CVE-2009-0858

The responseaddname function in response.c in Daniel J. Bernstein djbdns 1.05 and earlier does not constrain offsets in the required manner, which allows remote attackers, with control over a third-party subdomain served by tinydns and axfrdns, to trigger DNS responses containing arbitrary record...

CVE-2008-6445

Unspecified vulnerability in YourPlace before 1.0.1 has unknown impact and attack vectors, possibly related to improper authentication and the ability to upload arbitrary PHP code. NOTE: some of these details are obtained from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in ScriptsEz Ez PHP Comment allows remote attackers to inject arbitrary web script or HTML via the name parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Heap overflow

Heap-based buffer overflow in genmsn.dll in the genmsn plugin 0.31 for Winamp 5.541 allows remote attackers to execute arbitrary code via a playlist .pls file with a long URL in the File1 field. NOTE: some of these details are obtained from third party information...

Multiple vulnerabilities in TYPO3 third party extensions

Several vulnerabilities have been found in the following third party TYPO3 extensions: "Accessibility Glossary" a21glossary, "Calendar Base" cal, "Flat Manager" flatmgr Release Date: March 05, 2009 Please read first: This Collective Security Bulletin CSB is a listing of vulnerable extensions with...

FTC: ID theft cases surge

The number of identification theft cases surged in 2008, according to a report .pdf based on the Federal Trade Commission’s annual data. In 2008, ID theft was by far the biggest complaint to the FTC, representing 26 percent of complaints. The next biggest complaint — third party and creditor debt...

CVE-2008-6274

Multiple SQL injection vulnerabilities in index.php in FamilyProject 2.0 allow remote attackers to execute arbitrary SQL commands via 1 the logmbr parameter aka login field or 2 the mdpmbr parameter aka pass or "Mot de passe" field. NOTE: some of these details are obtained from third party...

CVE-2009-0729

Multiple directory traversal vulnerabilities in Page Engine CMS 2.0 Basic and Pro allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the fPrefix parameter to 1 modules/recentpollinclude.php, 2 modules/logininclude.php, and 3...

Directory traversal

Multiple directory traversal vulnerabilities in Page Engine CMS 2.0 Basic and Pro allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the fPrefix parameter to 1 modules/recentpollinclude.php, 2 modules/logininclude.php, and 3...

Improper access control

Downloadcenter 2.1 stores common.h under the web root with insufficient access control, which allows remote attackers to obtain user credentials and other sensitive information via a direct request. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2009-0710

Multiple cross-site scripting XSS vulnerabilities in PHPFootball 1.6 allow remote attackers to inject arbitrary web script or HTML via 1 the user parameter to login.php or 2 the dbfield parameter to filter.php. NOTE: the provenance of this information is unknown; the details are obtained solely...

The virtual machine software of the vulnerability and the virtual machine execution environment detection and anti-detection-vulnerability warning-the black bar safety net

1, The most recent occurring on virtual machine software of the vulnerability VM is the product of the vulnerability has some peculiarities, related to several operating environment, such as a masteroperating system, a guestoperating system, there is a more special is its virtual machine Manager...

CVE-2008-6206

Multiple PHP remote file inclusion vulnerabilities in RobotStats 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the DOCUMENTROOT parameter to 1 graph.php and 2 robotstats.inc.php. NOTE: the provenance of this information is unknown; the details are obtained solely from thir...

CVE-2008-6208

Cross-site scripting XSS vulnerability in submitnews.php in e107 CMS 0.7.11 allows remote attackers to inject arbitrary web script or HTML via the 1 authorname, 2 itemtitle, and 3 item parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third part...

Cross site scripting

Cross-site scripting XSS vulnerability in admin.php in Php-Stats 0.1.9.1 allows remote attackers to inject arbitrary web script or HTML via the 1 selmese and 2 selanno parameters in a systems action. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

Cross site scripting

Cross-site scripting XSS vulnerability in seeurl.php in Xavier Flahaut URLStreet 1.0 allows remote attackers to inject arbitrary web script or HTML via the 1 language, 2 order, and 3 filter parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in PhpForums.net mcGallery 1.1 allow remote attackers to inject arbitrary web script or HTML via the lang parameter to 1 admin.php, 2 index.php, 3 sess.php, 4 stats.php, 5 detail.php, 6 resize.php, and 7 show.php. NOTE: the provenance of this...

CVE-2008-6205

Cross-site scripting XSS vulnerability in seeurl.php in Xavier Flahaut URLStreet 1.0 allows remote attackers to inject arbitrary web script or HTML via the 1 language, 2 order, and 3 filter parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2008-6201

Directory traversal vulnerability in help.php in the eskuel module in KwsPHP 1.3.456, as available before 20080416, allows remote attackers to execute arbitrary commands via the action parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-0548

Cross-site scripting XSS vulnerability in the Additional Report Settings interface in ESET Remote Administrator before 3.0.105 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information...