CVE-2008-6146: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in pm.php in DeluxeBB 1.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via a delete parameter in a Delete action, a different vector than CVE-2005-2989...

CVE-2008-4562: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the ovlaunch CGI program in HP OpenView Network Node Manager OV NNM 7.01, 7.51, and 7.53 on Windows allows remote attackers to execute arbitrary code via a crafted Host parameter. NOTE: this issue may be partially covered by CVE-2009-0205...

CVE-2009-0357: Undefined Security Weakness

Mozilla Firefox before 3.0.6 and SeaMonkey before 1.1.15 do not properly restrict access from web pages to the 1 Set-Cookie and 2 Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly...

CVE-2009-0349: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in FTPShell Server 4.3 allows user-assisted remote attackers to cause a denial of service persistent daemon crash and possibly execute arbitrary code via a long string in a licensing key aka .key file...

CVE-2009-0322: Undefined Security Weakness

drivers/firmware/dellrbu.c in the Linux kernel before 2.6.27.13, and 2.6.28.x before 2.6.28.2, allows local users to cause a denial of service system crash via a read system call that specifies zero bytes from the 1 imagetype or 2 packetsize file in /sys/devices/platform/dellrbu/...

CVE-2008-5961: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Tribiq CMS Community 5.0.10B and 5.0.11E allows remote attackers to inject arbitrary web script or HTML via the cID parameter in a document action. NOTE: the provenance of this information is unknown; the details are obtained solely from thir...

CVE-2008-5916: Undefined Security Weakness

gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before 1.5.5.6, 1.5.4.x before 1.5.4.7, and other versions after 1.4.3 allows local repository owners to execute arbitrary commands by modifying the diff.external configuration variable and executing a craft...

CVE-2008-3997: Undefined Security Weakness

Unspecified vulnerability in the Oracle OLAP component in Oracle Database 10.1.0.5 and 10.2.0.3 allows remote authenticated users to affect availability, related to SYS.DBMSXSOQODBO...

CVE-2009-0111: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in frontpage.php in Goople CMS 1.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2009-0066: Undefined Security Weakness

Multiple unspecified vulnerabilities in Intel system software for Trusted Execution Technology TXT allow attackers to bypass intended loader integrity protections, as demonstrated by exploitation of tboot. NOTE: as of 20090107, the only disclosure is a vague pre-advisory with no actionable...

CVE-2008-5815: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Acomment.php in phpAlumni allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2008-5490: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in PHPStore Yahoo Answers allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2008-5079: Undefined Security Weakness

net/atm/svc.c in the ATM subsystem in the Linux kernel 2.6.27.8 and earlier allows local users to cause a denial of service kernel infinite loop by making two calls to svclisten for the same socket, and then reading a /proc/net/atm/vc file, related to corruption of the vcc table...

CVE-2008-5290: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in fulltxt.php in Werner Hilversum Clean CMS 1.5 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2008-5265: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in TNT Forum 0.9.4, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the modulo parameter...

CVE-2007-0073: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a file read operation over RPC...

CVE-2008-4737: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wholite.cgi in WhoDomLite 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the dom parameter...

CVE-2008-3862: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in CGI programs in the server in Trend Micro OfficeScan 7.3 Patch 4 build 1367 and other builds before 1374, and 8.0 SP1 Patch 1 before build 3110, allows remote attackers to execute arbitrary code via an HTTP POST request containing crafted form data, related to...

CVE-2008-4619: Undefined Security Weakness

The RPC subsystem in Sun Solaris 9 allows remote attackers to cause a denial of service daemon crash via a crafted request to procedure 8 in program 100000 rpcbind, related to the XDRDECODE operation and the taddr2uaddr function. NOTE: this might be a duplicate of CVE-2007-0165...

CVE-2008-2439: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the UpdateAgent function in TmListen.exe in the OfficeScanNT Listener service in the client in Trend Micro OfficeScan 7.3 Patch 4 build 1367 and other builds before 1372, OfficeScan 8.0 SP1 before build 1222, OfficeScan 8.0 SP1 Patch 1 before build 3087, and...

CVE-2008-4301: Undefined Security Weakness

A certain ActiveX control in iisext.dll in Microsoft Internet Information Services IIS allows remote attackers to set a password via a string argument to the SetPassword method. NOTE: this issue could not be reproduced by a reliable third party. In addition, the original researcher is unreliable...

CVE-2008-3632: Undefined Security Weakness

Use-after-free vulnerability in WebKit in Apple iPod touch 1.1 through 2.0.2, and iPhone 1.0 through 2.0.2, allows remote attackers to execute arbitrary code or cause a denial of service application crash via a web page with crafted Cascading Style Sheets CSS import statements...

CVE-2008-3935: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in DIC shopv50 3.0 and earlier and shopv52 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-3765: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in code.php in Quick Poll Script allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2008-3653: Undefined Security Weakness

Multiple unspecified vulnerabilities in TikiWiki CMS/Groupware before 2.0 have unknown impact and attack vectors...

CVE-2008-3379: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Snark VisualPic 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the pic parameter to the default URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-3385: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in include/headchat.inc.php in php Help Agent 1.0 and 1.1 Full allows remote attackers to include and execute arbitrary local files via a .. dot dot in the content parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a U...

CVE-2008-3259: Exposure of Sensitive Information to an Unauthorized Actor

OpenSSH before 5.1 sets the SOREUSEADDR socket option when the X11UseLocalhost configuration setting is disabled, which allows local users on some platforms to hijack the X11 forwarding port via a bind to a single IP address, as demonstrated on the HP-UX platform...

CVE-2008-2578: Undefined Security Weakness

Unspecified vulnerability in the WebLogic Server component in Oracle BEA Product Suite 10.0 and 9.2 MP1 has unknown impact and local attack vectors...

CVE-2008-2462: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the viewfile documentation command in Caucho Resin before 3.0.25, and 3.1.x before 3.1.4, allows remote attackers to inject arbitrary web script or HTML via the file parameter...

CVE-2008-2486: Undefined Security Weakness

Unspecified vulnerability in eMule Plus before 1.2d has unknown impact and attack vectors related to "staticservers.dat processing."...

CVE-2008-2414: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in sendemail.php in AN Guestbook ANG 0.4 allows remote attackers to inject arbitrary web script or HTML via the postid parameter...

CVE-2008-2273: Undefined Security Weakness

Unspecified vulnerability in the TACACS authentication component in Aruba Mobility Controller 3.1.x, 3.2.x, and 3.3.x allows remote authenticated users to gain privileges via unknown vectors...

CVE-2008-2126: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Tux CMS 0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 q parameter to index.php and the 2 returnURL parameter to tux-login.php...

CVE-2008-2018: Exposure of Sensitive Information to an Unauthorized Actor

The AssignUser function in template.class.php in PHPizabi 0.848b C1 HFP3 performs unsafe macro expansions on strings delimited by '' and '' characters, which allows remote authenticated users to obtain sensitive information via a comment containing a macro, as demonstrated by a "user.password"...

CVE-2008-1998: Undefined Security Weakness

The NNSTAT aka SYSPROC.NNSTAT procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter...

CVE-2008-1734: Improper Input Validation

Interpretation conflict in PHP Toolkit before 1.0.1 on Gentoo Linux might allow local users to cause a denial of service PHP outage and read contents of PHP scripts by creating a file with a one-letter lowercase alphabetic name, which triggers interpretation of a certain unquoted a-z argument as ...

CVE-2008-1705: Use of Externally-Controlled Format String

Format string vulnerability in the logging function in IBM solidDB 06.00.1018 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the 1 user name, 2 peer name, and possibly unspecified other fields...

CVE-2008-1564: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Dan Costin File Transfer before 1.2f allows remote attackers to read arbitrary files via a ".." dot dot backslash in the filename...

CVE-2008-1426: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in album.asp in KAPhotoservice allows remote attackers to execute arbitrary SQL commands via the albumid parameter...

CVE-2008-1248: Cross-Site Request Forgery (CSRF)

The web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to make arbitrary phone calls via the "Call a number" field. NOTE: this might overlap CVE-2007-3440...

CVE-2008-1192: Undefined Security Weakness

Unspecified vulnerability in the Java Plug-in for Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier; and SDK and JRE 1.4.216 and earlier, and 1.3.121 and earlier; allows remote attackers to bypass the same origin policy and "execute local applications" via unknown vectors...

CVE-2003-1548: Exposure of Sensitive Information to an Unauthorized Actor

MyABraCaDaWeb 1.0.2 and earlier allows remote attackers to obtain sensitive information via an invalid IDAdmin or other parameter, which reveals the installation path in an error message...

CVE-2008-1182: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in BSD Perimeter pfSense before 1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-0904: Exposure of Sensitive Information to an Unauthorized Actor

Unspecified vulnerability in the download servlet in BEA Plumtree Collaboration 4.1 through SP2 and AquaLogic Interaction 4.2 through MP1 allows remote attackers to read arbitrary files via a crafted URL...

CVE-2008-0805: Undefined Security Weakness

Unrestricted file upload vulnerability in image.php in PHPizabi 0.848b C1 HFP1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension from the event page, then accessing it via a direct request to the file in system/cache/pictures...

CVE-2008-0658: Undefined Security Weakness

slapd/back-bdb/modrdn.c in the BDB backend for slapd in OpenLDAP 2.3.39 allows remote authenticated users to cause a denial of service daemon crash via a modrdn operation with a NOOP LDAPXNOOPERATION control, a related issue to CVE-2007-6698...

CVE-2008-0621: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in SAPLPD 6.28 and earlier included in SAP GUI 7.10 and SAPSprint before 1018 allows remote attackers to execute arbitrary code via long arguments to the 1 0x01, 2 0x02, 3 0x03, 4 0x04, and 5 0x05 LPD commands...

CVE-2007-6548: Improper Control of Generation of Code

Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code via the 1 header and 2 footer parameters to modules/system/admin.php in a meta-generator action, 3 the disclaimer parameter to modules/system/admin.p...

CVE-2007-6094: Improper Input Validation

The IPsec module in the VPN component in Ingate Firewall before 4.6.0 and SIParator before 4.6.0 allows remote attackers to cause a denial of service module crash via an IPsec Phase 2 proposal that lacks Perfect Forward Secrecy PFS...