USN-229-1: Zope vulnerability

Zope did not deactivate the file inclusion feature when exposing RestructuredText functionalities to untrusted users. A remote user with the privilege of editing Zope webpages with RestructuredText could exploit this to expose arbitrary files that can be read with the privileges of the Zope serve...

CVE-2005-4159

The CVE concerns Simple Machines Forum (SMF) prior to 1.1 rc1 (inclusive) with a potential SQL injection in Memberlist.php via the start parameter. The vendor disputes that it constitutes a true SQL injection, arguing only a single character can be modified, which may be an invalid SQL syntax err...

Tiki Wiki CMS Groupware Multiple Unspecified Remote Vulnerabilities

Tiki Wiki CMS Groupware is prone to multiple unspecified vulnerabilities. SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

flexbackup default config insecure temporary file creation

flexbackup default config insecure temporary file creation Vendor: http://flexbackup.sourceforge.net/ Advisory: http://www.zataz.net/adviso/flexbackup-09192005.txt Vendor informed: yes Exploit available: yes Impact : low Exploitation : low The vulnerabilities ared due to insecure temporary files...

CVE-2005-3236

Multiple SQL injection vulnerabilities in Cyphor 0.19 allow remote attackers to execute arbitrary SQL and obtain administrative access via 1 the fid parameter of newmsg.php, which can enable XSS attacks when the SQL syntax is invalid or 2 the nick parameter of lostpwd.php...

CVE-2005-2778

SQL injection vulnerability in member.php in MyBulletinBoard MyBB allows remote attackers to execute arbitrary SQL statements via the fid parameter...

[Full-disclosure] [ GLSA 200507-06 ] TikiWiki: Arbitrary command execution through XML-RPC

Gentoo Linux Security Advisory GLSA 200507-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

phpBB < 2.0.16 viewtopic.php Highlighting Feature Arbitrary PHP Code Execution

The remote host is running a version of phpBB that allows attackers to inject arbitrary PHP code to the 'viewtopic.php' script to be executed subject to the privileges of the web server userid. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Ovidentia FX - Remote File Inclusion

Ovidentia FX - Remote File Inclusion source: https://www.securityfocus.com/bid/13927/info Ovidentia FX is prone to a remote file include vulnerability. An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server...

Warrior Kings 1.3 And Warrior Kings: Battles 1.23 - Remote Format String

Warrior Kings 1.3 And Warrior Kings: Battles 1.23 - Remote Format String source: https://www.securityfocus.com/bid/13711/info Warrior Kings, and Warrior Kings: Battles are vulnerable to a remote format string vulnerability. This issue is due to a failure of the application to securely implement a...

CVE-2005-1512

CVE-2005-1512 concerns the Admin panel of PwsPHP 1.2.2 , where the upload validation for image files is inadequate. The vulnerability allows remote attackers to upload potentially arbitrary files, which could lead to arbitrary code execution on the server. The CVSS details from the entry indicate...

CVE-2005-0125

The "at" commands on Mac OS X 10.3.7 and earlier do not properly drop privileges, which allows local users to 1 delete arbitrary files via atrm, 2 execute arbitrary programs via the -f argument to batch, or 3 read arbitrary files via the -f argument to batch, which generates a job file that is...

CVE-2005-0726

SQL injection vulnerability in editpost.php in UBB.threads 6.0 allows remote attackers to execute arbitrary SQL commands via the Number parameter...

CVE-2005-0268

CVE-2005-0268 affects FlatNuke 2.5.1 and describes a Direct code injection vulnerability that allows an attacker to execute arbitrary PHP code by placing the payload in the url_avatar field. The connected documents corroborate a remote code execution risk in FlatNuke via a form submission field, ...

Debian DSA-158-1 : gaim - arbitrary program execution

The developers of Gaim, an instant messenger client that combines several different networks, found a vulnerability in the hyperlink handling code. The 'Manual' browser command passes an untrusted string to the shell without escaping or reliable quoting, permitting an attacker to execute arbitrar...

phpGroupWare Calendar Module Holiday File Save Extension Feature Arbitrary File Execution

It has been reported that the version of phpGroupWare hosted on the remote web server may be affected by a vulnerability that allows remote attackers to upload scripts and then execute them on the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Softwin BitDefender - AvxScanOnlineCtrl COM Object Arbitrary File Upload / Execution

source: https://www.securityfocus.com/bid/10174/info Reportedly the BitDefender AvxScanOnlineCtrl COM object is affected by a file upload and execution vulnerability. This issue is due to a design error that allows a remote user to specify a file to be uploaded and executed on a system running th...

CVE-2004-0366

SQL injection vulnerability in the libpam-pgsql library before 0.5.2 allows attackers to execute arbitrary SQL statements...

LSH 1.x - Remote Buffer Overflow (1)

LSH 1.x - Remote Buffer Overflow 1 // source: https://www.securityfocus.com/bid/8655/info lsh has been reported prone to a remote buffer overflow vulnerability. The condition is reported to present itself in fairly restrictive circumstances, and has been reported to be exploitable...

Liquid War 5.4.55.5.6 - HOME Environment Variable Buffer Overflow

Liquid War 5.4.55.5.6 - HOME Environment Variable Buffer Overflow // source: https://www.securityfocus.com/bid/8629/info Liquid War has been reported prone to a buffer overflow condition when handling HOME environment variables of excessive length. The issue presents itself, due to a lack of...