OSVDB: Open Sourced Vulnerability Database

Browse Database

Browsing Vulnerabilities Disclosed in February of 2011

« Previous 1 2 … 9 10 11 12 13 14 15 16 17 Next »

OSVDB ID	Disclosure Date	Title
70770 [CLOSE] OSVDB ID : 70770 - Disclosed: 2011-02-01 Description: MediaWiki contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate certain input passed via CSS Comments before it is displayed to the user. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.	2011-02-01	MediaWiki CSS Comments XSS
72983 [CLOSE] OSVDB ID : 72983 - Disclosed: 2011-02-01 Description: TinyWebGallery contains a flaw that allows a [REMOTE \| LOCAL] attacker to traverse outside of a restricted path. The issue is due to the /admin/index.php script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied via the 'item' parameter. This directory traversal attack would allow the attacker to access arbitrary files.	2011-02-01	TinyWebGallery /admin/index.php item Parameter Traversal Arbitrary File Access
75740 [CLOSE] OSVDB ID : 75740 - Disclosed: 2011-02-01 Description: (Description Provided by CVE) : Ananta Gazelle 1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/template.php and certain other files.	2011-02-01	Ananta Gazelle CMS Multiple Script Direct Request Path Disclosure
75741 [CLOSE] OSVDB ID : 75741 - Disclosed: 2011-02-01 Description: (Description Provided by CVE) : AneCMS 1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by widgets/menu/index.php and certain other files.	2011-02-01	AneCMS Multiple Script Direct Request Path Disclosure
75742 [CLOSE] OSVDB ID : 75742 - Disclosed: 2011-02-01 Description: (Description Provided by CVE) : appRain 0.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by cron.php.	2011-02-01	appRain Multiple Script Direct Request Path Disclosure
75745 [CLOSE] OSVDB ID : 75745 - Disclosed: 2011-02-01 Description: (Description Provided by CVE) : Automne 4.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by admin/page-redirect-info.php.	2011-02-01	Automne Multiple Script Direct Request Path Disclosure
82232 [CLOSE] OSVDB ID : 82232 - Disclosed: 2011-02-01 Description: GR Board contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the view.php script not properly sanitizing user-supplied input to the 'tableType' and 'blindTarget' parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.	2011-02-01	GR Board (grboard) view.php Multiple Parameter SQL Injection
82236 [CLOSE] OSVDB ID : 82236 - Disclosed: 2011-02-01 Description: GR Board contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the view_memo.php script not properly sanitizing user-supplied input to the 'delTargets[0]' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.	2011-02-01	GR Board (grboard) view_memo.php delTargets[0] Parameter SQL Injection
87689 [CLOSE] OSVDB ID : 87689 - Disclosed: 2011-02-01 Description: ExpressionEngine contains an unspecified flaw related to comment previews. No further details have been provided.	2011-02-01	ExpressionEngine Comment Preview Unspecified Issue
70741 [CLOSE] OSVDB ID : 70741 - Disclosed: 2011-02-01 Description: AOL is prone to an overflow condition. It fails to properly sanitize user-supplied input resulting in a heap-based buffer overflow. With a specially crafted .rtx file, a context-dependent attacker can potentially execute arbitrary code.	2011-02-01	AOL Crafted RTX File Handling Overflow
70742 [CLOSE] OSVDB ID : 70742 - Disclosed: 2011-02-01 Description: Redaxscript contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'includes/password.php' script not properly sanitizing user-supplied input to the 'id' and 'password' POST parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.	2011-02-01	Redaxscript includes/password.php Multiple Parameter SQL Injection
70743 [CLOSE] OSVDB ID : 70743 - Disclosed: 2011-02-01 Description: TinyWebGallery contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'sview', 'tview', 'dir' and 'item' parameters upon submission to the 'admin/index.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.	2011-02-01	TinyWebGallery admin/index.php Multiple Parameter XSS
70752 [CLOSE] OSVDB ID : 70752 - Disclosed: 2011-02-01 Description: PMB Services contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'opac_css/index.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.	2011-02-01	PMB Services opac_css/index.php id Parameter SQL Injection
70798 [CLOSE] OSVDB ID : 70798 - Disclosed: 2011-02-01 Description: MediaWiki contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'languages/Language.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'Language::factory' function. This may allow an attacker to include a PHP file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.	2011-02-01	MediaWiki languages/Language.php Language::factory Function Traversal Local File Inclusion
70799 [CLOSE] OSVDB ID : 70799 - Disclosed: 2011-02-01 Description: MediaWiki contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'includes/StubObject.php' script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'Language::factory' function. This may allow an attacker to include a PHP file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.	2011-02-01	MediaWiki includes/StubObject.php Language::factory Function Traversal Local File Inclusion
72876 [CLOSE] OSVDB ID : 72876 - Disclosed: 2011-02-01 Description: Pluck contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker sends a direct request to the /data/themes/default/theme.php script, which discloses the software's installation path resulting in a loss of confidentiality. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.	2011-02-01	Pluck /data/themes/default/theme.php Direct Request Path Disclosure
72875 [CLOSE] OSVDB ID : 72875 - Disclosed: 2011-02-01 Description: Pluck contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker directs malformed input via the 'file[]' parameter to the index.php script, which discloses the software's installation path resulting in a loss of confidentiality. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.	2011-02-01	Pluck index.php Malformed file[] Parameter Path Disclosure
72860 [CLOSE] OSVDB ID : 72860 - Disclosed: 2011-02-01 Description: razorCMS contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker sends a direct request to the /theme/default_xhtml.php or /theme/maintenance_xhtml.php script, which discloses the software's installation path resulting in a loss of confidentiality. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.	2011-02-01	razorCMS Multiple Script Direct Request Path Disclosure
72859 [CLOSE] OSVDB ID : 72859 - Disclosed: 2011-02-01 Description: Redaxscript contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker sends a direct request to the index.php script, which discloses the software's installation path resulting in a loss of confidentiality. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.	2011-02-01	Redaxscript index.php Direct Request Path Disclosure
73764 [CLOSE] OSVDB ID : 73764 - Disclosed: 2011-02-01 Description: (Description Provided by CVE) : IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that (1) are "partially signed" or (2) signed by multiple entities, which allows remote attackers to trick users into executing code that appears to come from a trusted source.	2011-02-01	OpenJDK IcedTea JAR File Signature Verification Weakness
75037 [CLOSE] OSVDB ID : 75037 - Disclosed: 2011-02-01 Description: (Description Provided by CVE) : Multiple buffer overflows in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP21 EP3 and T27LC before SP22 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted (1) .wrf or (2) .arf file, a different vulnerability than CVE-2010-3041, CVE-2010-3042, and CVE-2010-3044.	2011-02-01	Cisco WRF / ARF Players Crafted File Handling Remote Overflow
75039 [CLOSE] OSVDB ID : 75039 - Disclosed: 2011-02-01 Description: (Description Provided by CVE) : Multiple buffer overflows in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP21 EP3 and T27LC before SP22 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted (1) .wrf or (2) .arf file, related to atas32.dll, a different vulnerability than CVE-2010-3042, CVE-2010-3043, and CVE-2010-3044.	2011-02-01	Cisco WRF / ARF Players atas32.dll Crafted File Handling Remote Overflow
75040 [CLOSE] OSVDB ID : 75040 - Disclosed: 2011-02-01 Description: (Description Provided by CVE) : Multiple buffer overflows in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP21 EP3 and T27LC before SP22 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted (1) .wrf or (2) .arf file, related to atas32.dll, a different vulnerability than CVE-2010-3041, CVE-2010-3042, and CVE-2010-3043.	2011-02-01	Cisco WRF / ARF Players atas32.dll Crafted File Handling Remote Memory Corruption
87688 [CLOSE] OSVDB ID : 87688 - Disclosed: 2011-02-01 Description: ExpressionEngine contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate certain unspecified input before returning it to the user. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.	2011-02-01	ExpressionEngine Unspecified XSS
87687 [CLOSE] OSVDB ID : 87687 - Disclosed: 2011-02-01 Description: ExpressionEngine contains an unspecified flaw that may allow an attacker to manipulate the email module 'recipients' parameter. No further details have been provided.	2011-02-01	ExpressionEngine Unspecified Email Module Recipient Parameter Manipulation
70940 [CLOSE] OSVDB ID : 70940 - Disclosed: 2011-01-31 Description: Newscoop contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'request' parameter upon submission to the admin/login.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.	2011-01-31	Newscoop admin/login.php request Parameter XSS

« Previous 1 2 … 9 10 11 12 13 14 15 16 17 Next »

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.