CVE-2005-0658

TYPO3 (CMS) vulnerable via a third‑party extension, cmw_linklist, to SQL injection through the category_uid parameter. The CVE description identifies the vulnerable component as a TYPO3 extension (third‑party) and notes that remote attackers can execute arbitrary SQL commands, implying remote, un...

TYPO3 Security Bulletin

An issue has been reported where a bug in the "cmwlinklist" extension allows SQL injection attacks. In specific situations, a remote offender can cause malicious database operations. Component Type: Third Party Extension. This extension is third party code that has not been submitted to the TYPO3...

USN-83-1: LessTif 2 vulnerabilities

Several vulnerabilities have been found in the XPM image decoding functions of the LessTif library. If an attacker tricked a user into loading a malicious XPM image with an application that uses LessTif, he could exploit this to execute arbitrary code in the context of the user opening the image...

CVE-2004-1312

A bug in the HTML parser in a certain Microsoft HTML library, as used in various third party products, may allow remote attackers to cause a denial of service via certain strings, as reported in GFI MailEssentials for Exchange 9 and 10, and GFI MailSecurity for Exchange 8, which causes emails to...

Vulnerability not with vBulletin

The vulnerability listed here is in a third-party 'hack' script, which is not part of vBulletin itself, and is beyond the control of the vBulletin developers. Kier Darby Product Manager, vBulletin From: "Dr. Death" To: [email protected] Subject: SQL injection in vBulletin forums last10.ph...

Microsoft Windows GDI+ contains a buffer overflow vulnerability in the JPEG parsing component

Overview A buffer overflow vulnerability in the Microsoft Windows GDI+ JPEG parsing component could allow a remote attacker to execute arbitrary code on a vulnerable system. Description Microsoft Windows Graphics Device Interface GDI+ is an application programming interface API that provides...

CVE-2002-0842

CVE-2002-0842 is a format-string vulnerability in Oracle’s mod_dav extension (used for logging gateway errors) that could enable remote code execution via a crafted destination URI triggering a 502 Bad Gateway. The vulnerability affects Oracle9i Application Server 9.0.2 (and related mod_dav code ...

NetBSD Security Advisory 2004-006: TCP protocol and implementation vulnerability

-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 2004-006 ================================= Topic: TCP protocol and implementation vulnerability Version: NetBSD-current: source prior to April 22, 2004 NetBSD 2.0: branch affected, release will include the fix NetBSD 1.6.2: affected NetB...

WMAPM 3.1 - Local Privilege Escalation

WMAPM 3.1 - Local Privilege Escalation source: https://www.securityfocus.com/bid/8995/info wmapm has been reported prone to a local privilege escalation vulnerability. The vulnerability has been conjectured to result from a lack of relative path usage while the vulnerable dock app is invoking a...

myPHPcalendar Multiple Scripts cal_dir Parameter Remote File Inclusion

The remote web server appears to be hosting myPHPCalender. The installed version contains a vulnerability that could allow an attacker to make the remote host include php files hosted on a third party server. An attacker may use this flaw to inject arbitrary code in the remote host and gain a she...

Nokia Electronic Documentation 5.0 - Connection redirection

Nokia Electronic Documentation 5.0 - Connection redirection source: https://www.securityfocus.com/bid/8625/info A vulnerability has been discovered in Nokia Electronic Documentation NED that may allow an attacker to redirect connections to a third party system. The problem likely occurs due to th...

Nokia Electronic Documentation 5.0 - Connection redirection

source: https://www.securityfocus.com/bid/8625/info A vulnerability has been discovered in Nokia Electronic Documentation NED that may allow an attacker to redirect connections to a third party system. The problem likely occurs due to the NED server failing to sufficiently verify hosts provided...

Restricted Zone: the OUTLOOK EXPRESS

Tuesday, 20 May, 2003 Silent delivery and installation of an executable on a target computer. No client input other than opening an email or newsgroup post. This can be achieved with the default setting of Outlook Express: RESTRICTED ZONE. Technically the following never worked, cannot work,...

CVE-2003-0115

Microsoft Internet Explorer 5.01, 5.5 and 6.0 are affected by CVE-2003-0115 due to improper validation of parameters during third-party rendering, enabling remote script execution. OpenVAS entries identify the issue as part of the IE cumulative patch set (890923) and MS05-020, with guidance that ...

EUVD-2003-0111

Microsoft Internet Explorer 5.01, 5.5 and 6.0 does not properly check parameters that are passed during third party rendering, which could allow remote attackers to execute arbitrary web script, aka the "Third Party Plugin Rendering" vulnerability, a different vulnerability than CVE-2003-0233...

CVE-2003-0115

Microsoft Internet Explorer 5.01, 5.5 and 6.0 does not properly check parameters that are passed during third party rendering, which could allow remote attackers to execute arbitrary web script, aka the "Third Party Plugin Rendering" vulnerability, a different vulnerability than CVE-2003-0233...

CVE-2003-0115: Undefined Security Weakness

Microsoft Internet Explorer 5.01, 5.5 and 6.0 does not properly check parameters that are passed during third party rendering, which could allow remote attackers to execute arbitrary web script, aka the "Third Party Plugin Rendering" vulnerability, a different vulnerability than CVE-2003-0233...

Microsoft Security Bulletin MS03-015: Cumulative Patch for Internet Explorer (813489)

-----BEGIN PGP SIGNED MESSAGE----- - ------------------------------------------------------------------- Title: Cumulative Patch for Internet Explorer 813489 Date: 23 April 2003 Software: Microsoft c Internet Explorer Impact: Run code of the attacker's choice on a user's machine. Max Risk: Critic...

CVE-2002-2301

Lawson Financials 8.0, when configured to use a third party relational database, stores usernames and passwords in a world-readable file, which allows local users to read the passwords and log onto the database...

FreeBSD-SN-02:06

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SN-02:06 Security Notice The FreeBSD Project Topic: security issues in ports Announced: 2002-10-10 I. Introduction Several ports in the FreeBSD Ports Collection are affected by...