kernel: sctp: crash due to malformed SCTPChunkInit packet

The sctpprocessunkparam function in net/sctp/smmakechunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service system crash via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data...

kernel: sctp: crash due to malformed SCTPChunkInit packet

The sctpprocessunkparam function in net/sctp/smmakechunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service system crash via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data...

Firebird SQL DoS

opconnectrequest request with invalid paramters causes server to shutdown listening socket end enter infinite loop...

Gentoo Security Advisory GLSA 200608-09 (mysql)

The remote host is missing updates announced in advisory GLSA 200608-09. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

tomcat examples XSS

Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...

Path traversal

WoltLab Community Framework WCF 1.0.6 in WoltLab Burning Board 3.0.5 allows remote attackers to obtain the full path via invalid 1 page and 2 form parameters, which leaks the path from an exception handler when a valid class cannot be found...

CVE-2007-3259

CVE-2007-3259 concerns Calendarix 0.7.20070307, where remote attackers can obtain sensitive information via multiple vectors: (1) invalid month[] on calendar.php, (2) invalid catview[] on cal_week.php during week operations, (3) invalid ycyear[] on yearcal.php, and (4) direct requests to cal_func...

CVE-2007-3171

Uebimiau Webmail allows remote attackers to obtain sensitive information via a request to demo/pop3/error.php with an invalid value of the 1 smarty or 2 selectedtheme parameter, which reveals the path in various error messages...

CVE-2007-0690

myEvent 1.6 allows remote attackers to obtain sensitive information via 1 a Log In action without a password to login.php, or an invalid 2 view or 3 monthno parameter to myevent.php, which reveals the path in various error messages...

Path traversal

Advanced Guestbook 2.4.2 allows remote attackers to obtain sensitive information via an invalid 1 GBTBL parameter to a lang/codes-english.php or b image.php, which reveal the database name; 2 an invalid GBDB parameter to index.php, coupled with a ../index lang cookie, which reveals the installati...

tomcat examples XSS

Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...

CVE-2006-3365

V3 Chat allows remote attackers to obtain the installation path via 1 an invalid id parameter to mail/index.php or 2 membername parameter to messenger/online.php, which displays the path in an error page due to an incorrect SQL statement...

Sql injection

Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allows remote attackers to obtain sensitive information via an invalid 1 secondary, 2 PageNumResults, 3 category, or 4 keywords parameter in a Results.cfm; or an invalid 5 ProdID parameter in b Details.cfm; which reveal the path in...

Path traversal

ActiveCampaign SupportTrio 2.5 allows remote attackers to obtain the full path of the server via invalid 1 article or 2 print parameters in a kb action to index.php, or 3 an invalid category parameter to modules/KB/pdf.php, which leaks the path in an error message...

tomcat examples XSS

Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...

Design/Logic Flaw

help.php in V-webmail 1.6.2 allows remote attackers to obtain the installation path via unspecified invalid parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2005-4490

Multiple cross-site scripting XSS vulnerabilities in SCOOP! 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 keyword and 2 invalid parameter to articleSearch.asp; 3 username and 4 invalid parameter to lostPassword.asp; 5 Username, 6 Password, and 7 invalid...

CVE-2005-2423

Beehive Forum allows remote attackers to obtain sensitive information via 1 an invalid finaluri or sortby parameter to index.php or a direct request to 2 admin.php, 3 attachments.inc.php, 4 banned.inc.php, 5 beehive.inc.php, 6 constants.inc.php, 7 db.inc.php, 8 dictionary.inc.php or 9...

CVE-2005-2423

Technical details are not publicly available in the provided documents. Monitor for updates from official advisories to obtain affected products, vulnerable components, impact, and remediation.

CVE-2005-0083

MySQL MaxDB 7.5.00 for Windows, and possibly earlier versions and other platforms, allows remote attackers to cause a denial of service application crash via invalid parameters to the 1 DBMCliString::ReallocString, 2 DBMCliString::operator, 3 DBMCliBuffer::ForceResize, 4...