VulnCheck KEV: CVE-2009-3041

SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for 1 ecrire/exec/install.php and 2 ecrire/index.php, which allows remote attackers to conduct unauthorized activities related to installation and backups, as exploited in the wild in August 2009...

PT-2009-4662 · Citrix · Citrix Netscaler Access Gateway

Name of the Vulnerable Software and Affected Versions: Citrix NetScaler Access Gateway appliance with Enterprise Edition firmware versions 9.0, 8.1, and earlier Description: The default configuration of the Security global settings on the Citrix NetScaler Access Gateway appliance specifies Allow...

CVE-2009-1296

The eCryptfs support utilities ecryptfs-utils 73-0ubuntu6.1 on Ubuntu 9.04 stores the mount passphrase in installation logs, which might allow local users to obtain access to the filesystem by reading the log files from disk. NOTE: the log files are only readable by root...

PT-2009-1291 · Apache +2 · Apache Tomcat +2

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 4.1.0 through 4.1.39 Apache Tomcat versions 5.5.0 through 5.5.27 Apache Tomcat versions 6.0.0 through 6.0.18 Description: The issue allows remote attackers to bypass intended access restrictions and conduct directory...

OpenJDK: Type1 font processing buffer overflow vulnerability

Integer signedness error in Java SE Development Kit JDK and Java Runtime Environment JRE 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via crafted glyph descriptions in a Type1 font, which bypasses a signed comparison and...

Firefox XSS vulnerabilities in SessionStore

Unspecified vulnerability in the session-restore feature in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19 allows remote attackers to bypass the same origin policy, inject content into documents associated with other domains, and conduct cross-site scripting XSS attacks via unknown...

UBUNTU-CVE-2008-5146

add-accession-numbers in ctn 3.0.6 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/accession temporary file...

ccms40-sql.txt

Author: !DoktOR! Date found: 21.08.08 Product: CCMS Gaming Portal Version: 4.0 The price: $55 URL: customcms.net Vulnerability Class: SQL injection print.php Vuln code: $q = mysqlquery"SELECT from ccmsnewscomments WHERE wid='$id'"; magicquotesgpc = Off http://localhost/installdir/ Exploit:...

PT-2008-3145 · Apple · Safari

Name of the Vulnerable Software and Affected Versions: Safari versions prior to 2.0 on Apple iPhone and iPod touch Description: The issue misinterprets a menu button press as user confirmation for visiting a web site with a self-signed or invalid certificate. This makes it easier for remote...

CVE-2008-2775

SQL injection vulnerability in search.asp in DT Centrepiece 4.0 allows remote attackers to execute arbitrary SQL commands via the searchFor parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

PT-2008-3576 · Cisco · Cisco Asa 5500 Series Adaptive Security Appliances +2

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA and Cisco PIX security appliance version 8.0.x before 8.039 Cisco ASA 5500 Series Adaptive Security Appliances and Cisco PIX Security Appliances affected versions not specified Description: The issue allo...

phaos-disclose.txt

Remote File Disclosure Vulnerability in showSource.php phaos4.0.1 MY HOmE : WWW.PAL-HACkEr.COM WWW.ATSDP.COM AUTHOR : HaCkeREgY My HoMe : www.PaL-HaCker.com & www.ATSDP.com ConTacT : [email protected] ----------------------------------------------- script: phaos4.0.1...

PYSEC-2008-14

Multiple cross-site request forgery CSRF vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to 1 add arbitrary accounts via the joinform page and 2 change the privileges of arbitrary groups via the prefsgroupsoverview page...

CVE-2007-6706

Unspecified vulnerability in nlnotes.dll in the client in IBM Lotus Notes 6.5, 7.0.x before 7.0.2 CCH or 7.0.3, and possibly 8.0 allows remote attackers to execute arbitrary code via crafted text in an e-mail message sent over SMTP...

security flaw

Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox before 2.0.0.5 and Thunderbird before 2.0.0.5 allow remote attackers to cause a denial of service crash via unspecified vectors that trigger memory corruption...

ScriptMagix Photo Rating <= 2.0 Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl Script Name: ScriptMagix Photo Rating = 2.0 viewcomments.php Remote Blind SQL Injection Exploit Coded by : ajann Author : ajann Contact : : S.Page : http://www.scriptmagix.com $$ : 75$ .. : ajann,Turkey use IO::Socket; if@ARGV 1 print "...

Insufficient boundary check in ImageMagick's SGIDecode()

Multiple buffer overflows in Imagemagick 6.0 before 6.0.6.2, and 6.2 before 6.2.4.5, has unknown impact and user-assisted attack vectors via a crafted SGI image...

security flaw

SQL injection vulnerability in MySQL 4.1.x before 4.1.20 and 5.0.x before 5.0.22 allows context-dependent attackers to execute arbitrary SQL commands via crafted multibyte encodings in character sets such as SJIS, BIG5, and GBK, which are not properly handled when the mysqlrealescape function is...

CVE-2006-1062

Unspecified vulnerability in lurker.cgi for Lurker 2.0 and earlier allows attackers to read arbitrary files via unknown vectors...

Einstein <= 1.01 Local Password Disclosure Exploit

Exploit for unknown platform in category local exploits ================================================== Einstein include HKEY hKey; define BUFSIZE 100 char usernameBUFSIZE, passwordBUFSIZE; DWORD dwBufLen=BUFSIZE; LONG lRet; int mainvoid ifRegOpenKeyExHKEYLOCALMACHINE,"Software\einstein", 0,...