CVE-2006-4799

Buffer overflow in ffmpeg for xine-lib before 1.1.2 might allow context-dependent attackers to execute arbitrary code via a crafted AVI file and "bad indexes", a different vulnerability than CVE-2005-4048 and CVE-2006-2802...

CVE-2006-4799

CVE-2006-4799 is a buffer overflow in ffmpeg for xine-lib prior to 1.1.2 that could allow context-dependent attackers to execute arbitrary code via a crafted AVI file and bad indexes. Documents provided include NVD data (base score 7.5, network vector, no authentication, partial confidentiality/i...

CVE-2006-4799: Undefined Security Weakness

Buffer overflow in ffmpeg for xine-lib before 1.1.2 might allow context-dependent attackers to execute arbitrary code via a crafted AVI file and "bad indexes", a different vulnerability than CVE-2005-4048 and CVE-2006-2802...

CVE-2006-4785: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in blog/edit.php in Moodle 1.6.1 and earlier allows remote attackers to execute arbitrary SQL commands via the format parameter as stored in the $blogEntry variable, which is not properly handled by the insertrecord function, which calls adodbcolumnsql in the adodb lay...

xine-lib: Buffer overflows

Background xine is a high performance, portable and reusable multimedia playback engine. xine-lib is xine's core engine. Description xine-lib contains buffer overflows in the processing of AVI. Additionally, xine-lib is vulnerable to a buffer overflow in the HTTP plugin xinepluginphttp.so via a...

CVE-2006-4675: Undefined Security Weakness

Unrestricted file upload vulnerability in lib/exe/media.php in DokuWiki before 2006-03-09c allows remote attackers to upload executable files into the data/media folder via unspecified vectors...

CVE-2006-4531

Vulnerability: PHP remote file inclusion in Pheap CMS 1.1 and earlier. Product: Pheap CMS, file lib/config.php; vector: lpref parameter taking a URL to include, enabling remote PHP code execution. Impact: potential arbitrary PHP execution on affected installations. Root cause: unsafely including ...

CVE-2006-4531: Undefined Security Weakness

PHP remote file inclusion vulnerability in lib/config.php in Pheap CMS 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the lpref parameter...

CVE-2006-4204: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in PHProjekt 5.1 and possibly earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 pathpre parameter in lib/specialdays.php and the 2 libpath parameter in lib/dbmanfilter.inc.php...

CVE-2006-4076: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Wim Fleischhauer docpile: wim's edition docpile:we 0.2.2 allow remote attackers to execute arbitrary PHP code via a URL in the INITPATH parameter to 1 lib/access.inc.php, 2 lib/folders.inc.php, 3 lib/init.inc.php or 4 lib/templates.inc.php...

SQLiteWebAdmin 0.1 - 'tpl.inc.php' Remote File Inclusion

SQLiteWebAdmin http://sourceforge.net/projects/sqlitewebadmin SQLiteWebAdmin is a simple PHP program for administrating a SQL DataBase. It suffers of a Remote File Inclusion Vulnerability. The bug is in the "tpl.inc.php" program in the "lib" directory, and is exploited when passing the parameter...

SQLiteWebAdmin 0.1 (tpl.inc.php) Remote Include Vulnerability

Exploit for unknown platform in category web applications ============================================================= SQLiteWebAdmin 0.1 tpl.inc.php Remote Include Vulnerability ============================================================= SQLiteWebAdmin...

phpAuction 2.1 - 'phpAds_path' Remote File Inclusion

+-------------------------------------------------------------------- + + PHPAuction 2.1 Remote File Inclusion + +-------------------------------------------------------------------- + + Affected Software .: PHPAuction 2.1 maybe higher + Venedor ...........: http://www.phpauction.net, + Class...

Slackware 10.2 / current : xine-lib (SSA:2006-207-04)

New xine-lib packages are available for Slackware 10.2 and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2006-207-04. The text itself is copyright C...

[slackware-security] xine-lib

New xine-lib packages are available for Slackware 10.2 and -current to fix security issues. More details about these issues may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2005-4048 https://vulners.com/cve/CVE-2006-2802 Evidently there is also an...

GLSA-200607-07 : xine-lib: Buffer overflow

The remote host is affected by the vulnerability described in GLSA-200607-07 xine-lib: Buffer overflow There is a stack based overflow in the libmms library included with xine-lib which can be triggered by malicious use of the sendcommand, stringutf16, getdata and getmediapacket functions. Impact...

CVE-2006-3756: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Geeklog 1.4.0sr4 and earlier, and 1.3.11sr6 and earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when validating comments in 1 lib-comment.php 1.4.0sr4 or 2 comment.php 0.3.11sr6...

Mandrake Linux Security Advisory : xine-lib (MDKSA-2006:121)

Stack-based buffer overflow in MiMMS 0.0.9 allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via the 1 sendcommand, 2 stringutf16, 3 getdata, and 4 getmediapacket functions, and possibly other functions. Xine-lib contains an embedded copy o...

CVE-2006-3306

CVE-2006-3306 affects Project EROS bbsengine (lib/common.php, preparestring) with an XSS flaw. The vulnerability is in the preparestring function and could allow remote attackers to inject arbitrary web script or HTML; affected versions include before 20060501-0142-jam and possibly earlier since ...

CVE-2006-3306: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the preparestring function in lib/common.php in Project EROS bbsengine before 20060501-0142-jam, and possibly earlier versions dating back to 2006-02-23, might allow remote attackers to inject arbitrary web script or HTML via unknown vectors...