CVE-2006-2005

CVE-2006-2005 affects ClanSys 1.1 (index.php). The vulnerability is an eval injection in the page parameter that allows remote attackers to execute arbitrary PHP code, demonstrated by injecting an include statement into the eval. Some sources describe it as a file inclusion, but the primary issue...

Internet Explorer DHTML object vulnerability

Added: 04/25/2006 CVE: CVE-2005-0553 BID: 13120 OSVDB: 15465 Background Dynamic HTML DHTML allows the creation of interactive web pages. Problem Race conditions in various DHTML methods could allow command execution when a specially crafted web page is loaded in Internet Explorer. Resolution Appl...

[SECURITY] [DSA 1039-1] New blender packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1039-1 [email protected] http://www.debian.org/security/ Martin Schulze April 24th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1039-1] New blender packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1039-1 [email protected] http://www.debian.org/security/ Martin Schulze April 24th, 2006 http://www.debian.org/security/faq -...

DSA-1039-1 blender - several

Bulletin has no description...

CVE-2005-4787

Turnkey Web Tools SunShop Shopping Cart is affected by CVE-2005-4787 via endpoints that execute PHP’s phpinfo() (index.php, admin/index.php, admin/adminindex.php), potentially exposing sensitive information. The root cause is the direct invocation of phpinfo() in these pages, enabling information...

Ubuntu 4.10 / 5.04 / 5.10 : mozilla-firefox, firefox vulnerabilities (USN-271-1)

Web pages with extremely long titles caused subsequent launches of Firefox browser to hang for up to a few minutes, or caused Firefox to crash on computers with insufficient memory. CVE-2005-4134 Igor Bukanov discovered that the JavaScript engine did not properly declare some temporary variables...

Cross site scripting

Cross-site scripting XSS vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the config parameter. NOTE: this might be the same core issue as CVE-2005-2732...

CVE-2005-4786

The CVE-2005-4786 issue is a buffer overflow in the ALZ archive decompression in vrAZMain.dll (version 5.8.22.137) used by HAURI antivirus products (ViRobot Expert 4.0, ViRobot Advanced Server, HAURI LiveCall). It can allow user‑assisted attackers to execute arbitrary code by processing an ALZ ar...

BrightStor ARCserve Backup discovery service buffer overflow

Added: 04/19/2006 CVE: CVE-2005-2535 BID: 12536 OSVDB: 13814 Background The BrightStor ARCserve Backup server includes a discovery service which listens on ports 41523/TCP and 41524/UDP. Problem A buffer overflow in the discovery service allows remote attackers to execute arbitrary commands...

BrightStor ARCserve Backup discovery service buffer overflow

Added: 04/19/2006 CVE: CVE-2005-2535 BID: 12536 OSVDB: 13814 Background The BrightStor ARCserve Backup server includes a discovery service which listens on ports 41523/TCP and 41524/UDP. Problem A buffer overflow in the discovery service allows remote attackers to execute arbitrary commands...

CVE-2005-4785

CVE-2005-4785 describes a Cross-site scripting (XSS) vulnerability in QuickBlogger 1.4 and earlier. The flaw allows remote attackers to inject arbitrary web script or HTML via the (1) author field and (2) the comment section. The documented impact includes partial integrity compromise of affected...

CVE-2005-4780

Cross-site scripting XSS vulnerability in Fidra Lighthouse CMS 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in a querystring to the home page. NOTE: The vendor disputes this issue, saying "Lighthouse does not in any way make use of the...

CVE-2005-4783

CVE-2005-4783 concerns NetBSD kernels where kernfs_xread in kernfs_vnops.c fails to check for a negative offset when reading the message buffer. This lack of validation allows local users to read arbitrary kernel memory. The description specifies impact as a local information disclosure, affectin...

CVE-2005-4780

CVE-2005-4780 affects Fidra Lighthouse CMS 1.1.0 and earlier. The vulnerability is a cross-site scripting (XSS) flaw that could allow remote attackers to inject arbitrary web script or HTML via the search parameter in the query string on the home page. The vendor disputes the issue, arguing Light...

CVE-2005-4784

CVE-2005-4784 involves multiple buffer overflows in the POSIX readdir_r function. The root cause is a race condition between opendir and pathconf, enabling a symlink attack that can move the filesystem to a state with a longer maximum directory-entry name length, or programmer-introduced errors o...

CVE-2005-4777

CVE-2005-4777 affects Tashcom ASPEdit 2.9, where the administration/FTP password is stored in cleartext in the Windows registry, enabling local users to view it. The vulnerability arises from cleartext storage in the registry; no fix/mitigation details are provided in the supplied documents. Expl...

CVE-2005-4776

CVE-2005-4776 describes an integer overflow in the NetBSD FreeBSD compatibility code (freebsd_misc.c) affecting NetBSD-current, NetBSD-3, NetBSD-2.0, and NetBSD-2 prior to 20050913, and NetBSD-1.6 prior to 20050914. This vulnerability could allow local users to cause a denial of service via heap ...

CVE-2005-4778

The CVE-2005-4778 entry concerns SUSE Linux 10.0 (before 20051007). A configuration problem in the powersave daemon is described as allowing local users to suspend the computer and potentially perform other unauthorized actions. The available documents do not specify the underlying root cause, th...

CVE-2005-4775

CVE-2005-4775 affects Contineo 2.0; when the admin account lacks an e-mail attribute, a warning upon page reload displays the password hash. This could let remote attackers view the hash. No remediation details are provided in the supplied documents.