10533 matches found
Web4Future Affiliate Manager PRO SQL inj. vuln.
Web4Future Affiliate Manager PRO SQL inj. vuln. Vuln. dicovered by : r0t Date: 5 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/web4future-affiliate-manager-pro-sql.html vendor:http://www.web4future.com/products.php?p=aff affected version:4.1 and prior Product Description: Affilia...
CVE-2005-4000
Cross-site scripting XSS vulnerability in archive.asp in SiteBeater News System 4.00 and earlier allows remote attackers to inject arbitrary web script or HTML via the sKeywords parameter...
CVE-2005-4004
CVE-2005-4004 describes a cross-site scripting (XSS) vulnerability in the web interface of MyTemplateSite up to version 1.2, where an attacker can inject arbitrary script or HTML via the q parameter to search.asp. The affected component is the search functionality (search.asp) and the root cause ...
CVE-2005-3995
The CVE applies to the Sobexsrv OBEX server, specifically the dosyslog function in obexsrv.c. When the syslog -S option is enabled, a format string vulnerability in OBEX file-name arguments can allow remote attackers to execute arbitrary code. Affected software/version: Sobexsrv prior to 1.0.0-pr...
CVE-2005-4003
Absolute Shopping Package Solutions (ASPS) Shopping Cart Professional ≤2.9d and Lite ≤2.1 are affected by SQL injection vulnerabilities remote attackers can exploit via (1) srch_product_name in adv_search.asp and (2) b_search in bsearch.asp to execute arbitrary SQL commands.
CVE-2005-3991
Multiple cross-site scripting XSS vulnerabilities in phpMyChat 0.14.6 allow remote attackers to inject arbitrary web script or HTML via the medium parameter to 1 startpage.css.php and 2 style.css.php; or the From parameter to userspopupL.php...
CVE-2005-3992
CVE-2005-3992 affects WinEggDropShell RAT 1.7. The vulnerability stems from multiple buffer overflows in the RAT’s HTTP server (GET requests) and FTP services (USER/PASS commands), allowing remote attackers to trigger arbitrary code execution. The provided documents do not specify affected versio...
CVE-2005-3991
PHPMyChat 0.14.6 is affected by multiple XSS vulnerabilities. Attackers can inject arbitrary script/HTML via the medium parameter to start_page.css.php and style.css.php, or the From parameter to users_popupL.php. The root cause is lack of input sanitization in these parameters. Impact is remote ...
CVE-2005-3987
CVE-2005-3987 affects Tradesoft CMS and involves multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via unspecified attack vectors. The connected documents confirm the product and vulnerability class but do not provide version ranges, affected mod...
CVE-2005-3989
CVE-2005-3989 concerns a memory leak in Avaya TN2602AP IP Media Resource 320 circuit pack on firmware older than vintage 9. The issue allows remote attackers to induce a denial of service through crafted VoIP packets, with network access, no authentication, and resulting in memory consumption lea...
CVE-2005-3985
The CVE-2005-3985 entry concerns the Internet Key Exchange v1 (IKEv1) implementation in Astaro Security Linux prior to 6.102, which can be triggered by crafted IKE packets to cause a denial of service and possibly arbitrary code execution; the advisory notes uncertainty about whether CVE-2005-366...
CVE-2005-3982
CRLF injection vulnerability in layerstoggle.php in WebCalendar 1.0.1 might allow remote attackers to modify HTTP headers and conduct HTTP response splitting attacks via the ret parameter, which is used to redirect URL requests...
CVE-2005-3984
SQL injection vulnerability in WebCalendar 1.0.1 allows remote attackers to execute arbitrary SQL commands via the timerange parameter to editreporthandler.php. NOTE: the startid/activitylog.php vector is already covered by CVE-2005-3949...
CVE-2005-3983
CVE-2005-3983 describes an unknown vulnerability in the login page of HP Systems Insight Manager (SIM) 4.0 and 4.1 when accessed through Microsoft Internet Explorer with the MS04-025 patch , resulting in a denial of service (browser hang) . The advisory is vague and the connected documents do not...
CVE-2005-3980
CVE-2005-3980 describes an SQL injection in Edgewall Trac’s ticket query module, exploitable via the group parameter. The vulnerability affects Trac 0.9 and possibly earlier, enabling remote SQL commands to be executed. Multiple sources (NVD, OSV, OpenVAS, and OSV detail entries) corroborate the ...
CVE-2005-3980
SQL injection vulnerability in the ticket query module in Edgewall Trac 0.9 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the group parameter...
CVE-2005-3980
SQL injection vulnerability in the ticket query module in Edgewall Trac 0.9 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the group parameter...
VERITAS NetBackup Volume Manager Daemon buffer overflow
Added: 12/04/2005 CVE: CVE-2005-3116 BID: 15353 OSVDB: 20674 Background VERITAS NetBackup is a backup and recovery solution for multiple platforms. Problem The Volume Manager Daemon VMD has an error in its shared library allowing for a buffer overflow. A specially crafted request sent to port...
CVE-2005-3971
Cross-site scripting XSS vulnerability in the login form in Citrix MetaFrame Secure Access Manager 2.0 through 2.2 and NFuse Elite 1.0 allows remote attackers to inject arbitrary web script or HTML via the username field...