CVE-2006-6733

Vulnerability summary (CVE-2006-6733) : A cross-site scripting (XSS) flaw exists in the web application module described as support/view.php within Support Cards 1 (osTicket) . The issue allows remote attackers to inject arbitrary web script or HTML via the e parameter. This affects the handling ...

CVE-2006-6744

CVE-2006-6744 affects phpProfiles prior to 2.1.1. The vulnerability arises because there is no index.php (or other index file) in (1) image_data, (2) graphics/comm, and (3) users read/write directories, which might allow remote attackers to list directory contents or cause other unknown impacts. ...

CVE-2006-6743

CVE-2006-6743 affects phpProfiles prior to 2.1.1. The vulnerability arises from world-writable permissions on certain profile files and directories, enabling local users to modify or delete files. Affected elements include (1) users/include/do_makeprofile.inc.php and (2) users/include/copy.inc.ph...

CVE-2006-6735

The CVE-2006-6735 entry concerns Minh Nguyen Duong Obie Website Mini Web Shop 2.1.c. The vulnerability allows remote attackers to obtain sensitive information by issuing a request with an arbitrary catname parameter and without an itemsdb parameter, causing an error message that reveals a file pa...

CVE-2006-6732

CVE-2006-6732 affects cwmVote 1.0 where archive.php is vulnerable to a PHP remote file inclusion via the abs parameter, enabling arbitrary PHP code execution. Provenance in the public CVE entry indicates an RFI vector with network access and no authentication, resulting in partial confidentiality...

CVE-2006-6730

CVE-2006-6730 affects OpenBSD and NetBSD. The vulnerability allows local users to execute code with root privileges by killing the display server and writing to the X.Org /dev/xf86 device to replace the System Management Mode (SMM) handler via an SMRAM write within /dev/xf86 (the video card RAM r...

CVE-2006-6734

CVE-2006-6734 describes a cross-site scripting (XSS) vulnerability in Minh Nguyen Duong Obie Website Mini Web Shop 2.1.c. The issue allows remote attackers to inject arbitrary web script or HTML via the catname parameter to modules/viewcategory.php. Connected records corroborate the same product ...

CVE-2006-6742

CVE-2006-6742 affects HP LaserJet 5000 (firmware R.25.15/R.25.47) and LaserJet 5100 (firmware V.29.12) printers. Multiple buffer overflows in the FTP Print Server 2.4/2.4.5 allow remote attackers to crash the device via long LIST or NLST commands. The available sources describe the affected model...

CVE-2006-6729

Cross-site scripting XSS vulnerability in a-blog 1.51 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2006-6727

This CVE concerns a PHP remote file inclusion in inertianews_class.php of inertianews 0.02 beta and earlier. The underlying issue is a vulnerable use of a URL specified in the DOCUMENT_ROOT parameter, allowing remote attackers to execute arbitrary PHP code. Affected file/component: inertianews_cl...

CVE-2006-6726

The CVE affects inertianews 0.02 beta, where inertianews_main.php contains a PHP remote file inclusion vulnerability. An attacker can pass a URL in the inews_path parameter to include and execute remote PHP code on the server, enabling arbitrary code execution and potential impact to confidential...

CVE-2006-6729

CVE-2006-6729 affects a-blog, a server-based blog tool from appleple, Inc. Vulnerability: Cross-site scripting (XSS) in version 1.51 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Impact: may execute script in a user’s browser; if session cooki...

CVE-2006-6728

CVE-2006-6728 describes an unspecified vulnerability in the info request mechanism of LAN Messenger prior to 1.5.1.2. The flaw allows remote attackers to cause a denial of service (application crash) or to transmit spam via unspecified vectors. Documents consistently cite the same description acr...

CVE-2006-6723

The CVE-2006-6723 issue affects the Workstation service in Microsoft Windows 2000 SP4 and Windows XP SP2, where a crafted NetrWkstaUserEnum RPC request with a large maxlen value can cause a denial of service through memory consumption. The root cause is tied to how the Workstation service process...

PHP-Update 2.7 - adminuploads.php Remote Code Execution

PHP-Update 2.7 - adminuploads.php Remote Code Execution !/usr/bin/perl rgod u fucking little piece of shit faggot. way to ruin a private exploit, scumbag use strict; use IO::Socket; use MIME::Base64; use Getopt::Std; my $app = "PHP-Update 2.7"; my $type = "Remote Code Execution"; my $author =...

Internet Explorer Undisclosed Script Handler Buffer Overflow (MS06-072; CVE-2006-5579)

Microsoft Internet Explorer IE contains a remote code execution vulnerability. By convincing a user to visit a specially crafted Web page, a remote attacker may trigger this vulnerability to deny service from legitimate users by causing the victim's Web browser to crash or execute arbitrary code ...

BrightStor ARCserve Backup Tape Engine ReserveGroup buffer overflow

Added: 12/26/2006 CVE: CVE-2006-6076 BID: 21221 OSVDB: 30637 Background The BrightStor ARCserve Backup server includes a Backup Tape Engine feature which allows use of tape drives for storage. Problem A buffer overflow vulnerability in the RPC ReserveGroup function allows remote attackers to...

PHP-Update 2.7 - '/admin/uploads.php' Remote Code Execution

!/usr/bin/perl rgod u fucking little piece of shit faggot. way to ruin a private exploit, scumbag use strict; use IO::Socket; use MIME::Base64; use Getopt::Std; my $app = "PHP-Update 2.7"; my $type = "Remote Code Execution"; my $author = "undefined1"; my $date = "2006-10-21"; my $settings = "none...

PHP-Update <= 2.7 (admin/uploads.php) Remote Code Execution Exploit

Exploit for unknown platform in category web applications =================================================================== PHP-Update = 2.7 admin/uploads.php Remote Code Execution Exploit =================================================================== !/usr/bin/perl rgod u fucking little...

[SECURITY] [DSA 1241-1] New squirrelmail packages fix cross-site scripting

-------------------------------------------------------------------------- Debian Security Advisory DSA 1241-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 25th, 2006 http://www.debian.org/security/faq -...