CVE-2009-4991

Cross-site scripting XSS vulnerability in users/resumeregister.php in Omnistar Recruiting allows remote attackers to inject arbitrary web script or HTML via the job2 parameter...

CVE-2009-4984

CVE-2009-4984 affects Accessories Me PHP Affiliate Script 1.4. The vulnerability is described as multiple cross-site scripting (XSS) in which attackers can inject arbitrary web script or HTML via the Keywords parameter to search.php and the SearchIndex parameter to browse.php. The connected recor...

CVE-2009-4979

Photokorn Gallery ≤ 1.81 is affected by multiple SQL injection vulnerabilities in search.php, exploitable via the (1) where[], (2) sort, (3) order, and (4) Match parameters. The underlying issue is improper input handling in the search functionality, allowing remote attackers to execute arbitrary...

CVE-2009-4982

The provided documents identify a SQL injection in Irokez CMS 0.7.1 affecting the core vulnerable function (the select path) when magic_quotes_gpc is disabled. Attack vector involves the PATH_INFO to the default URI or the CMS 'id' parameter depending on source, enabling remote arbitrary SQL exec...

CVE-2009-4978

Directory traversal vulnerability in down.php in MyBackup 1.4.0 allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter...

CVE-2009-4988

CVE-2009-4988 affects SAP Business One 2005 License Manager (NT Naming Service) for versions 6.80.123 and 6.80.320. The root cause is a stack-based buffer overflow in NT_Naming_Service.exe triggered by an excessively long GIOP request to TCP port 30000, allowing remote arbitrary-code execution. P...

CVE-2009-4992

The dataset confirms a concrete SQL injection vulnerability in LM Starmail Paidmail 2.0, specifically in paidbanner.php where the vulnerable parameter is ID. The root cause is improper handling of user input enabling arbitrary SQL execution, with remote access and no authentication required impli...

CVE-2009-4986

Affected software: In-Portal 4.3.1. Description confirms a directory traversal vulnerability in index.php that allows remote attackers to read arbitrary files by supplying a ".." path in the env parameter when magic_quotes_gpc is disabled. This is the only clearly stated vulnerability mechanism i...

Moderate: Red Hat Security Advisory: ImageMagick security update

Updated ImageMagick packages that fix one security issue are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Moderate: Red Hat Security Advisory: ImageMagick security and bug fix update

Updated ImageMagick packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

ImageMagick security and bug fix update

6.2.8.0-4.el55.2 - Fix SGI image decoding 625058 6.2.8.0-4.el55.1 - Add fix for CVE-2009-1882 504304...

ImageMagick security update

6.0.7.1-20.el48.1 - Add fix for CVE-2009-1882 504302...

httpdx - 'tolog()' Format String (Metasploit) (2)

$Id: httpdxtologformat.rb 10150 2010-08-25 20:55:37Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

KLA10312 ACE vulnerability in SAP Business One 2005

A buffer overflow was found in SAP Business One. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via a specially designed packet. Original advisories - Exploitation Public exploits exist for this vulnerability. Related...

Microsoft Excel Featheader Buffer Overflow

MS Excel Malformed FEATHEADER Record Exploit CVE-2009-3129, MS09-067, OSVDB-59860 Author Abhishek Lyall - abhilyallatgmaildotcom, infoataslitsecuritydotcom Web - http://www.aslitsecurity.com/ Blog - http://www.aslitsecurity.blogspot.com/ Vulnerble application MS office 2003/2007 Tested on XP SP2 ...

Cross site scripting

Cross-site scripting XSS vulnerability in include/topgraphheader.php in Cacti before 0.8.7g allows remote attackers to inject arbitrary web script or HTML via the graphstart parameter to graph.php. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-4032.2.b...

Debian DSA-2092-1 : lxr-cvs - missing input sanitizing

Dan Rosenberg discovered that in lxr-cvs, a code-indexing tool with a web frontend, not enough sanitation of user input is performed; an attacker can take advantage of this and pass script code in order to perform cross-site scripting attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Debian DSA-2094-1 : linux-2.6 - privilege escalation/denial of service/information leak

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-4895 Kyle Bader reported an issue in the tty subsystem that allows local...

[SECURITY] [DSA 2092-1] New lxr-cvs packages fix cross-site scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-2092-1 [email protected] http://www.debian.org/security/ Sebastien Delafond Aug 17th, 2010 http://www.debian.org/security/faq -...

Debian: Security Advisory (DSA-2081-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...