[CLOSE] OSVDB ID : 74983 - Disclosed: 2011-03-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 71706 - Disclosed: 2011-03-31

Description:

PHPBoost contains a flaw that may lead to an unauthorized information disclosure.  The issue is triggered when a direct request for a predictable filename to cache/backup occurs, which will disclose backup SQL files to a remote attacker.

[CLOSE] OSVDB ID : 72300 - Disclosed: 2011-03-31

Description:

WebSphere contains a flaw related to the Application Server on z/OS. The issue is triggered when incorrect permissions are set, which may grant users unintended access to WebSphere applications.

[CLOSE] OSVDB ID : 75047 - Disclosed: 2011-03-31

Description:

(Description Provided by CVE) : The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

[CLOSE] OSVDB ID : 74277 - Disclosed: 2011-03-31

Description:

(Description Provided by CVE) : jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP04 and 5.1.0 and JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3.0.CP09 and 5.1.0, does not properly restrict use of Expression Language (EL) statements in FacesMessages during page exception handling, which allows remote attackers to execute arbitrary Java code via a crafted URL to an application.

[CLOSE] OSVDB ID : 75029 - Disclosed: 2011-03-31

Description:

InTerra Blog Machine contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the actions/add.php script does not validate the 'subject' parameter upon submission to post_url/edit. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 71468 - Disclosed: 2011-03-31

Description:

IBM WEBi contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate certain unspecified input before returning it to the user. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 71464 - Disclosed: 2011-03-31

Description:

InTerra Blog Machine contains a flaw that allows a remote Cross-site Request Forgery (CSRF / XSRF) attack. The flaw exists because the application does not require multiple steps or explicit confirmation for sensitive transactions for multiple administrator functions, such as adding entries or inserting script. By using a crafted URL (e.g., a crafted GET request inside an "img" tag), an attacker may trick the victim into clicking on the image to take advantage of the trust relationship between the authenticated victim and the application. Such an attack could trick the victim into executing arbitrary commands in the context of their session with the application, without further prompting or verification.

[CLOSE] OSVDB ID : 71467 - Disclosed: 2011-03-31

Description:

IBM WEBi contains an unspecified flaw that may allow an attacker to have an unspecified impact. No further details have been provided.

[CLOSE] OSVDB ID : 71472 - Disclosed: 2011-03-31

Description:

Feng Office Community Edition contains a flaw that allows a remote Cross-site Request Forgery (CSRF / XSRF) attack. The flaw exists because the application does not require multiple steps or explicit confirmation for sensitive transactions for the manipulation of administrative user data. By using a crafted URL (e.g., a crafted GET request inside an "img" tag), an attacker may trick the victim into clicking on the image to take advantage of the trust relationship between the authenticated victim and the application. Such an attack could trick the victim into executing arbitrary commands in the context of their session with the application, without further prompting or verification.

[CLOSE] OSVDB ID : 72017 - Disclosed: 2011-03-31

Description:

Tine contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker sends a direct request to the Crm/Controller.php, Calendar/Model/Attender.php or Crm/Export/Csv.php script, which discloses the software's installation path resulting in a loss of confidentiality. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.

[CLOSE] OSVDB ID : 73757 - Disclosed: 2011-03-31

Description:

(Description Provided by CVE) : vmware-hgfsmounter in VMware Open Virtual Machine Tools (aka open-vm-tools) 8.4.2-261024 and earlier attempts to append to the /etc/mtab file without first checking whether resource limits would interfere, which allows local users to trigger corruption of this file via a process with a small RLIMIT_FSIZE value, a related issue to CVE-2011-1089.

[CLOSE] OSVDB ID : 75466 - Disclosed: 2011-03-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 75467 - Disclosed: 2011-03-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 75468 - Disclosed: 2011-03-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 75469 - Disclosed: 2011-03-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 75470 - Disclosed: 2011-03-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 75471 - Disclosed: 2011-03-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 75472 - Disclosed: 2011-03-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 87695 - Disclosed: 2011-03-31

Description:

Tine 2.0 contains a flaw that may lead to an unauthorized information disclosure. The issue is due to the tine20.log file storing passwords in plaintext, which may allow a local attacker to gain access to password information.

[CLOSE] OSVDB ID : 72608 - Disclosed: 2011-03-30

Description:

(Description Provided by CVE) : The default configuration of the RADIUS authentication feature on the Cisco Network Access Control (NAC) Guest Server with software before 2.0.3 allows remote attackers to bypass intended access restrictions and obtain network connectivity via unspecified vectors, aka Bug ID CSCtj66922.

[CLOSE] OSVDB ID : 73756 - Disclosed: 2011-03-30

Description:

(Description Provided by CVE) : Multiple heap-based buffer overflows in the virtio-blk driver (hw/virtio-blk.c) in qemu-kvm 0.14.0 allow local guest users to cause a denial of service (guest crash) and possibly gain privileges via a (1) write request to the virtio_blk_handle_write function or (2) read request to the virtio_blk_handle_read function that is not properly aligned.

[CLOSE] OSVDB ID : 71585 - Disclosed: 2011-03-30

Description:

HP Network Node Manager i (NNMi) contains a flaw that may lead to an unauthorized information disclosure.  The issue is triggered when an unspecified condition occurs, which will disclose unspecified information to a remote attacker.

[CLOSE] OSVDB ID : 73147 - Disclosed: 2011-03-30

Description:

(Description Provided by CVE) : SQL injection vulnerability in the Translation Management module 6.x before 6.x-1.21 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

[CLOSE] OSVDB ID : 73148 - Disclosed: 2011-03-30

Description:

(Description Provided by CVE) : Cross-site request forgery (CSRF) vulnerability in the Translation Management module 6.x before 6.x-1.21 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

[CLOSE] OSVDB ID : 71298 - Disclosed: 2011-03-30

Description:

RunCMS contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate input appended to the URL upon submission to the modules/forum/topicmanager.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 71310 - Disclosed: 2011-03-30

Description:

RunCMS contains a flaw that allows a remote Cross-site Request Forgery (CSRF / XSRF) attack. The flaw exists because the application does not require multiple steps or explicit confirmation for sensitive transactions for the addition of news articles. By using a crafted URL (e.g., a crafted GET request inside an "img" tag), an attacker may trick the victim into clicking on the image to take advantage of the trust relationship between the authenticated victim and the application. Such an attack could trick the victim into executing arbitrary commands in the context of their session with the application, without further prompting or verification. This vulnerability has been reported to also allow the execution of XSS attacks.

[CLOSE] OSVDB ID : 71299 - Disclosed: 2011-03-30

Description:

RunCMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the modules/forum/post.php script not properly sanitizing user-supplied input to the 'topic_id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 71300 - Disclosed: 2011-03-30

Description:

RunCMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the modules/forum/search.php script not properly sanitizing user-supplied input to the 'forum' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 71301 - Disclosed: 2011-03-30

Description:

RunCMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the modules/forum/post.php script not properly sanitizing user-supplied input to the 'forum' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 71302 - Disclosed: 2011-03-30

Description:

RunCMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the modules/forum/index.php script not properly sanitizing user-supplied input to the 'FORumLastVisit' cookie. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 71304 - Disclosed: 2011-03-30

Description:

RunCMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the modules/pm/index.php script not properly sanitizing user-supplied input to the 'sort' and 'by' parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 71303 - Disclosed: 2011-03-30

Description:

RunCMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the modules/pm/pmsend.php script not properly sanitizing user-supplied input to the 'sort' and 'by' parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 71305 - Disclosed: 2011-03-30

Description:

RunCMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the modules/banners/index.php script not properly sanitizing user-supplied input to the 'bid', 'cid' and 'url' parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 71306 - Disclosed: 2011-03-30

Description:

RunCMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the modules/links/viewcat.php script not properly sanitizing user-supplied input to the 'orderby' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 71307 - Disclosed: 2011-03-30

Description:

RunCMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the modules/galleri/carte.php script not properly sanitizing user-supplied input to the 'key' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 71308 - Disclosed: 2011-03-30

Description:

RunCMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the modules/galleri/index.php script not properly sanitizing user-supplied input to the 'orderby' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 71309 - Disclosed: 2011-03-30

Description:

RunCMS contains a flaw related to the modules/galleri/uploaduser.php script failing to properly validate uploaded files. The issue is triggered when a remote attacker appends a .gif or .jpg file extension to a PHP file when uploading it. This may allow an attacker to execute arbitrary PHP code.

[CLOSE] OSVDB ID : 71291 - Disclosed: 2011-03-30

Description:

YaCOMAS contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'S_login', 'S_nombrep', 'S_apellidos', 'S_mail', 'S_org' and 'S_ciudad' parameters upon submission to the asistente/index.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 71292 - Disclosed: 2011-03-30

Description:

YaCOMAS contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'S_login' parameter upon submission to the admin/index.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.