CVE-2009-4966

SQL injection vulnerability in the AST ZipCodeSearch astaddresszipsearch extension 0.5.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

RHEL 5 : pcsc-lite (RHSA-2010:0533)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0533 advisory. - pcsc-lite: Privilege escalation via specially-crafted client to PC/SC Smart Card daemon messages CVE-2009-4901, CVE-2010-0407 Note that...

RHEL 5 : avahi (RHSA-2010:0528)

Updated avahi packages that fix two security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

CVE-2009-4958

The CVE-2009-4958 entry concerns an SQL injection in the EMO Breeder Manager application (also called EMO Breader Manager). The vulnerability is triggered in video.php via the idd parameter, allowing an attacker to manipulate SQL execution on the backend. Affected detail from connected sources co...

CVE-2009-4962

Stack-based buffer overflow in Fat Player 0.6b allows remote attackers to execute arbitrary code via a long string in a .wav file. NOTE: some of these details are obtained from third party information...

CVE-2009-4969

The CVE-2009-4969 entry concerns SQL injection in the Solidbase Bannermanagement (SBbanner) extension 1.0.1 for TYPO3, allowing remote attackers to execute arbitrary SQL via unspecified vectors. Multiple sources (NVD, Red Hat, CVE listings) consistently identify the affected component as SBbanner...

CVE-2009-4971

CVE-2009-4971 affects the TYPO3 AJAX Chat (vjchat) extension prior to version 0.3.3. The vulnerability is described as an SQL injection that allows remote attackers to execute arbitrary SQL commands via unspecified vectors. The provided documents do not specify the root cause in code terms, affec...

CVE-2009-4973

TotalCalendar 2.4 is affected by a SQL injection in rss.php, exploitable via the selectedCal parameter in a SwitchCal action. The vulnerability allows remote attackers to execute arbitrary SQL commands. CVSS v2 base score 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P). Referenced exploit appears at Exploit-DB ...

CVE-2009-4966

CVE-2009-4966 is a SQL injection in the TYPO3 extension ast_addresszipsearch (ZipCodeSearch) version 0.5.4. The Red Hat/NVD entries confirm that remote attackers can execute arbitrary SQL commands via unspecified vectors. The impact is described as allowing unauthorized SQL execution; no specific...

CVE-2009-4974

TotalCalendar 2.4 is affected by a directory traversal vulnerability in box_display.php that allows remote attackers to read arbitrary files via a .. sequence in the box parameter. The issue is confirmed in multiple feeds (CVE-2009-4974; OpenVAS entry cites TotalCalendar SQL Injection and Directo...

CVE-2009-4967

CVE-2009-4967 : SQL injection vulnerability in the Car extension for TYPO3 (version before 0.1.1) that allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Multiple sources (NVD, Red Hat, CVE listings) corroborate that the issue affects TYPO3’s Car extension pre-0.1....

CVE-2009-4959

The CVE-2009-4959 entry affects the TYPO3 extension T3M E-Mail Marketing Tool (t3m) up to version 0.2.4. The vulnerability is a SQL injection that allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Public sources (NVD, Red Hat) confirm the issue; the NVD metrics in...

CVE-2009-4960

CVE-2009-4960 describes a directory traversal in Lanai Core 0.6, where an attacker can read arbitrary files by supplying a ".." in the f parameter to modules/backup/download.php. Multiple connected sources (NVD, CVE lists, PRION, CVELIST, EUVD) corroborate the same description. The core cause is ...

CVE-2009-4962

This CVE (CVE-2009-4962) affects Fat Player 0.6b and is caused by a stack-based buffer overflow triggered by a long string in a WAV file. The vulnerability permits remote code execution and has multiple public exemplars (e.g., SEH-based exploits) documented in exploit databases and security advis...

CVE-2009-4964

CVE-2009-4964 describes a stack-based buffer overflow in KSP 2006 FINAL that allows remote code execution via a long string in a .M3U playlist file. The vulnerability is triggered by crafted playlist data, with a CVSS v2 base score of 9.3 (HIGH) indicating NETWORK attack vector, no authentication...

CVE-2009-4968

CVE-2009-4968 concerns a SQL injection in the TYPO3 Event Registration (event_registr) extension, versions up to 1.0.0. Root cause: unsanitized input enabling arbitrary SQL execution via unspecified vectors. Impact: remote attacker can affect confidentiality, integrity, and availability. CVSSv2 b...

CVE-2009-4965

Summary: CVE-2009-4965 is a SQL injection vulnerability in the AIRware Lexicon (air_lexicon) extension version 0.0.1 for TYPO3. The described impact is that remote attackers can execute arbitrary SQL commands via unspecified vectors. The available connected documents corroborate the vulnerability...

CVE-2009-4970

The CVE-2009-4970 entry concerns a SQL injection vulnerability in the TYPO3 extension t3m_affiliate version 0.5.0. Affected component: t3m_affiliate/TYPO3; root cause: an SQL injection flaw allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Impact: enables arbitrar...

CVE-2009-4972

The CVE pertains to SimpleID before version 0.6.5 where the login page (index.php) is vulnerable to Cross-Site Scripting via the s parameter. The flaw allows remote attackers to inject arbitrary script/HTML in the context of the affected web page, with no authentication required and no confidenti...

CVE-2009-4974

Directory traversal vulnerability in boxdisplay.php in TotalCalendar 2.4 allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. dot dot in the box parameter...