CVE-2009-0759

Multiple CRLF injection vulnerabilities in webadmin in ZNC before 0.066 allow remote authenticated users to modify the znc.conf configuration file and gain privileges via CRLF sequences in the quit message and other vectors...

CVE-2009-0615

Directory traversal vulnerability in Cisco Application Networking Manager ANM before 2.0 and Application Control Engine ACE Device Manager before A32.1 allows remote authenticated users to read or modify arbitrary files via unspecified vectors, related to "invalid directory permissions."...

Code injection

The CICS listener in IBM TXSeries for Multiplatforms 6.2 GA waits for a forcepurge acknowledgement from the CICS Application Server CICSAS after an eci response timeout, which might allow remote authenticated users to cause a denial of service forcepurge handling delay, or have unspecified other...

CVE-2009-0700

CVE-2009-0700 affects Plunet BusinessManager 4.1 and earlier. Remote authenticated users can bypass access restrictions to read sensitive Customer or Order data via a modified Pfad parameter to pagesUTF8/Sys_DirAnzeige.jsp, or enumerate sensitive Jobs via a direct request to pagesUTF8/auftrag_job...

CVE-2009-0673

Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary PHP code via the ID Field Name box in a yaCustomFields action to admin.php...

CVE-2009-0359

Multiple cross-site scripting XSS vulnerabilities in Samizdat before 0.6.2 allow remote authenticated users to inject arbitrary web script or HTML via the 1 message title or 2 user full name...

Design/Logic Flaw

Trend Micro InterScan Web Security Suite IWSS 3.1 before build 1237 allows remote authenticated Auditor and Report Only users to bypass intended permission settings, and modify the system configuration, via requests to unspecified JSP pages...

CVE-2008-6125

Unspecified vulnerability in the user editing interface in Moodle 1.5.x, 1.6 before 1.6.6, and 1.7 before 1.7.3 allows remote authenticated users to gain privileges via unknown vectors...

Remote Authentication Bypass - Swann DVR4 SecuraNet (possibly DVR9 as well)

Dear BugTraq Readers, It is possible to download the configuration containing usernames/passwords to this CCTV DVR which is being marketed by Swann Security suspect that it is a rebranded AVTech unit tez@tetris $ curl http://192.168.2.100/../../var/run/vynetman.cfg snipPadmin111111 the above are...

CVE-2008-6098

CVE-2008-6098 affects Bugzilla variants (e.g., Bugzilla 3.2 before 3.2 RC2, 3.0 before 3.0.6, 2.22 before 2.22.6, 2.20 before 2.20.7, and related versions). The vulnerability lets remote authenticated users bypass moderation to approve/disapprove quips via a direct request to quips.cgi with actio...

CVE-2009-0214

Unspecified vulnerability in the WebFGServer application in AREVA e-terrahabitat 5.7 and earlier allows remote authenticated users to gain privileges via unknown vectors, aka PD32022...

CVE-2009-0372

Unrestricted file upload vulnerability in index.php in Miltenovik Manojlo MemHT Portal 4.0.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and an image content type via a users editProfile action, then accessing this file...

Sql injection

SQL injection vulnerability in the Downloads module for PHP-Nuke 8.0 8.1.0.3.5b and earlier allows remote authenticated users to execute arbitrary SQL commands via the url parameter in the Add operation to modules.php...

CVE-2008-5971

CVE-2008-5971 describes a cross-site scripting (XSS) vulnerability in the profile_social.php component of the i-Net Solution Orkut Clone. The issue allows remote authenticated users to inject arbitrary web script or HTML by manipulating the id parameter. The available references from NVD/PRION/CV...

Design/Logic Flaw

Sun Java System Access Manager 6.3 2005Q1, 7 2005Q4, and 7.1 allows remote authenticated users with console privileges to discover passwords, and obtain unspecified other "access to resources," by visiting the Configuration Items component in the console...

CVE-2009-0170

Technical details about CVE-2009-0170 are not publicly available in the provided connected documents. Monitor for updates from vendors and advisories to determine affected products, impact, and fixes.

Design/Logic Flaw

Unspecified vulnerability in the PeopleSoft Enterprise HRMS component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9.18 and 9.0.8 allows remote authenticated users to affect confidentiality and integrity via unknown vectors...

CVE-2008-5452

Unspecified vulnerability in the PeopleSoft Enterprise HRMS component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9.18 allows remote authenticated users to affect confidentiality and integrity via unknown vectors...

CVE-2008-4016

CVE-2008-4016 technical details are not publicly available in the provided documents. No affected products, vectors, or remediation are specified here. Monitor for updates.

CVE-2008-5456

The CVE-2008-5456 entry describes an unspecified vulnerability in the PeopleSoft Enterprise HRMS component of Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9.18 and 9.0.8, allowing remote authenticated users to affect confidentiality and integrity via unknown vectors. The CVSSv2 bas...