[CLOSE] OSVDB ID : 17632 - Disclosed: 2005-06-30

Description:

crip contains a flaw that may allow a malicious local user to overwrite or create arbitrary files on the system. The issue is due to crip creating temporary files insecurely. It is possible for a user to use a symlink style attack to manipulate arbitrary files, resulting in a loss of integrity.

[CLOSE] OSVDB ID : 17673 - Disclosed: 2005-06-30

Description:

The Hitachi Hibun Advanced Edition Server and Advanced Information Cypher products contain a flaw that may allow a malicious user to bypass access restrictions. The issue is triggered when a user accesses the view function of the Hibun Viewer from a client PC, resulting in the ability to operate beyond their privileges.

[CLOSE] OSVDB ID : 17674 - Disclosed: 2005-06-30

Description:

The Hitachi Hibun Advanced Edition Server and Advanced Information Cypher products contain a flaw that may allow a malicious user to bypass access restrictions. The issue is triggered by an error that causes Hibun to recognize an external drive, that is connected to a computer through PCMCIA, as an internal disk and is unable to restrict files that are copied out to the hard disk. It is possible that the flaw may allow a local attacker to obtain sensitive information resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 17775 - Disclosed: 2005-06-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 17650 - Disclosed: 2005-06-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 17651 - Disclosed: 2005-06-30

Description:

Comdev News Publisher contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 's_type' variable upon submission to the wce.editnews.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity. This flaw requires administrative access to exploit.

[CLOSE] OSVDB ID : 17675 - Disclosed: 2005-06-30

Description:

Comdev eCommerce contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate input passed to the 'Add Your Review' section of the 'index.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 17685 - Disclosed: 2005-06-30

Description:

SSH Tectia Server and SSH Secure Shell for Windows contains a flaw that may allow a malicious user to obtain the server host identification key caused by insufficient file permissions. It is possible that the flaw may allow an attacker to access the host identification key without the required administrative privileges. This key could then be copied and installed on a malicious server to masquerade as the original server.

[CLOSE] OSVDB ID : 17615 - Disclosed: 2005-06-30

Description:

Adobe Reader for Linux contains a flaw that may lead to an unauthorized information disclosure.  The issue is triggered when opening documents as temporary copies are created insecurely, which will disclose document contents to a local attacker.

[CLOSE] OSVDB ID : 17681 - Disclosed: 2005-06-30

Description:

NetBSD contains a flaw that may allow a local denial of service. The issue is triggered when a malicious attacker uses the set-parameters ioctl call on certain audio devices to change block size and set pause state to "unpaused" in the same ioctl, which will cause a divide-by-zero error resulting in loss of availability for the platform.

[CLOSE] OSVDB ID : 17736 - Disclosed: 2005-06-30

Description:

Jinzora contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the include_path variable not properly sanitizing user input. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.

[CLOSE] OSVDB ID : 17828 - Disclosed: 2005-06-30

Description:

(Description Provided by CVE) : Directory traversal vulnerability in default.asp for FSboard 2.0 allows remote attackers to read arbitrary files via ".." sequences in the filename parameter.

[CLOSE] OSVDB ID : 17737 - Disclosed: 2005-06-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 20785 - Disclosed: 2005-06-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 20784 - Disclosed: 2005-06-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 17677 - Disclosed: 2005-06-29

Description:

FreeBSD contains a flaw that may allow a malicious user to modify certain TCP options via a TCP packet with the SYN flag set for an already established session. It is possible that the flaw may allow an attacker to spoof the remote IP and port numbers of an established connection and stall the TCP communications resulting in a loss of availability.

[CLOSE] OSVDB ID : 17739 - Disclosed: 2005-06-29

Description:

(Description Provided by CVE) : im_trbbs.cgi in imTRSET 1.02 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the df parameter.

[CLOSE] OSVDB ID : 27598 - Disclosed: 2005-06-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 17879 - Disclosed: 2005-06-29

Description:

(Description Provided by CVE) : management.php in Realnode Emilda 1.2.2 and earlier allows remote attackers to perform actions as other users by modifying the user_id parameter.

[CLOSE] OSVDB ID : 17645 - Disclosed: 2005-06-29

Description:

ClamAV contains a flaw that may allow a remote denial of service. The issue is triggered when the ENSURE_BITS() function in the libclamav/mspack/mszipd.c fails to properly validate user supplied input. A remote attacker could send a specially crafted CAB file with a cffile_FolderOffset set to 0xff to cause the program to enter an infinite loop, resulting in a loss of availability of the anti-virus system.

[CLOSE] OSVDB ID : 17646 - Disclosed: 2005-06-29

Description:

ClamAV contains a flaw that may allow a remote denial of service. The issue is triggered by a file descriptor leak in cli_msexpand() function, located in libclamav/scanners.c, which consumes all available file descriptors and/or memory on the target system. A remote attacker sends approximately 1,000 specially crafted archive files, either by email attachment or directly to a current HTTP session, resulting in a loss of availability of the anti-virus system.

[CLOSE] OSVDB ID : 17620 - Disclosed: 2005-06-29

Description:

Dominion SX contains a flaw that may lead to an unauthorized information disclosure. The issue is due to the /etc/shadow file having world-readable permissions by default, which will disclose the root user's password hash resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 17621 - Disclosed: 2005-06-29

Description:

Dominion SX contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is due to the /bin/busybox file having default permissions of world-writable, which may allow an attacker replace the file causing arbitrary code execution with another user's privileges.

[CLOSE] OSVDB ID : 17619 - Disclosed: 2005-06-29

Description:

(Description Provided by CVE) : Unknown vulnerability in NateOn Messenger 3.0 allows remote attackers to list arbitrary directories via unknown attack vectors.

[CLOSE] OSVDB ID : 17689 - Disclosed: 2005-06-29

Description:

Emilda reportedly contains several security-related flaws. No further details have been provided.

[CLOSE] OSVDB ID : 17793 - Disclosed: 2005-06-29

Description:

XML-RPC for PHP (PHPXMLRPC) contains a flaw that may allow a remote attacker to execute arbitrary PHP code. The issue is due to the 'parseRequest()' function not properly sanitizing user-supplied input. By creating an XML file that uses single quotes to escape into the 'eval()' call, a remote attacker can execute arbitrary PHP code resulting in a loss of integrity.

[CLOSE] OSVDB ID : 17644 - Disclosed: 2005-06-29

Description:

Cisco IOS's RADIUS server contains a flaw that may allow a malicious user to bypass authorization and accounting. The issue is triggered when no fallback method of AAA is configured and a long username is submitted. It is possible that the flaw may allow unauthorized users to authenticate, resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 17649 - Disclosed: 2005-06-29

Description:

(Description Provided by CVE) : Soldier of Fortune II 1.02x and 1.03 allows remote attackers to cause a denial of service (server crash) via a large ID value in the ignore command, which is used as an array index and causes an out-of-bounds operation.

[CLOSE] OSVDB ID : 17672 - Disclosed: 2005-06-29

Description:

(Description Provided by CVE) : login.cgi in Community Link Pro Web Editor allows remote attackers to execute arbitrary commands via the file parameter.

[CLOSE] OSVDB ID : 17647 - Disclosed: 2005-06-29

Description:

(Description Provided by CVE) : Unknown vulnerability in Drupal 4.5.0 through 4.5.3, 4.6.0, and 4.6.1 allows remote attackers to execute arbitrary PHP code via a public comment or posting.

[CLOSE] OSVDB ID : 59221 - Disclosed: 2005-06-29

Description:

(Description Provided by CVE) : The netlink subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.13-rc1 does not initialize certain padding fields in structures, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors, related to the (1) tc_fill_qdisc, (2) tcf_fill_node, (3) neightbl_fill_info, (4) neightbl_fill_param_info, (5) neigh_fill_info, (6) rtnetlink_fill_ifinfo, (7) rtnetlink_fill_iwinfo, (8) vif_delete, (9) ipmr_destroy_unres, (10) ipmr_cache_alloc_unres, (11) ipmr_cache_resolve, (12) inet6_fill_ifinfo, (13) tca_get_fill, (14) tca_action_flush, (15) tcf_add_notify, (16) tc_dump_action, (17) cbq_dump_police, (18) __nlmsg_put, (19) __rta_fill, (20) __rta_reserve, (21) inet6_fill_prefix, (22) rsvp_dump, and (23) cbq_dump_ovl functions.

[CLOSE] OSVDB ID : 17680 - Disclosed: 2005-06-29

Description:

(Description Provided by CVE) : Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, as demonstrated using the JVIEW Profiler (Javaprxy.dll). NOTE: the researcher says that the vendor could not reproduce this problem.

[CLOSE] OSVDB ID : 17633 - Disclosed: 2005-06-29

Description:

Xoops contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'order' variable upon submission to the 'edit.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 17634 - Disclosed: 2005-06-29

Description:

Xoops contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'cid' variable upon submission to the 'comment_edit.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 17635 - Disclosed: 2005-06-29

Description:

(Description Provided by CVE) : SQL injection vulnerability in the loginUser function in the XMLRPC server in XOOPS 2.0.11 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via crafted values in an XML file, as demonstrated using the blogger.getPost method.

[CLOSE] OSVDB ID : 17636 - Disclosed: 2005-06-29

Description:

WordPress contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'comment' and 'p' variables upon submission to the 'post.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 17637 - Disclosed: 2005-06-29

Description:

(Description Provided by CVE) : SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via input that is not filtered in the HTTP_RAW_POST_DATA variable, which stores the data in an XML file.

[CLOSE] OSVDB ID : 17638 - Disclosed: 2005-06-29

Description:

(Description Provided by CVE) : wp-login.php in WordPress 1.5.1.2 and earlier allows remote attackers to change the content of the forgotten password e-mail message via the message variable, which is not initialized before use.

[CLOSE] OSVDB ID : 17639 - Disclosed: 2005-06-29

Description:

(Description Provided by CVE) : WordPress 1.5.1.2 and earlier allows remote attackers to obtain sensitive information via (1) a direct request to menu-header.php or a "1" value in the feed parameter to (2) wp-atom.php, (3) wp-rss.php, or (4) wp-rss2.php, which reveal the path in an error message. NOTE: vector [1] was later reported to also affect WordPress 2.0.1.

[CLOSE] OSVDB ID : 17640 - Disclosed: 2005-06-29

Description:

(Description Provided by CVE) : WordPress 1.5.1.2 and earlier allows remote attackers to obtain sensitive information via (1) a direct request to menu-header.php or a "1" value in the feed parameter to (2) wp-atom.php, (3) wp-rss.php, or (4) wp-rss2.php, which reveal the path in an error message. NOTE: vector [1] was later reported to also affect WordPress 2.0.1.