Design/Logic Flaw

Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.1, and 11.2.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability, related to SYSDBA...

CVE-2010-4761

The customer-interface ticket-print dialog in Open Ticket Request System OTRS before 3.0.0-beta3 does not properly restrict customer-visible data, which allows remote authenticated users to obtain potentially sensitive information from the 1 responsible, 2 owner, 3 accounted time, 4 pending until...

Etomite 1.1 SQL,XSS,and file include vulnerabilities and fixes-vulnerability warning-the black bar safety net

Due to thevulnerabilityexists in“/index.php”the script has not been filtered will provide a search variable input. The attacker can modify the application the SQL query to the database, execute arbitrary queries of the database, compromise the application, access or modify sensitive data, or use ...

CVE-2009-3168

Mevin Productions Basic PHP Events Lister 2.0 does not properly restrict access to 1 admin/reset.php and 2 admin/useradd.php, which allows remote authenticated users to reset administrative passwords or add administrators via a direct request...

CVE-2009-0759

Multiple CRLF injection vulnerabilities in webadmin in ZNC before 0.066 allow remote authenticated users to modify the znc.conf configuration file and gain privileges via CRLF sequences in the quit message and other vectors...

MLdonkey 2.9.7 - Arbitrary File Disclosure

MLdonkey up to 2.9.7 has a vulnerability that allows remote user to access any file with rights of running Mldonkey daemon by supplying a special-crafted request ok, there's not much special about double slash to an Mldonkey http GUI tcp/4080 usually. Reference:...

MLdonkey 2.9.7 - Arbitrary File Disclosure

MLdonkey 2.9.7 - Arbitrary File Disclosure MLdonkey up to 2.9.7 has a vulnerability that allows remote user to access any file with rights of running Mldonkey daemon by supplying a special-crafted request ok, there's not much special about double slash to an Mldonkey http GUI tcp/4080 usually...

SquirrelMail软件包会话处理绕过认证漏洞

BUGTRAQ ID: 33354 CVECAN ID: CVE-2009-0030 SquirrelMail是一款PHP编写的WEBMAIL程序。 Red Hat为CVE-2008-3663所提供的修复导致SquirrelMail对所有的会话都设置了相同的SQMSESSID Cookie值，这允许通过认证的远程用户通过使用标准的webmail.php接口访问其他用户的文件夹列表和配置数据。 SquirrelMail 1.4.8 厂商补丁： RedHat ------ RedHat已经为此发布了一个安全公告（RHSA-2009:0057-01）以及相应补丁:...

Gentoo Security Advisory GLSA 200612-19 (pam_ldap)

The remote host is missing updates announced in advisory GLSA 200612-19. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Fedora 9 : condor-7.0.4-1.fc9 (2008-7205)

A flaw was found in a way condor interpreted wild cards in the authorization lists. Certain authorization lists using wild cards in DENY rules such as DENYWRITE or HOSTDENYWRITE that conflict with with definitions in ALLOW rule could permit authenticated remote users to submit computation jobs,...

CVE-2007-5977

Cross-site scripting XSS vulnerability in dbcreate.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than...

[KAPDA::#44] - NewsCMSLite Login ByPass by Cookie

KAPDA::44 - NewsCMSLite Login ByPass by Cookie Vulnerability KAPDA New advisory Vulnerable product : NewsCMSLite Vendor: http://www.katywhitton.com Vulnerability: Authentication Flaw in 'newsadmin.asp' Lets Remote User Gain Administrative Access . Date : -------------------- Found : 2006/05/21...

CVE-2005-1932

Lpanel 1.59 and earlier, and other versions before 1.597, allows remote authenticated users to modify certain critical variables and 1 modify DNS settings for arbitrary domains via the domain parameter to diagnose.php, 2 close, open, or respond to arbitrary support tickets via the close, open, or...

Annuaire Netref v4.2 [ fwrite php ] vulnerability

Software: annuaire netref version : 4.2 url : http://www.netref.net Risk factor : critical Vendor has been contacted Description: ----------- Netref is a PHP/MySQL-based directory script that supports an unlimited number of categories and links. Many fonctions to manage the links : Fast search...

DoKuWiki file-upload vulnerabilities

ADZ Security Team =================== Info Program: DoKuWiki Version: 2005-02-18 Module: media.php Bug type: File Upload bug Vendor site: http://wiki.splitbrain.org/ Vendor Informed: Yes =================== Bug Info Remote user with file-upload privileges can upload anyone file with any...

CVE-2004-1653

The default configuration for OpenSSH enables AllowTcpForwarding, which could allow remote authenticated users to perform a port bounce, when configured with an anonymous access program such as AnonCVS...

Moderate: Red Hat Security Advisory: mod_python security update

An Updated modpython package that fixes a security issue in the publisher handler is now available. Modpython is a module that embeds the Python language interpreter within the Apache web server, allowing handlers to be written in Python. Graham Dumpleton discovered a flaw affecting the publisher...

CVE-2005-0285

Webseries Payment Application does not properly restrict privileged operations, which allows remote authenticated users to gain privileges by directly accessing certain URLs...

CVE-2004-2481

MyProxy 6.58 allows remote authenticated users in the Users Tab to connect to arbitrary hosts from the MyProxy server, possibly bypassing access restrictions, by connecting to the proxy and issuing a CONNECT command...

CVE-2004-2493

Directory traversal vulnerability in Groupmax World Wide Web GmaxWWW 2 and 3, and Desktop 5, 6, and Desktop for Jichitai allows remote authenticated users to read arbitrary .html files via the template name parameter...