CVE-2005-2411

Cross-Site Request Forgery CSRF vulnerability in tDiary 2.1.1, and tDiary 2.0.1 and earlier, allows remote attackers to conduct actions as another user, and execute commands on the server, via a URL that is activated by the user...

CVE-2005-2411

Cross-Site Request Forgery CSRF vulnerability in tDiary 2.1.1, and tDiary 2.0.1 and earlier, allows remote attackers to conduct actions as another user, and execute commands on the server, via a URL that is activated by the user...

CVE-2001-1487

popauth utility in Qualcomm Qpopper 4.0 and earlier allows local users to overwrite arbitrary files and execute commands as the pop user via a symlink attack on the -trace file option...

CVE-2004-1806

CFWebStore CFWebStore 5.0.x is vulnerable to SQL injection in index.cfm via the parameters category_id, product_id, or feature_id. The root cause is unsafe SQL construction, enabling remote attackers to run arbitrary SQL and potentially gain administrative access on affected hosts. The assessment...

Apple Terminal fails to properly sanitize input for "x-man-page" URI

Overview Apple Terminal on Mac OS X fails to sanitize x-man-page URIs, allowing an attacker to execute arbitrary commands. Description Mac OS X 10.3 includes a URI handler called x-man-page. It causes Apple Terminal to display a man page by using a URI of this form: x-man-page://command...

CVE-2005-0019

Unknown vulnerability in hztty 2.0 and earlier allows local users to execute arbitrary commands...

CVE-2004-1710

page.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the url parameter...

CVE-2004-1562

SQL injection vulnerability in redirurl.php in w-Agora 4.1.6a allows remote attackers to execute arbitrary SQL commands via the key parameter...

CVE-2004-1654

SQL injection vulnerability in the calendar module in phpWebsite 0.9.3-4 and earlier allows remote attackers to execute arbitrary SQL commands via caltemplate...

CVE-2005-0252

SQL injection vulnerability in BibORB 1.3.2, and possibly earlier versions, allows remote attackers to execute arbitrary SQL commands via the 1 Username or 2 Password...

CVE-2005-0273

Multiple SQL injection vulnerabilities in showgallery.php in PhotoPost before 4.86 allow remote attackers to execute arbitrary SQL commands via the 1 cat or 2 ppuser parameter...

CVE-2005-0015

diatheke.pl in Sword 1.5.7a allows remote attackers to execute arbitrary commands via shell metacharacters in a URL...

CVE-2005-0113

inpview in SGI IRIX allows local users to execute arbitrary commands via the SUNTTSESSIONCMD environment variable, which is executed by inpview without dropping privileges...

CVE-2004-2542

Multiple SQL injection vulnerabilities in Dynix formerly known as epixtech WebPAC allow remote attackers to execute arbitrary SQL commands via unknown attack vectors, resulting in an ability to execute stored procedures, bypass login authentication, and cause an unspecified denial of service to...

CVE-2004-1456

filediff in CVStrac allows remote attackers to execute arbitrary commands via shell metacharacters in rcsinfo...

USN-52-1: vim vulnerability

Ciaran McCreesh found several vulnerabilities related to the use of options in Vim modeline commands, such as 'termcap', 'printdevice', 'titleold', 'filetype', 'syntax', 'backupext', 'keymap', 'patchmode', and 'langmenu'. If an attacker tricked an user to open a file with a specially crafted...

Oracle Database Server 8.1.79.0.x - ctxsys.driload Access Validation

Oracle Database Server 8.1.79.0.x - ctxsys.driload Access Validation source: https://www.securityfocus.com/bid/11099/info Oracle Database Server is prone to an access validation vulnerability that may permit unprivileged users to execute commands as the DBA. This could compromise the database. SQ...

ifmail -- unsafe set-user-ID application

Niels Heinen reports that ifmail allows one to specify a configuration file. Since ifmail runs set-user-ID news', this may allow a local attacker to write to arbitrary files or execute arbitrary commands as the news' user...

CVE-2004-1710

page.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the url parameter...

RHEL 2.1 : ghostscript (RHSA-2002:123)

Updated packages are available for GNU Ghostscript, which fix a vulnerability found during PostScript interpretation. Ghostscript is a program for displaying PostScript files or printing them to non-PostScript printers. An untrusted PostScript file can cause ghostscript to execute arbitrary...