| OSVDB ID | Disclosure Date | Title |
|---|
|
12830
Description:
Unknown / Incomplete
|
2005-01-10
|
Amphor@ Gate Free Login validacion.php Privilege Escalation
|
|
24367
Description:
Mailman contains a flaw that may allow a remote denial of service. The issue is triggered when a multipart MIME message with a malformed part is received by the 'Scrubber.py' script, and will result in loss of availability for the list.
|
2005-01-09
|
Mailman Scrubber.py Crafted Multipart MIME Message DoS
|
|
12817
Description:
(Description Provided by CVE) : SQL injection vulnerability in index.php in Invision Community Blog allows remote attackers to execute arbitrary SQL commands via the eid parameter.
|
2005-01-09
|
Invision Community Blog Module eid SQL Injection
|
|
12888
Description:
Unknown / Incomplete
|
2005-01-09
|
PHPWind faq.php skin Parameter Remote File Inclusion
|
|
13235
Description:
Unknown / Incomplete
|
2005-01-09
|
Palace Chat Client Ban Bypass
|
|
12794
Description:
CitrusDB contains a flaw that may allow a remote attacker to execute arbritary commands. The issue is due to main.php not properly comparing the user input used to specify a file against the path_to_citrus variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.
|
2005-01-09
|
CitrusDB main.php path_to_citrus Arbitrary File Inclusion
|
|
12795
Description:
CitrusDB contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'path_to_citrus' variable upon submission to the 'tools.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.
|
2005-01-09
|
CitrusDB tools.php path_to_citrus Arbitrary File Inclusion
|
|
13104
Description:
A local overflow exists in Mac OS X. The parse_machfile() function declares nmcmds and offset variables as signed integers, but they are stored as unsigned when read from the file resulting in an integer overflow. With a specially crafted request, an attacker can cause a denial of service resulting in a loss of availability.
|
2005-01-08
|
Apple Mac OS X Mach-O Loader parse_machfile() Function Overflow DoS
|
|
14196
Description:
(Description Provided by CVE) : Firefox before 1.0.1 and Mozilla before 1.7.6, when displaying the HTTP Authentication dialog, do not change the focus to the tab that generated the prompt, which could facilitate spoofing and phishing attacks.
|
2005-01-08
|
Multiple Browser Authentication Prompt Tab Spoofing
|
|
14195
Description:
(Description Provided by CVE) : String handling functions in Mozilla 1.7.3, Firefox 1.0, and Thunderbird before 1.0.2, such as the nsTSubstring_CharT::Replace function, do not properly check the return values of other functions that resize the string, which allows remote attackers to cause a denial of service and possibly execute arbitrary code by forcing an out-of-memory state that causes a reallocation to fail and return a pointer to a fixed address, which leads to heap corruption.
|
2005-01-08
|
Mozilla Multiple Products MutatePrep string Library Overflow
|
|
16474
Description:
Unknown / Incomplete
|
2005-01-08
|
WordPress Same User Rank Arbitrary Message Post Modification
|
|
12816
Description:
(Description Provided by CVE) : The NTLM component in Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (crash) via a malformed NTLM type 3 message that triggers a NULL dereference.
|
2005-01-08
|
Squid NTLM Component Malformed Type 3 Message DoS
|
|
13114
Description:
Squid contains a flaw that may allow a remote denial of service. The issue is triggered by a memory leak in fakeauth_auth helper which may cause it to run out of memory if put under a high load, and can result in loss of availability for the service.
|
2005-01-08
|
Squid NTLM fakeauth_auth Helper Memory Leak DoS
|
|
13019
Description:
(Description Provided by CVE) : Mozilla 1.6 and possibly other versions allows remote attackers to cause a denial of service (application crash) via a XBM (X BitMap) file with a large (1) height or (2) width value.
|
2005-01-08
|
Mozilla Malformed XBM Image DoS
|
|
24280
Description:
Unknown / Incomplete
|
2005-01-07
|
Condor Unauthorized condor_ Negotiator Announcement
|
|
15333
Description:
Unknown / Incomplete
|
2005-01-07
|
Microsoft Windows Server 2003 EFS File Copy LDAP Connection DoS
|
|
13037
Description:
Unknown / Incomplete
|
2005-01-07
|
vBulletin includes/init.php Unspecified Critical Security Issue
|
|
12791
Description:
(Description Provided by CVE) : Race condition in the (1) load_elf_library and (2) binfmt_aout function calls for uselib in Linux kernel 2.4 through 2.429-rc2 and 2.6 through 2.6.10 allows local users to execute arbitrary code by manipulating the VMA descriptor.
|
2005-01-07
|
Linux Kernel sys_uselib Binary Format Loader Local Privilege Escalation
|
|
13240
Description:
Diebold Global Election Management System (GEMS) contains a flaw related to the local database as it allows arbitrary access. This may allow a local attacker to access the database file storing all cast votes to disclose or edit various data to e.g. manipulate election results.
|
2005-01-07
|
Diebold Global Election Management System (GEMS) Local Database Arbitrary Access
|
|
12836
Description:
A local overflow exists in the Linux kernel. The sg_scsi_ioctl() function fails to validate user-supplied integer values resulting in an integer overflow. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.
|
2005-01-07
|
Linux Kernel scsi_ioctl.c sg_scsi_ioctl() Overflow
|
|
12837
Description:
A local overflow exists in the Linux kernel. The MoxaDriverIoctl() function fails to validate user-supplied data resulting in a buffer overflow. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.
|
2005-01-07
|
Linux Kernel MOXA Serial Driver Overflow
|
|
13021
Description:
Unknown / Incomplete
|
2005-01-07
|
Novell GroupWise WebAcces WebAccessUninstall.ini Information Disclosure
|
|
18563
Description:
Unknown / Incomplete
|
2005-01-07
|
SysCP Session Handling Bypass
|
|
12823
Description:
(Description Provided by CVE) : Directory traversal vulnerability in Simple PHP Blog (SPHPBlog) 0.3.7c allows remote attackers to read or create arbitrary files via a .. (dot dot) in the entry parameter.
|
2005-01-07
|
Simple PHP Blog (SPHPBlog) comments.php Traversal Arbitrary .txt File Access
|
|
12824
Description:
Unknown / Incomplete
|
2005-01-07
|
Simple PHP Blog (SPHPBlog) comment_add_cgi.php Traversal Arbitrary Directory Creation
|
|
12822
Description:
MyBulletinBoard contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'Add Event' function upon submission to the 'calendar.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.
|
2005-01-07
|
MyBulletinBoard (MyBB) calendar.php Add Event Function XSS
|
|
69926
Description:
MyBB contains a flaw that may allow a remote denial of service. The issue is triggered when Java code is input to the subject field in calendar.php occurs, and will result in loss of availability for the calendar.
|
2005-01-07
|
MyBulletinBoard (MyBB) calendar.php Subject Field Arbitrary Java Code DoS
|
|
12820
Description:
Unknown / Incomplete
|
2005-01-07
|
OCC theme Variable Arbitrary Command Execution
|
|
13047
Description:
Unknown / Incomplete
|
2005-01-07
|
Mozilla Firefox URL Wrap Obfuscation
|
|
12819
Description:
Unknown / Incomplete
|
2005-01-06
|
Symantec Norton Anti-Virus ccErrDsp.ErrorDisplay.1 Object DoS
|
|
18807
Description:
(Description Provided by CVE) : The find_target function in ptrace32.c in the Linux kernel 2.4.x before 2.4.29 does not properly handle a NULL return value from another function, which allows local users to cause a denial of service (kernel crash/oops) by running a 32-bit ltrace program with the -i option on a 64-bit executable program.
|
2005-01-06
|
Linux Kernel ptrace32.c ltrace find_task_by_pid Function Local DoS
|
|
20778
Description:
Unknown / Incomplete
|
2005-01-06
|
Exponent CMS BB Module view_board.php Path Disclosure
|
|
12725
Description:
Amp II engine contains a flaw that may allow a remote denial of service. The issue is triggered when an empty UDP datagram is sent to the listening socket on the server causing an infinite loop, and will result in loss of availability for the service.
|
2005-01-06
|
Amp II Engine Zero Length UDP Packet DoS
|
|
12738
Description:
Sugar Sales contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to index.php not properly sanitizing user input supplied to the moduleDefaultFile variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.
|
2005-01-06
|
Sugar Sales index.php Arbitrary Command Execution
|
|
12722
Description:
(Description Provided by CVE) : Directory traversal vulnerability in WinHKI 1.4d allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a zip file.
|
2005-01-06
|
WinHKI Archive Extraction Traversal Arbitrary File Write
|
|
12723
Description:
Unknown / Incomplete
|
2005-01-06
|
WinACE Archive Extraction Traversal Arbitrary File Write
|
|
12724
Description:
A remote overflow exists in LibTIFF. LibTIFF fails to properly check into to the tiffdump utility resulting in a integer overflow. With a specially crafted request, an attacker can cause execution of arbitrary code resulting in a loss of integrity.
|
2005-01-06
|
LibTIFF tiffdump Utility Overflow
|
|
12726
Description:
A remote overflow exists in Exim. Exim fails to properly check input to host_aton() resulting in a buffer overflow. With a specially crafted request of an IPv6 address with more than 8 components, an attacker can cause execution of arbitrary code resulting in a loss of integrity.
|
2005-01-06
|
Exim -be Command Line Option host_aton Function Local Overflow
|
|
12727
Description:
A remote overflow exists in Exim. Exim fails to have sufficient boundary checks in the 'spa_base64_to_bits()' function resulting in a buffer overflow. With a specially crafted request, an attacker can execute arbitrary code in the context of the affected application resulting in a loss of integrity.
|
2005-01-06
|
Exim SPA Authentication spa_base64_to_bits Function Remote Overflow
|
|
12718
Description:
(Description Provided by CVE) : Directory traversal vulnerability in Jeuce Personal Web Server 2.13 allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.
|
2005-01-06
|
Jeuce Personal Web Server Traversal Arbitrary File Access
|
