[CLOSE] OSVDB ID : 32468 - Disclosed: 2006-12-25

Description:

Irokez CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'functions/section script not properly sanitizing user input supplied to the 'GLOBALS[PTH][classes]' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 32469 - Disclosed: 2006-12-25

Description:

Irokez CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'functions/users.func.php' script not properly sanitizing user input supplied to the 'GLOBALS[PTH][classes]' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 31581 - Disclosed: 2006-12-25

Description:

(Description Provided by CVE) : Format string vulnerability in the inputAnswer function in file.c in w3m before 0.5.2, when run with the dump or backend option, allows remote attackers to execute arbitrary code via format string specifiers in the Common Name (CN) field of an SSL certificate associated with an https URL.

[CLOSE] OSVDB ID : 31584 - Disclosed: 2006-12-25

Description:

(Description Provided by CVE) : SQL injection vulnerability in the login form in HLstats 1.20 through 1.34 allows remote attackers to execute arbitrary SQL commands via the killLimit parameter.

[CLOSE] OSVDB ID : 33325 - Disclosed: 2006-12-24

Description:

(Description Provided by CVE) : administration/index.php in Cahier de texte (CDT) 2.2 does not properly exit when authentication fails, which allows remote attackers to perform unauthorized administrative actions.

[CLOSE] OSVDB ID : 33323 - Disclosed: 2006-12-24

Description:

(Description Provided by CVE) : SQL injection vulnerability in SelGruFra.asp in chatwm 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) txtUse and (2) txtPas parameters.

[CLOSE] OSVDB ID : 35153 - Disclosed: 2006-12-24

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin allows remote attackers to inject arbitrary web script or HTML via an SWF file that uses ActionScript to trigger execution of JavaScript.

[CLOSE] OSVDB ID : 32487 - Disclosed: 2006-12-24

Description:

(Description Provided by CVE) : pages/register/register.php in Fishyshoop 0.930 beta allows remote attackers to create arbitrary administrative users by setting the is_admin HTTP POST parameter to 1.

[CLOSE] OSVDB ID : 31268 - Disclosed: 2006-12-24

Description:

Ananda Real Estate contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'list.asp' script not properly sanitizing user-supplied input to the 'agent' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 32470 - Disclosed: 2006-12-24

Description:

(Description Provided by CVE) : SQL injection vulnerability in detail.asp in Mxmania File Upload Manager (FUM) 1.0.6 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter.

[CLOSE] OSVDB ID : 31588 - Disclosed: 2006-12-24

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in shownews.php in TimberWolf 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the nid parameter.

[CLOSE] OSVDB ID : 35716 - Disclosed: 2006-12-24

Description:

(Description Provided by CVE) : PHP remote file inclusion vulnerability in ataturk.php in Okul Merkezi Portal 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.

[CLOSE] OSVDB ID : 33321 - Disclosed: 2006-12-23

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in Future Internet allow remote attackers to execute arbitrary SQL commands via the (1) newsId or (2) categoryid parameter in a Portal.Showpage action in index.cfm, or (3) the langId parameter in index.cfm.

[CLOSE] OSVDB ID : 33322 - Disclosed: 2006-12-23

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in index.cfm in Future Internet allows remote attackers to inject arbitrary web script or HTML via the categoryId parameter in a Portal.ShowPage action.

[CLOSE] OSVDB ID : 35443 - Disclosed: 2006-12-23

Description:

(Description Provided by CVE) : Certain forms in phpBB before 2.0.22 lack session checks, which has unknown impact and remote attack vectors.

[CLOSE] OSVDB ID : 35442 - Disclosed: 2006-12-23

Description:

(Description Provided by CVE) : Unspecified vulnerability in phpBB before 2.0.22 has unknown impact and remote attack vectors related to a "negative start parameter."

[CLOSE] OSVDB ID : 36177 - Disclosed: 2006-12-23

Description:

(Description Provided by CVE) : myprofile.asp in Enthrallweb eClassifieds does not properly validate the MM_recordId parameter during profile updates, which allows remote authenticated users to modify certain profile fields of another account by specifying that account's username in a modified MM_recordId parameter.

[CLOSE] OSVDB ID : 35441 - Disclosed: 2006-12-23

Description:

(Description Provided by CVE) : Unspecified vulnerability in phpBB before 2.0.22 has unknown impact and remote attack vectors related to "criteria for 'bad' redirection targets."

[CLOSE] OSVDB ID : 40977 - Disclosed: 2006-12-23

Description:

(Description Provided by CVE) : IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 does not properly revoke privileges on methods, which allows remote authenticated users to execute a method after revocation until the routine auth cache is flushed.

[CLOSE] OSVDB ID : 32489 - Disclosed: 2006-12-23

Description:

(Description Provided by CVE) : The (1) settings.php and (2) subscribers.php scripts in Open Newsletter 2.5 and earlier do not exit when authentication fails, which allows remote attackers to perform unauthorized administrative actions, or execute arbitrary code in conjunction with another vulnerability.

[CLOSE] OSVDB ID : 32456 - Disclosed: 2006-12-23

Description:

(Description Provided by CVE) : myprofile.asp in Enthrallweb eNews does not properly validate the MM_recordId parameter during profile updates, which allows remote authenticated users to modify certain profile fields of another account by specifying that account's username in a modified MM_recordId parameter.

[CLOSE] OSVDB ID : 32455 - Disclosed: 2006-12-23

Description:

(Description Provided by CVE) : SQL injection vulnerability in newsdetail.asp in Enthrallweb eJobs allows remote attackers to execute arbitrary SQL commands via the ID parameter.

[CLOSE] OSVDB ID : 32488 - Disclosed: 2006-12-23

Description:

(Description Provided by CVE) : PHP remote file inclusion vulnerability in misc.php in SH-News 0.93, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the news_cfg[path] parameter.

[CLOSE] OSVDB ID : 32454 - Disclosed: 2006-12-23

Description:

(Description Provided by CVE) : SQL injection vulnerability in actualpic.asp in Enthrallweb ePages allows remote attackers to execute arbitrary SQL commands via the Biz_ID parameter.

[CLOSE] OSVDB ID : 32452 - Disclosed: 2006-12-23

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 32451 - Disclosed: 2006-12-23

Description:

(Description Provided by CVE) : SQL injection vulnerability in newsdetail.asp in Enthrallweb eMates 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.

[CLOSE] OSVDB ID : 32446 - Disclosed: 2006-12-23

Description:

(Description Provided by CVE) : acFTP 1.5 allows remote authenticated users to cause a denial of service via a crafted argument to the (1) REST or (2) PBSZ command.

[CLOSE] OSVDB ID : 31360 - Disclosed: 2006-12-23

Description:

A buffer overflow exists in NetMail. The IMAP daemon fails to validate long string arguments passed to the SUBSCRIBE command resulting in a stack overflow. With a specially crafted request, a remote attacker can cause arbitrary code execution resulting in a loss of integrity.

[CLOSE] OSVDB ID : 31361 - Disclosed: 2006-12-23

Description:

(Description Provided by CVE) : The IMAP daemon (IMAPD) in Novell NetMail before 3.52e FTF2 allows remote authenticated users to cause a denial of service via an APPEND command with a single "(" (parenthesis) in the argument.

[CLOSE] OSVDB ID : 31362 - Disclosed: 2006-12-23

Description:

A buffer overflow exists in NetMail. The IMAP daemon fails to validate data passed with an APPEND command resulting in a stack overflow. With a specially crafted request, a remote attacker can cause arbitrary code execution resulting in a loss of integrity.

[CLOSE] OSVDB ID : 31363 - Disclosed: 2006-12-23

Description:

A buffer overflow exists in NetMail. The NMAP server fails to validate data passed to the STOR command resulting in a stack overflow. With a specially crafted request, a remote attacker can cause arbitrary code execution resulting in a loss of integrity.

[CLOSE] OSVDB ID : 35715 - Disclosed: 2006-12-23

Description:

(Description Provided by CVE) : PHP remote file inclusion vulnerability in b2verifauth.php in b2 Blog 0.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the index parameter.

[CLOSE] OSVDB ID : 33314 - Disclosed: 2006-12-22

Description:

(Description Provided by CVE) : SQL injection vulnerability in default.asp in Efkan Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the grup parameter.

[CLOSE] OSVDB ID : 32404 - Disclosed: 2006-12-22

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in @Mail WebMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.

[CLOSE] OSVDB ID : 32402 - Disclosed: 2006-12-22

Description:

a-blog contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate unspecified variables upon submission to an unspecified script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 41172 - Disclosed: 2006-12-22

Description:

(Description Provided by CVE) : Unspecified vulnerability in (1) pop3d, (2) pop3ds, (3) imapd, and (4) imapds in IBM AIX 5.3.0 has unspecified impact and attack vectors, involving an "authentication vulnerability."

[CLOSE] OSVDB ID : 32444 - Disclosed: 2006-12-22

Description:

KISGB contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'authenticate.php' script not properly sanitizing user input supplied to the 'default_path_for_themes' and 'path_to_themes' parameters. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 32441 - Disclosed: 2006-12-22

Description:

(Description Provided by CVE) : Directory traversal vulnerability in index.php in Matteo Lucarelli 3editor CMS 0.42 and earlier, when register_globals is enabled, allows remote attackers to include arbitrary files via a .. (dot dot) in the page parameter.

[CLOSE] OSVDB ID : 31364 - Disclosed: 2006-12-22

Description:

(Description Provided by CVE) : Multiple buffer overflows in Novell NetMail before 3.52e FTF2 allow remote attackers to execute arbitrary code (1) by appending literals to certain IMAP verbs when specifying command continuation requests to IMAPD, resulting in a heap overflow; and (2) via crafted arguments to the STOR command to the Network Messaging Application Protocol (NMAP) daemon, resulting in a stack overflow.

[CLOSE] OSVDB ID : 32595 - Disclosed: 2006-12-22

Description:

Unknown / Incomplete