Design/Logic Flaw

Unspecified vulnerability in the Manage Templates feature in Qsoft K-Rate Premium allows remote attackers to execute arbitrary PHP code via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-7099

Unspecified vulnerability in the Manage Templates feature in Qsoft K-Rate Premium allows remote attackers to execute arbitrary PHP code via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-7075

Multiple SQL injection vulnerabilities in Kalptaru Infotech Ltd. Star Articles 6.0 allow remote attackers to inject arbitrary SQL commands via 1 the subcatid parameter to article.list.php; or the artid parameter to 2 article.print.php, 3 article.comments.php, 4 article.publisher.php, or 5...

CVE-2009-2914

Cross-site scripting XSS vulnerability in index.php in XZero Community Classifieds 4.97.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the name of an uploaded file. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in XZero Community Classifieds 4.97.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the name of an uploaded file. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

VMware Hosted products update libpng and Apache HTTP Server

a. Third Party Library libpng Updated to 1.2.35Several flaws were discovered in the way third party library libpnghandled uninitialized pointers. An attacker could create a PNG imagefile in such a way, that when loaded by an application linked tolibpng, it could cause the application to crash or...

CVE-2008-6993

Siemens Gigaset WLAN Camera 1.27 has an insecure default password, which allows remote attackers to conduct unauthorized activities. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Subversion Client/Server Detection (Windows)

Subversion, an open source version control system, is installed on the remote system. Subversion can be installed on Windows using CollabNet-certified binaries or through third-party packages such as VisualSVN, TortoiseSVN, and SlikSVN. Third-party packages typically include CollabNet binaries in...

Blind SQL Injection vulnerability in extension T3M E-Mail Marketing Tool (t3m)

It has been discovered that the extension T3M E-Mail Marketing Tool t3m is vulnerable to Blind SQL Injection attacks. Release Date: August 18, 2009 Component Type: Third party extension. This extension is not part of the TYPO3 default installation. Affected Versions: Version 0.2.4 and below...

VMSA-2009-0010:VMware Hosted products update libpng and Apache HTTP Server

VMSA-2009-0010.1 VMware Hosted products update libpng and Apache HTTP Server VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2009-0010.1 VMware Security Advisory Synopsis: VMware Hosted products update libpng and Apache HTTP Server VMware Security Advisory Issue date: 2009-08-...

Multiple vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: "AIRware Lexicon" airlexicon, "AST ZipCodeSearch" astaddresszipsearch, "Car" car, "Event Registration" eventregistr, "Solidbase Bannermanagement" SBbanner, "t3maffiliate" t3maffiliate, "AJAX Chat" vjchat Releas...

Cross-Site Scripting vulnerability in extension Commerce (commerce)

It has been discovered that the extension Commerce commerce is vulnerable to Cross-Site Scripting attacks. Release Date: August 18, 2009 Component Type: Third party extension. This extension is not part of the TYPO3 default installation. Affected Versions: Version 0.9.8 and below. Vulnerability...

Cross site scripting

Cross-site scripting XSS vulnerability in function.php in Zenphoto 1.1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the "request logging" feature. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

Multiple vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: "CoolURI" cooluri, "Reset backend password" cwtresetbepassword, "datamints Newsticker" datamintsnewsticker, "Gobernalia Front End News Submitter" gbfenewssubmit, "Mailform" mailform, "Myth download" mythdownloa...

Researcher Shows Killbit is No Defense on MsVidCtl Flaw

Ryan Smith, one of the researchers who found the bug in the Microsoft MsVidCtl DLL that the vendor is rushing to patch this week, has posted a short video demonstration of a technique that bypasses the stop-gap solution of preventing the vulnerable ActiveX control from loading. In the demo, Smith...

CVE-2009-2559

Buffer overflow in the IPMI dissector in Wireshark 1.2.0 allows remote attackers to cause a denial of service crash via unspecified vectors related to an array index error. NOTE: some of these details are obtained from third party information...

CVE-2009-2546

Directory traversal vulnerability in Advanced Electron Forum AEF 1.x allows remote attackers to determine the existence of arbitrary files via the avatargalfile parameter when changing an avatar, which leaks the existence of the file in an error message. NOTE: the provenance of this information i...

Month Of Twitter Bugs - Twitiq XSRF/XSS

Friday, July 10, 2009 MoTB 10: CSRF+XSS vulnerabilities in Twitiq What is Twitiq "TwitIQ is an enhanced Twitter interface that provides insight into your Twitter stream and Twitter followers." Twitiq home page Twitter effect Twitiq can be used to send tweets, direct messages and follow/unfollow...

CVE-2009-2455

Multiple cross-site scripting XSS vulnerabilities in webadmin/admin.php in @mail 5.6.1 allow remote attackers to inject arbitrary web script or HTML via the 1 type and 2 func parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in webadmin/admin.php in @mail 5.6.1 allow remote attackers to inject arbitrary web script or HTML via the 1 type and 2 func parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...