[CLOSE] OSVDB ID : 51290 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : Mozilla Firefox 3.x before 3.0.5 allows remote attackers to bypass intended privacy restrictions by using the persist attribute in an XUL element to create and access data entities that are similar to cookies.

[CLOSE] OSVDB ID : 51291 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to bypass the same origin policy by causing the browser to issue an XMLHttpRequest to an attacker-controlled resource that uses a 302 redirect to a resource in a different domain, then reading content from the response, aka "response disclosure."

[CLOSE] OSVDB ID : 51292 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allow remote attackers to bypass the same origin policy and access portions of data from another domain via a JavaScript URL that redirects to the target resource, which generates an error if the target data does not have JavaScript syntax, which can be accessed using the window.onerror DOM API.

[CLOSE] OSVDB ID : 51293 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly parse URLs with leading whitespace or control characters, which might allow remote attackers to misrepresent URLs and simplify phishing attacks.

[CLOSE] OSVDB ID : 51294 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : The CSS parser in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 ignores the '\0' escaped null character, which might allow remote attackers to bypass protection mechanisms such as sanitization routines.

[CLOSE] OSVDB ID : 51295 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to bypass the same origin policy and conduct cross-site scripting (XSS) attacks via an XBL binding to an "unloaded document."

[CLOSE] OSVDB ID : 51296 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allow remote attackers to run arbitrary JavaScript with chrome privileges via unknown vectors in which "page content can pollute XPCNativeWrappers."

[CLOSE] OSVDB ID : 51297 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : Unspecified vulnerability in the session-restore feature in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19 allows remote attackers to bypass the same origin policy, inject content into documents associated with other domains, and conduct cross-site scripting (XSS) attacks via unknown vectors related to restoration of SessionStore data.

[CLOSE] OSVDB ID : 51285 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : The layout engine in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via vectors related to (1) a reachable assertion or (2) an integer overflow.

[CLOSE] OSVDB ID : 50812 - Disclosed: 2008-12-17

Description:

Rematic CMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script not properly sanitizing user-supplied input to the id parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 50813 - Disclosed: 2008-12-17

Description:

Rematic CMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the referenzdetail.php script not properly sanitizing user-supplied input to the id parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 50814 - Disclosed: 2008-12-17

Description:

Rematic CMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the produkte.php script not properly sanitizing user-supplied input to the id parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 50796 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : Unspecified vulnerability in Adobe Flash Player for Linux 10.0.12.36, and 9.0.151.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file.

[CLOSE] OSVDB ID : 50811 - Disclosed: 2008-12-17

Description:

Courier Authentication Library contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to authpgsqllib.c not properly sanitizing user-supplied input to unspecified parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 50933 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : tun in IP Tunnel in Solaris 10 and OpenSolaris snv_01 through snv_76 allows local users to cause a denial of service (panic) and possibly execute arbitrary code via a crafted SIOCGTUNPARAM IOCTL request, which triggers a NULL pointer dereference.

[CLOSE] OSVDB ID : 54239 - Disclosed: 2008-12-17

Description:

Lizardware CMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'administrator/index.php' script not properly sanitizing user-supplied input to the 'user' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 52656 - Disclosed: 2008-12-17

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 53573 - Disclosed: 2008-12-17

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 50743 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, uses an insecure hash when signing requests, which allows remote attackers to impersonate other users and gain privileges.

[CLOSE] OSVDB ID : 50779 - Disclosed: 2008-12-17

Description:

EvimGibi Pro Resim Galerisi contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'resim.asp' script not properly sanitizing user-supplied input to the 'kat_id' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 50802 - Disclosed: 2008-12-17

Description:

RSMScript contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when the 'verified' cookie value is set. This flaw may lead to a loss of confidentiality, integrity or availability.

[CLOSE] OSVDB ID : 50797 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : SQL injection vulnerability in ADbNewsSender before 1.5.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors in (1) opt_in_out.php.inc, (2) confirmation.php.inc, and (3) renewal.php.inc in mailinglist/.

[CLOSE] OSVDB ID : 50794 - Disclosed: 2008-12-17

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 50795 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : SQL injection vulnerability in the Views module 6.x before 6.x-2.2 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to "an exposed filter on CCK text fields."

[CLOSE] OSVDB ID : 50798 - Disclosed: 2008-12-17

Description:

ADbNewsSender contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'mailinglist/confirmation.php.inc' script not properly sanitizing user-supplied input to an Unspecified variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 50799 - Disclosed: 2008-12-17

Description:

ADbNewsSender contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'mailinglist/renewal.php.inc' script not properly sanitizing user-supplied input to an Unspecified variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 50800 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in ADbNewsSender before 1.5.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) subscribing and (2) unsubscribing.

[CLOSE] OSVDB ID : 50803 - Disclosed: 2008-12-17

Description:

RSMScript contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'quote' variables upon submission to the submit.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 50804 - Disclosed: 2008-12-17

Description:

RSMScript contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate quote variables upon submission to the 'edit-submit.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 51210 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : Unrestricted file upload vulnerability in admin/editor/images.php in K&S Shopsoftware allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/upload/.

[CLOSE] OSVDB ID : 50911 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : Heap-based buffer overflow in the Phoenician Casino FlashAX ActiveX control 1.0.0.7 allows remote attackers to execute arbitrary code via a long argument to the SetID method.

[CLOSE] OSVDB ID : 50952 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : Multiple buffer overflows in Opera before 9.63 might allow (1) remote attackers to execute arbitrary code via a crafted text area, or allow (2) user-assisted remote attackers to execute arbitrary code via a long host name in a file: URL. NOTE: this might overlap CVE-2008-5178.

[CLOSE] OSVDB ID : 50953 - Disclosed: 2008-12-17

Description:

A remote buffer overflow exists in Opera web browser. Opera incorrectly parses file:// URLs, resulting in a possible buffer overflow. With a specially crafted request, an attacker can cause remote code execution resulting in a loss of confidentiality and/or availability.

[CLOSE] OSVDB ID : 51206 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : SQL injection vulnerability in the create function in common/include/GroupJoinRequest.class in GForge 4.5 and 4.6 allows remote attackers to execute arbitrary SQL commands via the comments variable.

[CLOSE] OSVDB ID : 51781 - Disclosed: 2008-12-17

Description:

Tech Articles Component for Joomla! contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'item' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 51782 - Disclosed: 2008-12-17

Description:

TinyMCE contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'menuID' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

[CLOSE] OSVDB ID : 53403 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : Absolute path traversal vulnerability in phpcksec.php in Stefan Ott phpcksec 0.2.0 allows remote attackers to list arbitrary directories and read arbitrary files via a full pathname in the file parameter.

[CLOSE] OSVDB ID : 53404 - Disclosed: 2008-12-17

Description:

phpcksec contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'path' parameters upon submission to the 'phpcksec.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 56851 - Disclosed: 2008-12-17

Description:

(Description Provided by CVE) : Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not use timeouts for signed requests, which allows remote attackers to impersonate other users and gain privileges via a replay attack that sends the same request.

[CLOSE] OSVDB ID : 58941 - Disclosed: 2008-12-17

Description:

BIRT contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the '__report' parameter upon submission to the birt-viewer/run script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.