CVE-2000-1238

The CVE-2000-1238 entry affects BEA Systems WebLogic Express and WebLogic Server 5.1 SP1–SP6. The issue allows remote attackers to bypass access controls for restricted JSP/servlet pages by using a URL that contains multiple forward slash characters before the restricted pages. Vulnerable compone...

CVE-2005-3547

Cross-site scripting XSS vulnerability in Invision Power Board 2.1 allows remote attackers to inject arbitrary web script or HTML via the 1 adsess, 2 name, and 3 description parameters in admin.php, and the 4 ACP Notes, 5 Member Name, 6 Password, 7 Email Address, 8 Components, and multiple other...

CVE-2005-3511

CVE-2005-3511 affects Spymac Web OS 4.0. The vulns are multiple cross-site scripting (XSS) flaws in the blogs and notes modules, allowing remote attackers to inject arbitrary script/HTML via various parameters (e.g., blogs: curr, inspire, system, title, entry; caldate; notes: forwardid, del_folde...

Remotely DoSing JBoss 4.0.2 with serialized java objects

=+============================================================= Remotely DoSing JBoss 4.0.2 with serialized java objects Implications of serialisation vulnerabilies in JDK =+============================================================= Author: Marc Schoenefeld , illegalaccess.org...

CVE-2005-3477

Multiple interpretation error in the image upload handling code in Invision Gallery 2.0.3 allows remote attackers to conduct cross-site scripting XSS attacks via HTML or script in an image whose type does not match its extension, which is rendered by Internet Explorer due to CVE-2005-3312. NOTE: ...

Invision Gallery index.php st Parameter SQL Injection

The remote host is running Invision Gallery, a community-based photo gallery plugin for Invision Power Board. The version of Invision Gallery installed on the remote host fails to properly sanitize user-supplied input to the 'st' parameter of the 'index.php' script before using it in database...

CVE-2005-3315

Multiple SQL injection vulnerabilities in Novell ZENworks Patch Management 6.x before 6.2.2.181 allow remote attackers to execute arbitrary SQL commands via the 1 Direction parameter to computers/default.asp, and the 2 SearchText, 3 StatusFilter, and 4 computerFilter parameters to...

CVE-2005-3377

The CVE-2005-3377 entry describes a vulnerability in McAfee products where a file containing BAT, HTML, or EML data with an EXE-like MZ magic byte sequence can bypass virus scanning and be treated as a safe file type while still potentially enabling execution by applications on the host. Affected...

ATutor 1.x - forum.inc.php Arbitrary Command Execution

ATutor 1.x - forum.inc.php Arbitrary Command Execution source: https://www.securityfocus.com/bid/15221/info ATutor is prone to multiple vulnerabilities. These issues can allow remote attackers to execute arbitrary PHP commands and carry out local file include and cross-site scripting attacks...

CVE-2005-3140

Vulnerability overview (CVE-2005-3140): Procom NetFORCE 800, v4.02 M10 Build 20 and possibly other versions, can expose cleartext NIS password hashes because the NIS password map (passwd.nis) is sent as a file attachment in diagnostic e‑mail messages. The underlying issue is the unintended exfilt...

CVE-2005-2899

CVE-2005-2899 corresponds to multiple XSS vulnerabilities in details.php of CjTagBoard 3.0. The flaw allows remote attackers to inject arbitrary web script or HTML by supplying one of the parameters (date, time, name, ip, agent, or msg). The connected sources confirm the affected component and vu...

DSA-809-1 squid - several

Bulletin has no description...

CVE-2005-2812

man2web allows remote attackers to execute arbitrary commands via -P arguments...

[SECURITY] [DSA 779-2] New Mozilla Firefox packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 779-2 [email protected] http://www.debian.org/security/ Martin Schulze September 1st, 2005 http://www.debian.org/security/faq -...

CVE-2005-2730

The HTTP proxy in Astaro Security Linux 6.0 allows remote attackers to obtain sensitive information via an invalid request, which reveals a Proxy-authorization string in an error message...

CVE-2005-2683

Multiple SQL injection vulnerabilities in PHPKit 1.6.1 allow remote attackers to execute arbitrary SQL commands via the 1 letter parameter to login/member.php or 2 imreceiver parameter to login/imcenter.php...

CVE-2005-2602

Mozilla Thunderbird 1.0 and Firefox 1.0.6 allows remote attackers to obfuscate URIs via a long URI, which causes the address bar to go blank and could facilitate phishing attacks...

EMC Legato NetWorker portmapper allows remote calls to "pmap_set" and "pmap_unset"

Overview The EMC Legato NetWorker PortMapper allows remote access to pmapset and pmapunset. This could allow a remote attacker to cause a denial of service or potentially to eavesdrop on communications between NetWorker programs. Description EMC Legato NetWorker is a cross-platform backup and...

CVE-2005-2539

Multiple cross-site scripting XSS vulnerabilities in FlatNuke 2.5.5 and possibly earlier versions allow remote attackers to inject arbitrary web script or HTML via the 1 bodycolor, 2 backimage, 3 theme, or 4 logo parameter to structure.php, 5 admin, 6 adminmail, or 7 back parameter to footer.php,...

CVE-2005-2474

ChurchInfo is affected by CVE-2005-2474, where remote attackers can cause information disclosure by supplying various parameters (PersonID, GroupID, PropertyID, FamilyID, PledgeID, etc.) to multiple PHP scripts (e.g., PersonView.php, MemberRoleChange.php, PropertyAssign.php, WhyCameEditor.php, Gr...