CVE-2008-2511

Directory traversal vulnerability in the UmxEventCli.CachedAuditDataList.1 aka UmxEventCliLib ActiveX control in UmxEventCli.dll in CA Internet Security Suite 2008 allows remote attackers to create and overwrite arbitrary files via a .. dot dot in the argument to the SaveToFile method. NOTE: this...

Fedora 8 : libpng10-1.0.37-1.fc8 (2008-3937)

This update fixes the way that libpng10 handles unknown zero-length chunks, which in previous versions could result in writing to attacker controlled addresses, depending on how the libpng api is used. To be affected, an application would have to call pngsetkeepunknownchunks, which tells libpng n...

Fedora 7 : libpng10-1.0.37-1.fc7 (2008-3979)

This update fixes the way that libpng10 handles unknown zero-length chunks, which in previous versions could result in writing to attacker controlled addresses, depending on how the libpng api is used. To be affected, an application would have to call pngsetkeepunknownchunks, which tells libpng n...

Motorola Good Mobile Messaging insecure file deletion

Overview When formating removable storage cards, Motorola Good Mobile Messaging products may not properly delete old data. Description Motorola Good Mobile Messaging products can create encrypted containers on removable media storage cards. During the process of creating the container old...

Cross Site Scripting vulnerability in extension "KJ: Image Lightbox v2" (kj_imagelightbox2)

It has been discovered that the extension "KJ: Image Lightbox v2" kjimagelightbox2 is susceptible to Cross Site Scripting XSS attacks. Component Type: Third party extension. This extension is not part of the TYPO3 default installation. Affected Versions: Version 1.4.2 and below, possibly also all...

SQL Injection in extension "Library for Frontend plugins" (sg_zfelib)

It has been discovered that the extension "Library for Frontend plugins" sgzfelib is susceptible to SQL Injections. Component Type: Third party extension. This extension is not part of the TYPO3 default installation. Affected Versions: Version 1.1.512 and below Vulnerability Type: SQL Injection...

Multiple vulnerabilities in extension Frontend User Registration (sr_feuser_register)

It has been discovered that the extension Frontend User Registration srfeuserregister is susceptible to Cross Site Scripting XSS attacks and allows Remote Command Execution. Component Type: Third party extensions. These extensions are not part of the TYPO3 default installation. Affected Versions:...

Information disclosure

Unspecified vulnerability in the export feature in OpenKM before 2.0 allows remote attackers to export arbitrary documents via unspecified vectors. NOTE: some of these details are obtained from third party information...

Directory traversal

Multiple directory traversal vulnerabilities in PHP-Fusion Forum Rank System 6 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the settingslocale parameter to 1 forum.php and 2 profile.php in infusions/ranksystem/. NOTE: the provenance of this information i...

Sql injection

Multiple SQL injection vulnerabilities in SMartBlog aka SMBlog 1.3 allow remote attackers to execute arbitrary SQL commands via the 1 mois, 2 an, 3 jour, and 4 id parameters to index.php, and the 5 login parameter to gestion/logon.php, different vectors than CVE-2008-2183. NOTE: the provenance of...

CVE-2008-2181

Multiple cross-site scripting XSS vulnerabilities in search.php in cpLinks 1.03 allow remote attackers to inject arbitrary web script or HTML via the 1 searchtext and 2 searchcategory parameters. NOTE: the XSS reportedly occurs in a forced SQL error message. NOTE: some of these details are obtain...

Multiple vulnerabilities in extension WT Gallery (wt_gallery)

It has been discovered that the extension wtgallery is susceptible to Path Traversal and Cross Site Scripting XSS attacks. Besides that, it may disclose sensitive information. Component Type: Third party extension. This extension is not part of the TYPO3 default installation. Affected Versions:...

Multiple vulnerabilities in extension Statistics (ke_stats)

It has been discovered that the extension Statistics kestats is vulnerable to Blind SQL Injection attacks. Also, a Cross Site Scripting issue has been found. Component Type: Third party extension. This extension is not part of the TYPO3 default installation. Affected Versions: Version 0.1.2 and...

Cross Site Scripting vulnerability in extension Questionaire (pbsurvey)

It has been discovered that the extension Questionaire pbsurvey is susceptible to Cross Site Scripting XSS attacks. Component Type: Third party extension. This extension is not part of the TYPO3 default installation. Affected Versions: Version 1.2.0 and below Vulnerability Type: Cross Site...

Cross Site Scripting vulnerability in extension Event Database (rlmp_eventdb)

It has been discovered that the extension Event Database rlmpeventdb is susceptible to Cross Site Scripting XSS attacks. Component Type: Third party extension. This extension is not part of the TYPO3 default installation. Affected Versions: Version 1.1.1 and below Vulnerability Type: Cross Site...

Cross Site Scripting vulnerability in extension powermail

It has been discovered that the extension powermail is susceptible to Cross Site Scripting XSS attacks. Component Type: Third party extension. This extension is not part of the TYPO3 default installation. Affected Versions: Version 1.1.9 and all versions below Vulnerability Type: Cross Site...

Cross site scripting

Cross-site scripting XSS vulnerability in installControl.php3 in F5 FirePass 4100 SSL VPN 5.4.2-5.5.2 and 6.0-6.2 allows remote attackers to inject arbitrary web script or HTML via the query string. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

openSUSE 10 Security Update : audit (audit-5212)

A bug in the auditlogusercommand function could lead to a buffer overflow. No program in openSUSE uses that function. Third-party applications could be affected though CVE-2008-1628. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

CVE-2008-1988

Unrestricted file upload vulnerability in the fileupload function in core/misc.class.php in EncapsGallery 2.0.2 allows remote authenticated administrators to upload and execute arbitrary PHP files by uploading a file with an executable extension, then accessing it via a direct request to the file...

CVE-2008-1953

Cross-site scripting XSS vulnerability in the Sitedesigner before 1.1.5 search template in Magnolia Enterprise Edition allows remote attackers to inject arbitrary web script or HTML via the query parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from...