Directory traversal

Directory traversal vulnerability in Cisco Internet Streamer, as used in Cisco Content Delivery System CDS 2.2.x, 2.3.x, 2.4.x, and 2.5.x before 2.5.7 allows remote attackers to read arbitrary files via a crafted URL...

Design/Logic Flaw

Search.pm in Bugzilla 2.17.1 through 3.2.6, 3.3.1 through 3.4.6, 3.5.1 through 3.6, and 3.7 allows remote attackers to obtain potentially sensitive time-tracking information via a crafted search URL, related to a "boolean chart search."...

Input validation

The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences, which allows remote attackers to bypass the trusted documents whitelist fromHCP option and execute arbitrary commands v...

CVE-2010-1885

The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences, which allows remote attackers to bypass the trusted documents whitelist fromHCP option and execute arbitrary commands v...

Default credentials

Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not provide a warning about a 1 http or 2 https URL that contains a username and password, which makes it easier for remote attackers to conduct phishing attacks via a crafted URL...

Stack overflow

Multiple stack-based buffer overflows in the trmagnetParse function in libtransmission/magnet.c in Transmission 1.91 allow remote attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted magnet URL with a large number of 1 tr or 2 ws links...

CVE-2010-1618

Cross-site scripting XSS vulnerability in the phpCAS client library before 1.1.0, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is not properly handled in an error message...

CVE-2010-1618

Cross-site scripting XSS vulnerability in the phpCAS client library before 1.1.0, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is not properly handled in an error message...

Cross site scripting

Cross-site scripting XSS vulnerability in the phpCAS client library before 1.1.0, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is not properly handled in an error message...

Cross site scripting

Cross-site scripting XSS vulnerability in the eTracker module before 6.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML by appending a crafted string to an arbitrary URL associated with the Drupal site...

PhpMesFilms 1.8 SQL Injection

======================================================================================== | Title : PhpMesFilms 1.8 SQL Injection Vulnerability | Author : indoushka | email : [email protected] | Home : www.iqs3cur1ty.com | Tested on: windows SP2 Français V.Pnx2 2.0 + Lunix Français v.9.4 Ubunt...

PhpMesFilms 1.8 - SQL Injection

======================================================================================== | Title : PhpMesFilms 1.8 SQL Injection Vulnerability | Author : indoushka | email : [email protected] | Home : www.iqs3cur1ty.com | Tested on: windows SP2 Français V.Pnx2 2.0 + Lunix Français v.9.4 Ubunt...

Debian DSA-1895-1 : xmltooling - several vulnerabilities

Several vulnerabilities have been discovered in the xmltooling packages, as used by Shibboleth : - Chris Ries discovered that decoding a crafted URL leads to a crash and potentially, arbitrary code execution. - Ian Young discovered that embedded NUL characters in certificate names were not...

Debian DSA-1896-1 : opensaml, shibboleth-sp - several vulnerabilities

Several vulnerabilities have been discovered in the opensaml and shibboleth-sp packages, as used by Shibboleth 1.x : - Chris Ries discovered that decoding a crafted URL leads to a crash and potentially, arbitrary code execution. - Ian Young discovered that embedded NUL characters in certificate...

CVE-2010-0140

Multiple unspecified vulnerabilities in the web server in Cisco Unified MeetingPlace 7 before 7.02.3 hotfix 5F, 6 before 6.0.639.3, and possibly 5 allow remote attackers to create 1 user or 2 administrator accounts via a crafted URL in a request to the internal interface, aka Bug IDs CSCtc59231 a...

Design/Logic Flaw

Multiple unspecified vulnerabilities in the web server in Cisco Unified MeetingPlace 7 before 7.02.3 hotfix 5F, 6 before 6.0.639.3, and possibly 5 allow remote attackers to create 1 user or 2 administrator accounts via a crafted URL in a request to the internal interface, aka Bug IDs CSCtc59231 a...

CVE-2010-0140

Multiple unspecified vulnerabilities in the web server in Cisco Unified MeetingPlace 7 before 7.02.3 hotfix 5F, 6 before 6.0.639.3, and possibly 5 allow remote attackers to create 1 user or 2 administrator accounts via a crafted URL in a request to the internal interface, aka Bug IDs CSCtc59231 a...

Input validation

The URL validation functionality in Microsoft Internet Explorer 5.01, 6, 6 SP1, 7 and 8, and the ShellExecute API function in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, does not properly process input parameters, which allows remote attackers to execute arbitrary local programs via a...

Mandriva Linux Security Advisory : python-django (MDVSA-2009:275)

A vulnerability has been found and corrected in python-django : The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected static media files, which allows remote attackers to conduct directory traversal attacks and read arbitrary fil...

Skype skype4com URI Handler Remote Heap Corruption (CVE-2007-5989)

Skype is a peer-to-peer Voice over IP VoIP Internet telephony network solution. The product is used to transfer real time conversations between two peers over the Internet. Skype users can speak to other Skype users, receive calls from traditional phones, and receive voice-mail messages. Peers ar...