CVE-2008-3851

Multiple directory traversal vulnerabilities in Pluck CMS 4.5.2 on Windows allow remote attackers to include and execute arbitrary local files via a ..\ dot dot backslash in the 1 blogpost, 2 cat, and 3 file parameters to data/inc/themes/predefinedvariables.php, as reachable through index.php; an...

HPSystem Management Homepage (SMH) 2.1.12 - 'message.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/30846/info HP System Management Homepage SMH is prone to a cross-site scripting vulnerability. Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected site. As a...

Authentication flaw

The management console in the Volume Manager Scheduler Service aka VxSchedService.exe in Symantec Veritas Storage Foundation for Windows SFW 5.0, 5.0 RP1a, and 5.1 accepts NULL NTLMSSP authentication, which allows remote attackers to execute arbitrary code via requests to the service socket that...

CVE-2008-3703

The management console in the Volume Manager Scheduler Service aka VxSchedService.exe in Symantec Veritas Storage Foundation for Windows SFW 5.0, 5.0 RP1a, and 5.1 accepts NULL NTLMSSP authentication, which allows remote attackers to execute arbitrary code via requests to the service socket that...

zlib DoS

zlib 1.2 and later versions allows remote attackers to cause a denial of service crash via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file...

Citrix Metaframe Privilege escalation

Autorun item path is not fully specified...

PHP multibyte shell escape flaw

The escapeshellcmd API function in PHP before 5.2.6 has unknown impact and context-dependent attack vectors related to "incomplete multibyte chars."...

CVE-2008-3215

libclamav/petite.c in ClamAV before 0.93.3 allows remote attackers to cause a denial of service via a malformed Petite file that triggers an out-of-bounds memory access. NOTE: this issue exists because of an incomplete fix for CVE-2008-2713...

CVE-2008-3215

libclamav/petite.c in ClamAV before 0.93.3 allows remote attackers to cause a denial of service via a malformed Petite file that triggers an out-of-bounds memory access. NOTE: this issue exists because of an incomplete fix for CVE-2008-2713...

CVE-2008-3215

libclamav/petite.c in ClamAV before 0.93.3 allows remote attackers to cause a denial of service via a malformed Petite file that triggers an out-of-bounds memory access. NOTE: this issue exists because of an incomplete fix for CVE-2008-2713...

PHP multibyte shell escape flaw

The escapeshellcmd API function in PHP before 5.2.6 has unknown impact and context-dependent attack vectors related to "incomplete multibyte chars."...

CVE-2008-3140

The syslog dissector in Wireshark formerly Ethereal 1.0.0 allows remote attackers to cause a denial of service application crash via unknown vectors, possibly related to an "incomplete SS7 MSU syslog encapsulated packet."...

CVE-2008-3140

The syslog dissector in Wireshark formerly Ethereal 1.0.0 allows remote attackers to cause a denial of service application crash via unknown vectors, possibly related to an "incomplete SS7 MSU syslog encapsulated packet."...

Design/Logic Flaw

Incomplete blacklist vulnerability in the KB Unpack kbunpack extension 0.1.0 and earlier for TYPO3 has unknown impact and attack vectors...

CVE-2008-3046

CVE-2008-3046 concerns an incomplete blacklist vulnerability in the TYPO3 Packman (kb_packman) extension for version

CVE-2008-3047

TYPO3 kb_unpack extension (versions 0.1.0 and earlier) is affected by an incomplete blacklist vulnerability. The provided documents identify the product and vulnerable component but do not specify the exact impact or attack vectors beyond that the impact is unknown. No remediation details are des...

CVE-2008-3047

Incomplete blacklist vulnerability in the KB Unpack kbunpack extension 0.1.0 and earlier for TYPO3 has unknown impact and attack vectors...

Input validation

Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X before 10.5.4 allows user-assisted remote attackers to execute arbitrary code via a 1 .xht or 2 .xhtm file, which does not trigger a "potentially unsafe" warning message in a the Download Validation feature in Mac OS X 10.4 or b th...

CVE-2008-2309

The CVE-2008-2309 entry concerns Apple Mac OS X before 10.5.4, with an Incomplete blacklist vulnerability in CoreTypes. A user-assisted remote attacker could run arbitrary code by providing a .xht or .xhtm file, which would not trigger potential‑unsafe warnings in Mac OS X components: Download Va...

TYPO3 Security Bulletin

Several vulnerabilities have been found in TYPO3 third party extensions. Please read first: This Collective Security Bulletin CSB is a listing of vulnerable extensions with neither significant download numbers nor other special importance amongst the TYPO3 Community. The intention of CSBs is to...