Sql injection

SQL injection vulnerability in the Acidfree module for Drupal before 4.6.x-1.0, and before 4.7.x-1.0 in the 4.7 series, allows remote authenticated users with "create acidfree albums" privileges to execute arbitrary SQL commands via node titles...

MOAB-16-01-2007: Multiple Colloquy IRC Format String Vulnerabilities

Summary Traditionally, chat clients on the Mac have been anything but glamorous. Colloquy is an advanced IRC & SILC client which aims to fill this void. By adhering to Mac OS X interface conventions, Colloquy has the look and feel of a quality Mac application. By making a common mistake the...

CVE-2007-0272

Multiple buffer overflows in MDSYS.MD in Oracle Database 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4 allows remote authenticated users to cause a denial of service crash or execute arbitrary code via unspecified vectors involving certain public procedures, aka DB05...

CVE-2007-0270

Buffer overflow in SYS.DBMSDRS in Oracle Database 9.2.0.7 and 10.1.0.4 allows remote authenticated users to cause a denial of service crash or execute arbitrary code via the GETPROPERTY function in SYS.DBMSDRS, aka DB03...

CVE-2006-6852

Eval injection vulnerability in tDiary 2.0.3 and 2.1.4.200 61127 allows remote authenticated users to execute arbitrary Ruby code via unspecified vectors, possibly related to incorrect input validation by 1 conf.rhtml and 2 i.conf.rhtml. NOTE: some of these details are obtained from third party...

CVE-2006-6820

myprofile.asp in Enthrallweb eCoupons does not properly validate the MMrecordId parameter during profile updates, which allows remote authenticated users to modify certain profile fields of another account by specifying that account's username in a modified MMrecordId parameter...

CVE-2006-6822

myprofile.asp in Enthrallweb eClassifieds does not properly validate the MMrecordId parameter during profile updates, which allows remote authenticated users to modify certain profile fields of another account by specifying that account's username in a modified MMrecordId parameter...

CVE-2006-6548

The CVE-2006-6548 entry describes multiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0. Affected component: WHM 3.1.0. Vulnerable vectors: the domain parameter in several scripts (scripts2/changeemail, scripts2/limitbw, scripts/rearrangeacct). The issue allows...

CVE-2006-6330

index.php for TorrentFlux 2.2 allows remote registered users to execute arbitrary commands via shell metacharacters in the kill parameter...

CVE-2006-6291

Stack overflow in the IMAP module MEIMAPS.EXE in MailEnable Professional 1.6 through 1.83 and 2.0 through 2.33, and MailEnable Enterprise 1.1 through 1.40 and 2.0 through 2.33, allows remote authenticated users to cause a denial of service crash via a long argument containing asterisk and ?...

CVE-2006-6198

CVE-2006-6198 documents multiple XSS vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0. The flaws enable remote authenticated users to inject arbitrary web script or HTML via several parameters in the web UI: (1) email in scripts2/dochangeemail, (2) supporturl in cgi/addon_configsupport.cgi, ...

CVE-2006-6017

WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authenticated users to cause a denial of service application crash via a string that represents a 1 malformed or 2 large serialized object, because the object...

CVE-2006-6017

WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authenticated users to cause a denial of service application crash via a string that represents a 1 malformed or 2 large serialized object, because the object...

CVE-2006-6008

ftpd in Linux Netkit linux-ftpd 0.17, and possibly other versions, does not check the return status of certain seteuid, setgid, and setuid calls, which might allow remote authenticated users to gain privileges if these calls fail in cases such as PAM failures or resource limits, a different...

CVE-2006-6017

WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authenticated users to cause a denial of service application crash via a string that represents a 1 malformed or 2 large serialized object, because the object...

PT-2006-6664 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 2.0.5 Description: The issue allows remote authenticated users to cause a denial of service, resulting in an application crash. This occurs when a string representation of a serialized object is not properly stored...

DEBIAN-CVE-2006-5973

Off-by-one buffer overflow in Dovecot 1.0test53 through 1.0.rc14, and possibly other versions, when index files are used and mmapdisable is set to "yes," allows remote authenticated IMAP or POP3 users to cause a denial of service crash via unspecified vectors involving the cache file...

CVE-2006-5729

The CVE-2006-5729 entry concerns Yazd Discussion Forum prior to version 3.0 beta, where a mismanaged permission model allows remote authenticated users to (1) reply to a message in an arbitrary forum if they can create a message in any forum, and (2) perform certain unauthorized forum actions due...

Hosting Controller 6.1 Hotfix <= 3.2 Vulnerability

Hosting Controller 'EnableForum.asp' and 'DisableForum.asp' Scripts Let Remote Users Create or Delete Forums and Virtual Directories advisory : http://www.kapda.ir/advisory-442.html http://securitytracker.com/alerts/2006/Oct/1017103.html...

CVE-2006-5540

backend/parser/analyze.c in PostgreSQL 8.1.x before 8.1.5 allows remote authenticated users to cause a denial of service daemon crash via certain aggregate functions in an UPDATE statement, which are not properly handled during a "MIN/MAX index optimization."...