GraceNote CDDBControl ActiveX Control Buffer Overflow (CVE-2006-3134; CVE-2006-6442)

A vulnerability has been discovered in America Online AOL CDDB ActiveX Control. Gracenote CDDB ActiveX control contains a buffer overflow error that allows remote attackers to execute arbitrary code via a long option string. A remote attacker could exploit this flaw to execute arbitrary code and...

Integer overflow

Integer overflow in the ffsmountfs function in Mac OS X 10.4.8 and FreeBSD 6.1 allows local users to cause a denial of service panic and possibly gain privileges via a crafted DMG image that causes "allocation of a negative size buffer" leading to a heap-based buffer overflow, a related issue to...

Sql injection

wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary SQL commands via the tbid parameter. NOTE: it could b...

CVE-2006-6924

bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sortmode=-98 query string to 1 blogs/listblogs.php, 2 fisheye/index.php, 3 wiki/orphanpages.php, or 4 wiki/listpages.php, which forces a SQL error. NOTE: the fisheye/listgalleries.php vector is already cover...

CVE-2006-6927

CVE-2006-6927 describes multiple SQL injection vulnerabilities in Rialto 1.6, allowing remote attackers to execute arbitrary SQL commands via various input fields/parameters in the web application (examples include uname, pword in admin/default.asp; IDs in listfull.asp/printmain.asp; cat in listm...

CVE-2006-6923

CVE-2006-6923 describes a SQL injection in the newsletters/edition.php script of Bitweaver, affecting version 1.3.1 and earlier. The underlying issue allows an attacker to inject and execute arbitrary SQL via the tk parameter, leading to potential data disclosure or modification. The connected re...

CVE-2006-6924

bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sortmode=-98 query string to 1 blogs/listblogs.php, 2 fisheye/index.php, 3 wiki/orphanpages.php, or 4 wiki/listpages.php, which forces a SQL error. NOTE: the fisheye/listgalleries.php vector is already cover...

CVE-2006-6924

CVE-2006-6924 affects Bitweaver 1.3.1 and earlier, where a remote attacker can trigger a SQL error and potentially expose sensitive information by sending sort_mode=-98 to one of: blogs/list_blogs.php, fisheye/index.php, wiki/orphan_pages.php, or wiki/list_pages.php. The issue is described as a v...

CVE-2006-6922

CVE-2006-6922 describes a SQL injection vulnerability in Deadlock User Management System (phpdeadlock) 0.64 and earlier, allowing remote attackers to execute arbitrary SQL via unspecified vectors. The affected product is the Deadlock User Management System (phpdeadlock); the flaw is in the handli...

CVE-2006-6928

CVE-2006-6928 describes multiple cross-site scripting (XSS) vulnerabilities in Rialto 1.6. The issues allow remote attackers to inject arbitrary web script or HTML via: (1) the cat parameter to listmain.asp or searchmain.asp, (2) the Keyword parameter to searchkey.asp, and (3) the refno parameter...

CVE-2006-6926

CVE-2006-6926 describes a buffer overflow in eXtremail 2.1. The primary description explicitly states unknown impact and attack vectors, with details coming from third-party information (VulnDisco Pack). Connected sources corroborate a stack/buffer overflow scenario in eXtremail 2.1.x (and earlie...

CVE-2006-6929

Rapid Classified 3.1 is affected by CVE-2006-6929 due to multiple cross-site scripting (XSS) vulnerabilities. The issue enables injection of arbitrary web script/HTML via parameters across several scripts: id in reply.asp and view_print.asp, SH1 in search.asp, name in reply.asp, and dosearch in a...

navicopa.meta.txt

This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artistic. The latest version of the...

CVE-2006-6921

CVE-2006-6921 is an in-kernel local denial-of-service vulnerability where a zombie/p wedged process could be created if a parent died and init could not reap it. It is referenced across multiple advisories (e.g., RHSA-2007-0939, ELSA-2008-0154, CESAs) and Linux distributions have patched the kern...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via 1 the xcho parameter to my.logon.php3; the 2 topblue, 3 midblue, 4 wtopblue, and certain other Custom color parameters in a per action to...

Important: xorg-x11 security update

6.8.2-1.EL.13.37.5.1 - Add oracle detection to Imake and xprint 6.8.2-1.EL.13.37.5 - Add xorg-x11-6.8.2-sorted-xkbcomp-dirs.patch to fix rpmdiff multilib failure. 6.8.2-1.EL.13.37.4 - Add xorg-x11-server-CVE-2006-6101.patch. 218871...

Moderate: libgsf security update

1.10.1-2 - Resolves: rhbz217949 CVE-2006-4514...

CVE-2006-6919

The CVE-2006-6919 vulnerability affects the Firefox Sage extension (version 1.3.8 and earlier). An RSS feed containing an img tag with an embedded script and a trailing ">" can be manipulated so Sage closes the img element before the malicious script is executed, enabling remote JavaScript exe...

CVE-2006-6918

Technical details about CVE-2006-6918 are not publicly available in the provided connected documents. No concrete information on affected product/version, root cause, impact, or remediation is present. Monitor for updates and external advisories for specifics.

CVE-2006-6920

CVE-2006-6920 describes a cross-site scripting (XSS) vulnerability in Nucleus CMS prior to version 3.24. The issue allows remote attackers to inject arbitrary web script or HTML via unknown vectors, possibly involving lib/ADMIN.php and lib/SKIN.php. JVN details indicate that an arbitrary script c...