EUVD-2009-0672

Malware in sbrugna...

EUVD-2009-0674

Malware in sbrugna...

EUVD-2009-0677

Malware in sbrugna...

EUVD-2009-0678

Malware in sbrugna...

EUVD-2009-0679

Malware in sbrugna...

CVE-2009-0678

images/captcha.php in RavenNuke 2.30 allows remote attackers to obtain sensitive information via an aFonts array parameter value that does not correspond to a valid font file, which reveals the installation path in an error message...

CVE-2009-0679

Cross-site scripting XSS vulnerability in the Your Account module in RavenNuke 2.30 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-0672

SQL injection vulnerability in the ResendEmail module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary SQL commands via the userprefix parameter to modules.php...

CVE-2009-0677

avatarlist.php in the Your Account module, reached through modules.php, in Raven Web Services RavenNuke 2.30 allows remote authenticated users to execute arbitrary code via PHP sequences in an element of the replacements array, which is processed by the pregreplace function with the eval switch, ...

Sql injection

SQL injection vulnerability in the ResendEmail module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary SQL commands via the userprefix parameter to modules.php...

Design/Logic Flaw

images/captcha.php in RavenNuke 2.30 allows remote attackers to obtain sensitive information via an aFonts array parameter value that does not correspond to a valid font file, which reveals the installation path in an error message...

Code injection

avatarlist.php in the Your Account module, reached through modules.php, in Raven Web Services RavenNuke 2.30 allows remote authenticated users to execute arbitrary code via PHP sequences in an element of the replacements array, which is processed by the pregreplace function with the eval switch, ...

Design/Logic Flaw

Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary PHP code via the ID Field Name box in a yaCustomFields action to admin.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the Your Account module in RavenNuke 2.30 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-0679

Technical details (affected software, component, vectors, and impact) are not publicly available in the provided documents. Monitor for updates as new information may emerge.

CVE-2009-0673

CVE-2009-0673 describes an eval injection in RavenNuke 2.30’s Custom Fields within the Your Account module. The vulnerability allows remote authenticated administrators to execute arbitrary PHP code via the ID Field Name box in a yaCustomFields action to admin.php. Affected product/stack: Raven W...

CVE-2009-0672

SQL injection vulnerability in the ResendEmail module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary SQL commands via the userprefix parameter to modules.php...

CVE-2009-0677

The CVE-2009-0677 issue affects RavenNuke 2.30 (Your Account module, avatarlist.php, reachable via modules.php). It allows remote authenticated users to execute arbitrary code through PHP sequences in an element of the replacements array, which is processed by preg_replace with the eval switch as...

CVE-2009-0674

CVE-2009-0674 affects RavenNuke 2.30 (Raven Web Services). The vulnerability arises when register_globals and display_errors are enabled, allowing remote attackers to probe local file existence by sending requests with full paths in the aFonts array parameter and observing differing error message...

CVE-2009-0678

images/captcha.php in RavenNuke 2.30 allows remote attackers to obtain sensitive information via an aFonts array parameter value that does not correspond to a valid font file, which reveals the installation path in an error message...