Design/Logic Flaw

DISPUTED Varnish 2.0.6 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. NOTE:...

UBUNTU-CVE-2009-4494

AOLserver 4.5.1 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator...

DEBIAN-CVE-2009-4490

minihttpd 1.19 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator...

CVE-2009-4498

The nodeprocesscommand function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request...

CVE-2009-4046

FrontAccounting 2.2.x is affected by multiple SQL injection vulnerabilities (CVE-2009-4046) in modules under gl/manage/ and includes/db/, allowing remote attackers to execute arbitrary SQL via unspecified parameters to bank_accounts.php, currencies.php, exchange_rates.php, gl_account_types.php, g...

Family Connection 1.8.1 SQL Injection

Salvatore "drosophila" Fresta + Application: Family Connection + Version: 1.8.1 + Website: http://www.familycms.com + Bugs: A Multiple SQL Injection B Create Admin User C Blind SQL Injection + Exploitation: Remote + Date: 25 Mar 2009 + Discovered by: Salvatore "drosophila" Fresta + Author:...

curl: local file access via unsafe redirects

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPTFOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to 1 trigger arbitrary requests to intranet servers, 2 read or overwrite arbitrary files via a redirect to a file:...

GLSA-200903-21 : cURL: Arbitrary file access

The remote host is affected by the vulnerability described in GLSA-200903-21 cURL: Arbitrary file access David Kierznowski reported that the redirect implementation accepts arbitrary Location values when CURLOPTFOLLOWLOCATION is enabled. Impact : A remote attacker could possibly exploit this...

Sql injection

Multiple SQL injection vulnerabilities in CelerBB 0.0.2, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 viewforum.php and 2 viewtopic.php...

CVE-2009-0037

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPTFOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to 1 trigger arbitrary requests to intranet servers, 2 read or overwrite arbitrary files via a redirect to a file:...

CVE-2009-0037

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPTFOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to 1 trigger arbitrary requests to intranet servers, 2 read or overwrite arbitrary files via a redirect to a file:...

CVE-2009-0037

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPTFOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to 1 trigger arbitrary requests to intranet servers, 2 read or overwrite arbitrary files via a redirect to a file:...

curl -- cURL/libcURL Location: Redirect URLs Security Bypass

Secunia reports: The security issue is caused due to cURL following HTTP Location: redirects to e.g. scp:// or file:// URLs which can be exploited by a malicious HTTP server to overwrite or disclose the content of arbitrary local files and potentially execute arbitrary commands via specially...

Sql injection

Multiple SQL injection vulnerabilities in DevelopItEasy Photo Gallery 1.2 allow remote attackers to execute arbitrary SQL commands via the 1 catid parameter to gallerycategory.php, 2 photoid parameter to galleryphoto.php, and the 3 username and 4 userpass parameters to admin/index.php. NOTE: some...

CVE-2009-0402

SQL injection vulnerability in client/newaccount.php in Domain Technologie Control DTC before 0.29.16 allows remote attackers to execute arbitrary SQL commands via the 1 familyname, 2 christname, 3 companyname, 4 iscompany, 5 email, 6 phone, 7 fax, 8 addr1, 9 addr2, 10 addr3, 11 zipcode, 12 city,...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the administration interface in Cisco IronPort Encryption Appliance 6.2.4 before 6.2.4.1.1, 6.2.5, 6.2.6, 6.2.7 before 6.2.7.7, 6.3 before 6.3.0.4, and 6.5 before 6.5.0.2; and Cisco IronPort PostX 6.2.1 before 6.2.1.1 and 6.2.2 before 6.2.2.3; allo...

CVE-2008-4242

ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery CSRF attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web...

FreeBSD Ports: konversation

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Debian Security Advisory DSA 1611-1 (afuse)

The remote host is missing an update to afuse announced via advisory DSA 1611-1. OpenVAS Vulnerability Test $Id: deb16111.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1611-1 afuse Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

NetApp Data ONTAP contains multiple vulnerabilities

Overview NetApp Data ONTAP contains multiple vulnerabilities. The most severe of these vulnerabilities may allow an attacker to execute commands, view sensitive data, or cause a system to crash. Description NetApp Data ONTAP contains multiple undisclosed vulnerabilities. --- Impact A remote,...