[CLOSE] OSVDB ID : 21254 - Disclosed: 2005-11-28

Description:

B2B trading Marketplace Script contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the products.php script not properly sanitizing user-supplied input to the 'cid' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 21255 - Disclosed: 2005-11-28

Description:

B2B trading Marketplace Script contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the profiles.php script not properly sanitizing user-supplied input to the 'cid' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 21174 - Disclosed: 2005-11-28

Description:

BedengPSP contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the baca.php script not properly sanitizing user-supplied input to the 'ckode' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 21175 - Disclosed: 2005-11-28

Description:

BedengPSP contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the download.php script not properly sanitizing user-supplied input to the 'a.ngroup' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 21176 - Disclosed: 2005-11-28

Description:

BedengPSP contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script not properly sanitizing user-supplied input to the 'a.nsub' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 21166 - Disclosed: 2005-11-28

Description:

(Description Provided by CVE) : Direct static code injection vulnerability in error.php in GuppY 4.5.9 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via the _SERVER[REMOTE_ADDR] parameter, which is injected into a .inc script that is later included by the main script.

[CLOSE] OSVDB ID : 21167 - Disclosed: 2005-11-28

Description:

(Description Provided by CVE) : Multiple directory traversal vulnerabilities in GuppY 4.5.9 and earlier allow remote attackers to read and include arbitrary files via (1) the meskin parameter to admin/editorTypetool.php, or the lng parameter to the in admin/inc scripts (2) archbatch.php, (3) dbbatch.php, and (4) nwlmail.php.

[CLOSE] OSVDB ID : 21168 - Disclosed: 2005-11-28

Description:

(Description Provided by CVE) : Multiple directory traversal vulnerabilities in GuppY 4.5.9 and earlier allow remote attackers to read and include arbitrary files via (1) the meskin parameter to admin/editorTypetool.php, or the lng parameter to the in admin/inc scripts (2) archbatch.php, (3) dbbatch.php, and (4) nwlmail.php.

[CLOSE] OSVDB ID : 21169 - Disclosed: 2005-11-28

Description:

(Description Provided by CVE) : Multiple directory traversal vulnerabilities in GuppY 4.5.9 and earlier allow remote attackers to read and include arbitrary files via (1) the meskin parameter to admin/editorTypetool.php, or the lng parameter to the in admin/inc scripts (2) archbatch.php, (3) dbbatch.php, and (4) nwlmail.php.

[CLOSE] OSVDB ID : 21170 - Disclosed: 2005-11-28

Description:

(Description Provided by CVE) : Multiple directory traversal vulnerabilities in GuppY 4.5.9 and earlier allow remote attackers to read and include arbitrary files via (1) the meskin parameter to admin/editorTypetool.php, or the lng parameter to the in admin/inc scripts (2) archbatch.php, (3) dbbatch.php, and (4) nwlmail.php.

[CLOSE] OSVDB ID : 45342 - Disclosed: 2005-11-28

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 52634 - Disclosed: 2005-11-28

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 21397 - Disclosed: 2005-11-28

Description:

The Top Music Module contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the modules.php script not properly sanitizing user-supplied input to the 'idartist', 'idsong' and 'idalbum' variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 21398 - Disclosed: 2005-11-28

Description:

Geeklog contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker injects invalid SQL in the date field to search.php, which will disclose the software's installation path resulting in a loss of confidentiality. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.

[CLOSE] OSVDB ID : 21399 - Disclosed: 2005-11-28

Description:

SimpleBBS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the search module not properly sanitizing user-supplied input to undisclosed variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database. No further details have been provided.

[CLOSE] OSVDB ID : 21367 - Disclosed: 2005-11-27

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 35281 - Disclosed: 2005-11-27

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 21131 - Disclosed: 2005-11-27

Description:

ADC2000 NG Pro contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the adcbrowres.php script not properly sanitizing user-supplied input to the cat variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 21140 - Disclosed: 2005-11-27

Description:

(Description Provided by CVE) : Directory traversal vulnerability in index.php in PHP Doc System 1.5.1 and earlier allows remote attackers to access or include arbitrary files via a .. (dot dot) in the show parameter.

[CLOSE] OSVDB ID : 21381 - Disclosed: 2005-11-27

Description:

(Description Provided by CVE) : relocate_server.php in Coppermine Photo Gallery (CPG) 1.4.2 and 1.4 beta does not remove is not removed after installation and does not use authentication, which allows remote attackers to obtain sensitive information, such as database configuration, via a direct request.

[CLOSE] OSVDB ID : 21374 - Disclosed: 2005-11-27

Description:

SDMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the list.php script not properly sanitizing user-supplied input to the 'folder_id' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 21375 - Disclosed: 2005-11-27

Description:

SDMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the messages.php script not properly sanitizing user-supplied input to the 'mid' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 21373 - Disclosed: 2005-11-26

Description:

vBulletin contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the remote avatar URL upon submission to the profile.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 21372 - Disclosed: 2005-11-26

Description:

Zorum contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script not properly sanitizing user-supplied input to the 'rollid' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 21371 - Disclosed: 2005-11-26

Description:

GhostScripter Amazon Shop contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the "query" variable upon submission to the search.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 23103 - Disclosed: 2005-11-26

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 21407 - Disclosed: 2005-11-26

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 21408 - Disclosed: 2005-11-26

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 21409 - Disclosed: 2005-11-26

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 21358 - Disclosed: 2005-11-26

Description:

(Description Provided by CVE) : PHP remote file inclusion vulnerability in athena.php in Oliver May Athena PHP Website Administration 0.1a allows remote attackers to execute arbitrary PHP code via a URL in the athena_dir parameter.

[CLOSE] OSVDB ID : 21357 - Disclosed: 2005-11-26

Description:

(Description Provided by CVE) : PHP remote file inclusion vulnerability in content.php in phpGreetz 0.99 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the content parameter.

[CLOSE] OSVDB ID : 21534 - Disclosed: 2005-11-26

Description:

PHPLang contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the multiple unspecified fields upon submission to the 'sendpm.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 21161 - Disclosed: 2005-11-26

Description:

A local overflow exists in ktools. The 'VGETSTRING()' function fails to perform proper bounds checking resulting in a buffer overflow. With a specially crafted request, a malicious user can cause arbitrary code execution resulting in a loss of integrity.

[CLOSE] OSVDB ID : 21160 - Disclosed: 2005-11-26

Description:

A remote overflow exists in unalz. The application fails to perform proper bounds checking resulting in a buffer overflow. With a specially crafted 'ALZ' archive containing a file with an overly long filename, a remote attacker can cause arbitrary code execution resulting in a loss of integrity.

[CLOSE] OSVDB ID : 21173 - Disclosed: 2005-11-26

Description:

BosDates contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the calendar.php script not properly sanitizing user-supplied input to the 'year' and 'category' variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 21171 - Disclosed: 2005-11-26

Description:

(Description Provided by CVE) : merchants/index.php in Post Affiliate Pro 2.0.4 and earlier, with magic_quotes_gpc disabled, allows remote attackers to include arbitrary local files via the md parameter, possibly due to a directory traversal vulnerability.

[CLOSE] OSVDB ID : 21164 - Disclosed: 2005-11-26

Description:

Entergal MX contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'action' and 'idcat' variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 21172 - Disclosed: 2005-11-26

Description:

Post Affiliate Pro contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'sortorder' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 21441 - Disclosed: 2005-11-26

Description:

WowBB contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'search.php' script not properly sanitizing user-supplied input to the 'q' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 21442 - Disclosed: 2005-11-26

Description:

WowBB contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'view_user.php' script not properly sanitizing user-supplied input to the 'sort_by' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.