CVE-2005-1017

SQL injection vulnerability in the UpdateEvents function in eventsfunctions.asp in MaxWebPortal 1.33 and earlier allows remote attackers to execute arbitrary SQL commands via the EVENTID parameter, as demonstrated using events.asp...

Mandrake Linux Security Advisory : gdk-pixbuf (MDKSA-2005:069)

A bug was discovered in the way that gdk-pixbuf processes BMP images which could allow for a specially crafted BMP to cause a Denial of Service attack on applications linked against gdk-pixbuf. The updated packages have been patched to correct these issues. %NASLMINLEVEL 70300 C Tenable Network...

CVE-2005-1006

SonicWALL SOHO Web Interface (SOHO 5.1.7.0) is affected by multiple XSS vulnerabilities where an attacker can inject arbitrary script/HTML via the request URL or the login name, which is not filtered when an administrator views the log file. The CVE-2005-1006 entry is corroborated by multiple sou...

CVE-2005-0996

Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 7.6 allow remote attackers to inject arbitrary web script or HTML via 1 the email or url parameters in the Add function, 2 the min parameter in the viewsdownload function, or 3 the min parameter in the search function...

CVE-2005-1002

The CVE-2005-1002 entry concerns logwebftbs2000.exe in Logics Software File Transfer (LOG-FT). The vulnerable component is the file-transfer web client/server, where an attacker can read arbitrary files by supplying modified parameters VAR_FT_LANG and VAR_FT_TMPL. The cited reports describe remot...

CVE-2005-1003

CVE-2005-1003 affects ProfitCode PayProCart 3.0: a directory traversal in index.php via the modID parameter allows remote inclusion of arbitrary PHP files. The root cause is improper validation of .. (dot dot) sequences leading to file inclusion. Impact is remote code execution potential, as desc...

CVE-2005-0996

CVE-2005-0996 involves multiple SQL injection vulnerabilities in the Downloads module of PHP-Nuke 7.6. The issue allows remote attackers to inject arbitrary web script or HTML via: (1) email or url parameters in Add, (2) min parameter in viewsdownload, and (3) min parameter in search. Affected pr...

CVE-2005-1001

PHP-Nuke 7.6 is affected by CVE-2005-1001, where remote attackers can obtain sensitive information. The vulnerability arises from direct requests to the Surveys module (file parameter set to comments) or to 3D-Fantasy/theme.php, which causes a PHP error message that leaks the full server pathname...

CVE-2005-0998

The CVE-2005-0998 entry concerns the Web_Links module of PHP-Nuke 7.6. Reported vulnerability: an invalid show parameter triggers a division-by-zero PHP error, causing leakage of the server’s full pathname. Affected component: Web_Links module (PHP-Nuke 7.6). Impact: remote attackers could obtain...

CVE-2005-1004

The CVE-2005-1004 issue affects ProfitCode PayProCart 3.0, where an XSS flaw exists in usrdetails.php exploitable via the sgnuptype parameter. The vulnerability is reflected XSS with no authentication, allowing an attacker to inject script/html in the context of the victim’s browser (I:P, C:N). I...

CVE-2005-1007

CVE-2005-1007 is a vulnerability in the LISTS module of CommuniGate Pro prior to version 4.3c3, where remote attackers can cause a denial of service (server crash) by sending malformed multipart messages. The issue is tied to the LISTS functionality and enables a network-based DoS condition as de...

CVE-2005-0992

Cross-site scripting XSS vulnerability in index.php in phpMyAdmin before 2.6.2-rc1 allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter...

CVE-2005-0992

Summary: CVE-2005-0992 is an XSS in phpMyAdmin’s index.php via the convcharset parameter. The NVD entry lists a base score of 4.3 (MEDIUM) with network access, no confidentiality impact, but partial integrity impact and no availability impact. Connected OpenVAS entries tie the vulnerability to ph...

CVE-2005-0995

CVE-2005-0995 indicates multiple cross-site scripting (XSS) vulnerabilities in ProductCart 2.7. Attackers can inject arbitrary script or HTML via four parameters: (1) keyword to advSearch_h.asp, (2) redirectUrl to NewCust.asp, (3) country to storelocator_submit.asp, and (4) error to techErr.asp. ...

CVE-2005-1005

ProfitCode PayProCart 3.0 allows remote attackers to bypass authentication and gain administrative privileges to the admin control panel, as demonstrated via a direct request to adminshop/index.php with hex-encoded .. sequences in the ftoedit parameter...

CVE-2005-1005

CVE-2005-1005 affects ProfitCode PayProCart 3.0. The vulnerability allows remote attackers to bypass authentication and gain administrative privileges in the admin control panel by issuing a direct request to adminshop/index.php containing hex-encoded .. sequences in the ftoedit parameter, enabli...

CVE-2005-1002

logwebftbs2000.exe in Logics Software File Transfer LOG-FT allows remote attackers to read arbitrary files via modified 1 VARFTLANG and 2 VARFTTMPL parameters...

CVE-2005-1000

CVE-2005-1000: XSS in PHP-Nuke 7.6. Affected components include banners.pgp (EmailStats op) via bid, Web_Links (TopRated/MostPopular via ratenum, viewlinkdetails/editorial/comments/ratelink via ttitle), and Your_Account (username). Root cause is improper handling of user-supplied parameters leadi...

arts, kdelibs security update

CentOS Errata and Security Advisory CESA-2005:307-01 Updated kdelibs packages that fix a local denial of service issue are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The kdelibs package provides libraries for the K Desktop...

XFree86 security update

CentOS Errata and Security Advisory CESA-2005:044-01 Updated XFree86 packages that fix a libXpm integer overflow flaw and a number of bugs are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. XFree86 is an open source implementati...