CVE-2009-4546

The CVE-2009-4546 entry affects Logoshows BBS 2.0, specifically the globepersonnel_login.asp authentication page. The vulnerability allows remote attackers to bypass authentication and gain administrative access by manipulating cookies (pb_username and level). This corresponds to a cookie-based a...

Design/Logic Flaw

The Organic Groups OG Vocabulary module 6.x before 6.x-1.0 for Drupal allows remote authenticated group members to bypass intended access restrictions, and create, modify, or read a vocabulary, via unspecified vectors...

CVE-2009-4449

Directory traversal vulnerability in MyBB aka MyBulletinBoard 1.4.10, and possibly earlier versions, when changing the user avatar from the gallery, allows remote authenticated users to determine the existence of files via directory traversal sequences in the avatar and possibly the gallery...

CVE-2009-4133

CVE-2009-4133 affects Condor (versions 6.5.4–7.2.4, 7.3.x, and 7.4.0 as used in MRG/GRID environments). The issue allows remote authenticated users to queue jobs as an arbitrary user by using a Condor CLI tool to modify an unspecified job attribute, enabling privilege elevation (partial confident...

LinkPal 1.0 SQL Injection

Tybe: Auth Bypass Remote SQL Injection Vulnerability Vendor:www.datachecknh.com ? ? Software:LinkPal v1.0 ? Price $$9.95 One-time fee ? author: R3d-D3v!L ? ? Date: 15.d3c.2009 ?T!ME: 08:14 p//\ ? Home: www.Xp10.Me ? ? E-MaiL : [email protected] ???????????????????????DEV!L'5 of...

Sql injection

Multiple SQL injection vulnerabilities in TestLink before 1.8.5 allow remote authenticated users to execute arbitrary SQL commands via 1 the Test Case ID field to lib/general/navBar.php or 2 the logLevel parameter to lib/events/eventviewer.php...

PHP Inventory 1.2 SQL Injection

PHP Inventory v1.2 Remote Auth Bypass SQL Injection Vulnerabiity Found By: mrme Download: http://www.phpwares.com/content/php-inventory Tested On: Windows Vista Note: For educational purposes only First of all lets login to admin with: http://server/php-inventory/index.php username: ' or 1=1--...

Microsoft Internet Authentication Service MS-CHAP Security Bypass (MS09-071; CVE-2009-3677)

An elevation of privilege vulnerability has been reported in the Internet Authentication Service. Internet Authentication Service IAS is the Microsoft implementation of a Remote Authentication Dial-in User Service RADIUS server and proxy. As a RADIUS server, IAS performs centralized connection...

CVE-2009-4112

Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands...

CVE-2009-4112

Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands...

DEBIAN-CVE-2009-4112

Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands...

CVE-2009-4105

CVE-2009-4105 affects TYPSoft FTP Server 1.10. Remote authenticated users can crash the server by issuing APPE followed immediately by DELE without file data, causing a denial of service. The connected sources describe the DoS impact and CVSS base score 3.5, but remediation details are not provid...

CVE-2009-4105

TYPSoft FTP Server 1.10 allows remote authenticated users to cause a denial of service crash by sending an APPE append command immediately followed by a DELE delete command without sending file data in between these two commands...

CVE-2009-3898

Directory traversal vulnerability in src/http/modules/ngxhttpdavmodule.c in nginx aka Engine X before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. dot dot in the Destination HTTP header for the WebDAV 1 COPY or 2 MOVE method...

CVE-2009-4053

Multiple directory traversal vulnerabilities in Home FTP Server 1.10.1.139 allow remote authenticated users to 1 create arbitrary directories via directory traversal sequences in an MKD command or 2 create files with any contents in arbitrary directories via directory traversal sequences in a fil...

CVE-2009-3921

The Smartqueueog module 5.x before 5.x-1.3 and 6.x before 6.x-1.0-rc3, a module for Drupal, does not verify group-node privileges in certain circumstances involving subqueue creation, which allows remote authenticated users to discover arbitrary organic group names by reading confirmation message...

Design/Logic Flaw

Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote authenticated institution administrators to reset a site administrator password via unspecified vectors...

CVE-2009-3298

Mahara up to version 1.0.12 and 1.1.x up to 1.1.6 is affected: remote authenticated institutional administrators can reset the site administrator's password via unspecified vectors, enabling privilege escalation. Affects Mahara core components handling admin authentication. Remediation per source...

CVE-2009-3814

Static code injection vulnerability in RunCMS 2M1 allows remote authenticated administrators to execute arbitrary PHP code via the "Filter/Banning" feature, as demonstrated by modifying modules/system/cache/bademails.php using the "Prohibited: Emails" action, and other unspecified filters...

MySQL CREATE FUNCTION Table Arbitrary Library Injection (CVE-2005-0710)

MySQL is an open-source implementation of a relational database management system supporting the SQL Structured Query Language database query language. MySQL allows users to create user-defined functions UDF through the CREATE FUNCTION command. A vulnerability exists in the user-defined function...