CVE-2008-3122

Multiple SQL injection vulnerabilities in Xerox CentreWare Web CWW before 4.6.46 allow remote authenticated users to execute arbitrary SQL commands via the unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Tinytax module aka Tinytax taxonomy block 5.x before 5.x-1.10-1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML, probably by creating a crafted taxonomy term...

Unrestricted file upload

Unrestricted file upload vulnerability in ImperialBB 2.3.5 and earlier allows remote authenticated users to upload and execute arbitrary PHP code by placing a .php filename in the UploadAvatar parameter and sending the image/gif content type...

Buffer overflow

Buffer overflow in the convert function in Microsoft SQL Server 2000 SP4, 2000 Desktop Engine MSDE 2000 SP4, and 2000 Desktop Engine WMSDE allows remote authenticated users to execute arbitrary code via a crafted SQL expression...

Sql injection

Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS FCMS 1.4 allow remote authenticated users to execute arbitrary SQL commands via the 1 address parameter to addressbook.php, the 2 getnews parameter to familynews.php, and the 3 pollid parameter to home.php in a results...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/search.asp in Xigla Poll Manager XE allows remote authenticated users with administrator role privileges to inject arbitrary web script or HTML via unspecified vectors "all fields"...

CVE-2008-1445

Active Directory on Microsoft Windows 2000 Server SP4, XP Professional SP2 and SP3, Server 2003 SP1 and SP2, and Server 2008 allows remote authenticated users to cause a denial of service system hang or reboot via a crafted LDAP request...

Apache 1.3.*-2.0.48 mod_userdir Remote Users Disclosure Exploit

No description provided by source. / m00-apache-w00t.c Apache 1.3.-2.0.48 remote users disclosure exploit by m00 Security. Proof-of-Concept edition This tool scans remote hosts with httpd apache and disclosure information...

Code injection

admin/userform.php in RoomPHPlanning 1.5 does not require administrative credentials, which allows remote authenticated users to create new admin accounts...

CVE-2008-2053

CVE-2008-2053 affects Cisco Unified Customer Voice Portal (CVP) software. A vulnerability allows an administrator-level user to create, modify, or delete a superuser account, effectively gaining full system control. Affected CVP releases are 4.0.x before 4.0(2)_ES14, 4.1.x before 4.1(1)_ES11, and...

mysql DROP privilege not enforced when renaming tables

MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for RENAME TABLE statements, which allows remote authenticated users to rename arbitrary tables...

mysql SECURITY INVOKER functions do not drop privileges

The mysqlchangedb function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::dbaccess privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges...

CVE-2008-2300

Unspecified vulnerability in Citrix Presentation Server 4.5 and earlier, Citrix Access Essentials 2.0 and earlier, and Citrix Desktop Server 1.0 allows remote authenticated users to access unauthorized desktops via unknown attack vectors...

CVE-2008-2273

Unspecified vulnerability in the TACACS authentication component in Aruba Mobility Controller 3.1.x, 3.2.x, and 3.3.x allows remote authenticated users to gain privileges via unknown vectors...

Authentication flaw

Unspecified vulnerability in the TACACS authentication component in Aruba Mobility Controller 3.1.x, 3.2.x, and 3.3.x allows remote authenticated users to gain privileges via unknown vectors...

Design/Logic Flaw

The Site Documentation Drupal module 5.x before 5.x-1.8 and 6.x before 6.x-1.1 allows remote authenticated users to gain privileges of other users by leveraging the "access content" permission to list tables and obtain session IDs from the database...

Unrestricted file upload

Unrestricted file upload vulnerability in src/yopyupload.php in Project-Based Calendaring System PBCS 0.7.1 allows remote authenticated users to upload arbitrary files to tmp/uploads...

CVE-2008-2104

The WebService in Bugzilla 3.1.3 allows remote authenticated users without canconfirm privileges to create NEW or ASSIGNED bug entries via a request to the XML-RPC interface, which bypasses the canconfirm check...

Unrestricted file upload

Unrestricted file upload vulnerability in the ajoutcat mode in admin/main.php in Tr Script News 2.1 allows remote authenticated users to execute arbitrary code by uploading a file with a .php extension...

Sql injection

SQL injection vulnerability in links.php in Scriptsagent.com Links Directory 1.1 allows remote authenticated users to execute arbitrary SQL commands via the catid parameter in a list action...