[CLOSE] OSVDB ID : 65315 - Disclosed: 2010-01-18

Description:

WebKit contains a flaw that allows a universal cross-site scripting (UXSS) attack, as script tags and attributes are allowed to be copied and pasted from one page to another. This may allow an attacker to create a specially crafted web page that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 87721 - Disclosed: 2010-01-18

Description:

IBM WebSphere Application Server (WAS) contains a flaw related to the EJB feature pack that may lead to an unauthorized information disclosure. The issue is due to passwords being stored in property files in plaintext. This may allow a local attacker to gain access to password information.

[CLOSE] OSVDB ID : 61895 - Disclosed: 2010-01-17

Description:

(Description Provided by CVE) : Stack-based buffer overflow in VideoLAN VLC Media Player 0.8.6 allows user-assisted remote attackers to execute arbitrary code via an ogg file with a crafted Advanced SubStation Alpha Subtitle (.ass) file, probably involving the Dialogue field.

[CLOSE] OSVDB ID : 61828 - Disclosed: 2010-01-17

Description:

Thelia contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'motcle' parameter upon submission to the 'recherche.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61829 - Disclosed: 2010-01-17

Description:

Thelia contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'ref' parameter upon submission to the 'panier.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61830 - Disclosed: 2010-01-17

Description:

Thelia contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'ref' parameter upon submission to the 'produit.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61899 - Disclosed: 2010-01-17

Description:

libros Component for Joomla! contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 61957 - Disclosed: 2010-01-17

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 63190 - Disclosed: 2010-01-17

Description:

(Description Provided by CVE) : Directory traversal vulnerability in news/include/customize.php in Web Server Creator - Web Portal 0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the l parameter.

[CLOSE] OSVDB ID : 63191 - Disclosed: 2010-01-17

Description:

Web Server Creator - Web Portal contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'index.php' script not properly sanitizing user input supplied to the 'pg' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 63192 - Disclosed: 2010-01-17

Description:

Web Server Creator - Web Portal contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'news/form.php' script not properly sanitizing user input supplied to the 'path' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

[CLOSE] OSVDB ID : 63193 - Disclosed: 2010-01-17

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in the forum page in Web Server Creator - Web Portal 0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to index.php.

[CLOSE] OSVDB ID : 64383 - Disclosed: 2010-01-17

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 92278 - Disclosed: 2010-01-17

Description:

sudosh3 contains an overflow condition in replay.c. The issue is triggered as user-supplied input is not properly validated when the program attempts to read outside of the allotted memory in replays. This may allow a local attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.

[CLOSE] OSVDB ID : 62182 - Disclosed: 2010-01-16

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61802 - Disclosed: 2010-01-16

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61926 - Disclosed: 2010-01-16

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61927 - Disclosed: 2010-01-16

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61833 - Disclosed: 2010-01-15

Description:

Multiple Rockwell Automation MicroLogix controllers contain a flaw related to the authentication mechanism. The issue is triggered when a remote attacker intercepts the controller password which may allow an attacker to bypass the authentication mechanism and gain full access to the device.

[CLOSE] OSVDB ID : 61700 - Disclosed: 2010-01-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61701 - Disclosed: 2010-01-15

Description:

Testlink contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'order_by_role_dir', 'order_by_login_dir', and 'user_order_by' parameters upon submission to the 'lib/usermanagement/usersView.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61832 - Disclosed: 2010-01-15

Description:

(Description Provided by CVE) : Multiple unspecified vulnerabilities on the Rockwell Automation AB Micrologix 1100 and 1400 controllers allow remote attackers to obtain privileged access or cause a denial of service (halt) via unknown vectors.

[CLOSE] OSVDB ID : 61697 - Disclosed: 2010-01-15

Description:

Internet Explorer contains a flaw that may allow a context-dependent attacker to execute arbitrary code. The issue is triggered when a specially crafted website causes mshtml.dll to access memory that has been freed, allowing code execution.

[CLOSE] OSVDB ID : 61708 - Disclosed: 2010-01-15

Description:

(Description Provided by CVE) : Multiple cross-site request forgery (CSRF) vulnerabilities in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25c allow remote attackers to hijack the authentication of administrators for requests that modify access control rules, and other unspecified requests, via unknown vectors.

[CLOSE] OSVDB ID : 61699 - Disclosed: 2010-01-15

Description:

(Description Provided by CVE) : Buffer overflow in the SSLv2 support in Zeus Web Server before 4.3r5 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long string in an invalid Client Hello message.

[CLOSE] OSVDB ID : 61698 - Disclosed: 2010-01-15

Description:

Xforum contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'nbpageliste' parameter upon submission to the 'liste.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 61715 - Disclosed: 2010-01-15

Description:

(Description Provided by CVE) : Multiple integer overflows in LibThai before 0.1.13 might allow context-dependent attackers to execute arbitrary code via long strings that trigger heap-based buffer overflows, related to (1) thbrk/thbrk.c and (2) thwbrk/thwbrk.c. NOTE: some of these details are obtained from third party information.

[CLOSE] OSVDB ID : 61710 - Disclosed: 2010-01-15

Description:

(Description Provided by CVE) : A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010.

[CLOSE] OSVDB ID : 62034 - Disclosed: 2010-01-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61834 - Disclosed: 2010-01-15

Description:

(Description Provided by CVE) : Directory traversal vulnerability in op/op.Login.php in LetoDMS (formerly MyDMS) 1.7.2 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.

[CLOSE] OSVDB ID : 61835 - Disclosed: 2010-01-15

Description:

(Description Provided by CVE) : Multiple cross-site request forgery (CSRF) vulnerabilities in LetoDMS (formerly MyDMS) 1.7.2 and earlier allow remote attackers to hijack the authentication of administrators for requests that use (1) op/op.EditUserData.php, (2) op/op.UsrMgr.php, (3) out/out.RemoveVersion.php, (4) op/op.RemoveFolder.php, (5) op/op.DefaultKeywords.php, (6) op/op.GroupMgr.php, (7) op/op.FolderAccess.php, (8) op/op.FolderNotify.php, or (9) op.MoveFolder.php in mydms.

[CLOSE] OSVDB ID : 61859 - Disclosed: 2010-01-15

Description:

(Description Provided by CVE) : libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 creates a temporary directory with 0777 permissions, which has unknown impact and attack vectors.

[CLOSE] OSVDB ID : 61860 - Disclosed: 2010-01-15

Description:

(Description Provided by CVE) : libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 uses predictable filenames for temporary files, which has unknown impact and attack vectors.

[CLOSE] OSVDB ID : 61861 - Disclosed: 2010-01-15

Description:

(Description Provided by CVE) : scripts/setup.php (aka the setup script) in phpMyAdmin 2.11.x before 2.11.10 calls the unserialize function on the values of the (1) configuration and (2) v[0] parameters, which might allow remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.

[CLOSE] OSVDB ID : 61889 - Disclosed: 2010-01-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61918 - Disclosed: 2010-01-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 61919 - Disclosed: 2010-01-15

Description:

FreePBX contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'admin/config.php' script not properly sanitizing user-supplied input to the 'extdisplay' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 61920 - Disclosed: 2010-01-15

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 63257 - Disclosed: 2010-01-15

Description:

(Description Provided by CVE) : The sctp_rcv_ootb function in the SCTP implementation in the Linux kernel before 2.6.23 allows remote attackers to cause a denial of service (infinite loop) via (1) an Out Of The Blue (OOTB) chunk or (2) a chunk of zero length.

[CLOSE] OSVDB ID : 64216 - Disclosed: 2010-01-15

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in lib/LXR/Common.pm in LXR Cross Referencer before 0.9.8 allows remote attackers to inject arbitrary web script or HTML via vectors related to a string in the search page's TITLE element, a different vulnerability than CVE-2009-4497 and CVE-2010-1625.