8679 matches found
CVE-2006-1731
Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 returns the Object class prototype instead of the global window object when 1 .valueOf.call or 2 .valueOf.apply are called without any arguments, which allows remote...
phpBannerExchange Template Class Local File Inclusion
The remote host is running phpBannerExchange, a banner exchange script written in PHP. The version of phpBannerExchange installed on the remote host uses a template class that fails to sanitize user-supplied input before using it in a PHP 'include' function. An unauthenticated attacker can exploi...
WebGUI < 6.7.6 arbitrary command execution
The remote web server contains a CGI script that is prone to arbitrary code execution. Description : The remote host is running WebGUI, a content management system from Plain Black Software. The installed version of WebGUI on the remote host fails to sanitize user-supplied input via the OpenVAS...
r25xss.txt
R25 XSS Vulnerability ===================== Discovered By: Matthew Benenati Release Date: 3/3/2006 Vendor: CollegeNET Versions: /wv3/wv3servlet/urd/run/wvevent.QSearch?searchon=0,findby=1,criteria=%22%3C/div%3E%3Cscript%3Ealertdocument.cookie%3C/script%3E...
DBeSession102.txt
GulfTech Security Research February 11, 2006 Vendor : Lawrence Osiris URL : http://www.phpclasses.org/browse/package/1624.html Version : DBeSession 1.0.2 Risk : SQL Injection Description: DBeSession is a feature-packed PHP class that stores the session data in a MySQL database rather than files. ...
CVE-2005-4640
SQL injection vulnerability in index.php in class-1 Poll Software 0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 1 pollid or 2 previouspoll parameters...
CVE-2005-4640
The CVE-2005-4640 entry describes a SQL injection vulnerability in index.php of class-1 Poll Software 0.4 and earlier. The underlying issue is that input parameters (pollid and previouspoll) can be crafted to alter SQL commands executed by the application. This enables remote attackers to potenti...
CVE-2005-4843
The SmartConnect Class control allows remote attackers to cause a denial of service Internet Explorer crash by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer...
CVE-2005-4789
resmgr in SUSE Linux 9.2 and 9.3, and possibly other distributions, does not properly enforce class-specific exclude rules in some situations, which allows local users to bypass intended access restrictions for USB devices that set their class ID at the interface level...
SpireMedia CMS SQL inj. vuln.
SpireMedia CMS SQL inj. vuln. Vuln. discovered by : r0t Date: 21 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/spiremedia-cms-sql-inj-vuln.html vendor:http://www.spiremedia.com/ affected version:mx7 Product Description: The SpireMedia CMS is an enterprise class Content Management...
DMA[2005-1214a] - 'Widcomm BTW - Bluetooth for Windows Remote Audio Eavesdropping'
DMA2005-1214a - 'Widcomm BTW - Bluetooth for Windows Remote Audio Eavesdropping' Author: Kevin Finisterre Vendor: http://www.widcomm.com, http://www.broadcom.com/products/Bluetooth/ Product: 'versions = BTW 4.0.1.1500 ?' References: http://www.digitalmunition.com/DMA2005-1214a.txt Description: Wh...
CVE-2005-4031
Eval injection vulnerability in MediaWiki 1.5.x before 1.5.3 allows remote attackers to execute arbitrary PHP code via the "user language option," which is used as part of a dynamic class name that is processed using the eval function...
CVE-2005-4031
Eval injection vulnerability in MediaWiki 1.5.x before 1.5.3 allows remote attackers to execute arbitrary PHP code via the "user language option," which is used as part of a dynamic class name that is processed using the eval function...
CVE-2005-3946
Opera 8.50 allows remote attackers to cause a denial of service crash via a Java applet with a large string argument to the removeMember JNI method for the com.opera.JSObject class...
CVE-2005-3772
Multiple SQL injection vulnerabilities in Joomla! before 1.0.4 allow remote attackers to execute arbitrary SQL commands via the 1 Itemid variable in the Polls modules and 2 multiple unspecified methods in the mosDBTable class...
CVE-2005-3757
The Saxon XSLT parser in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to obtain sensitive information and execute arbitrary code via dangerous Java class methods in select attribute of xsl:value-of tags in XSLT style sheets, such as 1 system-property...
CVE-2005-3757
The CVE-2005-3757 issue affects the Saxon XSLT parser used by Google Mini Search Appliance (and possibly Google Search Appliance). The vulnerability arises from dangerous Java methods (system-property, sys:getProperty, run:exec) in the select attribute of xsl:value-of in XSLT style sheets, enabli...
CVE-2005-3757
Removed by vendor...
Multiple SQL Injection Vulnerabilities in class-1 Forum Software (v 0.24.4)
Multiple SQL Injection Vulnerabilities in class-1 Forum Software v 0.24.4 Author: r0t hackers.by.lv Date: 17 nov. 2005 Software: class-1 Forum Software v 0.24.4 Vendor:http://www.class1web.co.uk/ Affected:v 0.24.4 and prior Description: Multiple parameters isn't properly sanitised before being us...
class-1 Poll Software Multiple SQL Injection Vulnerabilities.
class-1 Poll Software Multiple SQL Injection Vulnerabilities. Author: r0t hackers.by.lv Date: 17 nov. 2005 Software:class-1 Poll Software v 0.4 Vendor:http://www.class1web.co.uk/ affected: v 0.4 and prior Description: Input passed to the "pollid" and "previouspoll" parameter in "index.php" isn't...