NetMail IMAP APPEND command buffer overflow

Added: 12/29/2006 CVE: CVE-2006-6425 BID: 21723 OSVDB: 31362 Background Novell NetMail is an e-mail and calendaring server application. Problem A buffer overflow in the NetMail IMAP service allows remote, authenticated attackers to execute arbitrary commands by sending a long, specially crafted...

NetMail IMAP APPEND command buffer overflow

Added: 12/29/2006 CVE: CVE-2006-6425 BID: 21723 OSVDB: 31362 Background Novell NetMail is an e-mail and calendaring server application. Problem A buffer overflow in the NetMail IMAP service allows remote, authenticated attackers to execute arbitrary commands by sending a long, specially crafted...

CVE-2006-6800

PHP remote file inclusion in eventcal/modeventcal.php in the event module 1.0 for Limbo CMS allows remote attackers to execute arbitrary PHP code via a URL in the lmabsolutepath parameter...

CVE-2006-6799

SQL injection vulnerability in Cacti 0.8.6i and earlier, when registerargcargv is enabled, allows remote attackers to execute arbitrary SQL commands via the 1 second or 2 third arguments to cmd.php. NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are...

CVE-2006-6799

SQL injection vulnerability in Cacti 0.8.6i and earlier, when registerargcargv is enabled, allows remote attackers to execute arbitrary SQL commands via the 1 second or 2 third arguments to cmd.php. NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are...

CVE-2006-6800

The CVE-2006-6800 issue affects Limbo CMS, specifically the eventcal module (eventcal/mod_eventcal.php, version 1.0). It is a PHP remote file inclusion vulnerability that lets an attacker supply a URL in the lm_absolute_path parameter to execute arbitrary PHP code on the server. This Remote Code ...

CVE-2006-6806

SQL injection vulnerability in newsdetail.asp in Enthrallweb eMates 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter...

CVE-2006-6802

CVE-2006-6802 describes an SQL injection vulnerability in Enthrallweb ePages, specifically in actualpic.asp via the Biz_ID parameter, allowing remote attackers to execute arbitrary SQL commands. Affected component: actualpic.asp within Enthrallweb ePages. Root cause: improper handling of Biz_ID p...

CVE-2006-6801

PHP remote file inclusion vulnerability in misc.php in SH-News 0.93, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the newscfgpath parameter...

CVE-2006-6803

CVE-2006-6803 describes a SQL injection in Enthrallweb eCars 1.0, exploitable via the Type_id parameter in Types.asp, allowing remote execution of arbitrary SQL commands. Connected sources confirm the affected component and root cause (SQL injection) but do not provide remediation details or patc...

CVE-2006-6807

CVE-2006-6807 is a SQL injection vulnerability in Softwebs Nepal’s Ananda Real Estate 3.4 and earlier. The flaw affects list.asp and allows remote attackers to execute arbitrary SQL commands via the agent parameter. The NVD entry lists a base score of 7.5 (HIGH) with network access, low attack co...

CVE-2006-6801

The vulnerability CVE-2006-6801 affects SH-News 0.93 and is a PHP remote file inclusion when register_globals is enabled. The root cause is unsafely using news_cfg[path], allowing an attacker to inject and execute arbitrary PHP code. Impact is partial confidentiality, integrity, and availability ...

CVE-2006-6804

CVE-2006-6804 affects Dragon Business Directory - Pro (aka Dragon Internet Business Search Directory - Pro) and is due to an SQL injection in bus_details.asp. The vulnerability is exploitable via the ID parameter in versions 3.01.12 and earlier. Impacted data can be partially disclosed or corrupt...

CVE-2006-6806

The CVE-2006-6806 entry concerns Enthrallweb eMates 1.0, where a SQL injection vulnerability exists in newsdetail.asp. The underlying issue enables remote attackers to inject arbitrary SQL commands through the ID parameter, potentially affecting data confidentiality, integrity and availability as...

CVE-2006-6808

CVE-2006-6808 is an XSS vulnerability in WordPress 2.0.5, exploitable via the file parameter in wp-admin/templates.php (and noted in other sources as possibly in get_file_description in admin-functions.php). The issue affects WordPress 2.0.5 and can be triggered remotely to inject arbitrary scrip...

CVE-2006-6805

CVE-2006-6805: SQL injection in Enthrallweb eJobs’ newsdetail.asp through the ID parameter. The vulnerability arises from unsafe handling of the ID value, enabling remote attackers to execute arbitrary SQL commands. Affected component is newsdetail.asp; root cause is improper input handling leadi...

CVE-2006-6318

Removed by vendor...

CVE-2006-6318

Affected product: ELOG Web Logbook (versions up to 2.6.2). Vulnerability: show_elog_list in elogd.c dereferences NULL when a logbook name begins with “global”, causing a remote DoS (daemon crash) with authenticated access. Impact per sources: denial of service; no exploit details beyond that prov...

[SECURITY] [DSA 1244-1] New xine-lib packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1244-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 28th, 2006 http://www.debian.org/security/faq -...

CVE-2006-6797

CVE-2006-6797 is a Windows CSRSS vulnerability where local users can cause a DoS crash or read arbitrary memory in csrss.exe by crafting arguments to NtRaiseHardError (status 0x50000018). It is tied to MS07-021 and attributed to improper CSRSS error message handling. Affected component: Client/Se...