CVE-2010-3070

Cross-site scripting XSS vulnerability in NuSOAP 0.9.5, as used in MantisBT and other products, allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to an arbitrary PHP script that uses NuSOAP classes...

CVE-2010-3070

Cross-site scripting XSS vulnerability in NuSOAP 0.9.5, as used in MantisBT and other products, allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to an arbitrary PHP script that uses NuSOAP classes...

CVE-2010-3481

Multiple SQL injection vulnerabilities in login.php in ApPHP PHP MicroCMS 1.0.1, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password variables, possibly related to include/classes/Login.php. NOTE: some of these details are...

NullPointerException when Switching between Projects or Boards

In my case, the WEB-INF/classes/log4j.properties included has these loggers turned off, but they still seem to run. I am including a patch that ignores the NullPointerException following the pattern of ignoring the ClassNotFoundException. Details below taken from:...

CVE-2010-1521: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in include/classes/tznuser.php in TaskFreak! Original multi user before 0.6.4 allows remote attackers to execute arbitrary SQL commands via the password parameter to login.php...

[SECURITY] Fedora 11 Update: gnustep-base-1.18.0-9.fc11

The GNUstep Base Library is a powerful fast library of general-purpose, non-graphical Objective C classes, inspired by the superb OpenStep API but implementing Apple and GNU additions to the API as well. It includes for example classes for unicode strings, arrays, dictionaries, sets, byte streams...

[SECURITY] Fedora 12 Update: sip-4.10.1-2.fc12

SIP is a tool for generating bindings for C++ classes so that they can be accessed as normal Python classes. SIP takes many of its ideas from SWIG bu t, because it is specifically designed for C++ and Python, is able to generate tighter bindings. SIP is so called because it is a small SWIG. SIP w...

Joomla Component com_education_classes SQL injection Vulnerability

Exploit for php platform in category web applications ================================================================== Joomla Component comeducationclasses SQL injection Vulnerability ================================================================== Exploit Title: joomla component education SQ...

libpangoft2 segfaults on forged font files

Array index error in the hbotlayoutbuildglyphclasses function in pango/opentype/hb-ot-layout.cc in Pango before 1.27.1 allows context-dependent attackers to cause a denial of service application crash via a crafted font file, related to building a synthetic Glyph Definition aka GDEF table by usin...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in PHPope 1.0.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 GLOBALSconfigdirplugins parameter to plugins/address/admin/index.php, 2 GLOBALSconfigdirfunctions parameter to plugins/im/compose.php, and 3...

Improper access control

DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and configuration information, log data, and gain administrative access via a direct request to scripts in 1 templates/ including 2 templates/deluxe/admincp/...

DeluxeBB 1.3 - Multiple Vulnerabilities

DeluxeBB 1.3 - Multiple Vulnerabilities Author: cp77fk4r | Empty0pagEShift+2gmail.com Vendor: http://www.deluxebb.com Directory Listing http://server/templates/ http://server/images/ http://server/logs/ http://server/wysiwyg/ http://server/docs/ http://server/classes http://server/lang...

CVE-2009-4220: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/classes/pctemplate.php in PointComma 3.8b2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pcConfigsmartyPath parameter...

[SECURITY] Fedora 11 Update: rubygem-activeresource-2.3.2-2.fc11

Wraps web resources in model classes that can be manipulated through XML ov er REST...

Microsoft Office Web Components OWC.Spreadsheet.9 HTMLURL property overflow

Added: 08/14/2009 CVE: CVE-2009-1534 BID: 35992 OSVDB: 56916 Background Microsoft Office Web Components OWC are a group of OLE classes implemented as ActiveX controls. Problem A buffer overflow vulnerability in the OWC.Spreadsheet.9 ActiveX control allows command execution when a user loads a web...

[SECURITY] Fedora 10 Update: wxGTK-2.8.10-2.fc10

wxWidgets/GTK2 is the GTK2 port of the C++ cross-platform wxWidgets GUI library, offering classes for all common GUI controls as well as a comprehensive set of helper classes for most common application tasks, ranging from networking to HTML display and image manipulation...

CVE-2009-1812

Multiple SQL injection vulnerabilities in myGesuad 0.9.14 aka 0.9 allow remote attackers to execute arbitrary SQL commands via 1 the formUser parameter aka the Name field to common/login.php, and allow remote authenticated users to execute arbitrary SQL commands via the ID parameter in a Detail...

CVE-2009-1506: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in classes/Xp.php in eLitius 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to banner-details.php...

FreeBSD : jdk/jre -- Security Vulnerability With Java Plugin (ac619d06-3ef8-11d9-8741-c942c075aa41)

The Sun Java Plugin capability in Java 2 Runtime Environment JRE 1.4.201, 1.4.204, and possibly earlier versions, does not properly restrict access between JavaScript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in MeetWeb 0.8 allow remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter to 1 modules.php, 2 ManagerResource.class.php, 3 ManagerRightsResource.class.php, 4 RegForm.class.php, 5 RegResource.class.php, and 6...