CVE-2009-1456

CVE-2009-1456 affects Malleo 1.2.3. A directory traversal exists in admin.php where remote authenticated administrators can cause local file inclusion/execution via a .. (dot dot) in the module parameter. This is a authenticated/local access issue with partial confidentiality/integrity/availabili...

Design/Logic Flaw

Unspecified vulnerability in the Web administration interface in Avaya Communication Manager 3.1.x before CM 3.1.4 SP2 and 4.0.x before 4.0.3 SP1 allows remote authenticated administrators to gain root privileges via unknown vectors related to "configuring data viewing or restoring credentials."...

CVE-2008-6708

Unspecified vulnerability in the Web management interface in Avaya SIP Enablement Services SES 3.x and 4.0, as used with Avaya Communication Manager 3.1.x and 4.x, allows remote authenticated administrators to gain root privileges via unknown vectors related to configuration of "data viewing or...

CVE-2008-6710

Unspecified vulnerability in the Web administration interface in Avaya Communication Manager 3.1.x before CM 3.1.4 SP2 and 4.0.x before 4.0.3 SP1 allows remote authenticated administrators to gain root privileges via unknown vectors related to "configuring data viewing or restoring credentials."...

CVE-2008-6658

CVE-2008-6658 affects Simple Machines Forum (SMF): directory traversal in index.php allows remote authenticated administrators to install packages from arbitrary directories via package parameter during install2, affecting SMF 1.0.x prior to 1.0.15 and SMF 1.1.x prior to 1.1.7. Impact per descrip...

CVE-2008-6641

Multiple SQL injection vulnerabilities in Shader TV Beta allow remote authenticated administrators to execute arbitrary SQL commands via the sid parameter to 1 kanal.asp, 2 google.asp, and 3 hakk.asp in yonet/; and allow remote attackers to execute arbitrary SQL commands via the 4 username or 5...

Sql injection

Multiple SQL injection vulnerabilities in Shader TV Beta allow remote authenticated administrators to execute arbitrary SQL commands via the sid parameter to 1 kanal.asp, 2 google.asp, and 3 hakk.asp in yonet/; and allow remote attackers to execute arbitrary SQL commands via the 4 username or 5...

Code injection

Unspecified vulnerability in the Skin Manager in DotNetNuke before 4.8.2 allows remote authenticated administrators to perform "server-side execution of application logic" by uploading a static file that is converted into a dynamic script via unknown vectors related to HTM or HTML files...

CVE-2008-6542

Unspecified vulnerability in the Skin Manager in DotNetNuke before 4.8.2 allows remote authenticated administrators to perform "server-side execution of application logic" by uploading a static file that is converted into a dynamic script via unknown vectors related to HTM or HTML files...

CVE-2008-6542

Unspecified vulnerability in the Skin Manager in DotNetNuke before 4.8.2 allows remote authenticated administrators to perform "server-side execution of application logic" by uploading a static file that is converted into a dynamic script via unknown vectors related to HTM or HTML files...

CVE-2008-6530

Unrestricted file upload vulnerability in editimage.php in eZoneScripts Living Local 1.1 allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the uploaded file...

CVE-2008-6530

Unrestricted file upload vulnerability in editimage.php in eZoneScripts Living Local 1.1 allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the uploaded file...

CVE-2009-1038

Multiple SQL injection vulnerabilities in YAP Blog 1.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 imageid parameter to comments.php, and remote authenticated administrators to execute arbitrary SQL commands via the 2 user parameter in a modif action to admin/index.php...

Sql injection

Multiple SQL injection vulnerabilities in YAP Blog 1.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 imageid parameter to comments.php, and remote authenticated administrators to execute arbitrary SQL commands via the 2 user parameter in a modif action to admin/index.php...

Sql injection

Multiple SQL injection vulnerabilities in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, allow remote authenticated administrators to execute arbitrary SQL commands via 1 a content type or 2 a voting API value...

CVE-2008-6276

Multiple SQL injection vulnerabilities in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, allow remote authenticated administrators to execute arbitrary SQL commands via 1 a content type or 2 a voting API value...

CVE-2008-6256

SQL injection vulnerability in admincp/admincalendar.php in vBulletin 3.7.3.pl1 allows remote authenticated administrators to execute arbitrary SQL commands via the holidayinforecurring parameter, a different vector than CVE-2005-3022...

CVE-2008-6255

Multiple SQL injection vulnerabilities in vBulletin 3.7.4 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 answer parameter to admincp/verify.php, 2 extension parameter in an edit action to admincp/attachmentpermission.php, and the 3 iperm parameter to...

Sql injection

SQL injection vulnerability in admincp/admincalendar.php in vBulletin 3.7.3.pl1 allows remote authenticated administrators to execute arbitrary SQL commands via the holidayinforecurring parameter, a different vector than CVE-2005-3022...

Sql injection

Multiple SQL injection vulnerabilities in vBulletin 3.7.4 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 answer parameter to admincp/verify.php, 2 extension parameter in an edit action to admincp/attachmentpermission.php, and the 3 iperm parameter to...