resulting in a loss of confidentiality.
|
2004-04-08
|
Gaim /tmp File Account Credentials Disclosure
|
|
33837
Description:
Unknown / Incomplete
|
2007-02-22
|
Gaim Animated Smiley Saturation DoS
|
|
18669
Description:
A remote overflow exists in gaim. The program fails to validate away messages resulting in a buffer overflow. With a specially crafted away message, an attacker can cause arbitrary code execution resulting in a loss of integrity.
|
2005-08-10
|
Gaim Away Message Processing Remote Overflow
|
|
8628
Description:
gaim contains a flaw that may allow a remote denial of service. The issue is triggered due to the 'buddy pounce' feature. It is possible for a remote attacker to add a buddy and to create a specially crafted buddy pounce message containing a HTML FONT SIZE tag with a value of 10,000, which causes the application to crash when the victim receives the message.
|
2003-06-26
|
Gaim Buddy Pounce Font Size Client DoS
|
|
9264
Description:
Gaim contains a flaw that may allow a remote denial of service. The issue is triggered when a malicious user sends an overly large content-length header value and Gaim tries to allocate buffer big enough to store the content. If value exceeds amount of available memory Gaim will crash and will result in loss of availability for the system.
|
2004-08-26
|
Gaim Content-Length Header DoS
|
|
8626
Description:
gaim contains a flaw related to the 'toc_build_config' function in dialogs.c that may allow an attacker to cause a buffer overlow. No further details have been provided.
|
2001-02-08
|
Gaim dialogs.c toc_build_config Overflow
|
|
3734
Description:
A remote overflow exists in gaim. Gaim fails to correctly parse some malformed directIM packets, resulting in a heap overflow. With a specially crafted request, an attacker can cause the execution of arbitrary code resulting in a loss of integrity.
|
2004-01-27
|
Gaim DirectIM AIM/Oscar Integer Buffer Overflow
|
|
8961
Description:
A local overflow exists in gaim. The encode_spaces() function fails to perform proper bounds checking resulting in a buffer overflow. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.
|
2004-08-05
|
Gaim encode_spaces() Function Overflow
|
|
8630
Description:
gaim contains a flaw related to the 'g_strsplit' function in eval.c that may allow an attacker to cause a buffer overflow. No further details have been provided.
|
2002-03-03
|
Gaim eval.c g_strsplit Function Overflow
|
|
3733
Description:
A remote overflow exists in Gaim. The Extract Info Field Function combines data from two tokens into a fixed-length stack buffer without properly checking the size of the resulting string, resulting in a buffer overflow. With a specially crafted set of data, an attacker can overflow the buffer and possibly execute arbitrary code on the system, resulting in a loss of integrity.
|
2004-01-27
|
Gaim Extract Info Field Function Buffer Overflow
|
|
12352
Description:
Unknown / Incomplete
|
2004-12-03
|
Gaim Festival Plugin Unspecified Format String DoS
|
|
18587
Description:
Gaim contains a flaw that may lead to an unauthorized password exposure. It is possible to gain access to plaintext passwords within the file accounts.xml, which may lead to a loss of confidentiality.
|
2005-08-05
|
Gaim for Windows accounts.xml Cleartext Password Local Disclosure
|
|
15276
Description:
A remote overflow exists in Gaim. The 'gaim_markup_strip_html()' function fails to perform proper bounds checking resulting in a buffer overflow. By issuing a string that contains malformed HTML, a remote attacker can cause the application to crash resulting in a loss of availability.
|
2005-04-01
|
Gaim gaim_markup_strip_html Function Malformed HTML DoS
|
|
9260
Description:
A remote overflow exists in Gaim. Gaim fails to check integer length resulting in a buffer overflow. With a specially crafted request, an attacker running a malicious groupware server can execute arbitrary commands on a gaim client resulting in a loss of integrity.
|
2004-08-26
|
Gaim Groupware Message Receive Overflow
|
|
3732
Description:
A remote overflow exists in Gaim. The HTTP proxy (http_canread function) subsystem fails to check if the proxy sends more than 8192 bytes in a line, resulting in a buffer overflow. With a malicious proxy sending specially crafted input, an attacker can overwrite the buffer and gain control of the instruction pointer resulting in a loss of integrity.
|
2004-01-27
|
Gaim HTTP Proxy Connect Overflow
|
|
15277
Description:
Gaim contains a flaw that may allow a remote attacker to inject arbitrary Gaim markup. The issue is triggered due to multiple functions of the IRC protocol plugin. It is possible that the flaw may allow a remote attacker to inject arbitrary Gaim markups over IRC resulting in a loss of integrity.
|
2005-04-01
|
Gaim IRC Plugin Multiple Function Arbitrary Gaim Markup Injection
|
|
15280
Description:
(Description Provided by CVE) : The IRC protocol plugin in Gaim 1.2.0, and possibly earlier versions, allows (1) remote attackers to inject arbitrary Gaim markup via irc_msg_kick, irc_msg_mode, irc_msg_part, irc_msg_quit, (2) remote attackers to inject arbitrary Pango markup and pop up empty dialog boxes via irc_msg_invite, or (3) malicious IRC servers to cause a denial of service (application crash) by injecting certain Pango markup into irc_msg_badmode, irc_msg_banned, irc_msg_unknown, irc_msg_nochan functions.
|
2005-04-02
|
Gaim IRC Server Arbitrary Pango Markup Injection
|
