[CLOSE] OSVDB ID : 67231 - Disclosed: 2010-08-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 67232 - Disclosed: 2010-08-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 68027 - Disclosed: 2010-08-15

Description:

(Description Provided by CVE) : Directory traversal vulnerability in the HTTP interface in AXIGEN Mail Server 7.4.1 for Windows allows remote attackers to read arbitrary files via a %5C (encoded backslash) in the URL.

[CLOSE] OSVDB ID : 67213 - Disclosed: 2010-08-15

Description:

Zomplog contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'message' parameter upon submission to the 'users.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 67214 - Disclosed: 2010-08-15

Description:

Zomplog contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'message' parameter upon submission to the 'category.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 67215 - Disclosed: 2010-08-15

Description:

Zomplog contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'message' parameter upon submission to the 'entry.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 67216 - Disclosed: 2010-08-15

Description:

Zomplog contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'message' parameter upon submission to the 'newentry.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 67217 - Disclosed: 2010-08-15

Description:

Zomplog contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'message' parameter upon submission to the 'comments.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 67218 - Disclosed: 2010-08-15

Description:

Zomplog contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'message' parameter upon submission to the 'newpage.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 67219 - Disclosed: 2010-08-15

Description:

Zomplog contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'message' parameter upon submission to the 'page.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 67220 - Disclosed: 2010-08-15

Description:

Zomplog contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'message' parameter upon submission to the 'settings.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 67221 - Disclosed: 2010-08-15

Description:

Zomplog contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'message' parameter upon submission to the 'changeclothes.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 67222 - Disclosed: 2010-08-15

Description:

Zomplog contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'message' parameter upon submission to the 'settings_theme.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 67223 - Disclosed: 2010-08-15

Description:

Zomplog contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'message' parameter upon submission to the 'themes.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 67224 - Disclosed: 2010-08-15

Description:

Zomplog contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'message' parameter upon submission to the 'plugins.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 67225 - Disclosed: 2010-08-15

Description:

Zomplog contains a flaw that allows a remote Cross-site Request Forgery (CSRF / XSRF) attack. The flaw exists because the application does not require multiple steps or explicit confirmation for sensitive transactions such as add an administrative user or change an administrator's password. By using a crafted URL (e.g., a crafted GET request inside an "img" tag), an attacker may trick the victim into clicking on the image to take advantage of the trust relationship between the authenticated victim and the application. Such an attack could trick the victim into executing arbitrary commands in the context of their session with the application, without further prompting or verification.

[CLOSE] OSVDB ID : 67327 - Disclosed: 2010-08-15

Description:

(Description Provided by CVE) : Integer overflow in the ext4_ext_get_blocks function in fs/ext4/extents.c in the Linux kernel before 2.6.34 allows local users to cause a denial of service (BUG and system crash) via a write operation on the last block of a large file, followed by a sync operation.

[CLOSE] OSVDB ID : 84540 - Disclosed: 2010-08-15

Description:

wxBitcoin and bitcoind contain a flaw that may allow a remote denial of service. The issue is triggered when the program fails to properly handle bitcoins associated with transactions that have no confirmations. This may allow a remote attacker to cause a loss of availability for the program by saturating it with large quantities of low-valued zero-fee transactions.

[CLOSE] OSVDB ID : 67312 - Disclosed: 2010-08-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 68506 - Disclosed: 2010-08-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 76228 - Disclosed: 2010-08-15

Description:

Weblinks Component for Joomla! contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'Itemid' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 67282 - Disclosed: 2010-08-14

Description:

JGrid Component for Joomla! contains a flaw that allows a remote attacker to traverse outside of a restricted path. The issue is due to the 'index.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied via the 'controller' parameter. This directory traversal attack would allow the attacker to access arbitrary files.

[CLOSE] OSVDB ID : 86463 - Disclosed: 2010-08-14

Description:

Mingle Forum Plugin for WordPress contains a flaw that may lead to an unauthorized information disclosure. This issue is triggered when the application fails to properly enforce privacy settings in certain widgets. This may allow a remote attacker to gain access to potentially sensitive private post information.

[CLOSE] OSVDB ID : 68123 - Disclosed: 2010-08-14

Description:

Microsoft SharePoint contains a flaw that may lead to an unauthorized information disclosure.  The issue is triggered when the application does not properly sanitise HTML code using SafeHTML. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

[CLOSE] OSVDB ID : 68438 - Disclosed: 2010-08-14

Description:

Microsoft contains a flaw related to the XSS filter library used in "all webapps". This may allow a remote attacker to bypass this function and conduct cross site scripting attacks..

[CLOSE] OSVDB ID : 67334 - Disclosed: 2010-08-14

Description:

(Description Provided by CVE) : The drm_ioctl function in drivers/gpu/drm/drm_drv.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows local users to obtain potentially sensitive information from kernel memory by requesting a large memory-allocation amount.

[CLOSE] OSVDB ID : 68113 - Disclosed: 2010-08-14

Description:

JPhone Component for Joomla! contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'index.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'controller' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 68415 - Disclosed: 2010-08-14

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 67275 - Disclosed: 2010-08-13

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 67256 - Disclosed: 2010-08-13

Description:

(Description Provided by CVE) : Directory traversal vulnerability in Porta+ FTP Client 4.1, and possibly other versions, allows remote FTP servers to overwrite arbitrary files via a directory traversal sequences in a filename.

[CLOSE] OSVDB ID : 85529 - Disclosed: 2010-08-13

Description:

An unspecified Tire Pressure Monitoring System (TPMS), that is reportedly installed in a significant number of automobiles, contains a flaw that may allow a remote denial of service. The issue is triggered when a remote attacker repeatedly spoofs a single TPS packet. The TPMS will consider the single packet invalid, but respond by sending several more packets. The flood of single malformed TPS packets can be used to cause the TPMS to continually send out more traffic, ultimately resulting in a consumption of battery resources and a loss of availability for the system.

[CLOSE] OSVDB ID : 85530 - Disclosed: 2010-08-13

Description:

An unspecified Tire Pressure Monitoring System (TPMS), that is reportedly installed in a significant number of automobiles, contains a flaw in the TPMS ECU that is triggered during the handling of a malformed traffic. By sending a considerable amount of malformed packets (e.g. over two days), the TPMS ECU may ultimately fail in such a manner that restarting the car will not fix it. Only by visiting the dealer for a system reset will the TPMS be restored.

[CLOSE] OSVDB ID : 67127 - Disclosed: 2010-08-13

Description:

Hulihan Mystic contains a flaw that allows a remote Cross-site Request Forgery (CSRF / XSRF) attack. The flaw exists because the application does not require multiple steps or explicit confirmation for sensitive transactions for the /admin/change_password script. By using a crafted URL (e.g., a crafted GET request inside an "img" tag), an attacker may trick the victim into clicking on the image to take advantage of the trust relationship between the authenticated victim and the application. Such an attack could trick the victim into manipulating the administrator password in the context of their session with the application, without further prompting or verification.

[CLOSE] OSVDB ID : 67146 - Disclosed: 2010-08-13

Description:

(Description Provided by CVE) : Multiple integer overflows in SWFTools 0.9.1 allow remote attackers to execute arbitrary code via (1) a crafted PNG file, related to the getPNG function in lib/png.c; or (2) a crafted JPEG file, related to the jpeg_load function in lib/jpeg.c.

[CLOSE] OSVDB ID : 67147 - Disclosed: 2010-08-13

Description:

(Description Provided by CVE) : Multiple integer overflows in SWFTools 0.9.1 allow remote attackers to execute arbitrary code via (1) a crafted PNG file, related to the getPNG function in lib/png.c; or (2) a crafted JPEG file, related to the jpeg_load function in lib/jpeg.c.

[CLOSE] OSVDB ID : 67212 - Disclosed: 2010-08-13

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 67306 - Disclosed: 2010-08-13

Description:

(Description Provided by CVE) : bdf/bdflib.c in FreeType before 2.4.2 allows remote attackers to cause a denial of service (application crash) via a crafted BDF font file, related to an attempted modification of a value in a static string.

[CLOSE] OSVDB ID : 67307 - Disclosed: 2010-08-13

Description:

(Description Provided by CVE) : Unspecified vulnerability in FreeType 2.3.9, and other versions before 2.4.2, allows remote attackers to cause a denial of service via vectors involving nested Standard Encoding Accented Character (aka seac) calls, related to psaux.h, cffgload.c, cffgload.h, and t1decode.c.

[CLOSE] OSVDB ID : 67467 - Disclosed: 2010-08-13

Description:

WebKit contains a use-after-free error in the 'Geolocation::watchPosition' and 'Geolocation::getCurrentPosition' functions in WebCore/page/Geolocation.cpp when Geolocation activity is started after a frame has been disconnected. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.

[CLOSE] OSVDB ID : 68510 - Disclosed: 2010-08-13

Description:

Unknown / Incomplete