[SA18361] Joomla! vCard Email Address Disclosure and TinyMCE Compressor Vulnerabilities

TITLE: Joomla! vCard Email Address Disclosure and TinyMCE Compressor Vulnerabilities SECUNIA ADVISORY ID: SA18361 VERIFY ADVISORY: http://secunia.com/advisories/18361/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting, Exposure of sensitive information WHERE: From remote SOFTWARE: Joomla...

CVE-2006-0114

The vCard functions in Joomla! 1.0.5 use predictable sequential IDs for vcards and do not restrict access to them, which allows remote attackers to obtain valid e-mail addresses to conduct spam attacks by modifying the contactid parameter to index2.php...

Design/Logic Flaw

The vCard functions in Joomla! 1.0.5 use predictable sequential IDs for vcards and do not restrict access to them, which allows remote attackers to obtain valid e-mail addresses to conduct spam attacks by modifying the contactid parameter to index2.php...

CVE-2006-0114

The CVE-2006-0114 entry concerns Joomla! 1.0.5 vCard handling. The affected component is Joomla!’s vCard functionality, which uses predictable, sequential vCard IDs and does not restrict access, enabling remote attackers to discover valid e-mail addresses by altering the contact_id parameter to i...

CVE-2006-0114

The vCard functions in Joomla! 1.0.5 use predictable sequential IDs for vcards and do not restrict access to them, which allows remote attackers to obtain valid e-mail addresses to conduct spam attacks by modifying the contactid parameter to index2.php...

CVE-2005-4769

SQL injection vulnerability in addrbook.php in Belchior Foundry vCard PRO 3.1 allows remote attackers to execute arbitrary SQL commands via the addrid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

vCard define.inc.php match Parameter Remote File Inclusion

The remote host appears to be running vCard, a web-based electronic postcard application from Belchior Foundry and written in PHP. The version of vCard installed on the remote host fails to sanitize the 'match' parameter before using it in the 'admin/define.inc.php' script to read other files. By...

Belchior Foundry vCard Pro 3.1 - Addrbook.php SQL Injection

Belchior Foundry vCard Pro 3.1 - Addrbook.php SQL Injection source: https://www.securityfocus.com/bid/15254/info vCard PRO is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query...

Belchior Foundry vCard Pro 3.1 - 'Addrbook.php' SQL Injection

source: https://www.securityfocus.com/bid/15254/info vCard PRO is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of the...

Remote File Inclusion in vCard :)

Remote File Inclusion in :- -------------------------- vCard Date :- ------ 26/10/2005 version :- --------- 2.9 The bug reside in :- ------------------- define.inc.php And error in :- -------------- online.inc.php search google :- --------------- powered by vCard 2.9 & allinurl:vCard Exploit :-...

vCard29.txt

Remote File Inclusion in :- -------------------------- vCard Date :- ------ 26/10/2005 version :- --------- 2.9 The bug reside in :- ------------------- define.inc.php And error in :- -------------- online.inc.php search google :- --------------- powered by vCard 2.9 & allinurl:vCard Exploit :-...

CVE-2005-3332

PHP remote file include vulnerability in admin/define.inc.php in Belchior Foundry vCard 2.9 allows remote attackers to execute arbitrary PHP code via the match parameter...

CVE-2005-3265

Buffer overflow in Skype for Windows 1.1.x.0 through 1.4.x.83 allows remote attackers to execute arbitrary code via 1 callto:// and 2 skype:// links, or 3 a non-standard VCARD, possibly due to an underlying error in the SysUtils.WideFmtStr Delphi routine...

CVE-2005-3265

Buffer overflow in Skype for Windows 1.1.x.0 through 1.4.x.83 allows remote attackers to execute arbitrary code via 1 callto:// and 2 skype:// links, or 3 a non-standard VCARD, possibly due to an underlying error in the SysUtils.WideFmtStr Delphi routine...

CVE-2005-3332

Vulnerability (CVE-2005-3332) in Belchior Foundry’s vCard 2.9: PHP remote file include in admin/define.inc.php allows an attacker to execute arbitrary PHP code via the match parameter. Multiple sources (NVD, Red Hat advisory, Nessus plugin) corroborate the flaw and impact. Affected software is th...

Belchior Foundry VCard 2.9 - Remote File Inclusion

Belchior Foundry VCard 2.9 - Remote File Inclusion source: https://www.securityfocus.com/bid/15207/info vCard is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to execute...

Belchior Foundry VCard 2.9 - Remote File Inclusion

source: https://www.securityfocus.com/bid/15207/info vCard is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer...

Skype VCARD handling routine contains a buffer overflow

Overview A buffer overflow in the way Skype handles imported VCARDs may allow a remote attacker to execute code on a vulnerable system. Description Skype software provides telephone service over IP networks. Skype fails to properly validate imported VCARDs, allowing a buffer overflow to occur. Th...

Mandrake Linux Security Advisory : evolution (MDKSA-2005:141)

Multiple format string vulnerabilities in Evolution 1.5 through 2.3.6.1 allow remote attackers to cause a denial of service crash and possibly execute arbitrary code via 1 full vCard data, 2 contact data from remote LDAP servers, or 3 task list data from remote servers. CVE-2005-2549 A format...

SUSE-SA:2005:054: evolution

The remote host is missing the patch for the advisory SUSE-SA:2005:054 evolution. Several format string bugs allowed remote attackers to cause evolution to crash or even execute code via full vCard data, contact data from remote LDAP servers, task list data from remote servers CVE-2005-2549 or...