CVE-2005-3022

Multiple SQL injection vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 announcement parameter to announcement.php, 2 userid parameter to user.php, 3 calendar parameter to admincalendar.php, 4 cronid parameter to cronlog.php, 5...

CVE-2005-3024

Multiple SQL injection vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 announcement parameter to announcement.php, the 2 threadforumid or 3 criteria parameters to thread.php, 4 userid parameter to user.php, the 5...

Hesk Session ID Validation Vulnerability

OS2A Hesk Session ID Validation Vulnerability OS2A ID: OS2A1003 Status 9/13/2005 Issue Discovered 9/14/2005 Reported to the vendor 9/18/2005 Patch Released 9/20/2005 Advisory Released Class: Authentication Bypass Severity: CRITICAL Overview: Hesk is a PHP based help desk software that runs with a...

PT-2005-3703 · Plain Black · Webgui

Name of the Vulnerable Software and Affected Versions: WebGUI versions prior to 6.7.3 Description: The issue allows remote attackers to execute arbitrary Perl code via multiple eval injection vulnerabilities in the following modules: 1 Help.pm, 2 International.pm, or 3 WebGUI.pm. Recommendations:...

Symantec AntiVirus Corporate Edition 9.0 and Symantec Client Security 2.0 Help File Elevation of Pri

SUMMARY The Symantec AntiVirus Corporate Edition HTML client help function uses HTML help, the Windows help interface, to provide support to the client user. A non-privileged client user can manipulate the help function to access files on the system with local SYSTEM privileges. Risk Impact Mediu...

CVE-2004-2355

Cross-site scripting XSS vulnerability in Crafty Syntax Live Help CSLH before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the name field of a livehelp or chat session...

CVE-2004-2355

Crafty Syntax Live Help (CSLH) prior to 2.7.4 is affected by a Cross-site scripting (XSS) vulnerability. The issue, described in CVE-2004-2355, allows remote attackers to inject arbitrary web script or HTML via the name field of a livehelp or chat session. Supported by NVD entry, the description ...

CVE-2004-2359: Undefined Security Weakness

Dell TrueMobile 1300 WLAN Mini-PCI Card Util TrayApplet 3.10.39.0 does not properly drop SYSTEM privileges when started from the systray applet, which allows local users to gain privileges by accessing the Help functionality...

CVE-2004-2355: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Crafty Syntax Live Help CSLH before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the name field of a livehelp or chat session...

helpcenterBad.txt

GulfTech Security Research May 17th, 2005 Vendor : Michael Bird URL : http://www.helpcenterlive.com/ Version : Help Center Live All Versions Risk : Multiple Vulnerabilities Description: Help Center Live is a Live help desk system written in PHP using a MySql database backend that features Live...

Linksys WLAN Monitor privilege escalation

It's possible to execute application with LocalSystem privileges from Help system...

CVE-2005-2382

Oray PeanutHull 3.0.1.0 and earlier does not properly drop SYSTEM privileges when launched from the system tray, which allows local users to gain privileges by accessing the Help functionality...

CVE-2005-2382: Undefined Security Weakness

Oray PeanutHull 3.0.1.0 and earlier does not properly drop SYSTEM privileges when launched from the system tray, which allows local users to gain privileges by accessing the Help functionality...

Echo Security Advisory 2005.14

.OR.ID ECHOADV14$2005 --------------------------------------------------------------------------- Multiple Vulnerabilities in Liberum Help Desk --------------------------------------------------------------------------- Author: Dedi Dwianto Date: June, 02nd 2005 Location: Indonesia, Jakarta Web:...

High Risk Vulnerability in HTML Help (ITSS Parser)

Peter Winter-Smith of NGSSoftware has discovered a high risk vulnerability in one of the dependencies of HTML Help, the InfoTech Storage System parser. This flaw can permit arbitrary code execution through a number of applications including HTML Help, Internet Explorer and Outlook/Outlook Express...

CVE-2005-1208: Undefined Security Weakness

Integer overflow in Microsoft Windows 98, 2000, XP SP2 and earlier, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via a crafted compiled Help .CHM file with a large size field that triggers a heap-based buffer overflow, as demonstrated using a "ms-its:" URL in...

Microsoft Windows HTML Help files parsing buffer overflow

Heap overflow on HTML help .chm files structure parsing...

Microsoft Security Bulletin MS05-026 Vulnerability in HTML Help Could Allow Remote Code Execution (896358)

Microsoft Security Bulletin MS05-026 Vulnerability in HTML Help Could Allow Remote Code Execution 896358 Issued: June 14, 2005 Version: 1.0 Summary Who should read this document: Customers who use Microsoft Windows Impact of Vulnerability: Remote Code Execution Maximum Severity Rating: Critical...

[VulnWatch] eEye Advisory - EEYEB-20050316 - HTML Help File Parsing Buffer Overflow

EEYEB-20050316 - HTML Help File Parsing Buffer Overflow Release Date: June 14, 2005 Date Reported: March 16, 2005 Severity: High Remote Code Execution Vendor: Microsoft Systems Affected: Windows 98 / 98 SE Windows Me Windows 2000 Service Pack 3 / Service Pack 4 Windows XP Service Pack 1 / Service...

Microsoft Windows HTML Help Remote Code Execution Vulnerability

Description Microsoft Windows HTML Help is affected by a remote code execution vulnerability. The vulnerability presents itself when the application handles malformed data through the InfoTech protocol ms-its, its, mk:@msitstore. An attacker may exploit this issue from a malicious Web page or...