[CLOSE] OSVDB ID : 19174 - Disclosed: 2005-08-12

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 19030 - Disclosed: 2005-08-12

Description:

MyBulletinBoard (MyBB) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script not properly sanitizing user-supplied input to the 'username' variable. This will allow an attacker to inject or manipulate SQL queries in the back-end database, including logging in as the site administrator and full access to the Admin Control Panel.

[CLOSE] OSVDB ID : 19031 - Disclosed: 2005-08-12

Description:

MyBulletinBoard (MyBB) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the member.php script not properly sanitizing user-supplied input to the 'action', 'username', 'rating' and possibly other variables. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 19032 - Disclosed: 2005-08-12

Description:

MyBulletinBoard (MyBB) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the polls.php script not properly sanitizing user-supplied input to the 'polloptions' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 19033 - Disclosed: 2005-08-12

Description:

MyBulletinBoard (MyBB) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the search.php script not properly sanitizing user-supplied input to the 'action' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 18731 - Disclosed: 2005-08-12

Description:

(Description Provided by CVE) : Grandstream BudgeTone 101 and 102 running firmware 1.0.6.7 and possibly earlier versions, allows remote attackers to cause a denial of service (device hang or reboot) via a large UDP packet to port 5060.

[CLOSE] OSVDB ID : 18980 - Disclosed: 2005-08-12

Description:

(Description Provided by CVE) : Kaspersky Anti-Virus for Unix/Linux File Servers 5.0-5 uses world-writable permissions for the (1) log and (2) license directory, which allows local users to delete log files, append to arbitrary files via a symlink attack on kavmonitor.log, or delete license keys and prevent keepup2date from properly executing.

[CLOSE] OSVDB ID : 18984 - Disclosed: 2005-08-12

Description:

Xoops has been reported to contain a flaw that allows a remote attacker to disclose the installation path. Subsequent inestigation revealed the issue was due to the global PHP configuration set to report error messages. The path disclosure is unrelated to the Xoops installation.

[CLOSE] OSVDB ID : 18701 - Disclosed: 2005-08-12

Description:

(Description Provided by CVE) : Buffer overflow in the xdr_xcode_array2 function in xdr.c in Linux kernel 2.6.12, as used in SuSE Linux Enterprise Server 9, might allow remote attackers to cause a denial of service and possibly execute arbitrary code via crafted XDR data for the nfsacl protocol.

[CLOSE] OSVDB ID : 18754 - Disclosed: 2005-08-12

Description:

MindAlign contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered through an unspecified user enumeration issue, which will disclose user account information resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 18755 - Disclosed: 2005-08-12

Description:

MindAlign contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate unspecified variables upon submission to an unspecified script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 18756 - Disclosed: 2005-08-12

Description:

(Description Provided by CVE) : Unknown vulnerability in Parlano MindAlign 5.0 and later versions allows remote attackers to bypass authentication via unknown vectors.

[CLOSE] OSVDB ID : 18757 - Disclosed: 2005-08-12

Description:

MindAlign contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered through an unspecified encryption weakness, which will disclose authentication or system information resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 18733 - Disclosed: 2005-08-12

Description:

(Description Provided by CVE) : Kaspersky Anti-Virus for Unix/Linux File Servers 5.0-5 uses world-writable permissions for the (1) log and (2) license directory, which allows local users to delete log files, append to arbitrary files via a symlink attack on kavmonitor.log, or delete license keys and prevent keepup2date from properly executing.

[CLOSE] OSVDB ID : 45053 - Disclosed: 2005-08-12

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 18985 - Disclosed: 2005-08-12

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 18986 - Disclosed: 2005-08-12

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 18987 - Disclosed: 2005-08-12

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 18988 - Disclosed: 2005-08-12

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 57544 - Disclosed: 2005-08-12

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 57545 - Disclosed: 2005-08-12

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 18796 - Disclosed: 2005-08-12

Description:

CUPS for OS X contains a flaw that may allow a local denial of service. The issue is triggered when CUPS receives a partial IPP request and a client terminates the connection. The printing service will consume all available CPU resources, and will result in loss of availability for the CUPS printing service.

[CLOSE] OSVDB ID : 18797 - Disclosed: 2005-08-12

Description:

CUPS contains a flaw that may allow a local denial of service. The issue is triggered when multiple, simultaneous print jobs are executed, and will result in loss of availability for the CUPS Service.

[CLOSE] OSVDB ID : 25368 - Disclosed: 2005-08-11

Description:

WebSphere Application Server contains a flaw that may lead to unauthorized access. The issue is triggered when a context is secured using a '/*' directive. Direct access to a context's index page using its file name is covered by an authentication process, whereas a request to the directory itself is not covered. This will disclose the index page without authenticatoin, resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 18921 - Disclosed: 2005-08-11

Description:

(Description Provided by CVE) : VCNative for Adobe Version Cue 1.0 and 1.0.1, as used in Creative Suite 1.0 and 1.3, and when running on Mac OS X with Version Cue Workspace, creates temporary log files with predictable names, which allows local users to modify arbitrary files via a symlink attack.

[CLOSE] OSVDB ID : 18922 - Disclosed: 2005-08-11

Description:

(Description Provided by CVE) : VCNative for Adobe Version Cue 1.0 and 1.0.1, as used in Creative Suite 1.0 and 1.3, and when running on Mac OS X with Version Cue Workspace, allows local users to load arbitrary libraries and execute arbitrary code via the -lib command line argument.

[CLOSE] OSVDB ID : 18735 - Disclosed: 2005-08-11

Description:

(Description Provided by CVE) : The web server for Network Associates ePolicy Orchestrator Agent 3.5.0 (patch 3) uses insecure permissions for the "Common Framework\Db" folder, which allows local users to read arbitrary files by creating a subfolder in the EPO agent web root directory.

[CLOSE] OSVDB ID : 18699 - Disclosed: 2005-08-11

Description:

FUDforum contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when an attacker modifies the mid HTTP variable, which will disclose arbitrary restricted forum messages resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 23195 - Disclosed: 2005-08-11

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 20162 - Disclosed: 2005-08-11

Description:

(Description Provided by CVE) : SQL injection vulnerability in MidiCart allows remote attackers to execute arbitrary SQL commands via the code_no parameter to (1) Item_Show.asp or (2) search_list.asp.

[CLOSE] OSVDB ID : 18763 - Disclosed: 2005-08-11

Description:

ezUpload contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to index.php not properly sanitizing user input supplied to the path variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.

[CLOSE] OSVDB ID : 18764 - Disclosed: 2005-08-11

Description:

ezUpload contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to initialize.php not properly sanitizing user input supplied to the path variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.

[CLOSE] OSVDB ID : 18765 - Disclosed: 2005-08-11

Description:

ezUpload contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to customize.php not properly sanitizing user input supplied to the path variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.

[CLOSE] OSVDB ID : 18766 - Disclosed: 2005-08-11

Description:

ezUpload contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to form.php not properly sanitizing user input supplied to the path variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.

[CLOSE] OSVDB ID : 18703 - Disclosed: 2005-08-11

Description:

A remote overflow exists in Novell eDirectory iMonitor on Windows. iMonitor fails to handle malformed HTTP GET requests resulting in a stack overflow. With a specially crafted request, an attacker can execute arbitrary code with SYSTEM privileges resulting in a loss of integrity.

[CLOSE] OSVDB ID : 45590 - Disclosed: 2005-08-11

Description:

(Description Provided by CVE) : The siteaccess URIMatching implementation in eZ publish 3.5 through 3.8 before 20050812 converts all non-alphanumeric characters in a URI to '_' (underscore), which allows remote attackers to bypass access restrictions by inserting certain characters in a URI, as demonstrated by a request for /admin:de, which matches a rule allowing only /admin_de to access /admin.

[CLOSE] OSVDB ID : 18697 - Disclosed: 2005-08-10

Description:

Nortel VPN Client contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when the client is manipulated to run local commands. The VPN Client allows the local user to select an application instead of a configuration file or replace a VPN Client application with a local application. The following application screens can be manipulated (e.g. Change file to cmd.exe) to allow this flaw to occur: - Options >> Authentication Options >> Digital Certificate Authentication Entrust - Connection Wizard - Group Authentication Options >> Challenge Response Token Options >> Software Token Directory This flaw may lead to a loss of integrity as any local commands can be executed as the same user as the VPN Client (typically running as a service under the Window System account).

[CLOSE] OSVDB ID : 18687 - Disclosed: 2005-08-10

Description:

(Description Provided by CVE) : Multiple format string vulnerabilities in Evolution 1.5 through 2.3.6.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) full vCard data, (2) contact data from remote LDAP servers, or (3) task list data from remote servers.

[CLOSE] OSVDB ID : 18688 - Disclosed: 2005-08-10

Description:

Evolution contains a flaw that may allow a malicious user to execute arbitrary code. The issue is related to an unspecified format string flaw in the display of LDAP contact data. It is possible that the flaw may allow arbitrary code execution resulting in a loss of integrity.

[CLOSE] OSVDB ID : 18689 - Disclosed: 2005-08-10

Description:

Evolution contains a flaw that may allow a malicious user to execute arbitrary code. The issue is due to an unspecified format string flaw related to the display of task list data from remote servers. It is possible that the flaw may allow arbitrary code execution resulting in a loss of integrity.