23 November 2008

• Friendly Technologies "fwRemoteCfg.dll" ActiveX Control Remote Buffer Overflow

22 November 2008

• cman "fence_egenera" Insecure Temporary File Creation
• Friendly Technologies "fwRemoteCfg.dll" ActiveX Control Arbitrary Command Execution
• Acc Scripts Acc PHP eMail Cookie Authentication Bypass
• IBM Lotus Connections Multiple Remote Vulnerabilities

21 November 2008

• Red Hat Directory Server Accept Language HTTP Headers Buffer Overflow
• Red Hat Directory Server Crafted Search Pattern Denial of Service
• Aegis "aegis.cgi" Insecure Temporary File Creation
• VMware Multiple ActiveX Controls Multiple Unspecified Security Vulnerabilities
• LogMeIn "RACtrl.dll" ActiveX Control Multiple Remote Stack-Based Buffer Overflow Vulnerabilities
• Najdi.si Toolbar "najdisitoolbar.dll" ActiveX Control Remote Buffer Overflow
• Ultra Office Control "HttpUpload()" Method Buffer Overflow
• Multiple ISecSoft Products Multiple IOCTL Request Local Privilege Escalation Vulnerabilities
• VMware VirtualCenter Directory Traversal
• CuteNews aj-fork "path" Parameter Remote File Include
• Adobe ColdFusion Local Information Disclosure and Local Privilege Escalation
• Adobe Flash Player Multiple Security Vulnerabilities
• Aruba Networks ArubaOS SNMP Community String Information Disclosure
• cluster Multiple Insecure Temporary File Creation Vulnerabilities
• Linux Kernel "tvaudio.c" Operations NULL Pointer Dereference Denial of Service
• Micro CMS "microcms-admin-home.php" Security Bypass
• Joomla! Flash Tree Gallery Component Remote File Include
• Absolute News Feed Cookie Authentication Bypass
• Absolute Content Rotator Cookie Authentication Bypass

20 November 2008

• gdrae Insecure Temporary File Creation
• Red Hat Directory Server LDAP Memory Leak Multiple Remote Denial of Service Vulnerabilities
• Friendly Technologies "fwRemoteCfg.dll" ActiveX Control Registry Key Manipulation
• Friendly Technologies "fwRemoteCfg.dll" ActiveX Control Information Disclosure
• Ultra Office Control "Save()" Method Arbitrary File Overwrite
• Orb Networks Orb Unspecified Directory Traversal
• VMware Products Trap Flag In-Guest Privilege Escalation
• Wi-Fi Protected Access (WPA) Encryption Standard TKIP Encryption Bypass
• Sun System Firmware Unspecified Local Information Disclosure
• Multiple Pre Projects Products Cookie Authentication Bypass
• VLC Media Player Multiple Stack Based Buffer Overflow Vulnerabilities
• XWork "ParameterInterceptor" Class OGNL Security Bypass
• FFmpeg "libswscale" Buffer Overflow
• HP Tru64 UNIX AdvFS "showfile" Command Local Privilege Escalation
• Sun Solaris DHCP Denial of Service And Remote Code Execution Vulnerabilities
• Linux Kernel "__scm_destroy()" Local Denial of Service
• Linux Kernel "ndiswrapper" Remote Buffer Overflow
• Linux Kernel VDSO Unspecified Privilege Escalation
• Agavi "cmplang" Parameter Directory Traversal
• Acc Scripts Acc Autos Cookie Authentication Bypass
• Acc Scripts Real Estate and Statistics Cookie Authentication Bypass
• Article Publisher PRO Cookie Authentication Bypass
• NetRisk SQL Injection and Cross-Site Scripting Vulnerabilities
• Absolute Newsletter Cookie Authentication Bypass
• Absolute FAQ Manager .NET Cookie Authentication Bypass
• Sepal SPBOARD "board.cgi" Remote Command Execution

19 November 2008

• Debian Feta "to-upgrade" Plugin Insecure Temporary File Creation
• APTonCD Insecure Temporary File Creation
• PureMessage for Microsoft Exchange RTF Multiple Denial of Service Vulnerabilities
• Openfire Multiple Input Validation Vulnerabilities
• Nagios Unspecified Privilege Escalation
• libcdaudio "cddb.c" Remote Heap Buffer Overflow
• Adobe Acrobat and Reader 8.1.2 Multiple Security Vulnerabilities
• Adobe Reader "util.printf()" JavaScript Function Stack Buffer Overflow
• GnuTLS X.509 Certificate Chain Security Bypass
• Sun Solstice X.25 "/dev/xty" Local Denial of Service
• Linux Kernel "hfsplus_block_allocate()" Local Denial of Service
• Linux Kernel "hfsplus_find_cat()" Local Denial of Service
• Apartment Search Script Arbitrary File Upload and Cross-Site Scripting Vulnerabilities
• Sharedlog CMS Remote File Include
• Dragan Mitic Apoll "admin/index.php" SQL Injection

18 November 2008

• IBM Hardware Management Console RMC Daemon Remote Denial of Service
• Novell Access Manager Local Browser Security Bypass
• libsamplerate Buffer Overflow
• NOS Microsystems getPlus Download Manager ActiveX Control Buffer Overflow
• Maran Project Maran PHP Shop Cookie Authentication Bypass
• Typo SQL Injection and HTML Injection Vulnerabilities
• Venalsur Booking Centre SQL Injection and Cross-Site Scripting Vulnerabilities
• Matpro.de Link "view.php" SQL Injection

17 November 2008

• getPlus Download Manager Unauthorized Access
• SAP AG SAPgui "mdrmsap.dll" ActiveX Control Remote Code Execution
• Microsoft Windows "UnhookWindowsHookEx" Local Denial of Service
• Joovili Cookie Authentication Bypass
• Tribiq CMS "template_path" Parameter Local File Include
• Agora "MysqlfinderAdmin.php" Remote File Include
• Instinct WP e-Commerce "image_processing.php" Arbitrary File Upload
• 7-Shop "imageupload.php" Arbitrary File Upload
• ASP Forum "iFor" Parameter SQL Injection

16 November 2008

• Tribiq CMS Cookie Authentication Bypass

15 November 2008

• Absolute File Send .Net Cookie Authentication Bypass
• YourFreeWorld Downline Builder Pro "id" Parameter SQL Injection
• YourFreeWorld Downline Builder Script "id" Parameter SQL Injection
• Scripts For Sites EZ Auction "viewfaqs.php" SQL Injection

14 November 2008

• Mambo and Joomla! SimpleBoard "image_upload.php" Arbitrary File Upload
• Absolute Poll Manager XE Cookie Authentication Bypass
• Absolute Podcast .NET Cookie Authentication Bypass
• ComingChina.com U-Mail "edit.php" Arbitrary File Upload
• Absolute Form Processor .Net Cookie Authentication Bypass
• Absolute Control Panel XE Cookie Authentication Bypass
• Absolute Control Panel XE Cookie Authentication Bypass
• Absolute News Manager .Net Cookie Authentication Bypass
• YourFreeWorld Classifieds Blaster Script "id" Parameter SQL Injection
• YourFreeWorld Reminder Service Script "id" Parameter SQL Injection
• YourFreeWorld Scrolling Text Ads Script "id" Parameter SQL Injection
• YourFreeWorld Autoresponder Hosting Script "id" Parameter SQL Injection
• deV!L'z Clanportal "users" Parameter SQL Injection
• Maran Project Maran PHP Shop "prod.php" SQL Injection
• Maran Project Maran PHP Shop "prodshow.php" SQL Injection
• Scripts For Sites EZ e-store "searchresults.php" SQL Injection
• Scripts For Sites EZ Career "content.php" SQL Injection
• Scripts For Sites EZ Link Directory "links.php" SQL Injection
• EZ Webring "category.php" SQL Injection
• SpitFire Photo Pro "pages.php" SQL Injection
• Matpo.de Link "view.php" Cross-Site Scripting
• RateMe "rate" Parameter Cross-Site Scripting
• SonicWALL Content Filtering Error Page Cross-Site Scripting
• Opera Web Browser History Search and Links Panel Cross-Site Scripting Vulnerabilities
• KKE Info Media Kmita Gallery Multiple Cross-Site Scripting Vulnerabilities
• Python Imageop Module "imageop.crop()" Buffer Overflow

13 November 2008

• GeSHi "geshi.php" Remote Code Execution
• YourFreeWorld Classifieds Hosting Script "id" Parameter SQL Injection
• AJ Article "index.php" SQL Injection
• YourFreeWorld Shopping Cart Script "c" Parameter SQL Injection
• 1st News "id" Parameter SQL Injection
• Scripts For Sites EZ Hotscripts SQL Injection
• Article Publisher Pro "admin.php" SQL Injection
• phpWebSite "links.php" SQL Injection
• MyPHP Forum "post.php" and "member.php" Multiple SQL Injection Vulnerabilities
• Harlandscripts Pro Traffic One "trg" Parameter SQL Injection
• WebCards "admin.php" Login Page SQL Injection
• MyGallery "gallery.inc.php" Parameter Cross-Site Scripting
• Tribiq CMS "template_path" Parameter Cross-Site Scripting
• Dorsa CMS "Default_.aspx" Cross-Site Scripting
• University of Washington IMAP "tmail" and "dmail" Local Buffer Overflow Vulnerabilities
• Absolute Live Support .Net Cookie Authentication Bypass
• Dovecot Invalid Message Address Parsing Denial of Service

12 November 2008

• BosClassifieds "cat_id" Parameter SQL Injection
• A-Link WL54AP3 and WL54AP2 Cross-Site Request Forgery and HTML Injection Vulnerabilities
• Absolute Banner Manager .NET Cookie Authentication Bypass
• Scripts For Sites EZ Top Sites "topsite.php" SQL Injection
• Multiple Scripts For Sites Products "directory.php" SQL Injection
• Interact "email_user_key" Parameter SQL Injection
• e107 Lyrics Plugin "lyrics_song.php" SQL Injection
• SignMe "signme.inc.php" Cross-Site Scripting
• Fortinet Fortigate Unspecified Cross-Site Scripting
• cPanel Cross-Site Scripting Vulnerabilities and Local File Include
• Dns2tcp "dns_decode.c" Remote Buffer Overflow
• Net-SNMP GETBULK Remote Denial of Service
• IBM Tivoli Storage Manager Client Buffer Overflow
• Quassel Core CTCP Ping Input Validation

11 November 2008

• YourFreeWorld Blog Blaster Script "id" Parameter SQL Injection
• EZ BIZ PRO "track.php" SQL Injection
• Logz podcast CMS "add_url.php" SQL Injection
• Harlandscripts Pro Traffic One "id" Parameter SQL Injection
• Camera Life Multiple Cross-Site Scripting Vulnerabilities
• CompactCMS "admin/index.php" Multiple Cross-Site Scripting Vulnerabilities
• Opera Web Browser 9.62 History Search Input Validation
• Adobe PageMaker Font Structure Multiple Buffer Overflow Vulnerabilities
• htop Hidden Process Name Input Filtering
• Network-Client FTP Now Heap Buffer Overflow
• Microsoft Windows Media Player Unspecified DAT File Parsing Denial of Service

10 November 2008

• All In One Control Panel "cp_polls_results.php" SQL Injection
• Adobe PageMaker "AldFs32.dll" Key Strings Stack-Based Buffer Overflow
• Microsoft DebugDiag "CrashHangExt.dll" ActiveX Control Remote Denial of Service
• Visagesoft eXPert PDF Viewer ActiveX Control Arbitrary File Overwrite
• MW6 PDF417 "MW6PDF417.dll" ActiveX Control Multiple Arbitrary File Overwrite Vulnerabilities
• MW6 Technologies Barcode ActiveX "Barcode.dll" Multiple Arbitrary File Overwrite Vulnerabilities
• DjVu "DjVu_ActiveX_MSOffice.dll" ActiveX Component Heap Buffer Overflow
• MW6 DataMatrix "DataMatrix.dll" ActiveX Control Multiple Arbitrary File Overwrite Vulnerabilities
• Aztec ActiveX "Aztec.dll" ActiveX Control Multiple Arbitrary File Overwrite Vulnerabilities

09 November 2008

• 08.44.74 - CVE: Not Available
• HP OpenView Products Shared Trace Service RPC Request Handling Denial of Service

08 November 2008

• Iamma Nuke Simple Gallery "upload.php" Arbitrary File Upload
• LightBlog Multiple Local File Include Vulnerabilities
• bcoos "modules/banners/click.php" SQL Injection
• PozScripts Classified Ads "gotourl.php" SQL Injection
• MyKtools Database Disclosure
• Citrix Web Interface Security Bypass
• Novell eDirectory NCP Unspecified Remote Memory Corruption

07 November 2008

• Smarty Template Engine "Smarty_Compiler.class.php" Security Bypass
• Joomla! Archaic Binary Gallery "com_ab_gallery" Component Directory Traversal
• KasraCMS "index.php" Multiple SQL Injection Vulnerabilities
• AJ RSS Reader "EditUrl.php" SQL Injection
• CS-Partner "gestion.php" Multiple SQL Injection Vulnerabilities
• Bahar Download Script "aspkat.asp" SQL Injection
• Dizi Portali "diziler.asp" SQL Injection
• iPei Guestbook "pg" Parameter Cross-Site Scripting
• ClipShare Pro "fullscreen.php" Cross-Site Scripting
• Microsoft Internet Explorer " " Address Bar URI Spoofing
• WebSVN Multiple Remote Input Validation Vulnerabilities
• Cisco PIX and ASA Windows NT Domain VPN Authentication Bypass
• IBM DB2 Universal Database Prior to 9.1 Fixpak 6 Multiple Vulnerabilities
• "imlib2" Library Multiple Unspecified Vulnerabilities

06 November 2008

• WebGUI "Asset.pm" Perl Module Handling Code Execution
• Drupal "bootstrap.inc" Local File Include
• Snoopy "_httpsrequest()" Arbitrary Command Execution
• Drupal Book Page Title HTML Injection
• TikiWiki Multiple Unspecified Vulnerabilities
• ElkaGroup Image Gallery "view.php" SQL Injection
• e107 CMS "alternate_profiles" Plugin "newuser.php" SQL Injection
• Tandis CMS "index.php" Multiple SQL Injection Vulnerabilities
• SFS Ez Forum "forum.php" SQL Injection
• UC Gateway Investment SiteEngine "announcements.php" SQL Injection
• Dorsa CMS "ShowPage.aspx" SQL Injection
• KBase Joomla! Component "id" Parameter SQL Injection
• ShopMaker "product.php" SQL Injection
• PHP-Nuke Nuke League Module "tid" Parameter Cross-Site Scripting
• MyBB "moderation.php" Cross-Site Scripting
• phpMyAdmin "pmd_pdf.php" Cross-Site Scripting
• Kayako eSupport "html-tidy-logic.php" Cross-Site Scripting
• MiniPortail "search.php" Cross-Site Scripting and Local File Include Vulnerabilities
• Jetbox CMS "liste" Parameter Cross-Site Scripting
• Multiple Vendor Web Browser FTP Client Cross-Site Scripting
• Multiple Products Unspecified Library MP4 File Remote Denial of Service
• Questwork QuestCMS Multiple Remote Vulnerabilities
• Blender "BPY_interface.c" Remote Command Execution
• Libpng Library "png_handle_tEXt()" Memory Leak Denial of Service
• GoodTech SSH Server SFTP Multiple Buffer Overflow Vulnerabilities
• Opera Web Browser History Search Input Validation
• VLC Media Player Multiple Remote Integer Overflow Vulnerabilities
• Cisco PIX and ASA Appliance IPv6 Denial of Service
• Trend Micro OfficeScan CGI Parsing Buffer Overflow
• Sun Java System LDAP JDK Search Feature Information Disclosure
• GNU Enscript "src/psgen.c" Stack-Based Buffer Overflow