[CLOSE] OSVDB ID : 79577 - Disclosed: 2012-02-16

Description:

Advantech/Broadwin WebAccess contains an unspecified flaw related to the uaddUpAdmin.asp script. This may allow a remote attacker to manipulate an admin's password.

[CLOSE] OSVDB ID : 79578 - Disclosed: 2012-02-16

Description:

Advantech/Broadwin WebAccess contains a flaw related to the authentication function in the GbScriptAddUp.asp script. This may allow a remote attacker to execute arbitrary code.

[CLOSE] OSVDB ID : 79576 - Disclosed: 2012-02-16

Description:

Advantech/Broadwin WebAccess is prone to an overflow condition. The program fails to properly sanitize user-supplied input resulting in a buffer overflow. With a specially crafted long string passed to parameters, a remote attacker can potentially execute arbitrary code.

[CLOSE] OSVDB ID : 79585 - Disclosed: 2012-02-16

Description:

Advantech/Broadwin WebAccess is prone to an overflow condition. The program fails to properly sanitize user-supplied input resulting in a buffer overflow. With a specially crafted long string passed to ActiveX parameters, a remote attacker can potentially execute arbitrary code

[CLOSE] OSVDB ID : 79586 - Disclosed: 2012-02-16

Description:

Advantech/Broadwin WebAccess contains a flaw related to the loading of local batch files on remote web pages allowing an attacker to write to them. This may allow a remote attacker to execute arbitrary code.

[CLOSE] OSVDB ID : 79567 - Disclosed: 2012-02-16

Description:

Advantech/Broadwin WebAccess contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate certain unspecified input upon submission to the bwerrdn.asp script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 79568 - Disclosed: 2012-02-16

Description:

Advantech/Broadwin WebAccess contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate certain unspecified input upon submission to the bwview.asp script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 79587 - Disclosed: 2012-02-16

Description:

Advantech/Broadwin WebAccess is prone to an overflow condition. The bwocxrun.ocx component fails to properly sanitize user-supplied input resulting in a buffer overflow. Through insecure methods allowing for the creation of arbitrary files, a remote attacker can potentially execute arbitrary code.

[CLOSE] OSVDB ID : 79565 - Disclosed: 2012-02-16

Description:

Advantech/Broadwin WebAccess contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to certain unspecified input not being properly sanitized before use in SQL queries. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 81977 - Disclosed: 2012-02-16

Description:

The RSA Algorithm Public Key Pair contains a flaw related to the implementation of the algorithm that may allow an attacker to crack public key. No further details have been provided.

[CLOSE] OSVDB ID : 80851 - Disclosed: 2012-02-16

Description:

A memory corruption flaw exists in Novell GroupWise Messenger. The nmma.exe binary fails to sanitize user-supplied input resulting in memory corruption. With a specially crafted search request, a context-dependent attacker can cause a denial of service or potentially execute arbitrary code.

[CLOSE] OSVDB ID : 79276 - Disclosed: 2012-02-16

Description:

The Lenovo ThinkManagement Console contains a flaw related to the ServerSetup web service. The issue is due to the service allowing unauthenticated access to various SOAP-based operations. By issuing a '-PutUpdateFileCore' command in a 'RunAMTCommand' operation, a remote attacker can upload arbitrary files.

[CLOSE] OSVDB ID : 79277 - Disclosed: 2012-02-16

Description:

The Lenovo ThinkManagement Console contains a flaw that allows a remote attacker to traverse outside of a restricted path. The issue is due to the VulCore web service not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied via the 'filename' parameter to the 'SetTaskLogByFile' operation. This directory traversal attack would allow the attacker to delete arbitrary files.

[CLOSE] OSVDB ID : 79303 - Disclosed: 2012-02-16

Description:

Piwik contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate user-supplied input before returning it to the user. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 79304 - Disclosed: 2012-02-16

Description:

Piwik contains a flaw that allows a remote Cross-site Request Forgery (CSRF / XSRF) attack. The flaw exists because the application does not require multiple steps or explicit confirmation for sensitive transactions for certain unspecified actions. By using a crafted URL (e.g., a crafted GET request inside an "img" tag), an attacker may trick the victim into clicking on the image to take advantage of the trust relationship between the authenticated victim and the application. Such an attack could trick the victim into executing arbitrary commands in the context of their session with the application, without further prompting or verification.

[CLOSE] OSVDB ID : 79603 - Disclosed: 2012-02-16

Description:

Impulsio CMS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 80850 - Disclosed: 2012-02-16

Description:

A memory corruption flaw exists in Novell GroupWise Messenger. The nmma.exe binary fails to sanitize user-supplied input resulting in memory corruption. With a specially crafted login request, a remote attacker can cause a denial of service or potentially execute arbitrary code.

[CLOSE] OSVDB ID : 79337 - Disclosed: 2012-02-16

Description:

Jenkins contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'description' parameter upon submission to the 'user/<user name>/submitDescription' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 80211 - Disclosed: 2012-02-16

Description:

ButorWiki contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'service' upon submission to the 'sso/signin' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 80852 - Disclosed: 2012-02-16

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 80853 - Disclosed: 2012-02-16

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 80854 - Disclosed: 2012-02-16

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 80855 - Disclosed: 2012-02-16

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 80856 - Disclosed: 2012-02-16

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 82619 - Disclosed: 2012-02-16

Description:

CMS Faethon contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the article.php script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

[CLOSE] OSVDB ID : 84153 - Disclosed: 2012-02-16

Description:

WebKit contains an integer overflow condition in the 'quoteCSSString' function in WebCore/css/CSSParser.cpp when generating quoted strings based on overly large strings. With a specially crafted web page, a context-dependent attacker can cause a heap-based buffer overflow, resulting in a denial of service or potentially execution of arbitrary code.

[CLOSE] OSVDB ID : 90253 - Disclosed: 2012-02-16

Description:

IBM CICS Transaction Server for z/OS contains a flaw in the Web Service. The issue is triggered when an expired password is accepted by the program, during the use of basic authentication. This will allow a user with an expired password to bypass authentication.

[CLOSE] OSVDB ID : 79228 - Disclosed: 2012-02-15

Description:

Oracle Java SE contains an off-by-one flaw related to the countCENHeaders() function in zip_util.c within the Java Runtime Environment component that may allow a context-dependent attacker to cause a denial of service via an endless recursion with a crafted ZIP file.

[CLOSE] OSVDB ID : 79316 - Disclosed: 2012-02-15

Description:

The Faster Permissions module for Drupal contains a flaw that may allow an attacker to gain access to unauthorized privileges. The issue is due to the module not properly restricting access to the permission administration, allowing a remote attacker to arbitrary modify access permissions.

[CLOSE] OSVDB ID : 79290 - Disclosed: 2012-02-15

Description:

(Description Provided by CVE) : translate/translate_manager.cc in Google Chrome before 17.0.963.56 and 19.x before 19.0.1036.7 uses an HTTP session to exchange data for translation, which allows remote attackers to obtain sensitive information by sniffing the network.

[CLOSE] OSVDB ID : 79291 - Disclosed: 2012-02-15

Description:

WebKit contains a use-after-free error in the 'EventHandler::updateDragAndDrop' function [WebCore/page/EventHandler.cpp] that is triggered when performing drag and drop actions. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.

[CLOSE] OSVDB ID : 79296 - Disclosed: 2012-02-15

Description:

Adobe Flash Player contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate certain unspecified input before returning it to the user. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

[CLOSE] OSVDB ID : 79309 - Disclosed: 2012-02-15

Description:

11in1 contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the index.php script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied to the 'class' parameter. This may allow an attacker to include a file from the targeted host that contains arbitrary commands or code that will be executed by the vulnerable script. Such attacks are limited due to the script only calling files already on the target host. In addition, this flaw can potentially be used to disclose the contents of any file on the system accessible by the web server.

[CLOSE] OSVDB ID : 79321 - Disclosed: 2012-02-15

Description:

devscripts contains a flaw related to the debdiff.pl script. This flaw exists because the application does not validate the filename parameter upon submission to the debdiff.pl script, which may allow a remote attacker to execute arbitrary code.

[CLOSE] OSVDB ID : 79227 - Disclosed: 2012-02-15

Description:

Oracle Java contains a flaw related to the SE Deployment component. The issue is triggered when Java Webstart fails to safely handle double quotes placed anywhere except the beginning of certain propery names in NJLP files. For example, the 'java-vm-args' parameter in the j2se tag within a jnlp file can be used to inject arbitrary command-line arguments into a javaw.exec process by using double quotes.

[CLOSE] OSVDB ID : 79315 - Disclosed: 2012-02-15

Description:

The Link Checker Module for Drupal contains a flaw that may lead to an unauthorized information disclosure. The issue is due to the module not enforcing access permissions for broken links, which will disclose restricted links to a remote attacker.

[CLOSE] OSVDB ID : 79317 - Disclosed: 2012-02-15

Description:

The CDN Module for Drupal contains a flaw that may lead to an unauthorized information disclosure. The issue is due to an unspecified error within the module, which may disclose the source code of PHP files to a remote attacker.

[CLOSE] OSVDB ID : 79319 - Disclosed: 2012-02-15

Description:

devscripts contains a flaw related to the debdiff.pl script. This flaw exists because the debdiff.pl script does not validate user-supplied input when handling .dsc and .changes files, which may allow a remote attacker to execute arbitrary code.

[CLOSE] OSVDB ID : 79284 - Disclosed: 2012-02-15

Description:

WebKit contains a use-after-free error in WebCore/rendering/RenderCounter.cpp that is triggered when handling counter nodes. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.

[CLOSE] OSVDB ID : 79298 - Disclosed: 2012-02-15

Description:

A memory corruption flaw exists in Adobe Flash Player. The program fails to sanitize user-supplied input when an unspecified error occurs causing a type confusion, which will result in memory corruption. This may allow a remote attacker to execute arbitrary code.