[CLOSE] OSVDB ID : 63686 - Disclosed: 2010-01-05

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 87490 - Disclosed: 2010-01-05

Description:

Apple Mac OS X contains a flaw that may allow an attacker to gain access to unauthorized privileges. The issue is triggered when an error occurs in vfork() during the handling of mach exceptions. This may allow a local attacker to gain escalated privileges.

[CLOSE] OSVDB ID : 93153 - Disclosed: 2010-01-05

Description:

Apache PDFBox contains a flaw in PDFXrefStreamParser that may allow a denial of service. The issue is triggered during the handling of a missing element when parsing PDF files. This may allow a context-dependent attacker to crash the program.

[CLOSE] OSVDB ID : 61442 - Disclosed: 2010-01-04

Description:

Hit Counter contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate input passed via the URI upon submission to the 'index.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61443 - Disclosed: 2010-01-04

Description:

Hit Counter contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate input passed via the URI upon submission to the 'inc/login.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61444 - Disclosed: 2010-01-04

Description:

Hit Counter contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate input passed via the URI upon submission to the 'admin/index.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61440 - Disclosed: 2010-01-04

Description:

VisionGate contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'url' parameter upon submission to the 'login.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 70480 - Disclosed: 2010-01-04

Description:

gif2png contains a flaw in the handling of Graphics Interchange Format (GIF) media files that may allow a remote denial of service. The issue is due to an error within gif2png.c not validating user-supplied input. With a specially crafted request containing many images, a context-dependent attacker can cause the program that uses the library to crash.

[CLOSE] OSVDB ID : 62461 - Disclosed: 2010-01-04

Description:

(Description Provided by CVE) : Stack consumption vulnerability in the ChildProcessSecurityPolicy::CanRequestURL function in browser/child_process_security_policy.cc in Google Chrome before 4.0.249.78 allows remote attackers to cause a denial of service (memory consumption and application crash) via a URL that specifies multiple protocols, as demonstrated by a URL that begins with many repetitions of the view-source: substring.

[CLOSE] OSVDB ID : 63644 - Disclosed: 2010-01-04

Description:

W-Agora contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'rss.php' script not properly sanitizing user input supplied to the 'bn' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 61437 - Disclosed: 2010-01-04

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61438 - Disclosed: 2010-01-04

Description:

BF Survey Component for Joomla! contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'index.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'controller' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 61439 - Disclosed: 2010-01-04

Description:

Imagevue Gallery contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'path' parameter upon submission to the 'admin/upload.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61446 - Disclosed: 2010-01-04

Description:

phpBannerExchange contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'bannerurl' parameter upon submission to the 'signupconfirm.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61456 - Disclosed: 2010-01-04

Description:

BF Survey Pro Component for Joomla! contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'catid' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 61481 - Disclosed: 2010-01-04

Description:

eMerge Management Component contains a flaw that may allow a remote denial of service. The issue is triggered when an attacker send a crafted HTTP request, and will result in loss of availability for the service.

[CLOSE] OSVDB ID : 61482 - Disclosed: 2010-01-04

Description:

Deviant Art Clone contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'seid' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 62325 - Disclosed: 2010-01-04

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61601 - Disclosed: 2010-01-04

Description:

(Description Provided by CVE) : Directory traversal vulnerability in libtransmission/metainfo.c in Transmission 1.22, 1.34, 1.75, and 1.76 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a pathname within a .torrent file.

[CLOSE] OSVDB ID : 61649 - Disclosed: 2010-01-04

Description:

(Description Provided by CVE) : Heap-based buffer overflow in Sun Java System Web Server 7.0 Update 6 on Linux allows remote attackers to discover process memory locations via crafted data to TCP port 80, as demonstrated by the vd_sjws2 module in VulnDisco. NOTE: as of 20100106, this disclosure has no actionable information. However, because the VulnDisco author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.

[CLOSE] OSVDB ID : 61650 - Disclosed: 2010-01-04

Description:

(Description Provided by CVE) : Unspecified vulnerability in Sun Java System Web Server 7.0 Update 6 on Linux allows remote attackers to execute arbitrary code by sending a process memory address and crafted data to TCP port 80, as demonstrated by the vd_sjws2 module in VulnDisco. NOTE: as of 20100106, this disclosure has no actionable information. However, because the VulnDisco author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.

[CLOSE] OSVDB ID : 62307 - Disclosed: 2010-01-04

Description:

WebKit contains a flaw that may lead to unauthorized disclosure of sensitive information and is triggered when handling cross-origin loading of stylesheets. With a specially crafted web page, a context-dependent attacker may disclose content from another domain.

[CLOSE] OSVDB ID : 62326 - Disclosed: 2010-01-04

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 63737 - Disclosed: 2010-01-04

Description:

JProject Component for Joomla! contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'project' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 65344 - Disclosed: 2010-01-04

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 65425 - Disclosed: 2010-01-04

Description:

Pay Per Minute Video Chat Script contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index_ie.php' script not properly sanitizing user-supplied input to the 'page' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 67708 - Disclosed: 2010-01-04

Description:

(Description Provided by CVE) : Off-by-one error in the Ins_MINDEX function in the TrueType bytecode interpreter in Ghostscript before 8.71 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a malformed TrueType font in a document that trigger an integer overflow and a heap-based buffer overflow.

[CLOSE] OSVDB ID : 80644 - Disclosed: 2010-01-03

Description:

Quake 3 Engine contains a flaw that may allow a remote denial of service. The issue is triggered when a remote attacker sends a specially crafted getstatus UDP request to the server, which will result in loss of availability for the server.

[CLOSE] OSVDB ID : 61436 - Disclosed: 2010-01-03

Description:

(Description Provided by CVE) : Acidcat CMS 3.5.3 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for databases/acidcat_3.mdb.

[CLOSE] OSVDB ID : 61441 - Disclosed: 2010-01-03

Description:

BLOG:CMS contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate input to the 'Comment Body' upon submission to the 'libs/MEMBER.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61450 - Disclosed: 2010-01-03

Description:

Rezervi contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'include/mail.inc.php' script not properly sanitizing user input supplied to the 'root' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 61447 - Disclosed: 2010-01-03

Description:

CARTwebERP Component for Joomla! contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'index.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'controller' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 61455 - Disclosed: 2010-01-03

Description:

Joomla! component oziogallery contains a flaw that may allow an attacker to write to anywhere in the server. The issue is triggered when the attacker manupilate the POST 'path' parameter.

[CLOSE] OSVDB ID : 61457 - Disclosed: 2010-01-03

Description:

Bible Study Component for Joomla contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the index.php script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'controller' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 61458 - Disclosed: 2010-01-03

Description:

(Description Provided by CVE) : Directory traversal vulnerability in the Abbreviations Manager (com_abbrev) component 1.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from third party information.

[CLOSE] OSVDB ID : 61477 - Disclosed: 2010-01-03

Description:

TPJobs Component for Joomla! contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'id_c[]' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 61566 - Disclosed: 2010-01-03

Description:

JoomlaBamboo (JB) Simpla Admin Template for Joomla! contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 62825 - Disclosed: 2010-01-03

Description:

HotBrackets Tournament Brackets Component for Joomla! contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 63077 - Disclosed: 2010-01-03

Description:

(Description Provided by CVE) : Acidcat CMS 3.5.x does not prevent access to install.asp after installation finishes, which might allow remote attackers to restart the installation process and have unspecified other impact via requests to install.asp and other install_*.asp scripts. NOTE: the final installation screen states "Important: you must now delete all files beginning with 'install' from the root directory."

[CLOSE] OSVDB ID : 65426 - Disclosed: 2010-01-03

Description:

Shape5 Bridge of Hope Template for Joomla! contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.