CVE-2008-1266

Multiple buffer overflows in the web interface on the D-Link DI-524 router allow remote attackers to cause a denial of service device crash or possibly have unspecified other impact via 1 a long username or 2 an HTTP header with a large name and an empty value...

Centreon 1.4.2.3 - 'get_image.php' Remote File Disclosure

!/usr/bin/python Date : 20/01/2008 Author : Julien CAYSSOL import sys, urllib2,re useragent = 'Mozilla/6.0 compatible; MSIE 6.0; Windows NT' headers = 'User-Agent' : useragent , 'Accept-Charset' : 'ISO-8859-15' if name == "main": if lensys.argv==2: host = sys.argv1 print " + Host : " + host url =...

Null pointer dereference

The administration web interface in NetWin SurgeFTP 2.3a2 and earlier allows remote attackers to cause a denial of service daemon crash via a large integer in the Content-Length HTTP header, which triggers a NULL pointer dereference when memory allocation fails...

CVE-2008-1052

The administration web interface in NetWin SurgeFTP 2.3a2 and earlier allows remote attackers to cause a denial of service daemon crash via a large integer in the Content-Length HTTP header, which triggers a NULL pointer dereference when memory allocation fails...

CVE-2008-1052

The administration web interface in NetWin SurgeFTP 2.3a2 and earlier allows remote attackers to cause a denial of service daemon crash via a large integer in the Content-Length HTTP header, which triggers a NULL pointer dereference when memory allocation fails...

CVE-2008-1052

The CVE-2008-1052 entry concerns NetWin SurgeFTP, specifically versions 2.3a2 and earlier. The issue is a remote denial of service: when an attacker sends a crafted large Content-Length HTTP header, memory exhaustion leads to a NULL pointer dereference and a daemon crash. The description does not...

CVE-2008-0850

Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to whoisonline.php, 2 trackinglistcoachescolumn parameter to main/mySpace/index.php, 3 tutorname parameter to main/createcourse/addcourse.php, the 4 Referer HTTP...

CVE-2008-0850

Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to whoisonline.php, 2 trackinglistcoachescolumn parameter to main/mySpace/index.php, 3 tutorname parameter to main/createcourse/addcourse.php, the 4 Referer HTTP...

CVE-2008-0694

Cross-site scripting XSS vulnerability in the HTTP Server in IBM OS/400 V5R3M0 and V5R4M0 allows remote attackers to inject arbitrary web script or HTML via the Expect HTTP header...

Cross site scripting

Cross-site scripting XSS vulnerability in the HTTP Server in IBM OS/400 V5R3M0 and V5R4M0 allows remote attackers to inject arbitrary web script or HTML via the Expect HTTP header...

CVE-2008-0694

The CVE-2008-0694 entry concerns IBM OS/400 HTTP Server (versions V5R3M0 and V5R4M0). The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via the Expect HTTP header. Affected component is the HTTP Server handling Expect header...

CVE-2008-0694

Cross-site scripting XSS vulnerability in the HTTP Server in IBM OS/400 V5R3M0 and V5R4M0 allows remote attackers to inject arbitrary web script or HTML via the Expect HTTP header...

CVE-2008-0563

Cross-site request forgery CSRF vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to perform unspecified actions as unspecified authenticated users via the User-Agent HTTP header, which is used when composing Forgot Password e-mail messages in...

Cross site scripting

Cross-site scripting XSS vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header, which is used when composing Forgot Password e-mail messages in HTML format...

CVE-2008-0563

Cross-site request forgery CSRF vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to perform unspecified actions as unspecified authenticated users via the User-Agent HTTP header, which is used when composing Forgot Password e-mail messages in...

CVE-2008-0563

CVE-2008-0563 describes a cross-site request forgery in Liferay Portal 4.3.6, where the application uses the User-Agent header when composing Forgot Password HTML emails. This allows remote attackers to perform unspecified actions as unspecified authenticated users. The available documents consis...

CVE-2008-0548

Steamcast 0.9.75 and earlier allows remote attackers to cause a denial of service daemon crash via a large integer in the Content-Length HTTP header, which triggers a NULL dereference when malloc fails...

Design/Logic Flaw

Steamcast 0.9.75 and earlier allows remote attackers to cause a denial of service daemon crash via a large integer in the Content-Length HTTP header, which triggers a NULL dereference when malloc fails...

CVE-2008-0548

Steamcast 0.9.75 and earlier is affected by a denial of service via a crafted large Content-Length HTTP header that causes a NULL dereference when malloc fails. Affected component: the server handling HTTP requests; root cause is handling of oversized Content-Length values. Impact is denial of se...

CVE-2008-0548

Steamcast 0.9.75 and earlier allows remote attackers to cause a denial of service daemon crash via a large integer in the Content-Length HTTP header, which triggers a NULL dereference when malloc fails...