[CLOSE] OSVDB ID : 31007 - Disclosed: 2006-04-17

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in index.php in AnimeGenesis Gallery allows remote attackers to inject arbitrary web script or HTML via the cat parameter.

[CLOSE] OSVDB ID : 31442 - Disclosed: 2006-04-17

Description:

(Description Provided by CVE) : SQL injection vulnerability in inc/start.php in FlexBB 0.5.5 and earlier allows remote attackers to execute arbitrary SQL commands via the flexbb_username COOKIE parameter.

[CLOSE] OSVDB ID : 44722 - Disclosed: 2006-04-17

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 31432 - Disclosed: 2006-04-17

Description:

(Description Provided by CVE) : fold_binary in fold-const.c in GNU Compiler Collection (gcc) 4.1 improperly handles pointer overflow when folding a certain expr comparison to a corresponding offset comparison in cases other than EQ_EXPR and NE_EXPR, which might introduce buffer overflow vulnerabilities into applications that could be exploited by context-dependent attackers.NOTE: the vendor states that the essence of the issue is "not correctly interpreting an offset to a pointer as a signed value."

[CLOSE] OSVDB ID : 24991 - Disclosed: 2006-04-17

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in jax_guestbook.php in Jax Guestbook 3.1, 3.31, and 3.50 allows remote attackers to inject arbitrary web script or HTML via the page parameter.

[CLOSE] OSVDB ID : 24999 - Disclosed: 2006-04-17

Description:

(Description Provided by CVE) : Directory traversal vulnerability in WinAgents TFTP Server for Windows 3.1 and earlier allows remote attackers to read arbitrary files via "..." (triple dot) sequences in a GET request.

[CLOSE] OSVDB ID : 25424 - Disclosed: 2006-04-17

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 24760 - Disclosed: 2006-04-17

Description:

(Description Provided by CVE) : Neon Responder 5.4 for LANsurveyor allows remote attackers to cause a denial of service (application outage) via a crafted Clock Synchronisation packet that triggers an access violation.

[CLOSE] OSVDB ID : 24646 - Disclosed: 2006-04-17

Description:

phpWebSite contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the index.php script not properly sanitizing user input supplied to the 'hub_dir' variable. This may allow an attacker to include a file from the local host that contains arbitrary commands which will be executed by the vulnerable script. It is also possible to include remote files, but only from accessable Windows shares when using PHP5.

[CLOSE] OSVDB ID : 25374 - Disclosed: 2006-04-17

Description:

(Description Provided by CVE) : Unspecified vulnerability in WebSphere 5.1.1 (or any earlier cumulative fix) Common Configuration Mode + CommonArchive and J2EE Models might allow attackers to obtain sensitive information via the trace.

[CLOSE] OSVDB ID : 24712 - Disclosed: 2006-04-17

Description:

(Description Provided by CVE) : phpGraphy 0.9.11 and earlier allows remote attackers to bypass authentication and gain administrator privileges via a direct request to index.php with the editwelcome parameter set to 1, which can then be used to modify the main page to inject arbitrary HTML and web script. NOTE: XSS attacks are resultant from this issue, since normal functionality allows the admin to modify pages.

[CLOSE] OSVDB ID : 24742 - Disclosed: 2006-04-17

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in stats_view.php in LinPHA 1.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) date_from, (2) date_to, and (3) date parameter.

[CLOSE] OSVDB ID : 24708 - Disclosed: 2006-04-17

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in global.php in ShoutBOOK 1.1 allows remote attackers to inject arbitrary web script or HTML via the (1) NAME and (2) COMMENTS parameters.

[CLOSE] OSVDB ID : 24737 - Disclosed: 2006-04-17

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in dev Neuron Blog 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) website parameters.

[CLOSE] OSVDB ID : 41278 - Disclosed: 2006-04-17

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 24959 - Disclosed: 2006-04-17

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in Ralph Capper Tiny PHP Forum (TPF) 3.6 allow remote attackers to inject arbitrary web script or HTML via (1) the uname parameter in a view action in profile.php and (2) a login name. NOTE: the "Access to hash password" issue is already covered by CVE-2006-0103.

[CLOSE] OSVDB ID : 24960 - Disclosed: 2006-04-17

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in Ralph Capper Tiny PHP Forum (TPF) 3.6 allow remote attackers to inject arbitrary web script or HTML via (1) the uname parameter in a view action in profile.php and (2) a login name. NOTE: the "Access to hash password" issue is already covered by CVE-2006-0103.

[CLOSE] OSVDB ID : 25160 - Disclosed: 2006-04-17

Description:

(Description Provided by CVE) : EMC Retrospect for Windows 6.5 before 6.5.382, 7.0 before 7.0.344, and 7.5 before 7.5.1.105 does not drop privileges before opening files, which allows local users to execute arbitrary code via the File>Open dialog.

[CLOSE] OSVDB ID : 25161 - Disclosed: 2006-04-17

Description:

(Description Provided by CVE) : EMC Retrospect for Windows 6.5 before 6.5.382, 7.0 before 7.0.344, and 7.5 before 7.5.1.105 allows local users to execute arbitrary code by replacing the Retrospect.exe file, possibly due to improper file permissions.

[CLOSE] OSVDB ID : 24639 - Disclosed: 2006-04-17

Description:

The Linux Kernel contains a flaw that may allow a local denial of service. The issue is triggered when control is returned using SYSRET. The way Intel EM64T handles exceptions with uncanonical addresses might cause a Denial of Service, and will result in loss of availability for the platform.

[CLOSE] OSVDB ID : 25375 - Disclosed: 2006-04-17

Description:

IBM WebSphere Application Server on Solaris contains a flaw related to the handling of tokens that may allow an attacker to gain unauthorised access using a corrupt token, resulting in a loss of integrity. No further details have been provided.

[CLOSE] OSVDB ID : 55359 - Disclosed: 2006-04-17

Description:

(Description Provided by CVE) : Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2, and K-Meleon 0.9.13 allows user-assisted remote attackers to open local files via a web page with an IMG element containing a SRC attribute with a non-image file:// URL, then tricking the user into selecting View Image for the broken image, as demonstrated using a .wma file to launch Windows Media Player, or by referencing an "alternate web page."

[CLOSE] OSVDB ID : 55360 - Disclosed: 2006-04-17

Description:

(Description Provided by CVE) : Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2, and K-Meleon 0.9.13 allows user-assisted remote attackers to open local files via a web page with an IMG element containing a SRC attribute with a non-image file:// URL, then tricking the user into selecting View Image for the broken image, as demonstrated using a .wma file to launch Windows Media Player, or by referencing an "alternate web page."

[CLOSE] OSVDB ID : 24701 - Disclosed: 2006-04-17

Description:

(Description Provided by CVE) : Untrusted search path vulnerability in unspecified components in Symantec LiveUpdate for Macintosh 3.0.0 through 3.5.0 do not set the execution path, which allows local users to gain privileges via a Trojan horse program.

[CLOSE] OSVDB ID : 58733 - Disclosed: 2006-04-17

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 30585 - Disclosed: 2006-04-16

Description:

(Description Provided by CVE) : phpWebFTP 3.2 and earlier stores script.js under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information.

[CLOSE] OSVDB ID : 24651 - Disclosed: 2006-04-16

Description:

(Description Provided by CVE) : SQL injection vulnerability in archiv2.php in Fuju News 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.

[CLOSE] OSVDB ID : 24652 - Disclosed: 2006-04-16

Description:

(Description Provided by CVE) : edit_kategorie.php in Fuju News 1.0 allows remote attackers to bypass authentication by setting the authorized cookie.

[CLOSE] OSVDB ID : 24635 - Disclosed: 2006-04-16

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in index.php in Musicbox 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the term parameter in a search action.

[CLOSE] OSVDB ID : 24636 - Disclosed: 2006-04-16

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in index.php in Musicbox 2.3.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) start parameter in a search action or (2) type parameter in a top action.

[CLOSE] OSVDB ID : 24740 - Disclosed: 2006-04-16

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in Martin Scheffler betaboard 0.1 allows remote attackers to inject arbitrary web script or HTML via a user's profile, possibly using the FormVal_profile parameter. NOTE: it is not clear whether this is a distributable product or a site-specific vulnerability. If it is site-specific, then it should not be included in CVE.

[CLOSE] OSVDB ID : 24722 - Disclosed: 2006-04-16

Description:

myEvent contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to initialize.php not properly sanitizing user input supplied to the 'myevent_path' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.

[CLOSE] OSVDB ID : 24723 - Disclosed: 2006-04-16

Description:

myEvent contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to event.php not properly sanitizing user input supplied to the 'myevent_path' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.

[CLOSE] OSVDB ID : 24973 - Disclosed: 2006-04-16

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 24707 - Disclosed: 2006-04-16

Description:

(Description Provided by CVE) : Directory traversal vulnerability in index.php in phpWebFTP 3.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the language parameter.

[CLOSE] OSVDB ID : 24955 - Disclosed: 2006-04-16

Description:

(Description Provided by CVE) : DbbS 2.0-alpha and earlier allows remote attackers to obtain sensitive information via an invalid (1) fcategoryid parameter to topics.php or (2) unavariabile, (3) GLOBALS, or (4) _SERVER[] parameters to script.php. NOTE: this information leak might be resultant from a global variable overwrite issue.

[CLOSE] OSVDB ID : 24956 - Disclosed: 2006-04-16

Description:

(Description Provided by CVE) : DbbS 2.0-alpha and earlier allows remote attackers to obtain sensitive information via an invalid (1) fcategoryid parameter to topics.php or (2) unavariabile, (3) GLOBALS, or (4) _SERVER[] parameters to script.php. NOTE: this information leak might be resultant from a global variable overwrite issue.

[CLOSE] OSVDB ID : 24957 - Disclosed: 2006-04-16

Description:

(Description Provided by CVE) : SQL injection vulnerability in topics.php in DbbS 2.0-alpha and earlier allows remote attackers to execute arbitrary SQL commands via the fcategoryid parameter.

[CLOSE] OSVDB ID : 24958 - Disclosed: 2006-04-16

Description:

(Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in profile.php in DbbS 2.0-alpha and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ulocation or (2) uhobbies parameters.

[CLOSE] OSVDB ID : 24953 - Disclosed: 2006-04-16

Description:

Snipe Gallery contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'gallery_id' parameter upon submission to the 'view.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.