PT-2012-1105 · Modplug +1 · Libmodplug +1

Name of the Vulnerable Software and Affected Versions: libmodplug versions prior to 0.8.8.4 Description: The issue is related to an off-by-one error in the CSoundFile::ReadAMS function, which can be exploited by remote attackers using a crafted AMS file with a large number of samples. This could...

PT-2012-1104 · Modplug +1 · Libmodplug +1

Name of the Vulnerable Software and Affected Versions: libmodplug versions prior to 0.8.8.4 Description: The issue concerns multiple vulnerabilities in the libmodplug package that can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protect...

PT-2011-4029 · Apache +1 · Mod Authnz External +2

Name of the Vulnerable Software and Affected Versions: mod authnz external module versions 3.2.5 and earlier Description: The issue allows remote attackers to execute arbitrary SQL commands via the user field. This is related to a SQL injection vulnerability in the mysql/mysql-auth.pl script. The...

PT-2011-3438 · Microsoft · Windows Vista +3

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Description: The issue is related to incorrect driver object management in kernel-mode drivers, allowing local users to gain privileges via a crafted application. This could enable an...

PT-2011-3450 · Microsoft · Forefront Threat Management Gateway (Tmg) 2010

Name of the Vulnerable Software and Affected Versions: Microsoft Forefront Threat Management Gateway TMG 2010 Description: The issue allows remote attackers to execute arbitrary code via vectors involving unspecified requests. This is related to the NSPLookupServiceNext function in the client...

PT-2011-1331 · Cre Loaded · Cre Loaded

Name of the Vulnerable Software and Affected Versions: CRE Loaded versions prior to 6.2.14 Description: The issue allows remote attackers to bypass authentication and gain administrator privileges. This is related to a modified PHP SELF variable, which is not properly handled by includes in the...

PT-2011-2778 · Cisco · Cisco Unified Operations Manager

Name of the Vulnerable Software and Affected Versions: Cisco Unified Operations Manager CUOM versions prior to 8.6 Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the CCMs parameter to the "/iptm/PRTestCreation.do" API endpoint or the ccm...

PT-2011-5196 · Artifex +1 · Mupdf +1

Name of the Vulnerable Software and Affected Versions: SumatraPDF version 2.1.1 MuPDF version 1.0 Description: The issue allows remote attackers to cause an integer overflow in the lex number function via a corrupt PDF file. It is also caused by a signedness error in the pdf repair obj stm functi...

PT-2011-2432

Name of the Vulnerable Software and Affected Versions OpenSSH versions 5.6 through 5.7 Description The issue is related to the key certify function in OpenSSH, specifically when generating legacy certificates using the -t command-line option in ssh-keygen. This function does not initialize the...

PT-2010-1040 · Opensuse +2 · Drbd-Kmp-Default +2

Name of the Vulnerable Software and Affected Versions: drbd-kmp-default versions affected versions not specified Linux kernel versions prior to 2.6.36-rc4 Description: The issue concerns multiple vulnerabilities in the drbd-kmp-default package of the openSUSE operating system, which can be...

Wind River Systems VxWorks debug service enabled by default

Overview Some products based on VxWorks have the WDB target agent debug service enabled by default. This service provides read/write access to the device's memory and allows functions to be called. Description The VxWorks WDB target agent is a target-resident, run-time facility that is required f...

PT-2010-1110 · Freetype +2 · Freetype +2

Name of the Vulnerable Software and Affected Versions: FreeType versions prior to 2.4.0 FreeType versions prior to 2.4.8 Description: The issue is related to an integer overflow in the gray render span function in smooth/ftgrays.c, which allows remote attackers to cause a denial of service or...

Accoria Rock Web Server contains multiple vulnerabilities

Overview Accoria Web Server contains multiple vulnerabilities that collectively could allow an attacker to execute commands through the administration interface. Description The Accoria web server, also known as Rock Web Server, contains several cross-site scripting XSS and cross-site request...

PT-2010-1663 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 version 4.0 Description: A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the showUid parameter in index.php. However, the TYPO3 Security Team disputes this report, stating that the showUid parameter i...

PT-2010-2066 · Microsoft · Windows Server 2003 +6

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to Windows 7, including Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2 Description: The issue arises from the imprope...

PT-2010-1096 · Mit +1 · Mit-Krb5 +2

Name of the Vulnerable Software and Affected Versions: MIT Kerberos 5 versions 1.5 through 1.6.3 mit-krb5 versions prior to 1.9.2-r1 Description: The issue concerns multiple vulnerabilities in the mit-krb5 package that can be exploited remotely, potentially leading to breaches of confidentiality,...

PT-2010-1279 · Varnish · Varnish

Name of the Vulnerable Software and Affected Versions: Varnish versions prior to 2.1.0 Description: The Command Line Interface in the master process of the reverse proxy server does not require authentication for commands received through a TCP port. This allows remote attackers to execute...

IntelliCom NetBiter Config HICP hostname buffer overflow

Overview The IntelliCom NetBiter Config HICP configuration utility has a buffer overflow vulnerability that can be triggered by a specially crafted hostname hn value. An attacker with network access could exploit this vulnerability to execute arbitrary code with the privileges of the user running...

Xi Software Net Transport eDonkey Protocol Buffer Overflow

Added: 02/22/2010 OSVDB: 61435 Background Net Transport, also known as NetXfer, is a download manager for Windows made by Xi Software. Among the protocols Net Transport can handle is eDonkey, a decentrailized peer to peer network for file sharing. Problem The Net Transport download manager fails ...

PT-2010-1348 · Acme.Com +2 · Mini Httpd +2

Name of the Vulnerable Software and Affected Versions: mini httpd version 1.19 Description: The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as mini httpd writes data t...