CVE-2008-3563

Multiple SQL injection vulnerabilities in Plogger 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the checked array parameter to plog-download.php in an album action and 2 unspecified parameters to plog-remote.php, and 3 allow remote authenticated administrators to...

CVE-2008-3563

Multiple SQL injection vulnerabilities in Plogger 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the checked array parameter to plog-download.php in an album action and 2 unspecified parameters to plog-remote.php, and 3 allow remote authenticated administrators to...

Remote file inclusion

PHP remote file inclusion vulnerability in tools/packages/import.php in ATutor 1.6.1 pl1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via a URL in the type parameter...

CVE-2008-3368

PHP remote file inclusion vulnerability in tools/packages/import.php in ATutor 1.6.1 pl1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via a URL in the type parameter...

CVE-2008-3332

Eval injection vulnerability in admconfigset.php in Mantis before 1.1.2 allows remote authenticated administrators to execute arbitrary code via the value parameter...

Sql injection

SQL injection vulnerability in admin/delete.php in BilboBlog 0.2.1, when magicquotesgpc is disabled, allows remote authenticated administrators to execute arbitrary SQL commands via the num parameter...

Code injection

SocialEngine SE before 2.83 grants certain write privileges for templates, which allows remote authenticated administrators to execute arbitrary PHP code...

CVE-2008-3298

SocialEngine SE before 2.83 grants certain write privileges for templates, which allows remote authenticated administrators to execute arbitrary PHP code...

Restrict the transmission of Confluence version details

I noticed that on several installs, Confluence by default displays its full version number and sometimes build number to the world. It is a commonly accepted web security practice to withhold all product details, including version information, except to users on a "need to know" basis. Otherwise,...

Restrict the transmission of Confluence version details

I noticed that on several installs, Confluence by default displays its full version number and sometimes build number to the world. It is a commonly accepted web security practice to withhold all product details, including version information, except to users on a "need to know" basis. Otherwise,...

Input validation

Multiple unspecified "input validation" vulnerabilities in the Web management interface aka Messaging Administration interface in Avaya Message Storage Server MSS 3.x and 4.0, and possibly Communication Manager 3.1.x, allow remote authenticated administrators to execute arbitrary commands as user...

Sql injection

Multiple SQL injection vulnerabilities in myWebland myBloggie 2.1.6 allow remote attackers to execute arbitrary SQL commands via 1 the userid parameter in a viewuser action to index.php, and allow remote authenticated administrators to execute arbitrary SQL commands via 2 the postid parameter in ...

CVE-2007-1899

Multiple SQL injection vulnerabilities in myWebland myBloggie 2.1.6 allow remote attackers to execute arbitrary SQL commands via 1 the userid parameter in a viewuser action to index.php, and allow remote authenticated administrators to execute arbitrary SQL commands via 2 the postid parameter in ...

CVE-2008-3080

Cross-site request forgery CSRF vulnerability in admin.php in myWebland myBloggie 2.1.6 allows remote attackers to perform edit actions as administrators. NOTE: this can be leveraged to execute SQL commands by also exploiting CVE-2007-1899...

CVE-2008-3080

Cross-site request forgery CSRF vulnerability in admin.php in myWebland myBloggie 2.1.6 allows remote attackers to perform edit actions as administrators. NOTE: this can be leveraged to execute SQL commands by also exploiting CVE-2007-1899...

CVE-2008-3081

Technical details such as affected product components, root cause, and fix are not publicly provided in the supplied documents; monitor for updates.

CVE-2008-2943

Double free vulnerability in IBM Tivoli Directory Server TDS 6.1.0.0 through 6.1.0.15 allows remote authenticated administrators to cause a denial of service ABEND and possibly execute arbitrary code by using ldapadd to attempt to create a duplicate ibm-globalAdminGroup LDAP database entry. NOTE:...

Double free

Double free vulnerability in IBM Tivoli Directory Server TDS 6.1.0.0 through 6.1.0.15 allows remote authenticated administrators to cause a denial of service ABEND and possibly execute arbitrary code by using ldapadd to attempt to create a duplicate ibm-globalAdminGroup LDAP database entry. NOTE:...

CVE-2008-2943

Double free vulnerability in IBM Tivoli Directory Server TDS 6.1.0.0 through 6.1.0.15 allows remote authenticated administrators to cause a denial of service ABEND and possibly execute arbitrary code by using ldapadd to attempt to create a duplicate ibm-globalAdminGroup LDAP database entry. NOTE:...

Sql injection

SQL injection vulnerability in searchbanners.asp in Xigla Absolute Banner Manager XE 2.0 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter...