[CLOSE] OSVDB ID : 87437 - Disclosed: 2002-07-19

Description:

Geeklog contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate input passed via stories or comment bodies by stripping out HTML elements. This may allow a user to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 7983 - Disclosed: 2002-07-18

Description:

PunBB contains a flaw that may allow a remote attacker to modify arbitrary post subjects. No further details have been provided.

[CLOSE] OSVDB ID : 14488 - Disclosed: 2002-07-18

Description:

(Description Provided by CVE) : Buffer overflow in the control service for MERCUR Mailserver 4.2 allows remote attackers to execute arbitrary code via a long password.

[CLOSE] OSVDB ID : 9633 - Disclosed: 2002-07-18

Description:

(Description Provided by CVE) : Unknown vulnerability in HP Instant Support Enterprise Edition (ISEE) product U2512A for HP-UX 11.00 and 11.11 may allow authenticated users access to access restricted files.

[CLOSE] OSVDB ID : 59367 - Disclosed: 2002-07-18

Description:

(Description Provided by CVE) : CRLF injection vulnerability in the "User Profile: Send Email" feature in Geeklog 1.35 and 1.3.5sr1 allows remote attackers to obtain e-mail addresses by injecting a CRLF into the Subject field and adding a BCC mail header.

[CLOSE] OSVDB ID : 8386 - Disclosed: 2002-07-17

Description:

The Mozilla Web Browser contains a flaw that could allow a remote site to enumerate web sites visited by the user. This flaw exists because the eval() functions lacks sufficient access controls.

[CLOSE] OSVDB ID : 18531 - Disclosed: 2002-07-17

Description:

Linux dump contains a flaw that may allow a local denial of service. The issue is triggered when a malicious user uses 'dump' to execute a lock on the /etc/dumpdates file, and will result in loss of availability for the dump service.

[CLOSE] OSVDB ID : 6695 - Disclosed: 2002-07-17

Description:

(Description Provided by CVE) : rwcgi60 CGI program in Oracle Reports Server, by design, provides sensitive information such as the full pathname, which could enable remote attackers to use the information in additional attacks.

[CLOSE] OSVDB ID : 9231 - Disclosed: 2002-07-17

Description:

Macromedia Sitespring contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'et' parameter upon submission to the '500error.jsp' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 9982 - Disclosed: 2002-07-17

Description:

The ZyXEL Prestige 642R router contains a flaw that may allow a remote denial of service. The issue is triggered when a remote attacker send a TCP packet with the SYN and ACK flags set, and will result in loss of availability for the device short period of time.

[CLOSE] OSVDB ID : 4629 - Disclosed: 2002-07-17

Description:

(Description Provided by CVE) : Jigsaw 2.2.1 on Windows systems allows remote attackers to use MS-DOS device names in HTTP requests to (1) cause a denial of service using the "con" device, or (2) obtain the physical path of the server using two requests to the "aux" device.

[CLOSE] OSVDB ID : 4628 - Disclosed: 2002-07-17

Description:

(Description Provided by CVE) : Jigsaw 2.2.1 on Windows systems allows remote attackers to use MS-DOS device names in HTTP requests to (1) cause a denial of service using the "con" device, or (2) obtain the physical path of the server using two requests to the "aux" device.

[CLOSE] OSVDB ID : 5498 - Disclosed: 2002-07-17

Description:

PHPWiki contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the pagename variable in the wiki module. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 850 - Disclosed: 2002-07-17

Description:

(Description Provided by CVE) : Caucho Technology Resin server 2.1.1 to 2.1.2 allows remote attackers to obtain server's root path via requests for MS-DOS device names such as lpt9.xtp.

[CLOSE] OSVDB ID : 59909 - Disclosed: 2002-07-17

Description:

(Description Provided by CVE) : tip on multiple BSD-based operating systems allows local users to cause a denial of service (execution prevention) by using flock() to lock the /var/log/acculog file.

[CLOSE] OSVDB ID : 59910 - Disclosed: 2002-07-17

Description:

(Description Provided by CVE) : tip on multiple BSD-based operating systems allows local users to cause a denial of service (execution prevention) by using flock() to lock the /var/log/acculog file.

[CLOSE] OSVDB ID : 60254 - Disclosed: 2002-07-17

Description:

(Description Provided by CVE) : Winamp 2.65 through 3.0 stores skin files in a predictable file location, which allows remote attackers to execute arbitrary code via a URL reference to (1) wsz and (2) wal files that contain embedded code.

[CLOSE] OSVDB ID : 87436 - Disclosed: 2002-07-17

Description:

Python Pickle Module contains a flaw that is triggered when an error occurs during the unpickling of data. This may allow a context-dependent attacker to execute arbitrary system commands.

[CLOSE] OSVDB ID : 87435 - Disclosed: 2002-07-17

Description:

Python Pickle Module contains a flaw that is triggered when an error occurs in the SmartCookie class during the handling of constructor data. This may allow a context-dependent attacker to execute arbitrary system commands.

[CLOSE] OSVDB ID : 6769 - Disclosed: 2002-07-16

Description:

A remote overflow exists in Oddspot Song Requester. The Song Requester fails to check the length of multiple variables in the request.cgi script resulting in a buffer overflow. With a specially crafted request, an attacker can cause a DoS resulting in a loss of availability.

[CLOSE] OSVDB ID : 60062 - Disclosed: 2002-07-16

Description:

(Description Provided by CVE) : Cross-site scripting vulnerability AOL Instant Messenger (AIM) 4.5 and 4.7 for MacOS and Windows allows remote attackers to conduct unauthorized activities, such as adding buddies and groups to a user's buddy list, via a URL with a META HTTP-EQUIV="refresh" tag to an aim: URL.

[CLOSE] OSVDB ID : 3955 - Disclosed: 2002-07-16

Description:

MIT cgiemail contains a flaw that allows a remote attacker to send e-mail without authentication. The issue us due to the program not asking or requiring authentication credentials to send e-mail. If an attacker (or spammer) uses this, mail can be sent through the server and made to appear from the victim network.

[CLOSE] OSVDB ID : 11365 - Disclosed: 2002-07-16

Description:

(Description Provided by CVE) : Buffer overflow in ipcs for HP Tru64 UNIX 4.0f through 5.1a may allow attackers to execute arbitrary code, a different vulnerability than CVE-2001-0423.

[CLOSE] OSVDB ID : 59762 - Disclosed: 2002-07-16

Description:

(Description Provided by CVE) : Unknown vulnerability in inetd in HP Tru64 Unix 4.0f through 5.1a allows remote attackers to cause a denial of service via unknown attack vectors.

[CLOSE] OSVDB ID : 88848 - Disclosed: 2002-07-16

Description:

NetWin SurgeFTP contains a flaw that may lead to unauthorized disclosure of potentially sensitive information. The issue is due to the command line displaying login credentials. This may allow a local attacker to gain access to credential information via a process listing.

[CLOSE] OSVDB ID : 16393 - Disclosed: 2002-07-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 16392 - Disclosed: 2002-07-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 4366 - Disclosed: 2002-07-15

Description:

Symantec personal firewalls contain a flaw that may allow a remote attacker to execute arbitrary code. The issue is due to the HTTP proxy not sanitizing all forms of user input. If an attacker can trick a user into sending an overly long outgoing HTTP request through the proxy, they may be able to have their code executed by the user with elevated privileges. This scenario could be achieved by sending an e-mail with an HREF link or having the user visit a hostile web page.

[CLOSE] OSVDB ID : 27088 - Disclosed: 2002-07-15

Description:

(Description Provided by CVE) : Format string vulnerability in newsx NNTP client before 1.4.8 allows local users to execute arbitrary code via format string specifiers that are not properly handled in a call to the syslog function.

[CLOSE] OSVDB ID : 5049 - Disclosed: 2002-07-15

Description:

Cisco Secure ACS contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'action' variables upon submission to 'setup.exe' handler. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 6767 - Disclosed: 2002-07-15

Description:

(Description Provided by CVE) : Buffer overflow in web server for Tivoli Management Framework (TMF) Endpoint 3.6.x through 3.7.1, before Fixpack 2, allows remote attackers to cause a denial of service or execute arbitrary code via a long HTTP GET request.

[CLOSE] OSVDB ID : 6768 - Disclosed: 2002-07-15

Description:

(Description Provided by CVE) : Buffer overflow in web server for Tivoli Management Framework (TMF) ManagedNode 3.6.x through 3.7.1 allows remote attackers to cause a denial of service or execute arbitrary code via a long HTTP GET request.

[CLOSE] OSVDB ID : 10927 - Disclosed: 2002-07-15

Description:

(Description Provided by CVE) : Buffer overflows in IMAP Agent (imapd) for Novell NetMail (NIMS) 3.0.3 before 3.0.3A allows remote attackers to cause a denial of service.

[CLOSE] OSVDB ID : 59363 - Disclosed: 2002-07-15

Description:

123tkShop contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'function_describe_item1.inc.php' script not properly sanitizing user-supplied input to the unspecified parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 59364 - Disclosed: 2002-07-15

Description:

(Description Provided by CVE) : Directory traversal vulnerability in function_foot_1.inc.php for Thorsten Korner 123tkShop before 0.3.1 allows remote attackers to read arbitrary files via .. (dot dot) sequences terminated by a null character in the $designNo variable, which is part of an "include" function call.

[CLOSE] OSVDB ID : 59275 - Disclosed: 2002-07-15

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in FuseTalk 2.0 and 3.0 allows remote attackers to insert arbitrary HTML and web script.

[CLOSE] OSVDB ID : 60241 - Disclosed: 2002-07-15

Description:

(Description Provided by CVE) : Sun PC NetLink 1.0 through 1.2 does not properly set the access control list (ACL) for files and directories that use symbolic links and have been restored from backup, which could allow local or remote attackers to bypass intended access restrictions.

[CLOSE] OSVDB ID : 87434 - Disclosed: 2002-07-15

Description:

ICQ contains a flaw that is triggered during the handling of a specially crafted SCM file. This may allow a remote attacker to manipulate arbitrary sound schemes.

[CLOSE] OSVDB ID : 5848 - Disclosed: 2002-07-14

Description:

(Description Provided by CVE) : Cross-site scripting vulnerability in Double Choco Latte (DCL) before 20020706 allows remote attackers to inject arbitrary HTML, including script, into web pages via the (1) Ticket# Find, (2) Priorities, (3) Severities, (4) Projects, (5) WO# Find, (6) Departments and (7) Users features.

[CLOSE] OSVDB ID : 11330 - Disclosed: 2002-07-12

Description:

Unknown / Incomplete