CVE-2006-2782

Firefox 1.5.0.2 does not fix all test cases associated with CVE-2006-1729, which allows remote attackers to read arbitrary files by inserting the target filename into a text box, then turning that box into a file upload control...

Design/Logic Flaw

Incomplete blacklist vulnerability in Ideal Science Ideal BB 1.5.4a and earlier allows remote attackers to upload and execute an ASP script via a ".asa" file, which bypasses the check for the ".asp" extension but is executable on the server...

CVE-2006-2318

CVE-2006-2318 affects Ideal Science Ideal BB versions up to 1.5.4a. The flaw is an incomplete blacklist that allows a remote attacker to upload and execute an ASP script by uploading a ".asa" file, bypassing the ".asp" extension check but executable on the server. The NVD entry cites a CVSSv2 bas...

Ubuntu 4.10 / 5.04 / 5.10 : mysql-dfsg vulnerability (USN-274-1)

A logging bypass was discovered in the MySQL query parser. A local attacker could exploit this by inserting NUL characters into query strings even into comments, which would cause the query to be logged incompletely. This only affects you if you enabled the 'log' parameter in the MySQL...

Important: Red Hat Security Advisory: kdegraphics security update

Updated kdegraphics packages that fully resolve a security issue in kpdf are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The kdegraphics packages contain applications for the K Desktop Environment including kpdf, a PDF file...

CVE-2006-0786

The CVE-2006-0786 entry concerns PHP-Kit prior to 1.6.1 Release 2, where include.php contains an incomplete blacklist vulnerability. When allow_url_fopen is enabled, an attacker can perform PHP remote file include attacks by passing a path parameter that points to a (1) UNC share or (2) ftps URL,...

Counter Strike (Half Life) game servers DoS

Incomplete client request leads to endless loop...

CVE-2005-3973

Multiple cross-site scripting XSS vulnerabilities in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allow remote attackers to inject arbitrary web script or HTML via various HTML tags and values, such as the 1 legend tag and the value parameter used in 2 label and 3 input tags, possibly due t...

CVE-2002-2175

phpSquidPass before 0.2 uses an incomplete regular expression to find a matching username in its database, which allows remote authenticated attackers to effectively delete other usernames via a short username that matches the end of the targeted username...

CVE-2002-2175

The vulnerability (CVE-2002-2175) affects phpSquidPass prior to 0.2. It stems from an incomplete regular expression used to match usernames in the database, enabling remote authenticated attackers to delete other usernames by supplying a short username that matches the end of the targeted usernam...

Incomplete Basic Authentication DoS Vulnerability

It was possible to kill the web server by sending an invalid request with an incomplete Basic authentication. SPDX-FileCopyrightText: 2004 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier...

CVE-2005-2959

CVE-2005-2959 concerns sudo 1.6.8 and earlier, where the SHELLOPTS and PS4 environment variables are not cleared during privilege-escalation prompts. The result is a local privilege escalation when a user with limited sudo privileges runs a bash script, as these variables can be passed through to...

CVE-2005-2959

Incomplete blacklist vulnerability in sudo 1.6.8 and earlier allows local users to gain privileges via the 1 SHELLOPTS and 2 PS4 environment variables before executing a bash script on behalf of another user, which are not cleared even though other variables are...

DEBIAN-CVE-2005-3256

The key selection dialogue in Enigmail before 0.92.1 can incorrectly select a key with a user ID that does not have additional information, which allows parties with that key to decrypt the message...

CVE-2005-3167

Incomplete blacklist vulnerability in MediaWiki before 1.4.11 does not properly remove certain CSS inputs HTML inline style attributes that are processed as active content by Internet Explorer, which allows remote attackers to conduct cross-site scripting XSS attacks...

CVE-2005-3167

The CVE-2005-3167 entry concerns MediaWiki before 1.4.11 with an incomplete blacklist that fails to remove CSS inputs (HTML inline style attributes). This allows remote attackers to execute cross-site scripting (XSS) via Internet Explorer, as the inputs are processed as active content. The vulner...

CVE-2005-3167

Incomplete blacklist vulnerability in MediaWiki before 1.4.11 does not properly remove certain CSS inputs HTML inline style attributes that are processed as active content by Internet Explorer, which allows remote attackers to conduct cross-site scripting XSS attacks...

security flaw

slocate before 2.7 does not properly process very long paths, which allows local users to cause a denial of service updatedb exit and incomplete slocate database via a certain crafted directory structure...

Mandrake Linux Security Advisory : slocate (MDKSA-2005:147)

A bug was discovered in the way that slocate processes very long paths. A local user could create a carefully crafted directory structure that would prevent updatedb from completing its filesystem scan, resulting in an incomplete database. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

CVE-2005-2885

The Downloads page in MAXdev MD-Pro 1.0.73, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which could allow remote attackers to bypass file extension checks and execute arbitrary commands by uploading a file with a different extension, as...