Microsoft Management Console Zone Bypass Vulnerability

Description Microsoft Management Console MMC is prone to a cross-zone scripting vulnerability because the operating system fails to properly restrict access to MMC components, allowing the MMC files to be referenced from the Internet Zone in some cases. Exploiting this vulnerability could let an...

CVE-2006-3540

Check Point Zone Labs ZoneAlarm Internet Security Suite 6.5.722.000, 6.1.737.000, and possibly other versions do not properly validate RegSaveKey, RegRestoreKey, and RegDeleteKey function calls, which allows local users to cause a denial of service system crash via a certain combination of these...

CVE-2006-3540

Check Point Zone Labs ZoneAlarm Internet Security Suite 6.5.722.000, 6.1.737.000, and possibly other versions do not properly validate RegSaveKey, RegRestoreKey, and RegDeleteKey function calls, which allows local users to cause a denial of service system crash via a certain combination of these...

CVE-2006-3540: Undefined Security Weakness

Check Point Zone Labs ZoneAlarm Internet Security Suite 6.5.722.000, 6.1.737.000, and possibly other versions do not properly validate RegSaveKey, RegRestoreKey, and RegDeleteKey function calls, which allows local users to cause a denial of service system crash via a certain combination of these...

CVE-2006-3494

Multiple cross-site scripting XSS vulnerabilities in Buddy Zone 1.0.1 allow remote attackers to inject arbitrary HTML and web script via the 1 catid parameter to a viewclassifieds.php; 2 id parameter in b viewad.php; 3 eventid parameter in c viewevent.php, d deleteevent.php, and e editevent.php;...

CVE-2006-3494

CVE-2006-3494 affects Buddy Zone 1.0.1 and is described in multiple sources as cross-site scripting (XSS) vulnerabilities. The affected functionality involves user-supplied parameters that can be manipulated to inject arbitrary HTML/script: (1) cat_id in view_classifieds.php; (2) id in view_ad.ph...

CVE-2006-3494

Multiple cross-site scripting XSS vulnerabilities in Buddy Zone 1.0.1 allow remote attackers to inject arbitrary HTML and web script via the 1 catid parameter to a viewclassifieds.php; 2 id parameter in b viewad.php; 3 eventid parameter in c viewevent.php, d deleteevent.php, and e editevent.php;...

CVE-2006-3494: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Buddy Zone 1.0.1 allow remote attackers to inject arbitrary HTML and web script via the 1 catid parameter to a viewclassifieds.php; 2 id parameter in b viewad.php; 3 eventid parameter in c viewevent.php, d deleteevent.php, and e editevent.php;...

buddyzone101.txt

Buddy Zone Version 1.0.1 Homepage: http://www.vastal.com/buddy-zone-social-networking-script.html Affected files: Sending invitations Profiles Blogs Journals Posting comments Posting in the forum Sending mail Creating a group viewsubforum.php viewpost.php viewclassifieds.php viewad.php...

Cross site scripting

Cross-Application Scripting XAS vulnerability in ICQ Client 5.04 build 2321 and earlier allows remote attackers to inject arbitrary web script from one application into another via a banner, which is processed in the My Computer zone using the Internet Explorer COM object...

CVE-2006-2303

Cross-Application Scripting XAS vulnerability in ICQ Client 5.04 build 2321 and earlier allows remote attackers to inject arbitrary web script from one application into another via a banner, which is processed in the My Computer zone using the Internet Explorer COM object...

CVE-2006-2303: Undefined Security Weakness

Cross-Application Scripting XAS vulnerability in ICQ Client 5.04 build 2321 and earlier allows remote attackers to inject arbitrary web script from one application into another via a banner, which is processed in the My Computer zone using the Internet Explorer COM object...

ICQ Client Cross-Application Scripting (XAS)

ICQ Client Cross-Application Scripting XAS by [email protected] Severity: Low Potential Impact: Remote script execution ICQ client in some condition is vulnerable to remote script injection into used Internet Explorer in My Computer Security Zone. Detailed description quote...

ICQ client cross application scripting

It's possible to inject script code into banner window to execute code in My Computer security zone...

Microsoft Internet Explorer Erroneous IOleClientSite Data Zone Bypass Vulnerability

Description Microsoft Internet Explorer is prone to a zone-bypass vulnerability because the browser returns erroneous IOleClientSite when dynamically creating an embedded object. This could cause malicious script code to be executed in a security zone with fewer restrictions than the zone that th...

CVE-2006-1275

GGZ Gaming Zone 0.0.12 allows remote attackers to cause a denial of service client disconnect via inputs that produce malformed XML, including 1 trailing ' apostrophe character on the ID attribute in a PLAYER XML tag, 2 joining with a long ID attribute or non-trailing ' characters, which causes a...

CVE-2006-1275

GGZ Gaming Zone 0.0.12 allows remote attackers to cause a denial of service client disconnect via inputs that produce malformed XML, including 1 trailing ' apostrophe character on the ID attribute in a PLAYER XML tag, 2 joining with a long ID attribute or non-trailing ' characters, which causes a...

CVE-2006-1275

GGZ Gaming Zone 0.0.12 is affected by CVE-2006-1275. The vulnerability allows remote attackers to cause a denial of service (client disconnect) through malformed XML inputs: (1) a trailing apostrophe in the ID attribute of a PLAYER XML tag, (2) a long ID attribute or non-trailing apostrophes that...

CVE-2006-1275: Undefined Security Weakness

GGZ Gaming Zone 0.0.12 allows remote attackers to cause a denial of service client disconnect via inputs that produce malformed XML, including 1 trailing ' apostrophe character on the ID attribute in a PLAYER XML tag, 2 joining with a long ID attribute or non-trailing ' characters, which causes a...

CVE-2006-1221

Untrusted search path vulnerability in the TrueVector service VSMON.exe in Zone Labs ZoneAlarm 6.x and Integrity does not search ZoneAlarm's own folders before other folders that are specified in a user's PATH, which might allow local users to execute code as SYSTEM by placing malicious DLLs into...