[CLOSE] OSVDB ID : 59422 - Disclosed: 2009-10-19

Description:

Amiro.CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'status_message' parameter upon submission to the '/news', '/comment', '/forum', '/blog', '/tags', '/_admin/forum.php', '/_admin/discussion.php', '/_admin/guestbook.php', '/_admin/blog.php', '/_admin/news.php', '/_admin/google_sitemap.php', '/_admin/sitemap_history.php', '/_admin/locales.php' and '/_admin/plugins_wizard.php' scripts. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 59423 - Disclosed: 2009-10-19

Description:

Amiro.CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'status_message' parameter upon submission to the '/news', '/comment', '/forum', '/blog', '/tags', '/_admin/forum.php', '/_admin/discussion.php', '/_admin/guestbook.php', '/_admin/blog.php', '/_admin/news.php', '/_admin/google_sitemap.php', '/_admin/sitemap_history.php', '/_admin/locales.php' and '/_admin/plugins_wizard.php' scripts. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 59424 - Disclosed: 2009-10-19

Description:

Amiro.CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'status_message' parameter upon submission to the '/news', '/comment', '/forum', '/blog', '/tags', '/_admin/forum.php', '/_admin/discussion.php', '/_admin/guestbook.php', '/_admin/blog.php', '/_admin/news.php', '/_admin/google_sitemap.php', '/_admin/sitemap_history.php', '/_admin/locales.php' and '/_admin/plugins_wizard.php' scripts. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 59425 - Disclosed: 2009-10-19

Description:

Amiro.CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'status_message' parameter upon submission to the '/news', '/comment', '/forum', '/blog', '/tags', '/_admin/forum.php', '/_admin/discussion.php', '/_admin/guestbook.php', '/_admin/blog.php', '/_admin/news.php', '/_admin/google_sitemap.php', '/_admin/sitemap_history.php', '/_admin/locales.php' and '/_admin/plugins_wizard.php' scripts. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 59426 - Disclosed: 2009-10-19

Description:

Amiro.CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'status_message' parameter upon submission to the '/news', '/comment', '/forum', '/blog', '/tags', '/_admin/forum.php', '/_admin/discussion.php', '/_admin/guestbook.php', '/_admin/blog.php', '/_admin/news.php', '/_admin/google_sitemap.php', '/_admin/sitemap_history.php', '/_admin/locales.php' and '/_admin/plugins_wizard.php' scripts. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 59427 - Disclosed: 2009-10-19

Description:

Amiro.CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'status_message' parameter upon submission to the '/news', '/comment', '/forum', '/blog', '/tags', '/_admin/forum.php', '/_admin/discussion.php', '/_admin/guestbook.php', '/_admin/blog.php', '/_admin/news.php', '/_admin/google_sitemap.php', '/_admin/sitemap_history.php', '/_admin/locales.php' and '/_admin/plugins_wizard.php' scripts. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 59428 - Disclosed: 2009-10-19

Description:

Amiro.CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'status_message' parameter upon submission to the '/news', '/comment', '/forum', '/blog', '/tags', '/_admin/forum.php', '/_admin/discussion.php', '/_admin/guestbook.php', '/_admin/blog.php', '/_admin/news.php', '/_admin/google_sitemap.php', '/_admin/sitemap_history.php', '/_admin/locales.php' and '/_admin/plugins_wizard.php' scripts. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 59429 - Disclosed: 2009-10-19

Description:

Amiro.CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'status_message' parameter upon submission to the '/news', '/comment', '/forum', '/blog', '/tags', '/_admin/forum.php', '/_admin/discussion.php', '/_admin/guestbook.php', '/_admin/blog.php', '/_admin/news.php', '/_admin/google_sitemap.php', '/_admin/sitemap_history.php', '/_admin/locales.php' and '/_admin/plugins_wizard.php' scripts. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 59430 - Disclosed: 2009-10-19

Description:

Amiro.CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'status_message' parameter upon submission to the '/news', '/comment', '/forum', '/blog', '/tags', '/_admin/forum.php', '/_admin/discussion.php', '/_admin/guestbook.php', '/_admin/blog.php', '/_admin/news.php', '/_admin/google_sitemap.php', '/_admin/sitemap_history.php', '/_admin/locales.php' and '/_admin/plugins_wizard.php' scripts. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 59431 - Disclosed: 2009-10-19

Description:

Amiro.CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'status_message' parameter upon submission to the '/news', '/comment', '/forum', '/blog', '/tags', '/_admin/forum.php', '/_admin/discussion.php', '/_admin/guestbook.php', '/_admin/blog.php', '/_admin/news.php', '/_admin/google_sitemap.php', '/_admin/sitemap_history.php', '/_admin/locales.php' and '/_admin/plugins_wizard.php' scripts. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 59432 - Disclosed: 2009-10-19

Description:

Amiro.CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'status_message' parameter upon submission to the '/news', '/comment', '/forum', '/blog', '/tags', '/_admin/forum.php', '/_admin/discussion.php', '/_admin/guestbook.php', '/_admin/blog.php', '/_admin/news.php', '/_admin/google_sitemap.php', '/_admin/sitemap_history.php', '/_admin/locales.php' and '/_admin/plugins_wizard.php' scripts. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 59433 - Disclosed: 2009-10-19

Description:

Amiro.CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'status_message' parameter upon submission to the '/news', '/comment', '/forum', '/blog', '/tags', '/_admin/forum.php', '/_admin/discussion.php', '/_admin/guestbook.php', '/_admin/blog.php', '/_admin/news.php', '/_admin/google_sitemap.php', '/_admin/sitemap_history.php', '/_admin/locales.php' and '/_admin/plugins_wizard.php' scripts. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 59434 - Disclosed: 2009-10-19

Description:

Amiro.CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'status_message' parameter upon submission to the '/news', '/comment', '/forum', '/blog', '/tags', '/_admin/forum.php', '/_admin/discussion.php', '/_admin/guestbook.php', '/_admin/blog.php', '/_admin/news.php', '/_admin/google_sitemap.php', '/_admin/sitemap_history.php', '/_admin/locales.php' and '/_admin/plugins_wizard.php' scripts. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 59435 - Disclosed: 2009-10-19

Description:

Amiro.CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'status_message' parameter upon submission to the '/news', '/comment', '/forum', '/blog', '/tags', '/_admin/forum.php', '/_admin/discussion.php', '/_admin/guestbook.php', '/_admin/blog.php', '/_admin/news.php', '/_admin/google_sitemap.php', '/_admin/sitemap_history.php', '/_admin/locales.php' and '/_admin/plugins_wizard.php' scripts. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 59436 - Disclosed: 2009-10-19

Description:

Amiro.CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'status_message' parameter upon submission to the '/news', '/comment', '/forum', '/blog', '/tags', '/_admin/forum.php', '/_admin/discussion.php', '/_admin/guestbook.php', '/_admin/blog.php', '/_admin/news.php', '/_admin/google_sitemap.php', '/_admin/sitemap_history.php', '/_admin/locales.php' and '/_admin/plugins_wizard.php' scripts. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 60311 - Disclosed: 2009-10-19

Description:

(Description Provided by CVE) : Array index error in the gdth_read_event function in drivers/scsi/gdth.c in the Linux kernel before 2.6.32-rc8 allows local users to cause a denial of service or possibly gain privileges via a negative event index in an IOCTL request.

[CLOSE] OSVDB ID : 59051 - Disclosed: 2009-10-19

Description:

Input passed via the "name" and "HTTP_RAW_POST_DATA" parameters to "ofc_upload_image.php" is not sanitized. This can be exploited to create arbitrary PHP files with the .php extension that can be remotely executed.

[CLOSE] OSVDB ID : 59066 - Disclosed: 2009-10-19

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in the help pages in IBM Rational AppScan Enterprise Edition 5.5.0.2 allows remote attackers to inject arbitrary web script or HTML via the query string.

[CLOSE] OSVDB ID : 59056 - Disclosed: 2009-10-19

Description:

AjaxChat Component for Joomla! contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'components/com_ajaxchat/tests/ajcuser.php' script not properly sanitizing user input supplied to the 'mosConfig_absolute_path' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 59137 - Disclosed: 2009-10-19

Description:

Sahana disaster management system contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'index.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'mod' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 59210 - Disclosed: 2009-10-19

Description:

(Description Provided by CVE) : net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace AF_UNIX listening socket, performing a shutdown operation on this socket, and then performing a series of connect operations to this socket.

[CLOSE] OSVDB ID : 59377 - Disclosed: 2009-10-19

Description:

BookLibrary Component for Joomla! contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'doc/releasenote.php' script not properly sanitizing user input supplied to the 'mosConfig_absolute_path' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 62306 - Disclosed: 2009-10-19

Description:

Google Chrome contains a flaw in the pop-up blocking feature within WebKit when handling click events. With a specially crafted web page, a context-dependent attacker can bypass the pop-up blocking feature.

[CLOSE] OSVDB ID : 63223 - Disclosed: 2009-10-19

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 62858 - Disclosed: 2009-10-18

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 66230 - Disclosed: 2009-10-18

Description:

By default, 3Com OfficeConnect Routers install with multiple default passwords. The following account:password combinations are publicly known and documented: support:support, user:5, nobody:admin, (no username)/PASSWORD. This allows attackers to trivially access the program or system.

[CLOSE] OSVDB ID : 91396 - Disclosed: 2009-10-18

Description:

FrontAccounting (FA) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the /admin/print_profiles.php script not properly sanitizing user-supplied input before using it in SQL queries. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 91395 - Disclosed: 2009-10-18

Description:

FrontAccounting (FA) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the /admin/printers.php script not properly sanitizing user-supplied input before using it in SQL queries. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 91394 - Disclosed: 2009-10-18

Description:

FrontAccounting (FA) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the /admin/shipping_companies.php script not properly sanitizing user-supplied input before using it in SQL queries. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 91393 - Disclosed: 2009-10-18

Description:

FrontAccounting (FA) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the /admin/view_print_transaction.php script not properly sanitizing user-supplied input before using it in SQL queries. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 91392 - Disclosed: 2009-10-18

Description:

FrontAccounting (FA) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the /admin/db/company_db.inc script not properly sanitizing user-supplied input before using it in SQL queries. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 91391 - Disclosed: 2009-10-18

Description:

FrontAccounting (FA) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the /admin/db/printers_db.inc script not properly sanitizing user-supplied input before using it in SQL queries. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 91390 - Disclosed: 2009-10-18

Description:

FrontAccounting (FA) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the /admin/db/voiding_db.inc script not properly sanitizing user-supplied input before using it in SQL queries. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 91389 - Disclosed: 2009-10-18

Description:

FrontAccounting (FA) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the /admin/db/users_db.inc script not properly sanitizing user-supplied input before using it in SQL queries. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 91388 - Disclosed: 2009-10-18

Description:

FrontAccounting (FA) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the /dimensions/includes/dimensions_db.inc script not properly sanitizing user-supplied input before using it in SQL queries. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 91387 - Disclosed: 2009-10-18

Description:

FrontAccounting (FA) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the /dimensions/inquiry/search_dimensions.php script not properly sanitizing user-supplied input before using it in SQL queries. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 91386 - Disclosed: 2009-10-18

Description:

FrontAccounting (FA) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the /gl/bank_account_reconcile.php script not properly sanitizing user-supplied input before using it in SQL queries. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 91385 - Disclosed: 2009-10-18

Description:

FrontAccounting (FA) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the /gl/gl_budget.php script not properly sanitizing user-supplied input before using it in SQL queries. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 91384 - Disclosed: 2009-10-18

Description:

FrontAccounting (FA) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the /gl/includes/db/gl_db_account_types.inc script not properly sanitizing user-supplied input before using it in SQL queries. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 91383 - Disclosed: 2009-10-18

Description:

FrontAccounting (FA) contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the /gl/includes/db/gl_db_accounts.inc script not properly sanitizing user-supplied input before using it in SQL queries. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.