EUVD-2009-0674

Malware in sbrugna...

EUVD-2009-0677

Malware in sbrugna...

EUVD-2009-0672

Malware in sbrugna...

EUVD-2009-0679

Malware in sbrugna...

EUVD-2009-0678

Malware in sbrugna...

CVE-2009-0679

Cross-site scripting XSS vulnerability in the Your Account module in RavenNuke 2.30 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-0678

images/captcha.php in RavenNuke 2.30 allows remote attackers to obtain sensitive information via an aFonts array parameter value that does not correspond to a valid font file, which reveals the installation path in an error message...

Sql injection

SQL injection vulnerability in the ResendEmail module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary SQL commands via the userprefix parameter to modules.php...

CVE-2009-0672

SQL injection vulnerability in the ResendEmail module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary SQL commands via the userprefix parameter to modules.php...

CVE-2009-0677

avatarlist.php in the Your Account module, reached through modules.php, in Raven Web Services RavenNuke 2.30 allows remote authenticated users to execute arbitrary code via PHP sequences in an element of the replacements array, which is processed by the pregreplace function with the eval switch, ...

Design/Logic Flaw

Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary PHP code via the ID Field Name box in a yaCustomFields action to admin.php...

Design/Logic Flaw

images/captcha.php in RavenNuke 2.30 allows remote attackers to obtain sensitive information via an aFonts array parameter value that does not correspond to a valid font file, which reveals the installation path in an error message...

Code injection

avatarlist.php in the Your Account module, reached through modules.php, in Raven Web Services RavenNuke 2.30 allows remote authenticated users to execute arbitrary code via PHP sequences in an element of the replacements array, which is processed by the pregreplace function with the eval switch, ...

Cross site scripting

Cross-site scripting XSS vulnerability in the Your Account module in RavenNuke 2.30 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-0679

Cross-site scripting XSS vulnerability in the Your Account module in RavenNuke 2.30 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-0678

CVE-2009-0678 affects RavenNuke 2.30. The vulnerability in images/captcha.php arises from an aFonts array parameter value that does not map to a valid font file, causing an error message that reveals the installation path. The NVD entry lists a base CVSSv2 score of 5.0 (Medium) with network attac...

CVE-2009-0678

images/captcha.php in RavenNuke 2.30 allows remote attackers to obtain sensitive information via an aFonts array parameter value that does not correspond to a valid font file, which reveals the installation path in an error message...

CVE-2009-0672

SQL injection vulnerability in the ResendEmail module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary SQL commands via the userprefix parameter to modules.php...

CVE-2009-0679

Technical details (affected software, component, vectors, and impact) are not publicly available in the provided documents. Monitor for updates as new information may emerge.

CVE-2009-0672

The CVE shows a SQL injection in the RavenNuke 2.30 Resend_Email module, exploitable via the user_prefix parameter to modules.php. Affected component: Raven Web Services (Resend_Email). Root cause: improper handling of user_prefix leads to arbitrary SQL commands when accessed by remote authentica...