Design/Logic Flaw

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.1 allows remote attackers to affect integrity via unknown vectors...

CVE-2008-6136

Unspecified vulnerability in EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to gain privileges as another user or an administrator via unknown attack vectors...

CVE-2008-0533

Multiple cross-site scripting XSS vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password UCP before 4.2 in Cisco Secure Access Control Server ACS for Windows and ACS Solution Engine allow remote attackers to inject arbitrary web script or HTML via an argument located immediate...

CVE-2008-1226

Multiple cross-site scripting XSS vulnerabilities in Zimbra Collaboration Suite ZCS 4.0.3, 4.5.6, and possibly other versions before 4.5.10 allow remote attackers to inject arbitrary web script or HTML via an e-mail attachment, possibly involving a 1 .jpg or 2 .gif image attachment...

CVE-2008-0193

Cross-site scripting XSS vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php...

CVE-2007-6675

The bsystemcommentsshow function in htdocs/modules/system/blocks/systemblocks.php in XOOPS before 2.0.18 does not check permissions, which allows remote attackers to read the comments in restricted modules...

CVE-2007-5939

The gssuserok function in appl/ftp/ftpd/gssuserok.c in Heimdal 0.7.2 does not allocate memory for the ticketfile pointer before calling free, which allows remote attackers to have an unknown impact via an invalid username. NOTE: the vulnerability was originally reported for ftpd.c, but this is...

Code injection

Vikingboard 0.1.2 allows remote attackers to obtain sensitive information via the debug parameter to 1 forum.php, 2 cp.php, and possibly other unspecified components...

CVE-2007-2471

Directory traversal vulnerability in sendcard.php in Sendcard 3.4.1 and earlier allows remote attackers to read arbitrary files via a full pathname in the form parameter...

CVE-2006-3571

Multiple cross-site scripting XSS vulnerabilities in interna/hilfe.php in Papoo 3 RC3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 titel or 2 ausgabe parameters...

CVE-2006-3342

Cross-site scripting XSS vulnerability in index.php in Arctic 1.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search cmd...

CVE-2005-3528

Cross-site scripting XSS vulnerability in tiki-viewforumthread.php in TikiWiki 1.9.0 through 1.9.2 allows remote attackers to inject arbitrary web script or HTML via the topicsoffset parameter...

CVE-2005-3283

Cross-site scripting XSS vulnerability in TikiWiki before 1.9.1.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

CVE-2005-2677

ACNews stores the database in a file under the web document root with a db.inc extension and insufficient access control, which allows remote attackers to obtain sensitive information such as the full pathname of the server...

CVE-2005-1669

Cross-site scripting XSS vulnerability in Opera 8.0 Final Build 1095 allows remote attackers to inject arbitrary web script or HTML via "javascript:" URLs when a new window or frame is opened, which allows remote attackers to bypass access restrictions and perform unauthorized actions on other...