CVE-2009-2735

The CVE-2009-2735 entry describes an SQL injection in sun-jester OpenNews 1.0, via admin.php when magic_quotes_gpc is disabled. The vulnerability affects the username parameter, enabling remote attackers to execute arbitrary SQL commands. This is documented in NVD and mirrored in multiple referen...

CVE-2009-2647: Undefined Security Weakness

Unspecified vulnerability in Kaspersky Anti-Virus 2010 and Kaspersky Internet Security 2010 before Critical Fix 9.0.0.463 allows remote attackers to disable the Kaspersky application via unknown attack vectors unrelated to "an external script."...

python: PyString_FromStringAndSize does not check for negative size values

Python 2.5.2 and earlier allows context-dependent attackers to execute arbitrary code via multiple vectors that cause a negative size value to be provided to the PyStringFromStringAndSize function, which allocates less memory than expected when assert is disabled and triggers a buffer overflow...

openSUSE Security Update : koffice (koffice-801)

The pdf filter of koffice is prone to several buffer overflows. Due to the large number of problems and the huge backporting effort that would be needed the filter has been disabled. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

openSUSE Security Update : koffice (koffice-801)

The pdf filter of koffice is prone to several buffer overflows. Due to the large number of problems and the huge backporting effort that would be needed the filter has been disabled. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

CVE-2009-2553

Multiple SQL injection vulnerabilities in comments.php in Super Simple Blog Script 2.5.4, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the entry parameter...

Sql injection

Multiple SQL injection vulnerabilities in newsscript.php in USOLVED NEWSolved 1.1.6, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 jahr or 2 idneu parameter in an archive action, or 3 the newsid parameter...

CVE-2009-1648: Undefined Security Weakness

The YaST2 LDAP module in yast2-ldap-server on SUSE Linux Enterprise Server 11 aka SLE11 does not enable the firewall in certain circumstances involving reboots during online updates, which makes it easier for remote attackers to access network services...

CVE-2009-2164

Multiple SQL injection vulnerabilities in Kjtechforce mailman beta1, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via 1 the code parameter to activate.php or 2 the dest parameter to index.php...

Directory traversal

Multiple directory traversal vulnerabilities in DB Top Sites 1.0, when magicquotesgpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the u parameter to 1 full.php, 2 index.php, and 3 contact.php...

CVE-2009-2110

Multiple directory traversal vulnerabilities in DB Top Sites 1.0, when magicquotesgpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the u parameter to 1 full.php, 2 index.php, and 3 contact.php...

CVE-2009-1913

SQL injection vulnerability in manager.php in LuxBum 0.5.5, when magicquotesgpc is disabled and dotclear authentication is used, allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action...

CentOS 4 / 5 : thunderbird (CESA-2009:0258)

An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaw...

CVE-2009-1741

Multiple SQL injection vulnerabilities in login.php in DM FileManager 3.9.2, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 Username and 2 Password fields...

Sun Java Runtime Environment ActiveX Control Multiple Remote Buffer Overflow Vulnerabilities

Description Sun Java Runtime Environment is prone to multiple remote buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied data. Successfully exploiting these issues allows remote attackers to execute arbitrary code in the context of th...

Sql injection

SQL injection vulnerability in public/specific.php in EZ-Blog before Beta 2 20090427, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the category parameter...

Sql injection

Multiple SQL injection vulnerabilities in leap.php in Leap CMS 0.1.4, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 searchterm or 2 email parameter...

CVE-2009-1613

Multiple SQL injection vulnerabilities in leap.php in Leap CMS 0.1.4, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 searchterm or 2 email parameter...

Sql injection

Multiple SQL injection vulnerabilities in TemaTres 1.031, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 idcorreoelectronico and 2 idpassword parameters to login.php. NOTE: the provenance of this information is unknown; the details are obtained...

Sql injection

Multiple SQL injection vulnerabilities in TemaTres 1.0.3 and 1.031, when magicquotesgpc is disabled, allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the 1 mail, 2 password, and 3 letra parameters to index.php; 4 y and 5 m parameters to sobre.php; and the...