Code injection

Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses the same private DSA key for each installation, which allows remote attackers to conduct man-in-the-middle attacks and decrypt communications...

ampleShop™ eCommerce Software vuln.

ampleShop™ eCommerce Software vuln. Vuln. discovered by : r0t Date: 25 april 2006 vendor:www.amplecom.com/ affected versions:2.1 and previous orginal advisory:http://pridels.blogspot.com/2006/04/ampleshop-ecommerce-software-vuln.html Vuln. Description: ampleShop™ contains a flaw that allows a...

CVE-2006-1965

CVE-2006-1965 affects aasi media Net Clubs Pro versions 4.0 and earlier. The vulnerability is multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML via parameters in various CGI scripts: (a) sendim.cgi (parameters onuser, pass, chatsys, room,...

Portal Pack 6 XSS vuln.

Portal Pack 6 XSS vuln. Vuln. discovered by : r0t Date: 20 april 2006 vendor:www.kcscripts.com/scripts/portal-pack.htm affected versions:6.0 and prior orginal advisoy: http://pridels.blogspot.com/2006/04/portal-pack-6-xss-vuln.html Vuln. Description: Portal Pack contains a flaws that allows a...

Article Publisher Pro SQL inj.

Article Publisher Pro SQL inj. Vuln. discovered by : r0t Date: 18 april 2006 vendor:Scriptsfrenzy.com product link:http://www.scriptsfrenzy.com/article.html affected versions: 1.0.1 and previous orginal advisory: http://pridels.blogspot.com/2006/04/article-publisher-pro-sql-inj.html Vuln...

CVE-2006-1795

Cross-site scripting XSS vulnerability in tablepublisher.cgi in UPDI Network Enterprise @1 Table Publisher 2006-03-23 allows remote attackers to inject arbitrary web script or HTML via the Title of Table field...

CVE-2006-1723

Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via unknown attack vectors related to DHTML. NOTE: due to the lack of sufficient public details from the...

APT-webshop-system vuln.

APT-webshop-system vuln. Vuln. discovered by : r0t Date: 9 april 2006 vendor:http://www.apt-webservice.de/shopsoftware/ affected versions: 4.0 PRO 3.0 BASIC 3.0 LIGHT orginal advisory: http://pridels.blogspot.com/2006/04/apt-webshop-system-vuln.html Vuln. description: 1. SQL injection vuln...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in vscripts aka Kuba Kunkiewicz VBook aka VBook 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 autor, 2 www, 3 temat, and 4 tresc parameters...

CVE-2006-1414

Multiple cross-site scripting XSS vulnerabilities in toast.asp in Toast Forums 1.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 author, 2 subject, 3 message, or 4 dayprune parameter...

Absolute Image Gallery XE 2.0 XSS vuln.

Absolute Image Gallery XE 2.0 XSS vuln. Vuln. discovered by : r0t Date: 25 march 2006 vendor:http://www.xigla.com/absoluteig/index.htm affected versions:V2.0 and prior orginal advisory: http://pridels.blogspot.com/2006/03/absolute-image-gallery-xe-20-xss-vuln.html Vuln. Description: Absolute Imag...

CVE-2006-0058

Signal handler race condition in Sendmail 8.13.x before 8.13.6 allows remote attackers to execute arbitrary code by triggering timeouts in a way that causes the setjmp and longjmp function calls to be interrupted and modify unexpected memory locations...

CVE-2006-1329

The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service "c2s segfault" by sending a "response stanza before an auth stanza"...

CVE-2006-1263

Multiple "unannounced" cross-site scripting XSS vulnerabilities in WordPress before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors...

CVE-2006-1165

Cross-site scripting XSS vulnerability in the mediamanager module in DokuWiki before 2006-03-05 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors relating to "handling EXIF data."...

CVE-2006-1162

CVE-2006-1162 : A directory traversal in Nodez 4.6.1.1 and earlier allows remote attackers to read or include arbitrary PHP files via a .. in the op parameter, demonstrated by inserting malicious Email parameters into list.gtdat and accessing it with op. Root cause is improper path handling enabl...

Cross site scripting

Cross-site scripting XSS vulnerability in Thomson SpeedTouch modems running firmware 5.3.2.6.0 allows remote attackers to inject arbitrary web script or HTML via the name parameter to the LocalNetwork page...

CVE-2006-0926

Multiple directory traversal vulnerabilities in Allume StuffIt Standard and Deluxe 9.0, ZipMagic Deluxe 9.0, and StuffIt Expander 9.0.0.21 Engine 9.0.0.21 allow remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a 1 zip or 2 tar archive...

CVE-2006-0195

Interpretation conflict in the MagicHTML filter in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to conduct cross-site scripting XSS attacks via style sheet specifiers with invalid 1 "/" and "/" comments, or 2 a newline in a "url" specifier, which is processed by certain web browsers...

CVE-2006-0806

Multiple cross-site scripting XSS vulnerabilities in ADOdb 4.71, as used in multiple packages such as phpESP, allow remote attackers to inject arbitrary web script or HTML via 1 the nextpage parameter in adodb-pager.inc.php and 2 other unspecified vectors related to PHPSELF...