CVE-2006-3305

Multiple cross-site scripting XSS vulnerabilities in UebiMiau Webmail 2.7.10, and 2.7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 fuser parameter in index.php, the 2 pag parameter in messages.php, or the 3 lid, 4 tid, and 5 sid parameters in error.php...

CVE-2006-3245

Multiple cross-site scripting XSS vulnerabilities in activatemember in mvnForum 1.0 GA and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 member and 2 activatecode parameters...

CVE-2006-3145

Buffer overflow in pamtofits of NetPBM 10.30 through 10.33 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code when assembling the header, possibly related to an off-by-one error...

CVE-2006-3087

CVE-2006-3087 involves multiple cross-site scripting (XSS) vulnerabilities in EZGallery 1.5 and earlier. The flaws allow remote attackers to inject arbitrary web script or HTML via parameters in three scripts: (a) common/galleries.asp (pUserID, aid, aname, uid, m); (b) common/pupload.asp (aid, an...

CVE-2006-2920

Sylpheed-Claws before 2.2.2 and Sylpheed before 2.2.6 allow remote attackers to bypass the URI check functionality and makes it easier to conduct phishing attacks via a URI that begins with a space character...

CVE-2006-2755

CVE-2006-2755 is a cross-site scripting (XSS) vulnerability affecting UBBThreads 5.x and earlier, where the index.php script uses the debug parameter insecurely. The underlying issue is unsafely handling the debug input in UBBThreads, enabling remote attackers to inject arbitrary web script or HT...

Directory traversal

Directory traversal vulnerability in index.php in PhpMyDesktop|arcade 1.0 FINAL allows remote attackers to read arbitrary files or execute PHP code via a .. dot dot sequence and trailing null %00 byte in the subsite parameter in a showsubsite todo...

CVE-2006-2714

Secure Elements Class 5 AVR client aka C5 EVM before 2.8.1 does not validate the CEID of an incoming message, which allows remote attackers to send messages to a protected asset without knowing the proper CEID...

D-Link DSA-3100 Cross-Site Scripting

D-Link DSA-3100 Cross-Site Scripting Tested on D-Link DSA-3100 Discovered by: jaime.blascoateazeldot.es http://www.eazel.es Description: D-Link DSA-3100 Airspot Gateway is vulnerable to a security vulnerability that allow Cross-Site Scripting attacks. Due to improper filtering, a remote attacker...

CVE-2006-2608

artmedic newsletter 4.1 and possibly other versions, when registerglobals is enabled, allows remote attackers to modify arbitrary files and execute arbitrary PHP code via the logfile parameter in a direct request to log.php, which causes the $logfile variable to be redefined to an...

Cross site scripting

Cross-site scripting XSS vulnerability in Florian Amrhein NewsPortal before 0.37, and possibly TR Newsportal TRanx rebuilded, allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

CVE-2006-2463

viewalbum.php in SelectaPix 1.31 and earlier allows remote attackers to obtain the installation path via a certain request, which displays the path in an error message, possibly due to an invalid or missing parameter...

CVE-2006-2414

Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via ".." sequences in the 1 LIST or 2 DELETE IMAP command...

CVE-2006-2405

Directory traversal vulnerability in unblib/abbc.conf.php in Unclassified NewsBoard UNB 1.6.1 patch 1 and earlier, when registerglobals is enabled, allows remote attackers to include arbitrary files via .. dot dot sequences and a trailing null byte %00 in the ABBCConfigsmileset parameter to...

[Full-disclosure] Multiple vulnerabilities in Raydium rev 309

Luigi Auriemma Application: Raydium http://raydium.org Versions: = SVN revision 309 newer versions can be vulnerable to some of the bugs which are still unfixed Platforms: Windows, nix, BSD and others Bugs: A buffer-overflow in raydiumlog and raydiumconsolelineadd B format string in raydiumlog C...

CVE-2006-2347

The CVE-2006-2347 entry concerns E-Business Designer (eBD) 3.1.4 and earlier. The vulnerability allows remote attackers to reveal the web server’s full path by supplying special values (e.g., a single quote) to the id parameter in form_grupo.html or by requesting the archivos/ and files/ director...

CVE-2006-1518

Buffer overflow in the opentable function in sqlbase.cc in MySQL 5.0.x up to 5.0.20 might allow remote attackers to execute arbitrary code via crafted COMTABLEDUMP packets with invalid length values...

Cartweaver ColdFusion vuln.

Cartweaver ColdFusion vuln. Vuln. discovered by : r0t Date: 25 april 2006 vendorlink:www.cartweaver.com affected versions:2.16.11 and previous orginal advisory:http://pridels.blogspot.com/2006/04/cartweaver-coldfusion-vuln.html Vuln. Description: 1. SQL Injection vuln. Cartweaver ColdFusion...

SUSE-SA:2006:021: MozillaFirefox,mozilla

The remote host is missing the patch for the advisory SUSE-SA:2006:021 MozillaFirefox,mozilla. A number of security issues have been fixed in the Mozilla browser suite and the Mozilla Firefox browser. These problems could be used by remote attackers to gain privileges, gain access to confidential...

QuickEStore 7.9 vuln.

QuickEStore 7.9 vuln. Vuln. discovered by : r0t Date: 25 april 2006 vendorlink:www.quickestore.com affected versions:7.9 and previous orginal advisory:http://pridels.blogspot.com/2006/04/quickestore-79-vuln.html Vuln. Description: 1. SQL Injection vuln. QuickEStore contains a flaw that allows a...