3943 matches found
CVE-2005-3311
BMC Software Control-M 6.1.03 for Solaris, and possibly other platforms, allows local users to overwrite arbitrary files via a symlink attack on temporary files...
BMC Control M enterprise scheduling system agent symbolic links problem
Insecure creation of temporary directory...
Insecure Temporary Files in BMC/Control-M Agent
BMC's Control M is an enterprise scheduling facility. Unfortunately, the agent software suffers from a problem with insecure temporary file creation. We noticed the problem on Solaris systems running the version 6.1.03 with current patches; it is reasonable to assume that other OS platforms and...
CVE-2005-3311: Undefined Security Weakness
BMC Software Control-M 6.1.03 for Solaris, and possibly other platforms, allows local users to overwrite arbitrary files via a symlink attack on temporary files...
CVE-2005-2674: Undefined Security Weakness
Note: the vendor has disputed this issue. Multiple cross-site scripting XSS vulnerabilities in Land Down Under LDU 800 allow remote attackers to inject arbitrary web script or HTML via the 1 c or 2 m parameters to index.php or 3 w parameter to journal.php. NOTE: this issue has been disputed by th...
CVE-2004-2347
The CVE-2004-2347 entry applies to Leif M. Wright Web Blog (blog.cgi) versions 1.1 and 1.1.5. The vulnerability arises in the ViewFile request’s file parameter, where shell metacharacters (e.g., |) enable remote command execution. Impact is remote arbitrary commands executed with the web server u...
CVE-2004-2347: Undefined Security Weakness
blog.cgi in Leif M. Wright Web Blog 1.1 and 1.1.5 allows remote attackers to execute arbitrary commands via shell metacharacters such as '|' in the file parameter of ViewFile requests...
CVE-2004-2078
Red-M Red-Alert 2.7.5 with software 3.1 build 24 is affected. A remote attacker can trigger a denial of service (reboot and loss of logged events) by sending a long request to TCP port 80, potentially causing a buffer overflow. No explicit exploitation details or mitigations are provided in the s...
CVE-2004-2079
Red-M Red-Alert 2.7.5 with software 3.1 build 24 is affected: authentication is bound to client IPs, allowing remote attackers to bypass authentication by connecting from the same IP as an active authenticated user. No explicit root cause, affected components, versions beyond what's stated are pr...
CVE-2004-2080
CVE-2004-2080 affects Red-M Red-Alert 2.7.5 with software 3.1 build 24. The issue is that multiple spaces in an SSID are collapsed to a single space, which prevents Red-Alert from correctly identifying the SSID. The connected documents confirm the affected product/version and the underlying cause...
CVE-2004-2078
Red-M Red-Alert 2.7.5 with software 3.1 build 24 allows remote attackers to cause a denial of service reboot and loss of logged events via a long request to TCP port 80, possibly triggering a buffer overflow...
CVE-2004-2079
Red-M Red-Alert 2.7.5 with software 3.1 build 24 binds authentication to IP addresses, which allows remote attackers to bypass authentication by connecting from the same IP address as an active authenticated user...
CVE-2004-2079: Undefined Security Weakness
Red-M Red-Alert 2.7.5 with software 3.1 build 24 binds authentication to IP addresses, which allows remote attackers to bypass authentication by connecting from the same IP address as an active authenticated user...
CVE-2004-2080: Undefined Security Weakness
Red-M Red-Alert 2.7.5 with software 3.1 build 24 converts multiple spaces in a Service Set Identifier SSID to a single space, which prevents Red-Alert from correctly identifying the SSID...
CVE-2004-2078: Undefined Security Weakness
Red-M Red-Alert 2.7.5 with software 3.1 build 24 allows remote attackers to cause a denial of service reboot and loss of logged events via a long request to TCP port 80, possibly triggering a buffer overflow...
CVE-2005-1561
Multiple cross-site scripting XSS vulnerabilities in post.asp in MaxWebPortal 1.3.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 mod, 2 M, or 3 type parameter...
CVE-2005-1561: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in post.asp in MaxWebPortal 1.3.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 mod, 2 M, or 3 type parameter...
CVE-2005-1486: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting vulnerabilities in FishCart 3.1 allow remote attackers to inject arbitrary web script or HTML via the 1 trackingnum, 2 reqagree, or 3 m parameter to upstracking.php or 4 nlst parameter to display.php. NOTE: the vendor was not able to reproduce some of the reported...
CVE-2004-1785: Undefined Security Weakness
SQL injection vulnerability in calendar.php for Invision Power Board 1.3 allows remote attackers to execute arbitrary SQL commands via the m parameter, which sets the $this-chosenmonth variable...
