CVE-2004-2133

Certain third-party packages for CVSup 16.1h, such as SuSE Linux, contain untrusted paths in the ELF RPATH fields of certain executables, which could allow local users to execute arbitrary code by causing cvsup to link against malicious libraries that are created in world-writable directories suc...

BookReview 1.0 Multiple Script XSS

The remote host is running the BookReview software. The remote version of this software is vulnerable to multiple cross-site scripting attacks due to a lack of sanitization of user-supplied data. Successful exploitation of this issue may allow an attacker to use the remote server to perform an...

CVE-2005-1244

NetIQ Security Manager / iSeries Security Solutions (NetIQ) are affected by a directory traversal vulnerability in a third‑party tool used to secure the iSeries AS/400 FTP server. The issue allows access to arbitrary files (including qsys.lib) via ".." sequences in GET requests to the /api/ftp en...

CVE-2005-1239

CVE-2005-1239 describes a directory-traversal flaw in Raz‑Lee’s third‑party tool used with the iSeries (AS/400) FTP server. The vulnerability allows remote attackers to access arbitrary files, including those in qsys.lib, by sending crafted "." sequences in a GET request. Publicly available refer...

CVE-2005-0658

TYPO3 (CMS) vulnerable via a third‑party extension, cmw_linklist, to SQL injection through the category_uid parameter. The CVE description identifies the vulnerable component as a TYPO3 extension (third‑party) and notes that remote attackers can execute arbitrary SQL commands, implying remote, un...

TYPO3 Security Bulletin

An issue has been reported where a bug in the "cmwlinklist" extension allows SQL injection attacks. In specific situations, a remote offender can cause malicious database operations. Component Type: Third Party Extension. This extension is third party code that has not been submitted to the TYPO3...

USN-83-1: LessTif 2 vulnerabilities

Several vulnerabilities have been found in the XPM image decoding functions of the LessTif library. If an attacker tricked a user into loading a malicious XPM image with an application that uses LessTif, he could exploit this to execute arbitrary code in the context of the user opening the image...

CVE-2004-1312

A bug in the HTML parser in a certain Microsoft HTML library, as used in various third party products, may allow remote attackers to cause a denial of service via certain strings, as reported in GFI MailEssentials for Exchange 9 and 10, and GFI MailSecurity for Exchange 8, which causes emails to...

Vulnerability not with vBulletin

The vulnerability listed here is in a third-party 'hack' script, which is not part of vBulletin itself, and is beyond the control of the vBulletin developers. Kier Darby Product Manager, vBulletin From: "Dr. Death" To: [email protected] Subject: SQL injection in vBulletin forums last10.ph...

Microsoft Windows GDI+ contains a buffer overflow vulnerability in the JPEG parsing component

Overview A buffer overflow vulnerability in the Microsoft Windows GDI+ JPEG parsing component could allow a remote attacker to execute arbitrary code on a vulnerable system. Description Microsoft Windows Graphics Device Interface GDI+ is an application programming interface API that provides...

CVE-2002-0842

CVE-2002-0842 is a format-string vulnerability in Oracle’s mod_dav extension (used for logging gateway errors) that could enable remote code execution via a crafted destination URI triggering a 502 Bad Gateway. The vulnerability affects Oracle9i Application Server 9.0.2 (and related mod_dav code ...

NetBSD Security Advisory 2004-006: TCP protocol and implementation vulnerability

-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 2004-006 ================================= Topic: TCP protocol and implementation vulnerability Version: NetBSD-current: source prior to April 22, 2004 NetBSD 2.0: branch affected, release will include the fix NetBSD 1.6.2: affected NetB...

WMAPM 3.1 - Local Privilege Escalation

WMAPM 3.1 - Local Privilege Escalation source: https://www.securityfocus.com/bid/8995/info wmapm has been reported prone to a local privilege escalation vulnerability. The vulnerability has been conjectured to result from a lack of relative path usage while the vulnerable dock app is invoking a...

myPHPcalendar Multiple Scripts cal_dir Parameter Remote File Inclusion

The remote web server appears to be hosting myPHPCalender. The installed version contains a vulnerability that could allow an attacker to make the remote host include php files hosted on a third party server. An attacker may use this flaw to inject arbitrary code in the remote host and gain a she...

Nokia Electronic Documentation 5.0 - Connection redirection

Nokia Electronic Documentation 5.0 - Connection redirection source: https://www.securityfocus.com/bid/8625/info A vulnerability has been discovered in Nokia Electronic Documentation NED that may allow an attacker to redirect connections to a third party system. The problem likely occurs due to th...

Nokia Electronic Documentation 5.0 - Connection redirection

source: https://www.securityfocus.com/bid/8625/info A vulnerability has been discovered in Nokia Electronic Documentation NED that may allow an attacker to redirect connections to a third party system. The problem likely occurs due to the NED server failing to sufficiently verify hosts provided...

Restricted Zone: the OUTLOOK EXPRESS

Tuesday, 20 May, 2003 Silent delivery and installation of an executable on a target computer. No client input other than opening an email or newsgroup post. This can be achieved with the default setting of Outlook Express: RESTRICTED ZONE. Technically the following never worked, cannot work,...

EUVD-2003-0111

Microsoft Internet Explorer 5.01, 5.5 and 6.0 does not properly check parameters that are passed during third party rendering, which could allow remote attackers to execute arbitrary web script, aka the "Third Party Plugin Rendering" vulnerability, a different vulnerability than CVE-2003-0233...

CVE-2003-0115

Microsoft Internet Explorer 5.01, 5.5 and 6.0 are affected by CVE-2003-0115 due to improper validation of parameters during third-party rendering, enabling remote script execution. OpenVAS entries identify the issue as part of the IE cumulative patch set (890923) and MS05-020, with guidance that ...

CVE-2003-0115

Microsoft Internet Explorer 5.01, 5.5 and 6.0 does not properly check parameters that are passed during third party rendering, which could allow remote attackers to execute arbitrary web script, aka the "Third Party Plugin Rendering" vulnerability, a different vulnerability than CVE-2003-0233...