Cross site scripting

Opera before 9.64 allows remote attackers to conduct cross-domain scripting attacks via unspecified vectors related to plug-ins...

CVE-2009-0037

CVE-2009-0037 affects curl/libcurl 5.11–7.19.3 when CURLOPT_FOLLOWLOCATION is enabled. The redirect code accepts arbitrary Location values, allowing: (1) triggering requests to intranet servers, (2) reading/writing files via file: URLs, and (3) executing commands via scp: URLs. Affected platforms...

Cross site scripting

Cross-site scripting XSS vulnerability in default.asp in Ocean12 Contact Manager Pro 1.02 allows remote attackers to inject arbitrary web script or HTML via the DisplayFormat parameter...

CVE-2008-6332

SQL injection vulnerability in login.php in Simple Customer 1.2 allows remote attackers to execute arbitrary SQL commands via the password parameter...

CVE-2008-6320

SQL injection vulnerability in index.cfm in CF Shopkart 5.2.2 allows remote attackers to execute arbitrary SQL commands via the Category parameter in a ViewCategory action...

CVE-2009-0522

CVE-2009-0522 affects Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 on Windows, where an attacker could trick a user into visiting an arbitrary URL via manipulation of the mouse pointer display (a clickjacking-like issue). Multiple connected sources corroborate the Windows-sp...

CVE-2009-0646

Multiple SQL injection vulnerabilities in 4Site CMS 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 login and 2 password parameters to pcgi/4site.pl, 3 page parameter to print/print.shtml, 4 s and 5 i parameters to portfolio/index.shtml, 6 h parameter to...

CVE-2009-0526

AdaptCMS Lite (1.4; and 1.5 per OpenVAS) is affected by multiple cross-site scripting (XSS) vulnerabilities and a remote file-include vulnerability due to insufficient sanitization of user-supplied data in index.php. The issues allow injecting arbitrary script/HTML via the url, acuparam, and the ...

RedHat Security Advisory RHSA-2009:0257

The remote host is missing updates announced in advisory RHSA-2009:0257. SeaMonkey is an open source Web browser, email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause...

CVE-2009-0478

Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request with an invalid version number, which triggers a reachable assertion in 1 HttpMsg.c and 2 HttpStatusLine.c...

CVE-2009-0418

The IPv6 Neighbor Discovery Protocol NDP implementation in HP HP-UX B.11.11, B.11.23, and B.11.31 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service loss of connectivity, read private network traffic, and possibly execute...

CVE-2009-0352

Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via vectors related to the layout engin...

CVE-2009-0409

SQL injection vulnerability in offlineauth.php in Max.Blog 1.0.6 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2009-0398

Array index error in the gstqtptrakhandler function in gst/qtdemux/qtdemux.c in GStreamer Plug-ins aka gstreamer-plugins 0.6.0 allows remote attackers to have an unknown impact via a crafted QuickTime media file...

Sql injection

Multiple SQL injection vulnerabilities in Jetik Emlak Sistem A ESA 2.0 allow remote attackers to execute arbitrary SQL commands via the KayitNo parameter to 1 diger.php and 2 sayfalar.php...

Memory corruption

The Word processor in OpenOffice.org 1.1.2 through 1.1.5 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted 1 .doc, 2 .wri, or 3 .rtf Word 97 file that triggers memory corruption, as exploited in the wild in December 2008, as demonstrated ...

CVE-2009-0041

IAX2 in Asterisk Open Source 1.2.x before 1.2.31, 1.4.x before 1.4.23-rc4, and 1.6.x before 1.6.0.3-rc2; Business Edition A.x.x, B.x.x before B.2.5.7, C.1.x.x before C.1.10.4, and C.2.x.x before C.2.1.2.1; and s800i 1.2.x before 1.3.0 responds differently to a failed login attempt depending on...

CVE-2008-5888

Multiple SQL injection vulnerabilities in Click&Rank allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 hitcounter.asp, 2 userdelete.asp, and 3 userupdate.asp; 4 the userid parameter to adminlogin.asp aka the USERNAME field in admin.asp; and 5 the PassWord paramete...

CVE-2008-5252

Cross-site request forgery CSRF vulnerability in the Special:Import feature in MediaWiki 1.3.0 through 1.6.10, 1.12.x before 1.12.2, and 1.13.x before 1.13.3 allows remote attackers to perform unspecified actions as authenticated users via unknown vectors...

Code injection

Unspecified vulnerability in Adobe Flash Player for Linux 10.0.12.36, and 9.0.151.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file...