CVE-2006-5414

Barry Nauta BRIM before 1.2.1 allows remote authenticated users to read information from other users via a modified URL...

CVE-2006-5424: Undefined Security Weakness

Unspecified vulnerability in Justsystem Ichitaro 2006, 2006 trial version, and Government 2006 allows remote attackers to execute arbitrary code via a modified document, possibly because of a buffer overflow, a different vulnerability than CVE-2006-4326...

CVE-2006-5414: Undefined Security Weakness

Barry Nauta BRIM before 1.2.1 allows remote authenticated users to read information from other users via a modified URL...

Security Update for Excel 2002 (KB923089)

A security vulnerability exists in Microsoft Excel 2002 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Security Update for Excel 2003 (KB923088)

A security vulnerability exists in Microsoft Office Excel 2003 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

CVE-2006-4586

The admin panel in Tr Forum 2.0 accepts a username and password hash for authentication, which allows remote authenticated users to perform unauthorized actions, as demonstrated by modifying user settings via the id parameter to /membres/modifprofil.php, and changing a password via...

CVE-2006-4588

vtiger CRM 4.2.4, and possibly earlier, allows remote attackers to bypass authentication and access administrative modules via a direct request to index.php with a modified module parameter, as demonstrated using the Settings module...

CVE-2006-4549

CHXO Feedsplitter 2006-01-21 allows remote attackers to read the source code of feedsplitter.php via the showsource function. NOTE: this issue is not a vulnerability in standard distributions, but could be an issue if the source has been modified...

CVE-2006-4210

numail.inc.php in Andreas Kansok phPay 2.02 and 2.02.1, when registerglobals is enabled, allows remote attackers to use the server as an open mail relay via modified mailtext2, userrow5, numail1, and shopmail parameters. NOTE: some of these details are obtained from third party information...

PHP-Nuke INP XSS

---------------------------------------------------------- Aria-Security.net Advisory Discovered by: l2odon www.Aria-security.net Gr33t to: O.U.T.L.A.W & A.u.r.a & DrtRp & Cl0wn ----------------------------------------------------------- Software: PHP-Nuke INP Description: PHP-Nuke INP is the...

Directory traversal

Absolute path directory traversal vulnerability in 1 MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and 2 VisNetic MailServer before 8.5.0.5 allows remote authenticated users to include arbitrary files via a modified language parameter and a full Windows or UNC pathname i...

CVE-2006-3205

Ultimate PHP Board UPB 1.9.6 and earlier allows remote attackers to gain access via modified userenv, passenv, powerenv, and idenv parameters in a cookie, which comprise a persistent logon that does not vary across sessions...

Default credentials

Dmx Forum 2.1a allows remote attackers to obtain username and password information via a direct request to pops/edit.php with a modified membre parameter...

Design/Logic Flaw

links.asp in aspWebLinks 2.0 allows remote attackers to change the administrative password, possibly via a direct request with a modified txtAdministrativePassword field...

CVE-2006-2848

links.asp in aspWebLinks 2.0 allows remote attackers to change the administrative password, possibly via a direct request with a modified txtAdministrativePassword field...

CVE-2006-2794

Hesabim.asp in ASPSitem 2.0 and earlier allows remote attackers to read private messages of other users via a modified id parameter...

Directory traversal

Unspecified vulnerability in Secure Elements Class 5 AVR client and server aka C5 EVM before 2.8.1 allows authenticated attackers to overwrite arbitrary files 1 on a server during an update or 2 on a client via modified pathnames, possibly due to a directory traversal issue...

Code injection

phpFoX allows remote authenticated users to modify arbitrary accounts via a modified NATIO cookie value, possibly the phpfoxuser parameter...

Cross site scripting

Bitrix Site Manager 4.1.x allows remote attackers to redirect users to other websites via a modified backurl during a HTTP POST request. NOTE: this issue has been referred to as "cross-site scripting," but that is inconsistent with the common use of the term...

CVE-2006-2478

Bitrix Site Manager 4.1.x allows remote attackers to redirect users to other websites via a modified backurl during a HTTP POST request. NOTE: this issue has been referred to as "cross-site scripting," but that is inconsistent with the common use of the term...