CVE-2006-1711

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the 1 changeMemberPortrait, 2 deletePersonalPortrait, and 3 testCurrentPassword methods, which allows remote attackers to modify portraits...

Design/Logic Flaw

Joomla! 1.0.7 and earlier allows attackers to bypass intended access restrictions and gain certain privileges via certain attack vectors related to the 1 Weblink, 2 Polls, 3 Newsfeeds, 4 Weblinks, 5 Content, 6 Content Section, 7 Content Category, 8 Contact items, or 9 Contact Search, 10 Content...

CVE-2006-1048

CVE-2006-1048 affects Joomla! 1.0.7 and earlier. It allows attackers to bypass intended access restrictions and gain certain privileges via multiple vectors in the Joomla! components (1) Weblink, (2) Polls, (3) Newsfeeds, (4) Weblinks, (5) Content, (6) Content Section, (7) Content Category, (8) C...

CVE-2005-4725

Geeklog before 1.3.11sr3 allows remote attackers to bypass intended access restrictions and comment on an arbitrary story or topic by guessing the story ID...

CVE-2005-4725: Undefined Security Weakness

Geeklog before 1.3.11sr3 allows remote attackers to bypass intended access restrictions and comment on an arbitrary story or topic by guessing the story ID...

[Full-disclosure] Secunia Research: ADOdb Insecure Test Scripts Security Issues

====================================================================== Secunia Research 09/01/2006 - ADOdb Insecure Test Scripts Security Issues - ====================================================================== Table of Contents Affected...

CVE-2006-0114

The vCard functions in Joomla! 1.0.5 use predictable sequential IDs for vcards and do not restrict access to them, which allows remote attackers to obtain valid e-mail addresses to conduct spam attacks by modifying the contactid parameter to index2.php...

CVE-2005-4789

resmgr in SUSE Linux 9.2 and 9.3, and possibly other distributions, does not properly enforce class-specific exclude rules in some situations, which allows local users to bypass intended access restrictions for USB devices that set their class ID at the interface level...

PT-2005-2725 · Oracle · Javamail Api

Name of the Vulnerable Software and Affected Versions: JavaMail API versions 1.1.3 through 1.3 Description: The issue allows remote attackers to view other users' e-mail attachments via a direct request to "/mailboxesdir/username@domainname". This is related to the ReadMessage.jsp file in the...

CVE-2005-3741: Undefined Security Weakness

Almond Classifieds does not properly verify the password, which allows attackers to bypass access restrictions...

Subversion Module unreadeable path information disclosure

You are running a version of Subversion which is older than 1.0.8 or 1.1.0-rc4. A flaw exist in older version, in the apache module modauthzsvn, which fails to properly restrict access to metadata within unreadable paths. An attacker can read metadata in unreadable paths, which can contain...

Cabletron Web View Administrative Access (HTTP)

This host is a Cabletron switch and is running Cabletron WebView. This web software provides a graphical, real-time representation of the front panel on the switch. This graphic, along with additionally defined areas of the browser interface, allow you to interactively configure the switch, monit...

VERITAS NetBackup Java Administration Console contains a format string vulnerability in "bpjava-msvc"

Overview The VERITAS NetBackup Java Administration Console contains a format string vulnerability, which may allow an unauthenticated, remote attacker to execute arbitrary code with root or SYSTEM privileges. Description The Java Administration Console is an alternative administrative interface f...

CVE-2005-3054

PHP fopen_wrappers.c vulnerability (CVE-2005-3054) affects PHP 4.4.0 and possibly other versions, where open_basedir with a trailing slash can fail to restrict access to directories whose names are substrings of the target path. This enables PHP scripts in one directory to access files in other d...

TWiki does not properly sanitize URI parameters

Overview A lack of input validation in the TWiki revision control function may allow a remote, unauthenticated attacker to execute arbitrary commands. Description TWiki is a web-based collaborative publishing environment. TWiki does not sanitize user-controlled URI parameters supplied to the...

CVE-2005-2890

CVE-2005-2890 affects SecureOL VE2 1.05.1008. The issue is improper restriction of public access to physical memory via the PhysicalMemory device, allowing local users to bypass restrictions and gain access to the secured environment. Documented CVSSv2 base metrics: AV:L/AC:L/Au:N/C:P/I:P/A:P (ba...

[SA16742] COOL! Remote Control Denial of Service Vulnerability

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

AttachmateWRQ Reflection for Secure IT Server < 6.0 Build 24 Multiple Vulnerabilities

Binary data 3207.prm...

CVE-2005-2700: Undefined Security Weakness

sslenginekernel.c in modssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions...

AttachmateWRQ Reflection for Secure IT Server < 6.0 Build 24 Multiple Vulnerabilities

The remote host is running AttachmateWRQ Reflection for Secure IT Server, a commercial SSH server for Windows. According to its banner, the installed version of Reflection for Secure IT Server on the remote host suffers from several vulnerabilities, including : - An Access Restriction Bypass...