5604 matches found
CVE-2006-6268
SQL injection vulnerability in system/core/profile/profile.inc.php in Neocrome Land Down Under LDU 8.x and earlier allows remote authenticated users to execute arbitrary SQL commands via a url-encoded id parameter to users.php that begins with a valid filename, as demonstrated by "default.gif"...
CVE-2006-6223
Cross-site scripting XSS vulnerability in Google Search Appliance and Google Mini allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded q parameter...
CVE-2006-6223
Cross-site scripting XSS vulnerability in Google Search Appliance and Google Mini allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded q parameter...
CVE-2006-6223
The vulnerability CVE-2006-6223 affects Google Mini and Google Search Appliance. Both products fail to handle UTF-7 encoded URIs, which may allow a remote, unauthenticated attacker to inject arbitrary content (including script) into web pages, potentially reading or modifying page data and relate...
CVE-2006-6223
Cross-site scripting XSS vulnerability in Google Search Appliance and Google Mini allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded q parameter...
CVE-2006-6177
CVE-2006-6177 describes an SQL injection in Neocrome Seditio
CVE-2006-5718
Cross-site scripting XSS vulnerability in error.php in phpMyAdmin 2.6.4 through 2.9.0.2 allows remote attackers to inject arbitrary web script or HTML via UTF-7 or US-ASCII encoded characters, which are injected into an error message, as demonstrated by a request with a utf7 charset parameter...
CVE-2006-5617
Directory traversal vulnerability in index.php in Thepeak File Upload Manager 1.3 allows remote attackers to read or download arbitrary files via a base64-encoded file path containing a .. dot dot sequence in the file parameter...
CVE-2006-5617
The CVE-2006-5617 entry concerns Thepeak File Upload Manager 1.3. Affected component: index.php, where directory traversal can be achieved via a base64-encoded file parameter containing ".." to read or download arbitrary files. Documented impact is partial confidentiality and potential file acces...
CVE-2006-5617: Undefined Security Weakness
Directory traversal vulnerability in index.php in Thepeak File Upload Manager 1.3 allows remote attackers to read or download arbitrary files via a base64-encoded file path containing a .. dot dot sequence in the file parameter...
DEBIAN-CVE-2006-4805
epan/dissectors/packet-xot.c in the XOT dissector dissectxotpdu in Wireshark formerly Ethereal 0.9.8 through 0.99.3 allows remote attackers to cause a denial of service memory consumption and crash via an encoded XOT packet that produces a zero length value when it is decoded...
CVE-2006-5504
Cross-site scripting XSS vulnerability in index.php in Simple Machines Forum SMF allows remote attackers to inject arbitrary web script or HTML via a base64 encoded params value in the action parameter...
CVE-2006-5504: Undefined Security Weakness
Cross-site scripting XSS vulnerability in index.php in Simple Machines Forum SMF allows remote attackers to inject arbitrary web script or HTML via a base64 encoded params value in the action parameter...
CVE-2006-5442
ViewVC 1.0.2 and earlier does not specify a charset in its HTTP headers or HTML documents, which allows remote attackers to conduct cross-site scripting XSS attacks that inject arbitrary UTF-7 encoded JavaScript code via a view...
CVE-2006-5303
Secure Computing SafeWord RemoteAccess 2.1 allows local users to obtain the UserCenter webportal password, database encryption keys, and signing keys by reading 1 base-64 encoded data in SERVERS\Web\Tomcat\usercenter\WEB-INF\login.conf and 2 plaintext data in SERVERS\Shared\signers.cfg. NOTE: the...
CVE-2006-5210: Undefined Security Weakness
Directory traversal vulnerability in IronWebMail before 6.1.1 HotFix-17 allows remote attackers to read arbitrary files via a GET request to the IMFILE identifier with double-url-encoded "../" sequences "%252e%252e/"...
Debian DSA-947-2 : clamav - heap overflow
A heap overflow has been discovered in ClamAV, a virus scanner, which could allow an attacker to execute arbitrary code by sending a carefully crafted UPX-encoded executable to a system running ClamAV. In addition, other potential overflows have been corrected. Packages for the ARM architecture...
CVE-2006-5219
SQL injection vulnerability in blog/index.php in the blog module in Moodle 1.6.2 allows remote attackers to execute arbitrary SQL commands via a double-encoded tag parameter...