[CLOSE] OSVDB ID : 59870 - Disclosed: 2009-10-31

Description:

Super Serious Stats contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'user.php' script not properly sanitizing user-supplied input to the 'uid' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 59965 - Disclosed: 2009-10-31

Description:

(Description Provided by CVE) : Panda Global Protection 2010, Internet Security 2010, and Antivirus Pro 2010 use weak permissions (Everyone: Full Control) for the product files, which allows local users to gain privileges by replacing executables with Trojan horse programs.

[CLOSE] OSVDB ID : 60074 - Disclosed: 2009-10-31

Description:

(Description Provided by CVE) : The activation resend function in the Profiles module in XOOPS before 2.4.1 sends activation codes in response to arbitrary activation requests, which allows remote attackers to bypass administrative approval via a request involving activate.php.

[CLOSE] OSVDB ID : 73532 - Disclosed: 2009-10-31

Description:

(Description Provided by CVE) : Memory leak in the ldap_explode_dn function in IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.61 (aka 6.0.0.8-TIV-ITDS-IF0003) allows remote authenticated users to cause a denial of service (memory consumption) via an empty string argument.

[CLOSE] OSVDB ID : 59721 - Disclosed: 2009-10-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 59635 - Disclosed: 2009-10-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 59465 - Disclosed: 2009-10-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 59576 - Disclosed: 2009-10-30

Description:

Mura CMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'go/default/blog/blog-post-with-flash-video/' script not properly sanitizing user-supplied input to the 'txtName' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 59577 - Disclosed: 2009-10-30

Description:

Mura CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'txtName' and 'txtUrl' parameters upon submission to the 'go/default/blog/blog-post-with-flash-video/' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 59578 - Disclosed: 2009-10-30

Description:

Mura CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'link' parameter upon submission to the 'default/includes/display_objects/sendtofriend/index.cfm' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 59579 - Disclosed: 2009-10-30

Description:

Mura CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'returnURL' parameter upon submission to the 'go/default/blog/index.cfm' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 59583 - Disclosed: 2009-10-30

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in the resume blocktype in Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

[CLOSE] OSVDB ID : 59584 - Disclosed: 2009-10-30

Description:

(Description Provided by CVE) : Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote authenticated institution administrators to reset a site administrator password via unspecified vectors.

[CLOSE] OSVDB ID : 59660 - Disclosed: 2009-10-30

Description:

SoftRemote is prone to an overflow condition. spdedit.exe fails to properly sanitize user-supplied input resulting in a stack overflow. With a specially crafted SPD file, a context-dependent attacker can potentially cause arbitrary code execution.

[CLOSE] OSVDB ID : 59724 - Disclosed: 2009-10-30

Description:

(Description Provided by CVE) : Stack-based buffer overflow in SafeNet SoftRemote 10.8.5 (Build 2) and 10.3.5 (Build 6), and possibly other versions before 10.8.9, allows local users to execute arbitrary code via a long string in a (1) TREENAME or (2) GROUPNAME Policy file (spd).

[CLOSE] OSVDB ID : 63224 - Disclosed: 2009-10-30

Description:

PSAtr contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the news.asp script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 63296 - Disclosed: 2009-10-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 65079 - Disclosed: 2009-10-30

Description:

(Description Provided by CVE) : Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l.c in the strfmon implementation in the GNU C Library (aka glibc or libc6) before 2.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted format string, as demonstrated by the %99999999999999999999n string, a related issue to CVE-2008-1391.

[CLOSE] OSVDB ID : 59704 - Disclosed: 2009-10-29

Description:

Runtimes for Java Technology contains a flaw related to the XML component XML4J update that may allow an attacker to perform unspecified impact. No further details have been provided.

[CLOSE] OSVDB ID : 59586 - Disclosed: 2009-10-29

Description:

Oscailt CMS contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'index.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'obj_id' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 59703 - Disclosed: 2009-10-29

Description:

Solaris contains a flaw that may allow an attacker to bypass security controls. The issue is triggered when trusted extensions prevents the operation of the xscreensaver-demo command for the XScreenSaver application.

[CLOSE] OSVDB ID : 59696 - Disclosed: 2009-10-29

Description:

CubeCart contains a flaw that may allow an attacker to gain access to unauthorized privileges. The issue is triggered when a remote attacker sends an HTTP request with empty "X_CLUSTER_CLIENT_IP" and "User-Agent" headers and the "ccAdmin" cookie set to "+", allowing a remote attacker to gain administrative privileges.

[CLOSE] OSVDB ID : 60075 - Disclosed: 2009-10-29

Description:

SemanticScuttle contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'sort' parameter upon submission to the 'index.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 60243 - Disclosed: 2009-10-29

Description:

(Description Provided by CVE) : The management interface on the 2wire Gateway 1700HG, 1701HG, 1800HW, 2071, 2700HG, and 2701HG-T with software before 5.29.52 allows remote attackers to cause a denial of service (reboot) via a %0d%0a sequence in the page parameter to the xslt program on TCP port 50001, a related issue to CVE-2006-4523.

[CLOSE] OSVDB ID : 60425 - Disclosed: 2009-10-29

Description:

(Description Provided by CVE) : The nsGIFDecoder2::GifWrite function in decoders/gif/nsGIFDecoder2.cpp in libpr0n in Mozilla Firefox before 3.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an animated GIF file with a large image size, a different vulnerability than CVE-2009-3373.

[CLOSE] OSVDB ID : 60473 - Disclosed: 2009-10-29

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x before 2.2 RC allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) bank_accounts.php, (2) currencies.php, (3) exchange_rates.php, (4) gl_account_types.php, and (5) gl_accounts.php in gl/manage/; and (6) audit_trail_db.inc, (7) comments_db.inc, (8) inventory_db.inc, (9) manufacturing_db.inc, and (10) references_db.inc in includes/db/.

[CLOSE] OSVDB ID : 60474 - Disclosed: 2009-10-29

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x before 2.2 RC allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) bank_accounts.php, (2) currencies.php, (3) exchange_rates.php, (4) gl_account_types.php, and (5) gl_accounts.php in gl/manage/; and (6) audit_trail_db.inc, (7) comments_db.inc, (8) inventory_db.inc, (9) manufacturing_db.inc, and (10) references_db.inc in includes/db/.

[CLOSE] OSVDB ID : 60475 - Disclosed: 2009-10-29

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x before 2.2 RC allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) bank_accounts.php, (2) currencies.php, (3) exchange_rates.php, (4) gl_account_types.php, and (5) gl_accounts.php in gl/manage/; and (6) audit_trail_db.inc, (7) comments_db.inc, (8) inventory_db.inc, (9) manufacturing_db.inc, and (10) references_db.inc in includes/db/.

[CLOSE] OSVDB ID : 60476 - Disclosed: 2009-10-29

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x before 2.2 RC allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) bank_accounts.php, (2) currencies.php, (3) exchange_rates.php, (4) gl_account_types.php, and (5) gl_accounts.php in gl/manage/; and (6) audit_trail_db.inc, (7) comments_db.inc, (8) inventory_db.inc, (9) manufacturing_db.inc, and (10) references_db.inc in includes/db/.

[CLOSE] OSVDB ID : 60477 - Disclosed: 2009-10-29

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x before 2.2 RC allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) bank_accounts.php, (2) currencies.php, (3) exchange_rates.php, (4) gl_account_types.php, and (5) gl_accounts.php in gl/manage/; and (6) audit_trail_db.inc, (7) comments_db.inc, (8) inventory_db.inc, (9) manufacturing_db.inc, and (10) references_db.inc in includes/db/.

[CLOSE] OSVDB ID : 60478 - Disclosed: 2009-10-29

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x before 2.2 RC allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) bank_accounts.php, (2) currencies.php, (3) exchange_rates.php, (4) gl_account_types.php, and (5) gl_accounts.php in gl/manage/; and (6) audit_trail_db.inc, (7) comments_db.inc, (8) inventory_db.inc, (9) manufacturing_db.inc, and (10) references_db.inc in includes/db/.

[CLOSE] OSVDB ID : 60479 - Disclosed: 2009-10-29

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x before 2.2 RC allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) bank_accounts.php, (2) currencies.php, (3) exchange_rates.php, (4) gl_account_types.php, and (5) gl_accounts.php in gl/manage/; and (6) audit_trail_db.inc, (7) comments_db.inc, (8) inventory_db.inc, (9) manufacturing_db.inc, and (10) references_db.inc in includes/db/.

[CLOSE] OSVDB ID : 60480 - Disclosed: 2009-10-29

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x before 2.2 RC allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) bank_accounts.php, (2) currencies.php, (3) exchange_rates.php, (4) gl_account_types.php, and (5) gl_accounts.php in gl/manage/; and (6) audit_trail_db.inc, (7) comments_db.inc, (8) inventory_db.inc, (9) manufacturing_db.inc, and (10) references_db.inc in includes/db/.

[CLOSE] OSVDB ID : 60481 - Disclosed: 2009-10-29

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x before 2.2 RC allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) bank_accounts.php, (2) currencies.php, (3) exchange_rates.php, (4) gl_account_types.php, and (5) gl_accounts.php in gl/manage/; and (6) audit_trail_db.inc, (7) comments_db.inc, (8) inventory_db.inc, (9) manufacturing_db.inc, and (10) references_db.inc in includes/db/.

[CLOSE] OSVDB ID : 60482 - Disclosed: 2009-10-29

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x before 2.2 RC allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) bank_accounts.php, (2) currencies.php, (3) exchange_rates.php, (4) gl_account_types.php, and (5) gl_accounts.php in gl/manage/; and (6) audit_trail_db.inc, (7) comments_db.inc, (8) inventory_db.inc, (9) manufacturing_db.inc, and (10) references_db.inc in includes/db/.

[CLOSE] OSVDB ID : 75714 - Disclosed: 2009-10-29

Description:

(Description Provided by CVE) : ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

[CLOSE] OSVDB ID : 59355 - Disclosed: 2009-10-28

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 59357 - Disclosed: 2009-10-28

Description:

(Description Provided by CVE) : Opera before 10.01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted domain name.

[CLOSE] OSVDB ID : 59358 - Disclosed: 2009-10-28

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 59359 - Disclosed: 2009-10-28

Description:

(Description Provided by CVE) : Opera before 10.01 on Windows does not prevent use of Web fonts in rendering the product's own user interface, which allows remote attackers to spoof the address field via a crafted web site.