CA BrightStor ARCserve Backup Tape Engine directly calls user supplied data in RPC requests

Overview The Computer Associates BrightStor ARCserve Backup Tape Engine contains a vulnerability in its Tape Engine RPC service. If successfully exploited, this vulnerability may allow a remote attacker to execute arbitrary code. Description BrightStor ARCserve Backup is a backup and data retenti...

PT-2007-1655 · Allmylinks · Allmylinks

Name of the Vulnerable Software and Affected Versions: AllMyLinks versions 0.5.0 and earlier Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the AML opensite parameter in the index.php file. This enables attackers to potentially gain control over the syst...

PT-2006-7480 · Unknown · Phpirc Bot

Name of the Vulnerable Software and Affected Versions: PHPIrc bot version 0.2 Description: A remote file inclusion issue in the php4you.php file allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter. Recommendations: For PHPIrc bot version 0.2, consider validating a...

Microsoft Remote Installation Service Writable Path Vulnerability

Overview A vulnerability in the way Microsoft Remote Installation Service handles TFTP may allow a remote, unauthorized attacker to create or overwrite arbitrary operating system files. Description Microsoft Remote Installation Service contains a vulnerability in the way that it provides TFTP...

Microsoft Windows Print Spooler service fails to properly handle RPC requests

Overview The Microsoft Windows Print Spooler fails to properly handle malformed RPC requests. This vulnerability may allow a remote attacker to cause a denial-of-service condition. Description The Microsoft Print Spooler service manages printing operations on a system. The Print Spooler service...

Computer Associates BrightStor ARCserve Backup Tape Engine fails to properly handle RPC requests

Overview A vulnerability exists in the Computer Associates BrightStor ARCserve Backup Tape Engine. If successfully exploited, this vulnerability may allow a remote attacker to execute arbitrary code. Description BrightStor ARCserve Backup is a backup and data retention tool that integrates with...

NaviCOPA Web Server fails to properly handle certain HTTP requests

Overview A vulnerability exists in the NaviCOPA Web Server. If successfully exploited, this vulnerability may allow an attacker to execute arbitrary code. Description NaviCOPA Web Server is an HTTP server that is available for multiple versions of Microsoft Windows including Windows 98, NT, 2000,...

PT-2006-6665 · My-Bic · My-Bic

Name of the Vulnerable Software and Affected Versions: My-BIC version 0.6.5 Description: A remote file inclusion issue in mybic server.php allows remote attackers to execute arbitrary PHP code via a URL in the INC PATH parameter. This issue is disputed by third-party researchers because INC PATH ...

PT-2006-6566 · @Cid · @Cid Stats

Name of the Vulnerable Software and Affected Versions: @cid stats version 2.3 Description: A remote file inclusion issue in install.php3 allows remote attackers to execute arbitrary PHP code via a URL in the repertoire parameter. Note that this issue has been disputed by a third party, who claims...

OpenSSH contains a race condition vulnerability

Overview A race condition vulnerability exists in the OpenSSH daemon. Successful exploitation of this vulnerability may result in a denial-of-service condition. Description OpenSSH is an open source client and server implementation of the Secure Shell SSH protocol.The OpenSSH server includes the...

PT-2006-5741 · Ipswitch · Ws Ftp Server

Name of the Vulnerable Software and Affected Versions: WS FTP Server versions 5.0 through 5.05 before Hotfix 1 Description: Multiple buffer overflows have unknown impact and remote authenticated attack vectors via the 1 XCRC, 2 XMD5, and 3 XSHA1 commands. Recommendations: For WS FTP Server versio...

PT-2006-5618 · All Enthusiast · Reviewpost

Name of the Vulnerable Software and Affected Versions: All Enthusiast ReviewPost version 2.5 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the RP PATH parameter in the index.php file. Recommendations: For All Enthusiast ReviewPost version 2.5, consider...

Microsoft PGM vulnerable to remote code execution

Overview A buffer overflow vulnerability in Microsoft's Pragmatic General Multicast PGM protocol implementation may allow an attacker to execute arbitrary code. Description The Pragmatic General Multicast PGM protocol is an experimental protocol defined in RFC 3208. Microsoft's implementation of...

Xsan Filesystem fails to properly process path names

Overview A buffer overflow vulnerability in Apple's Xsan product may allow a local attacker to run arbitrary code with root privileges or create a denial-of-service condition. Description Xsan FilesystemXsan is a Storage Area Network SAN filesystem designed for use by Apple OS X and OS X Server...

PT-2006-4995 · Mywebland · Mywebland Minibloggie

Name of the Vulnerable Software and Affected Versions: myWebland miniBloggie versions 1.0 and earlier Description: The issue allows remote attackers to potentially execute arbitrary PHP code via a URL in the fname parameter in the cls fast template.php file. However, another researcher was unable...

Microsoft Windows Server service buffer overflow

Overview A stack-based buffer overflow exists in the Microsoft Server service. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code with SYSTEM privileges. Description Microsoft Server ServiceMS06-040 includes the following information: The Server service...

PT-2006-4418 · Invision · Invision Power Board

Name of the Vulnerable Software and Affected Versions: Invision Power Board versions 1.x through 2.x Description: Multiple SQL injection vulnerabilities allow remote attackers to execute arbitrary SQL commands via various parameters in different actions in index.php and coins list.php. The...

PT-2006-4443 · Unknown · Fantastic Guestbook

Name of the Vulnerable Software and Affected Versions: Fantastic Guestbook versions 2.0.1 and earlier Description: The issue allows remote attackers to inject arbitrary web script or HTML via the first name, last name, or nickname parameters in the guestbook.php file. Recommendations: For Fantast...

PT-2006-4419 · Invision · Invision Power Board

Name of the Vulnerable Software and Affected Versions: Invision Power Board version 1.3 Final Description: The issue concerns SQL injection vulnerabilities that could allow remote attackers to execute arbitrary SQL commands. This is allegedly possible via the CODE parameter in certain actions in...

PT-2006-4252 · Phpsysinfo · Phpsysinfo

Name of the Vulnerable Software and Affected Versions: phpSysInfo versions 2.5.1 through 3.2.4 Description: The issue allows remote attackers to determine the existence of arbitrary files via a .. dot dot sequence and a trailing null %00 byte in the lng parameter. This will display a different...