CVE-2009-0460

Whole Hog Ware Support 1.x allows remote attackers to bypass authentication and obtain administrative access via an integer value in the adminid cookie...

CVE-2009-0460

CVE-2009-0460 affects Whole Hog Ware Support 1.x. The vulnerability allows remote attackers to bypass authentication and obtain administrative access by manipulating an integer value in the adminid cookie. The root cause is improper validation of the adminid cookie, enabling privilege escalation ...

CVE-2009-0458

CVE-2009-0458 affects Whole Hog Ware Support 1.x. The admin/login_submit.php script exposes SQL injection via the uid (Username) and pwd (Password) fields, enabling remote attackers to execute arbitrary SQL commands. The NVD entry lists a high impact with a CVSS v2 base score of 7.5 (Network atta...

CVE-2009-0459

Multiple SQL injection vulnerabilities in admin/loginsubmit.php in Whole Hog Password Protect: Enhanced 1.x allow remote attackers to execute arbitrary SQL commands via 1 the uid parameter aka Username field or 2 the pwd parameter aka Password field. NOTE: some of these details are obtained from...

CVE-2008-5920

CVE-2008-5920 affects WebSVN 1.x. The flaw is in the create_anchors function in utils.inc, where a crafted username is processed by preg_replace with the eval switch, allowing remote code execution. Multiple open-source scanners reference WebSVN vulnerabilities related to unsanitised input (e.g.,...

CVE-2008-5786

CVE-2008-5786 describes a cross-site scripting (XSS) vulnerability in the Silva Find extension. The issue affects Silva Find extension 1.1.5 and earlier within Silva 1.x up to 1.6.3.2, Silva 2.0 up to 2.0.12.2, and Silva 2.1 up to 2.1.0.2, where an attacker could inject arbitrary web script or HT...

Cross site scripting

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to bypass the same origin policy and conduct cross-site scripting XSS attacks via an XBL binding to an "unloaded document."...

CVE-2008-5502

The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service crash via vectors that trigger memory corruption, related to the GetXMLEntity and FastAppendChar functions...

Design/Logic Flaw

Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are no...

CVE-2008-5017

Integer overflow in xpcom/io/nsEscape.cpp in the browser engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service crash via unknown vectors...

Design/Logic Flaw

The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service crash via multiple vectors that trigger an assertion failure or other consequences...

Design/Logic Flaw

The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-origin policy and execute arbitrary script via multiple listeners, which bypass t...

CVE-2008-5017

Integer overflow in xpcom/io/nsEscape.cpp in the browser engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service crash via unknown vectors...

CVE-2008-0017

CVE-2008-0017 is a buffer overflow in the http-index-format parser (nsDirIndexParser) that could lead to remote arbitrary code execution. Public advisories show affected Mozilla-family products (Firefox/Iceweasel/Iceape/SeaMonkey/XULRunner) with fixes in Firefox 3.0.4 and corresponding Mozilla/NS...

Mozilla crash with evidence of memory corruption

The JavaScript engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service crash via vectors related to "insufficient class checking" in the Date class...

CVE-2008-0017

The http-index-format MIME type parser nsDirIndexParser in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 does not check for an allocation failure, which allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via an...

Wireshark 1.x Malformed .ncf packet capture Local Denial of Service PoC

No description provided by source. Wireshark 1.x .ncf local denial of service author: Shinnok Description Wireshark 1.0.x crashes as a result of a failed assertion when dealing with a malformed .ncf packet capture. http://sebug.net/paper/poc/2008-wireshark.ncf...

Gentoo Security Advisory GLSA 200310-03 (Apache)

The remote host is missing updates announced in advisory GLSA 200310-03. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Memory corruption

The rbstrformat function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger memory corruption via unspecified vectors related to alloca, a different issue than CVE-2008-2662,...

CVE-2008-1732

CVE-2008-1732 affects Prediction Football 1.x. A SQL injection exists in showpredictionsformatch.php via the matchid parameter in a dupa action, allowing remote attackers to execute arbitrary SQL commands. Exploitation details, patch/version info, and official remediation are not provided in the ...