CVE-2009-4669

Multiple SQL injection vulnerabilities in RoomPHPlanning 1.6 allow remote attackers to execute arbitrary SQL commands via 1 the loginus parameter to Login.php or 2 the Old Password field to changepwd.php, and allow 3 remote authenticated administrators to execute arbitrary SQL commands via the id...

Symantec remote overflow exp allow an attacker to execute arbitrary commands with the&system level permissions-bug warning-the black bar safety net

The AMS2 Alert Management Systems 2 component of multiple Symantec products is prone to a remote command-execution vulnerability because the software fails to adequately sanitize user-supplied input. Successfully exploiting this issue will allow an attacker to execute arbitrary commands with...

Design/Logic Flaw

DISPUTED Varnish 2.0.6 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. NOTE:...

Design/Logic Flaw

minihttpd 1.19 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator...

UBUNTU-CVE-2009-4494

AOLserver 4.5.1 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator...

DEBIAN-CVE-2009-4490

minihttpd 1.19 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator...

CVE-2009-4498

The nodeprocesscommand function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request...

CVE-2009-4046

FrontAccounting 2.2.x is affected by multiple SQL injection vulnerabilities (CVE-2009-4046) in modules under gl/manage/ and includes/db/, allowing remote attackers to execute arbitrary SQL via unspecified parameters to bank_accounts.php, currencies.php, exchange_rates.php, gl_account_types.php, g...

Family Connection 1.8.1 SQL Injection

Salvatore "drosophila" Fresta + Application: Family Connection + Version: 1.8.1 + Website: http://www.familycms.com + Bugs: A Multiple SQL Injection B Create Admin User C Blind SQL Injection + Exploitation: Remote + Date: 25 Mar 2009 + Discovered by: Salvatore "drosophila" Fresta + Author:...

curl: local file access via unsafe redirects

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPTFOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to 1 trigger arbitrary requests to intranet servers, 2 read or overwrite arbitrary files via a redirect to a file:...

GLSA-200903-21 : cURL: Arbitrary file access

The remote host is affected by the vulnerability described in GLSA-200903-21 cURL: Arbitrary file access David Kierznowski reported that the redirect implementation accepts arbitrary Location values when CURLOPTFOLLOWLOCATION is enabled. Impact : A remote attacker could possibly exploit this...

Sql injection

Multiple SQL injection vulnerabilities in CelerBB 0.0.2, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 viewforum.php and 2 viewtopic.php...

CVE-2009-0037

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPTFOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to 1 trigger arbitrary requests to intranet servers, 2 read or overwrite arbitrary files via a redirect to a file:...

CVE-2009-0037

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPTFOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to 1 trigger arbitrary requests to intranet servers, 2 read or overwrite arbitrary files via a redirect to a file:...

CVE-2009-0037

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPTFOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to 1 trigger arbitrary requests to intranet servers, 2 read or overwrite arbitrary files via a redirect to a file:...

curl -- cURL/libcURL Location: Redirect URLs Security Bypass

Secunia reports: The security issue is caused due to cURL following HTTP Location: redirects to e.g. scp:// or file:// URLs which can be exploited by a malicious HTTP server to overwrite or disclose the content of arbitrary local files and potentially execute arbitrary commands via specially...

Sql injection

Multiple SQL injection vulnerabilities in DevelopItEasy Photo Gallery 1.2 allow remote attackers to execute arbitrary SQL commands via the 1 catid parameter to gallerycategory.php, 2 photoid parameter to galleryphoto.php, and the 3 username and 4 userpass parameters to admin/index.php. NOTE: some...

CVE-2009-0402

SQL injection vulnerability in client/newaccount.php in Domain Technologie Control DTC before 0.29.16 allows remote attackers to execute arbitrary SQL commands via the 1 familyname, 2 christname, 3 companyname, 4 iscompany, 5 email, 6 phone, 7 fax, 8 addr1, 9 addr2, 10 addr3, 11 zipcode, 12 city,...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the administration interface in Cisco IronPort Encryption Appliance 6.2.4 before 6.2.4.1.1, 6.2.5, 6.2.6, 6.2.7 before 6.2.7.7, 6.3 before 6.3.0.4, and 6.5 before 6.5.0.2; and Cisco IronPort PostX 6.2.1 before 6.2.1.1 and 6.2.2 before 6.2.2.3; allo...

CVE-2008-4242

ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery CSRF attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web...