CVE-2009-4960

Directory traversal vulnerability in modules/backup/download.php in Lanai Core 0.6 allows remote attackers to read arbitrary files via a .. dot dot in the f parameter...

CVE-2009-4972

The CVE pertains to SimpleID before version 0.6.5 where the login page (index.php) is vulnerable to Cross-Site Scripting via the s parameter. The flaw allows remote attackers to inject arbitrary script/HTML in the context of the affected web page, with no authentication required and no confidenti...

CVE-2009-4974

Directory traversal vulnerability in boxdisplay.php in TotalCalendar 2.4 allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. dot dot in the box parameter...

PunBB <= 1.3.4 and Pun_PM <= v1.2.6 Remote Blind SQL Injection Exploit

No description provided by source. !/usr/bin/perl 0-Day PunBB = 1.3. Package: PunPM = v1.2.6 Remote Blind SQL Injection Exploit Author/s: Dante90, WaRWolFz Crew Created: 2009.07.30 after 0 days the bug was discovered. Crew Members: 4lasthor, Andryxxx, Cod3, Gho5t, HeRtZ, N.o.3.X, RingZero,...

openSUSE Security Update : ghostscript-devel (openSUSE-SU-2010:0425-1)

Specially crafted postscript .ps files could cause buffer overflows in ghostscript that could potentially be exploited to execute arbitrary code CVE-2010-1628, CVE-2010-1869, CVE-2009-4270 ghostscript by default read some initialization files from the current working directory. Local attackers...

RedHat Update for openldap RHSA-2010:0543-01

Check for the Version of openldap OpenVAS Vulnerability Test RedHat Update for openldap RHSA-2010:0543-01 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

CVE-2009-4955

SQL injection vulnerability in the ultraCards thultracards extension before 0.5.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2009-4950

SQL injection vulnerability in the A21glossary Advanced Output a21glossaryadvancedoutput extension before 0.1.12 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2009-4948

Cross-site scripting XSS vulnerability in the Store Locator extension before 1.2.8 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-4950

The CVE concerns the TYPO3 extension A21glossary Advanced Output (a21glossary_advanced_output) prior to version 0.1.12. The issue is a SQL injection vulnerability in the extension that could allow remote attackers to execute arbitrary SQL commands via unspecified vectors. Affected component: a21g...

CVE-2009-4956

CVE-2009-4956 is an XSS vulnerability in TYPO3's Visitor Tracking (ws_stats) extension prior to 0.1.2. Reported vulnerability allows remote attackers to inject arbitrary script/HTML through unspecified vectors, potentially executing code in a victim’s browser without authentication. The issue aff...

CVE-2009-4957

CVE-2009-4957 describes a directory-traversal vulnerability in Interspire ActiveKB (affects loadpanel.php) that allows remote attackers to read arbitrary files via directory traversal in the Panel parameter. The vulnerability is referenced in multiple sources (NVD entry with a CVSSv2 base score o...

CVE-2009-4948

The vulnerability CVE-2009-4948 affects the TYPO3 Store Locator extension prior to version 1.2.8, where an XSS flaw allows remote attackers to inject arbitrary script or HTML via unspecified vectors. The root cause is an input/output handling flaw in the extension that fails to neutralize user-su...

CVE-2009-4957

Directory traversal vulnerability in loadpanel.php in Interspire ActiveKB allows remote attackers to read arbitrary files and possibly have unspecified other impact via directory traversal sequences in the Panel parameter...

CVE-2009-4953

TYPO3 sg_userdata (Userdata Create/Edit) extension vulnerable to Cross-site Scripting (XSS) in versions before 0.91.0. The issue permits injection of arbitrary script/HTML via unspecified vectors; CVSSv2 base score 4.3 (Medium). Remediation per TYPO3 security bulletin TYPO3-SA-2009-005 is to upda...

CVE-2009-4947

The CVE-2009-4947 entry details a SQL injection in the web form FrmLoginPwdReminderPopup.aspx of Q2 Solutions ConnX 4.0.20080606, exploitable via the txtEmail parameter. The root cause is improper input handling leading to arbitrary SQL execution, with the impact described as remote arbitrary com...

CVE-2009-4952

CVE-2009-4952 is a directory traversal vulnerability in TYPO3’s Directory Listing (dir_listing) extension up to version 1.1.0 and earlier. The affected component is the dir_listing extension, with the underlying issue described as a directory traversal that allows remote attackers to achieve an u...

CVE-2009-4951

The CVE affects the TYPO3 environment via the ClickStream Analyzer [output] (alternet_csa_out) extension, version 0.3.0 and earlier. The vulnerability is described as unspecified and allows remote attackers to obtain sensitive information through unknown vectors. No concrete root cause, affected ...

CVE-2009-4946

CVE-2009-4946 describes a directory traversal vulnerability in Joomla!'s Messaging (com_messaging) component prior to 1.5.1. The issue allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter of the messages action to index...

CVE-2009-4955

The CVE-2009-4955 issue is a SQL injection vulnerability in the ultraCards (th_ultracards) TYPO3 extension, affected before version 0.5.1. The underlying flaw permits remote attackers to execute arbitrary SQL commands via unspecified vectors. A fixed release is 0.5.1; applying that version (or pa...