[CLOSE] OSVDB ID : 37799 - Disclosed: 2007-06-30

Description:

Ripe Website Manager contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'admin/includes/author_panel_header.php' script not properly sanitizing user input supplied to the 'level' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 37800 - Disclosed: 2007-06-30

Description:

Ripe Website Manager contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'admin/includes/admin_header.php' script not properly sanitizing user input supplied to the 'level' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 37994 - Disclosed: 2007-06-30

Description:

(Description Provided by CVE) : The focus handling for the onkeydown event in Mozilla Firefox 1.5.0.12, 2.0.0.4 and other versions before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to change field focus and copy keystrokes via the "for" attribute in a label, which bypasses the focus prevention, as demonstrated by changing focus from a textarea to a file upload field.

[CLOSE] OSVDB ID : 36337 - Disclosed: 2007-06-30

Description:

TotalCalendar contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'view_event.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 38960 - Disclosed: 2007-06-30

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in Buddy Zone 1.5 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the news_id parameter to view_news.php, (2) the cat_id parameter to view_events.php, or (3) the member_id parameter to video_gallery.php.

[CLOSE] OSVDB ID : 38961 - Disclosed: 2007-06-30

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in Buddy Zone 1.5 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the news_id parameter to view_news.php, (2) the cat_id parameter to view_events.php, or (3) the member_id parameter to video_gallery.php.

[CLOSE] OSVDB ID : 38962 - Disclosed: 2007-06-30

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in Buddy Zone 1.5 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the news_id parameter to view_news.php, (2) the cat_id parameter to view_events.php, or (3) the member_id parameter to video_gallery.php.

[CLOSE] OSVDB ID : 38963 - Disclosed: 2007-06-30

Description:

(Description Provided by CVE) : Multiple directory traversal vulnerabilities in Module/Galerie.php in XCMS 1.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) Ent or (2) Lang parameter.

[CLOSE] OSVDB ID : 38964 - Disclosed: 2007-06-30

Description:

(Description Provided by CVE) : Multiple PHP remote file inclusion vulnerabilities in sPHPell 1.01 allow remote attackers to execute arbitrary PHP code via a URL in the SpellIncPath parameter to (1) spellcheckpageinc.php, (2) spellchecktext.php, (3) spellcheckwindow.php, or (4) spellcheckwindowframeset.php.

[CLOSE] OSVDB ID : 38965 - Disclosed: 2007-06-30

Description:

(Description Provided by CVE) : Multiple PHP remote file inclusion vulnerabilities in sPHPell 1.01 allow remote attackers to execute arbitrary PHP code via a URL in the SpellIncPath parameter to (1) spellcheckpageinc.php, (2) spellchecktext.php, (3) spellcheckwindow.php, or (4) spellcheckwindowframeset.php.

[CLOSE] OSVDB ID : 38966 - Disclosed: 2007-06-30

Description:

(Description Provided by CVE) : Multiple PHP remote file inclusion vulnerabilities in sPHPell 1.01 allow remote attackers to execute arbitrary PHP code via a URL in the SpellIncPath parameter to (1) spellcheckpageinc.php, (2) spellchecktext.php, (3) spellcheckwindow.php, or (4) spellcheckwindowframeset.php.

[CLOSE] OSVDB ID : 38967 - Disclosed: 2007-06-30

Description:

(Description Provided by CVE) : Multiple PHP remote file inclusion vulnerabilities in sPHPell 1.01 allow remote attackers to execute arbitrary PHP code via a URL in the SpellIncPath parameter to (1) spellcheckpageinc.php, (2) spellchecktext.php, (3) spellcheckwindow.php, or (4) spellcheckwindowframeset.php.

[CLOSE] OSVDB ID : 45745 - Disclosed: 2007-06-29

Description:

(Description Provided by CVE) : Stack-based buffer overflow in W3Filer 2.1.3 allows remote FTP servers to cause a denial of service (application hang or crash) and possibly execute arbitrary code by sending a large banner to a client that is sending a file.

[CLOSE] OSVDB ID : 38955 - Disclosed: 2007-06-29

Description:

(Description Provided by CVE) : Microsoft Internet Explorer 7 allows remote attackers to determine the existence of page history via the history.length JavaScript variable.

[CLOSE] OSVDB ID : 37791 - Disclosed: 2007-06-29

Description:

(Description Provided by CVE) : The 3Com IntelliJack Switch NJ220 before 2.0.23 allows remote attackers to cause a denial of service (reboot and reporting outage) via a loopback packet with zero in the length field.

[CLOSE] OSVDB ID : 40524 - Disclosed: 2007-06-29

Description:

(Description Provided by CVE) : Stack-based buffer overflow in the local__vcentry_parse_value function in vorbiscomment.c in flac123 (aka flac-tools or flac) before 0.0.10 allows user-assisted remote attackers to execute arbitrary code via a large comment value_length.

[CLOSE] OSVDB ID : 37064 - Disclosed: 2007-06-29

Description:

(Description Provided by CVE) : SQL injection vulnerability in Coppermine Photo Gallery (CPG) before 1.4.11 allows remote attackers to execute arbitrary SQL commands via an album password cookie to an unspecified component.

[CLOSE] OSVDB ID : 37065 - Disclosed: 2007-06-29

Description:

(Description Provided by CVE) : SQL injection vulnerability in Coppermine Photo Gallery (CPG) before 1.4.11 allows remote attackers to execute arbitrary SQL commands via an album password cookie to an unspecified component.

[CLOSE] OSVDB ID : 42434 - Disclosed: 2007-06-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 42435 - Disclosed: 2007-06-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 42436 - Disclosed: 2007-06-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 42437 - Disclosed: 2007-06-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 42438 - Disclosed: 2007-06-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 42439 - Disclosed: 2007-06-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 42440 - Disclosed: 2007-06-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 42441 - Disclosed: 2007-06-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 42442 - Disclosed: 2007-06-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 42443 - Disclosed: 2007-06-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 42444 - Disclosed: 2007-06-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 42445 - Disclosed: 2007-06-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 42446 - Disclosed: 2007-06-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 38914 - Disclosed: 2007-06-29

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in akocomment allow remote attackers to execute arbitrary SQL commands via the (1) acparentid or (2) acitemid parameter to an unspecified component, different vectors than CVE-2006-1421.

[CLOSE] OSVDB ID : 38936 - Disclosed: 2007-06-29

Description:

(Description Provided by CVE) : SQL injection vulnerability in view_sub_cat.php in Buddy Zone 1.5 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.

[CLOSE] OSVDB ID : 38860 - Disclosed: 2007-06-28

Description:

Safari for Windows contains a flaw that may lead to an unauthorized information disclosure.  The issue is triggered when a malicious user uses JavaScript to overwrite the document variable and statically sets the document.domain attribute, which will disclose information from other domains resulting in a loss of confidentiality.

[CLOSE] OSVDB ID : 37792 - Disclosed: 2007-06-28

Description:

(Description Provided by CVE) : IBM OS/400 (aka i5/OS) V4R2M0 through V5R3M0 on iSeries machines sends responses to TCP SYN-FIN packets, which allows remote attackers to obtain system information and possibly bypass firewall rules.

[CLOSE] OSVDB ID : 48696 - Disclosed: 2007-06-28

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 37755 - Disclosed: 2007-06-28

Description:

(Description Provided by CVE) : Directory traversal vulnerability in the PersistenceService in Sun Java Web Start in JDK and JRE 5.0 Update 11 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, for Windows allows remote attackers to perform unauthorized actions via an application that grants file overwrite privileges to itself. NOTE: this can be leveraged to execute arbitrary code by overwriting a .java.policy file.

[CLOSE] OSVDB ID : 39847 - Disclosed: 2007-06-28

Description:

(Description Provided by CVE) : Xeweb XEForum allows remote attackers to gain privileges via a modified xeforum cookie.

[CLOSE] OSVDB ID : 37672 - Disclosed: 2007-06-28

Description:

(Description Provided by CVE) : Multiple buffer overflows in the AMX NetLinx VNC (AmxVnc) ActiveX control in AmxVnc.dll 1.0.13.0 allow remote attackers to execute arbitrary code via long (1) Host, (2) Password, or (3) LogFile property values.

[CLOSE] OSVDB ID : 40177 - Disclosed: 2007-06-28

Description:

(Description Provided by CVE) : NVIDIA drivers (nvidia-drivers) before 1.0.7185, 1.0.9639, and 100.14.11, as used in Gentoo Linux and possibly other distributions, creates /dev/nvidia* device files with insecure permissions, which allows local users to modify video card settings, cause a denial of service (crash or physical video card damage), and obtain sensitive information.