CVE-2006-6370: Undefined Security Weakness

SQL injection vulnerability in forum/modules/gallery/post.php in Invision Gallery 2.0.7 allows remote attackers to cause a denial of service and possibly have other impacts, as demonstrated using a "SELECT BENCHMARK" statement in the img parameter in a doaddcomment operation in index.php...

CVE-2006-6200: Undefined Security Weakness

Multiple SQL injection vulnerabilities in the 1 ratearticle and 2 ratecomplete functions in modules/News/index.php in the News module in Francisco Burzi PHP-Nuke 7.9 and earlier, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the sid parameter...

CVE-2006-6202: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/NukeAI/util.php in the NukeAI 0.0.3 Beta module for PHP-Nuke, aka Program E is an AIML chatterbot, allows remote attackers to execute arbitrary PHP code via a URL in the AIbasedir parameter...

CVE-2006-5906: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/bannieres/bannieres.php in Jean-Christophe Ramos SCRIPT BANNIERES aka ban 0.1 and PLS-Bannieres 1.21 allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter. NOTE: the issue is disputed by other researchers, who...

CVE-2006-5907: Undefined Security Weakness

SQL injection vulnerability in modules/bannieres/bannieres.php in Jean-Christophe Ramos SCRIPT BANNIERES aka ban 0.1 and PLS-Bannieres 1.21 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2006-5810: Undefined Security Weakness

Cross-site scripting XSS vulnerability in modules/wfdownloads/newlist.php in XOOPS 1.0 allows remote attackers to inject arbitrary web script or HTML via the newdownloadshowdays parameter...

CVE-2006-5803: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/mxsmartor/album.php in the mxBB Smartor Album module 1.02 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the modulerootpath parameter...

NVIDIA binary graphics driver: Privilege escalation vulnerability

Background The NVIDIA binary graphics driver from NVIDIA Corporation provides the kernel module and the GL modules for graphic acceleration on the NVIDIA based graphic cards. Description Rapid7 reported a boundary error in the NVIDIA binary graphics driver that leads to a buffer overflow in the...

Apache mod_tcl module contains a format string error

Overview A format string vulnerability exists in the modtcl Apache module. This vulnerability may allow a remote attacker to execute arbitrary code. Description The Apache HTTP Server, also known as httpd, is an open-source HTTP server that runs on Microsoft Windows, Linux, Unix, and Apple OS X...

CVE-2006-5720: Undefined Security Weakness

SQL injection vulnerability in modules/journal/search.php in the Journal module in Francisco Burzi PHP-Nuke 7.9 and earlier allows remote attackers to execute arbitrary SQL commands via the forwhat parameter...

PhpShop Core 0.9.0 RC1 - 'PS_BASE' File Inclusion

--------------------------------------|| Viva Palestine ||----------------------------------------- PhpShop-Core append.php Remot File Include Vulnerability Found By : CoLd Zero Wasem898 Source : includeonce $4AZHARTeAM."Securty."; PalesTine Arab Muslim Hacker's PhpShop-Core v0.9.0 RC1 Class:...

CVE-2006-5494

Multiple PHP remote file inclusion vulnerabilities in modules/MyeGallery/public/displayCategory.php in the pandaBB module for PHP-Nuke allow remote attackers to execute arbitrary PHP code via a URL in the 1 adminpath or 2 basepath parameters. NOTE: this issue might overlap CVE-2006-6795...

Jaws 0.5.2 - '/include/JawsDB.php' Remote File Inclusion

ToXiC Jaws 0.5.2: Remote File Inclusion by ToXiC CreW ToXic Security Italian CreW BuG FounD by Drago84 Application Affect: jaws 0.5.2 Sorce Code: http://forge.novell.com/modules/xfcontent/private.php/jaws/jaws-0.5.2/jaws-0.5.2.tar.gz Page: JawsDB.php Problem: GLOBALS"path" not Declare Dir :...

Important: Red Hat Security Advisory: kernel security update

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating syste...

CVE-2006-5433: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/guestbook/index.php in ALiCE-CMS 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the CONFIGlocalroot parameter...

ALiCE-CMS 0.1 - 'CONFIG[local_root]' Remote File Inclusion

+------------------------------------------------------------------------------------------- + ALiCE-CMS 0.1 CONFIGlocalroot Remote File Include Vulnerability +------------------------------------------------------------------------------------------- + Affected Software .: ALiCE-CMS 0.1 + Vendor...

Debian DSA-1018-2 : kernel-source-2.4.27 - several vulnerabilities

The original update lacked recompiled ALSA modules against the new kernel ABI. Furthermore, kernel-latest-2.4-sparc now correctly depends on the updated packages. For completeness we're providing the original problem description : Several local and remote vulnerabilities have been discovered in t...

Debian DSA-1148-1 : gallery - several vulnerabilities

Several remote vulnerabilities have been discovered in gallery, a web-based photo album. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-2734 A cross-site scripting vulnerability allows injection of web script code through HTML or EXIF information. ...

CVE-2006-5257: Undefined Security Weakness

PHP remote file inclusion vulnerability in modules/forum/include/config.php in Ciamos Content Management System CMS 0.9.6b and earlier allows remote attackers to execute arbitrary PHP code via a URL in the modulecachepath parameter...

CVE-2006-5121: Undefined Security Weakness

SQL injection vulnerability in modules/Downloads/admin.php in the Admin section of PostNuke 0.762 allows remote attackers to execute arbitrary SQL commands via the hits parameter...