Multiple vulnerabilities in extension mm_forum

It has been discovered that the extension mmforum is vulnerable to multiple SQL Injection attacks and multiple XSS flaws alongside other vulnerabilities. Component Type: Third party extension. This extension is not part of the TYPO3 default installation. Affected Versions: Version 0.1.2 and all...

Information disclosure

Yana Framework before 2.8.5a allows remote authenticated users with permissions to modify a guestbook profile to modify or delete arbitrary guestbook profiles via unspecified vectors. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Advanced Guestbook 2.4.2 allow remote attackers to execute arbitrary PHP code via a URL in the includepath parameter to 1 index.php, 2 addentry.php, or 3 picture.php, a different set of vectors than CVE-2006-5804. NOTE: this issue has been...

Remote file inclusion

PHP remote file inclusion vulnerability in index.php in FreeForum 0.9.0 allows remote attackers to execute arbitrary PHP code via a URL in the fpath parameter. NOTE: this issue has been disputed by third party researchers, stating that fpath variable is initialized before being used...

Tip-a-friend - Header Injection

A header injection problem has been found in the extension tipafriend Component Type: Third party extension. The extension is not part of the TYPO3 default installation Affected Versions: 1.2.2 and earlier Vulnerability Type: Header Injection Severity: HIGH Problem Description: A problem has been...

NCTsoft NCTAudioFile2 ActiveX Control Remote Buffer Overflow Vulnerability

Description NCTsoft NCTAudioFile2 ActiveX control is prone to a buffer-overflow vulnerability. The software fails to perform sufficient bounds-checking of user-supplied input before copying it to an insufficiently sized memory buffer. NCTAudioEditor is a collection of ActiveX controls for...

CVE-2007-0406

Removed by vendor...

Information disclosure

Unspecified vulnerability in Total Commander before 6.5.6 allows user-assisted remote attackers to delete arbitrary files and corrupt a filesystem via a crafted RAR file. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

Buffer overflow

Buffer overflow in Winzip32.exe in WinZip 9.0 allows local users to cause a denial of service application crash and possibly execute arbitrary code via a long command line argument. NOTE: this issue may cross privilege boundaries if an application automatically invokes Winzip32.exe for untrusted...

Integer overflow

Integer overflow in the ffsmountfs function in Mac OS X 10.4.8 and FreeBSD 6.1 allows local users to cause a denial of service panic and possibly gain privileges via a crafted DMG image that causes "allocation of a negative size buffer" leading to a heap-based buffer overflow, a related issue to...

CVE-2006-6926

Buffer overflow in eXtremail 2.1 has unknown impact and attack vectors, as demonstrated by VulnDisco Pack. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-6926

Buffer overflow in eXtremail 2.1 has unknown impact and attack vectors, as demonstrated by VulnDisco Pack. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-0050

OpenPinboard 2.0 is affected by a PHP remote file inclusion in index.php, exploitable via the language parameter. The underlying issue is contested (variable set before use), with CVE notes indicating a small time window of risk during installation. Affected component: index.php of OpenPinboard 2...

CVE-2006-6855

AIDeX Mini-WebServer 1.1 early release 3 allows remote attackers to cause a denial of service daemon crash via a flood of HTTP GET requests, possibly related to display of HTTP log data by the GUI. NOTE: some of these details are obtained from third party information...

CVE-2006-6915

ftpd in IBM AIX 5.2.0 and 5.3.0 allows remote authenticated users to cause a denial of service port exhaustion via unspecified vectors. NOTE: some details were obtained from third party sources...

CVE-2005-4818

Technical details about CVE-2005-4818 are not publicly provided in the supplied documents. Monitor for updates from sources that disclose affected products, vulnerable components, and fixes; no concrete risk, vectors, or remediation can be specified from current materials.

CVE-2006-6725

Multiple directory traversal vulnerabilities in PHPBuilder 0.0.2 and earlier allow remote attackers to read arbitrary files via a .. dot dot in the filename parameter to 1 lib/htm2php.php and 2 sitetools/htm2php.php. NOTE: The provenance of this information is unknown; the details are obtained...

Multiple Oracle application server vulnerabilities

SQL injections, DoS, data modification, crossite scripting, privilege escalation, audit setings modification. Password is passed from JDeveloper to SQLPlus in cleartext. JDeveloper password is stored in cleartext in different XML configuration files. Cleartext FormBuilder password is stored in...

CVE-2006-6664

Format string vulnerability in Marathon Aleph One before 0.17.1 and 2006-12-17 might allow remote attackers to cause a denial of service application crash or execute arbitrary code via format string specifiers in the TopLevelLogger::logMessageV function in Misc/Logging.cpp. NOTE: some details wer...

CVE-2006-6668

Cross-site scripting XSS vulnerability in VerliAdmin 0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...