CVE-2008-1469

Gallarific Free Edition 1.1 does not require authentication for 1 photos.php, 2 comments.php, and 3 gallery.php in gadmin/, which allows remote attackers to edit objects via a direct request, different vectors than CVE-2008-1327. NOTE: the provenance of this information is unknown; the details ar...

[SECURITY] Fedora 7 Update: krb5-1.6.1-9.fc7

Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of cleartext passwords...

Cross site scripting

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine SupportCenter Plus 7.0.0 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter, a related issue to CVE-2008-1299. NOTE: the provenance of this information is unknown; the details are...

HPSBST02321 SSRT080029 rev.1 - HP StorageWorks Library and Tape Tools (LTT) Running on HP-UX, Local Unauthorized Access

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01399648 Version: 1 HPSBST02321 SSRT080029 rev.1 - HP StorageWorks Library and Tape Tools LTT Running on HP-UX, Local Unauthorized Access NOTICE: The information in this Security Bulletin should ...

7-Zip < 4.57 Archive Handling Unspecified Issue

The remote host contains a version of the open source 7-Zip file archiver and included in third-party products such as Knownsoft's Turbo Searcher. The version of 7-Zip installed on the remote host reportedly is affected by an as-yet unspecified vulnerability involving archive handling. C Tenable...

Information disclosure

MRcgi/MRProcessIncomingForms.pl in Numara FootPrints 8.1 on Linux allows remote attackers to execute arbitrary code via shell metacharacters in the PROJECTNUM parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-1212

Cross-site scripting XSS vulnerability in setpermissions.php in Podcast Generator 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the scriptlang parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-1211

Cross-site scripting XSS vulnerability in BosDates 3.x and 4.x allows remote attackers to inject arbitrary web script or HTML via 1 the type parameter in calendar.php and 2 the category parameter in calendarsearch.php. NOTE: the provenance of this information is unknown; the details are obtained...

Sql injection

Multiple SQL injection vulnerabilities in wppa.php in the WP Photo Album WPPA before 1.1 plugin for WordPress allow remote attackers to execute arbitrary SQL commands via 1 the photo parameter to index.php, used by the wppaphotoname function; or 2 the album parameter to index.php, used by the...

LookStrike Lan Manager 0.9 - Local/Remote File Inclusion

--==+================================================================================+==-- --==+ LookStrike Lan Manager v0.9 Remote\Local File Inclusion +==-- --==+================================================================================+==-- Author: MhZ91 Title: LookStrike Lan Manager v0....

lookstrike-rfilfi.txt

--==+================================================================================+==-- --==+ LookStrike Lan Manager v0.9 Remote\Local File Inclusion +==-- --==+================================================================================+==-- Author: MhZ91 Title: LookStrike Lan Manager v0....

LookStrike Lan Manager 0.9 - LocalRemote File Inclusion

LookStrike Lan Manager 0.9 - LocalRemote File Inclusion --==+================================================================================+==-- --==+ LookStrike Lan Manager v0.9 Remote\Local File Inclusion +==--...

CVE-2008-0757

Cross-site scripting XSS vulnerability in index.php in MercuryBoard 1.1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter aka the message text area, which leads to an injection in the messenger during private message PM preview. NOTE: some of these details...

Sql injection

Multiple SQL injection vulnerabilities in CandyPress CP 4.1.1.26, and earlier 4.1.x versions, allow remote attackers to execute arbitrary SQL commands via the 1 idcust parameter to a ajaxgetTiers.asp and b ajaxgetCust.asp in ajax/, and the 2 tableName parameter to c ajax/ajaxtableFields.asp. NOTE...

Design/Logic Flaw

Mobile Safari on Apple iPhone 1.1.2 and 1.1.3 allows remote attackers to cause a denial of service memory exhaustion and device crash via certain JavaScript code that constructs a long string and an array containing long string elements, possibly a related issue to CVE-2006-3677. NOTE: some of...

CVE-2008-0722

Cross-site scripting XSS vulnerability in index.php in Pagetool 1.0.7 allows remote attackers to inject arbitrary web script or HTML via the searchterm parameter in a pagetoolsearch action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2008-0722

Cross-site scripting XSS vulnerability in index.php in Pagetool 1.0.7 allows remote attackers to inject arbitrary web script or HTML via the searchterm parameter in a pagetoolsearch action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

Sql injection

SQL injection vulnerability in login.php in Simple OS CMS 0.1c beta allows remote attackers to execute arbitrary SQL commands via the username field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in Uniwin eCart Professional before 2.0.16 allows remote attackers to inject arbitrary web script or HTML via the rp parameter to cartView.asp and unspecified other components. NOTE: the provenance of this information is unknown; the details are obtained...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in SoftCart.exe in SoftCart 5.1.2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 LicensePlate, 2 LicenseState, 3 TicketDate, and 4 TicketNumber parameters. NOTE: the provenance of this information is unknown; the details...