CVE-2009-5098

The CVE-2009-5098 issue affects Palm Pre WebOS 1.1 and earlier, specifically the LunaSysMgr process. A web page containing a long string after a refresh tag can trigger a floating point exception when the device is not in landscape mode, allowing remote attackers to cause a denial of service (cra...

CVE-2009-5101

Pentaho BI Server 1.7.0.1062 and earlier is affected by CVE-2009-5101 due to including the JSESSIONID in the URL. The session ID can be obtained from session history, Referer headers, or by sniffing web traffic, enabling an attacker to hijack a user session. The CVSS base score is 5.0 (Medium) wi...

CVE-2009-5097

Technical details (affected software versions, root cause, exploitation status, and fixes) are not provided in the connected documents; monitor for updates.

CVE-2009-5096

Technical details about CVE-2009-5096 are not publicly available in the provided connected documents. The Drupal Flag Content module XSS description exists, but data such as affected versions, root cause, or remediation are not corroborated here. Monitor for updates.

CVE-2009-5090

SQL injection vulnerability in editcomments.php in Bloggeruniverse Beta 2, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter and possibly other unspecified vectors...

CVE-2009-5092

Cross-site scripting XSS vulnerability in the management interface in Microsoft FAST ESP 5.1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-5095

CVE-2009-5095 concerns ea-gBook

CVE-2009-5090

CVE-2009-5090 documents a SQL injection in Bloggeruniverse Beta 2, affecting the editcomments.php handler. The vulnerability allows remote attackers to inject arbitrary SQL via the id parameter when magic_quotes_gpc is disabled. Affected component: Bloggeruniverse (Beta 2) web module; vulnerable ...

CVE-2009-5091

The CVE-2009-5091 entry concerns a SQL injection in the Vlinks Web app (versions 1.0.3 and 1.1.6) affecting page.php via the id parameter. This allows remote attackers to execute arbitrary SQL commands. The CVSS data indicates a High base score (7.5) with network attack vector and low complexity,...

CVE-2009-5092

CVE-2009-5092 is a cross-site scripting (XSS) vulnerability in the Microsoft FAST ESP management interface, affecting FAST ESP 5.1.5 and earlier. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, potentially executing in the victim’s browser. Affect...

CVE-2009-5089

The CVE-2009-5089 entry concerns IdeaCart 0.02 and 0.02a, with a directory traversal flaw in index.php. The vulnerability arises from insufficient sanitization of the page parameter, allowing remote attackers to read arbitrary files via a .. (dot dot) path traversal sequence. Impact is partial co...

CVE-2009-5088

CVE-2009-5088 describes an SQL injection in IdeaCart 0.02, specifically in secure/index.php where the cID parameter allows remote attackers to execute arbitrary SQL commands. The vulnerability arises from improper input handling in that script, enabling data disclosure or modification depending o...

CVE-2009-5094

CMS Faethon 2.2.0 Ultimate is affected by an SQL Injection vulnerability in the file info.php triggered via the item parameter. The root cause is improper handling of user-supplied input, allowing an attacker to send crafted SQL statements that may be executed by the database. Impact per sources ...

CVE-2009-5087

CVE-2009-5087 refers to a directory traversal vulnerability in Geovision Digital Video Surveillance System 8.2, affecting the geohttpserver component. The issue allows remote attackers to read arbitrary files via a .. (dot-dot) in a GET request. The primary affected product is Geovision’s DVSS 8....

[SECURITY] [DSA 2301-1] rails security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2301-1 [email protected] http://www.debian.org/security/ Luciano Bello September 5, 2011 http://www.debian.org/security/faq -...

Cross site scripting

Cross-site scripting XSS vulnerability in the Sage add-on 1.3.10 and earlier for Firefox allows remote attackers to inject arbitrary web script or HTML via a crafted feed, a different vulnerability than CVE-2009-4102...

Fortinet FortiClient Crafted VPN Connection Name Handling Local Format String

FortiClient, a client-based software solution intended to provide security features for enterprise computers and mobile devices, is installed on the remote Windows host. The installed version does not properly handle format string specifiers within a VPN connection name. A local user may be able ...

DSA-2301-1 rails - several

Bulletin has no description...

CVE-2009-5086

CVE-2009-5086 concerns an XSS vulnerability in Juniper IDP ACM (Appliance Configuration Manager). Affected are IDP versions prior to 4.1r3 and prior to 4.2r1, where an attacker can inject arbitrary web script or HTML via unspecified vectors in the ACM web interface. The practical impact is that a...

CVE-2009-5063

Memory leak in the embeddedprofilelen function in pngwutil.c in libpng before 1.2.39beta5 allows context-dependent attackers to cause a denial of service memory leak or segmentation fault via a JPEG image containing an iCCP chunk with a negative embedded profile length. NOTE: this is due to an...