[CLOSE] OSVDB ID : 72289 - Disclosed: 2011-03-30

Description:

Cisco ACS contains a flaw related to the web interface. The issue is triggered when a remote attacker uses a malformed URL to change any user password to an arbitrary value. This may allow an attacker to reset any user password.

[CLOSE] OSVDB ID : 73146 - Disclosed: 2011-03-30

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in Translation Management module 6.x before 6.x-1.21 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

[CLOSE] OSVDB ID : 72186 - Disclosed: 2011-03-30

Description:

Cyrus IMAP Server contains a flaw related to the TLS implementation failing to properly clear transport layer buffers when changing from plaintext to ciphertext upon receipt of the 'STARTTLS' command. This may allow a remote attacker to inject arbitrary plaintext data which will be executed upon transition to ciphertext.

[CLOSE] OSVDB ID : 73652 - Disclosed: 2011-03-30

Description:

(Description Provided by CVE) : Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.

[CLOSE] OSVDB ID : 71488 - Disclosed: 2011-03-30

Description:

Data Dynamics Reports contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'traceLevel', 'reportName' and 'uniqueId' parameters upon submission to the CoreHandler.ashx script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 73408 - Disclosed: 2011-03-30

Description:

An unspecified component to ICJobSite contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to an unspecified script not properly sanitizing user-supplied input to the 'pid' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 74015 - Disclosed: 2011-03-30

Description:

WebKit contains a use-after-free error in the 'isDeletableElement' function in WebCore/editing/DeleteButtonController.cpp when focusing a styled, editable element. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.

[CLOSE] OSVDB ID : 92061 - Disclosed: 2011-03-30

Description:

WebKit contains a typecasting flaw that is triggered when removing an inline style from a node that is not an HTML element. With a specially crafted web page, a context-dependent attacker can corrupt memory to cause a denial of service or potentially execute arbitrary code.

[CLOSE] OSVDB ID : 72295 - Disclosed: 2011-03-29

Description:

WebSphere DataPower Appliance contains a flaw related to the included Java version. No further details have been provided.

[CLOSE] OSVDB ID : 73648 - Disclosed: 2011-03-29

Description:

(Description Provided by CVE) : Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity (aka XXE) issue.

[CLOSE] OSVDB ID : 71288 - Disclosed: 2011-03-29

Description:

Froxlor contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate certain input passed to the ticket reply functionality before returning it to the user. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 71289 - Disclosed: 2011-03-29

Description:

Froxlor contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to certain input passed to the ticket search functionality not being properly sanitized before use in SQL queries. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 73651 - Disclosed: 2011-03-29

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.

[CLOSE] OSVDB ID : 73650 - Disclosed: 2011-03-29

Description:

(Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA allows remote authenticated users to inject arbitrary web script or HTML via a blog title.

[CLOSE] OSVDB ID : 73649 - Disclosed: 2011-03-29

Description:

(Description Provided by CVE) : The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files via a file:/// URL.

[CLOSE] OSVDB ID : 71352 - Disclosed: 2011-03-29

Description:

Tracks contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because input appended to the URL after todos/tag/ is not properly validated by app/controllers/todos_controller.rb. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 71586 - Disclosed: 2011-03-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 71290 - Disclosed: 2011-03-29

Description:

Ays Blog contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 74842 - Disclosed: 2011-03-29

Description:

WebKit contains a flaw in the 'counterToCSSValue' function in WebCore/css/CSSComputedStyleDeclaration.cpp. With a specially crafted web page, a context-dependent attacker can cause a crash.

[CLOSE] OSVDB ID : 71426 - Disclosed: 2011-03-29

Description:

HP Operations for UNIX contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate certain unspecified input before returning it to the user. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 71427 - Disclosed: 2011-03-29

Description:

HP Operations for UNIX contains an unspecified flaw that may allow an attacker to bypass access restrictions. No further details have been provided.

[CLOSE] OSVDB ID : 71297 - Disclosed: 2011-03-29

Description:

Spitfire contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'username' parameter upon submission to the index.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 71783 - Disclosed: 2011-03-29

Description:

(Description Provided by CVE) : VMware vmrun, as used in VIX API 1.x before 1.10.3 and VMware Workstation 6.5.x and 7.x before 7.1.4 build 385536 on Linux, might allow local users to gain privileges via a Trojan horse shared library in an unspecified directory.

[CLOSE] OSVDB ID : 72031 - Disclosed: 2011-03-29

Description:

WordPress contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker sends a direct request to multiple scripts, which discloses the software's installation path resulting in a loss of confidentiality. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks. Consult the testing notes for a full list of affected scripts.

[CLOSE] OSVDB ID : 72019 - Disclosed: 2011-03-29

Description:

bbPress contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker sends a direct request to the /bb-templates/kakumei/edit-form.php, /bb-templates/kakumei/edit-post.php, /bb-templates/kakumei/footer.php or /bb-templates/kakumei/favorites.php script, which discloses the software's installation path resulting in a loss of confidentiality. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.

[CLOSE] OSVDB ID : 75370 - Disclosed: 2011-03-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 75388 - Disclosed: 2011-03-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 93207 - Disclosed: 2011-03-29

Description:

MaxSite Anti Spam Image for WordPress contains a flaw that may allow an attacker to bypass the anti-automated CAPTCHA test. This flaw is triggered when an attacker supplies the same value for the '4e2342ffffc8' parameter on multiple pages allowing an attacker to bypass CAPTCHA testing.

[CLOSE] OSVDB ID : 72551 - Disclosed: 2011-03-28

Description:

(Description Provided by CVE) : GNOME Display Manager (gdm) 2.x before 2.32.1 allows local users to change the ownership of arbitrary files via a symlink attack on a (1) dmrc or (2) face icon file under /var/cache/gdm/.

[CLOSE] OSVDB ID : 71353 - Disclosed: 2011-03-28

Description:

HP Diagnostics contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate certain unspecified input before returning it to the user. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 72182 - Disclosed: 2011-03-28

Description:

Wonderware InBatch is prone to an overflow condition. The BatchField ActiveX control fails to properly sanitize user-supplied input resulting in a stack-based buffer overflow. This may be exploited by a remote attacker to cause a denial of service or allow the execution of arbitrary code.

[CLOSE] OSVDB ID : 75361 - Disclosed: 2011-03-28

Description:

Aklacon OpenCMS contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when the HTTPOnly attribute is not set on multiple cookies, allowing the value to be read or set, allowing a remote attacker to obtain sensitive information via accessing the cookie.

[CLOSE] OSVDB ID : 71420 - Disclosed: 2011-03-28

Description:

Zend Server contains a flaw related to the Java Bridge Component. The issue is triggered when a remote attacker sends specially crafted messages to the javamw.jar service on TCP port 10001. This may allow an attacker to execute arbitrary code.

[CLOSE] OSVDB ID : 71284 - Disclosed: 2011-03-28

Description:

Alkacon OpenCMS contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'resourcelist' and 'includerelated' parameters upon submission to the opencms/opencms/system/workplace/commons/report-locks.jsp script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 71285 - Disclosed: 2011-03-28

Description:

Alkacon OpenCMS contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'acttarget' parameter upon submission to the opencms/opencms/system/workplace/views/explorer/contextmenu.jsp script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 71838 - Disclosed: 2011-03-28

Description:

ikiwiki contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the input passed via the 'meta stylesheet' directive before returning it to the user. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 75362 - Disclosed: 2011-03-28

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 75363 - Disclosed: 2011-03-28

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 75364 - Disclosed: 2011-03-28

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 75365 - Disclosed: 2011-03-28

Description:

Unknown / Incomplete