20 October 2008

• OpenX "bannerid" SQL Injection

19 October 2008

• JMweb "src" Parameter Multiple Local File Include Vulnerabilities
• RPortal "file_op" Parameter Remote File Include
• PHP Auto's "searchresults.php" SQL Injection
• Galerie "pic" Parameter SQL Injection
• AdaptCMS Lite "check_user.php" SQL Injection
• Blosxom "blosxom.cgi" Cross-Site Scripting
• WikyBlog Multiple Cross-Site Scripting Vulnerabilities

18 October 2008

• pPIM "id" Parameter Local File Include
• Bux.to Clone Script Cookie Authentication Bypass
• phpScheduleIt "reserve.php" Remote Code Execution
• MySQL Quick Admin "index.php" Local File Include
• Select Development Solutions Multiple Products "view_cat.php" SQL Injection
• AmpJuke "index.php" SQL Injection
• geccBBlite "leggi.php" Parameter SQL Injection
• XAMPP for Windows "cds.php" SQL Injection
• IP Reg "login.php" SQL Injection
• H-Sphere WebShell "actions.php" Multiple Cross-Site Scripting Vulnerabilities
• Condor Prior to 7.0.5 Multiple Security Vulnerabilities
• Simple Machines Forum HTTP POST Request Filter Security Bypass
• Xerces-C++ "maxOccurs" XML Parsing Remote Denial of Service

17 October 2008

• Crux Gallery "index.php" Local File Include
• PHP-Fusion "manuals" Module "manual" Parameter SQL Injection
• PHP-Fusion "recept" Module "kat_id" Parameter SQL Injection
• Full PHP Emlak Script "arsaprint.php" SQL Injection
• BMForum "plugins.php" SQL Injection
• noName CMS Multiple SQL Injection Vulnerabilities
• VeriSign Kontiki Delivery Management System "action" Parameter Cross-Site Scripting
• Dreamcost HostAdmin "index.php" Cross-Site Scripting
• PHP FastCGI Module File Extension Denial of Service Vulnerabilities
• Mozilla Firefox Internet Shortcut Same Origin Policy Violation
• MetaGauge Web Server Directory Traversal
• RhinoSoft Serv-U FTP Server "sto con:1" Denial of Service
• HP-UX NFS/ONCplus Unspecified Remote Denial of Service
• Vba32 Personal Antivirus Archive Parsing Denial of Service

16 October 2008

• Kwalbum "UploadItems" Parameter Arbitrary File Upload
• phpscripts Ranking Script Cookie Authentication Bypass
• XAMPP for Windows "phonebook.php" SQL Injection
• PHP-Fusion "raidtracker_panel" Module "INFO_RAID_ID" Parameter SQL Injection
• eZoneScripts Link Trader Script "ratelink.php" SQL Injection
• Discussion Forums 2k Multiple SQL Injection Vulnerabilities
• ASPapp Knowledge Base "catid" Parameter SQL Injection
• Nucleus CMS EUC-JP Cross-Site Scripting
• Website Directory "index.php" Cross-Site Scripting
• Celoxis Multiple Cross-Site Scripting Vulnerabilities
• Adobe Flash Player Unspecified Clickjacking
• Skype Toolbars Extension for Firefox BETA Clipboard Security Weakness
• OpenNMS HTTP Response Splitting
• VMware Products In-Guest Privilege Escalation and Information Disclosure Vulnerabilities
• Serv-U FTP Server "rnto" Command Directory Traversal
• vxFtpSrv CWD Command Buffer Overflow
• Trend Micro OfficeScan and Worry-Free Business Security Multiple Vulnerabilities
• Debian mon "alert.d/test.alert" Insecure Temporary File Creation
• Linux Kernel LDT Selector Local Privilege Escalation and Denial of Service
• Linux kernel "fs/direct-io.c" Local Denial of Service
• AyeView GIF Image Handling Denial of Service
• mIRC "PRIVMSG" Buffer Overflow

15 October 2008

• CCMS "skin" Parameter Multiple Local File Include Vulnerabilities
• Drupal Brilliant Gallery Module SQL Injection and Cross-Site Scripting Vulnerabilities
• OLIB7 WebView "infile" Parameter Local File Include
• AutoNessus "bulk_update.pl" Cross-Site Scripting
• KDE Konqueror Font Color Assertion Denial of Service
• Internet Download Manager File Parsing Buffer Overflow
• Lighttpd URI Rewrite/Redirect Information Disclosure
• Novell eDirectory Multiple Buffer Overflow And Denial of Service Vulnerabilities
• TCP/IP Protocol Stack Unspecified Remote Denial of Service
• Debian xsabre Insecure Temporary File Creation

14 October 2008

• Juniper ScreenOS HTML Injection
• MediaWiki "useskin" Cross-Site Scripting
• OpenNMS "surveillanceView.htm" Cross-Site Scripting
• D-Bus "dbus_signature_validate()" Type Signature Denial of Service
• Lighttpd "mod_userdir" Case Sensitive Comparison Security Bypass
• Dovecot ACL Plugin Multiple Security Bypass Vulnerabilities
• Apple QuickTime PICT Denial of Service
• iseemedia "LPControl.dll" LPViewer ActiveX Control Multiple Buffer Overflow Vulnerabilities
• ESET SysInspector "esiadrv.sys" Local Privilege Escalation

13 October 2008

• IBM Quickr Denial of Service and Security Bypass Vulnerabilities
• MediaWiki "$wgGroupPermissions" Configuration Security Bypass
• YourOwnBux "usNick" Cookie Parameter SQL Injection
• PHP-Fusion "triscoop_race_system" Module "raceid" Parameter SQL Injection
• Blue Coat WebFilter ICAP Patience Page Cross-Site Scripting
• libxml2 Denial of Service
• Apple QuickTime "STSZ" Atoms Memory Corruption
• Adobe Flash Player SWF Version Null Pointer Dereference Denial of Service
• Multiple Vendors IPv6 Neighbor Discovery Protocol Implementation Address Spoofing
• Linux Kernel "generic_file_splice_write()" Local Privilege Escalation
• Fedora 8/9 Linux Kernel "utrace_control" NULL Pointer Dereference Denial of Service
• Apple Mail S/MIME Draft Message Encryption Weakness
• Microsoft Windows Vista Local Denial of Service

10 October 2008

• Google Chrome Carriage Return Remote Denial of Service
• PHP "create_function()" Code Injection Weakness
• Autodesk "LiveUpdate16.DLL" ActiveX Control Arbitrary Program Execution
• Autodesk DWF Viewer Control "AdView.dll" Arbitrary File Download
• DATAC RealWin SCADA Server Remote Stack Buffer Overflow

09 October 2008

• Apple Mac OS X Java Plug-in "file://" URL Handling Remote Code Execution
• Novell ZENworks Desktop Management ActiveX Control "CanUninstall()" Buffer Overflow
• ZoneAlarm HTTP Proxy Remote Denial of Service
• Win FTP Server "LSTR" Command Remote Denial of Service
• Microsoft Windows Mobile Overly Long Bluetooth Device Name Denial of Service

08 October 2008

• Fedora initscripts Arbitrary File Deletion
• Symantec Veritas NetBackup Java Administration GUI Remote Privilege Escalation
• Mozilla Firefox/SeaMonkey UTF-8 Stack-Based Buffer Overflow
• Linux Kernel "truncate()" Local Privilege Escalation
• Apple Mac OS X Java Applet HMAC Provider Handling Remote Code Execution
• Flip4Mac WMV Vulnerability
• WinZip "gdiplus.dll" Microsoft Module Unspecified Security
• CCProxy Server HTTP "CONNECT" Request Buffer Overflow
• K-Lite Mega Codec Pack "vsfilter.dll" Denial of Service
• NMS DVD Burning SDK "NMSDVDX.dll" ActiveX Control Arbitrary File Overwrite

07 October 2008

• EC-CUBE SQL Injection and Cross-Site Scripting Vulnerabilities
• moziloCMS Prior to 1.10.3 Multiple Vulnerabilities
• RPG.Board Cookie Authentication Bypass
• Joomla Image Browser Component "index.php" Directory Traversal
• osCMax "test.html" Arbitrary File Upload
• Vikingboard "upload/index.php" Local File Include
• Cisco IOS MPLS Forwarding Infrastructure Remote Denial of Service
• Cisco IOS NAT Skinny Call Control Protocol Multiple Remote Denial of Service Vulnerabilities
• Microsoft GDI+ "GDIPLUS.dll" ICO File Divide-By-Zero Denial of Service
• Microsoft WordPad ".doc" File Remote Denial of Service

06 October 2008

• PHP iCalendar Cookie Authentication Bypass
• Drupal Talk Module Multiple Remote Vulnerabilities
• TYPO3 Swigmore institute Extension Unspecified SQL Injection
• TYPO3 My Quiz and Poll Extension Unspecified SQL Injection
• Drupal Mailhandler Module Multiple SQL Injection Vulnerabilities
• phpMyAdmin Cross-Site Scripting
• Achievo "atknodetype" Parameter Cross-Site Scripting
• Parallels H-Sphere "login.php" Multiple Cross-Site Scripting Vulnerabilities

03 October 2008

• ClanSphere Multiple Information Disclosure Vulnerabilities
• SquirrelMail Insecure Cookie Disclosure Weakness
• Quick.Cms.Lite "admin.php" Cross-Site Scripting
• Kantan WEB Server Unspecified Cross-Site Scripting
• Sama Educational Management System "Error.asp" Cross-Site Scripting
• Mozilla Firefox/SeaMonkey/Thunderbird Multiple Remote Vulnerabilities
• BitlBee Unspecified Security Bypass Variant
• Multiple Vendors IMAP Servers Denial of Service
• JBoss Enterprise Application Platform Class Files Information Disclosure
• ProFTPD Long Command Handling Security
• fhttpd Basic Authorization Remote Denial of Service
• Emacspeak "extract-table.pl" Insecure Temporary File Creation
• FFmpeg "lavf_demux" Animated GIF Processing Remote Denial of Service
• Mercurial hgweb "allowpull" Information Disclosure
• FAAD2 Frontend "decodeMP4file()" Heap-Based Buffer Overflow
• Apple QuickTime/iTunes QuickTime Type Remote Buffer Overflow
• G DATA InternetSecurity/AntiVirus/TotalCare 2008 "GDTdiIcpt.sys" Memory Corruption

02 October 2008

• osCommerce "create_account.php" Information Disclosure
• Drupal Mailsave Module MIME Type HTML Injection
• MyBB Prior to 1.4.2 Multiple Security Vulnerabilities
• Vignette Content Management Unspecified Security Bypass
• Mantis Insecure Cookie Disclosure Weakness
• Cisco 871 Integrated Services Router Cross-Site Request Forgery
• Xerox WorkCentre/WorkCentre Pro Network Controller Remote Code Execution
• Sun Solaris UFS Filesystem "acl(2)" Local Denial of Service
• Sun Solaris Text Editors Local Privilege Escalation
• strongSwan "mpz_export()" Remote Denial of Service
• Openswan IPsec Livetest Insecure Temporary File Creation
• Chilkat XML ActiveX Control Multiple Vulnerabilities
• DESlock+ Local Buffer Overflow and Multiple Denial of Service Vulnerabilities

01 October 2008

• Kolab Groupware Server Apache Log File User Password Information Disclosure
• MyBB Prior to 1.4.1 Multiple Unspecified Vulnerabilities
• Nokia E90 Communicator Remote Denial of Service

30 September 2008

• Fantastico De Luxe "fantasticopath" Parameter Local File Include
• phpMyAdmin "server_databases.php" Remote Command Execution
• Agares Media Arcadem Pro "articleblock.php" SQL Injection
• Drupal Link to Us "Link page header" Field HTML Injection
• Multiple Sagem F@st Routers DHCP Hostname HTML Injection
• pfSense DHCPREQUEST Hostname HTML Injection
• ISC BIND Windows UDP Client Handler Denial of Service
• InstallShield Update Service Agent ActiveX Control Buffer Overflow
• Data Dynamics ActiveReports ARViewer2 ActiveX Control Multiple Insecure Method Vulnerabilities
• Acritum Femitter Server Information Disclosure and Denial of Service Vulnerabilities
• Kantan WEB Server Unspecified Directory Traversal
• Microsoft Internet Explorer Malformed PNG File Remote Denial of Service

29 September 2008

• Linux Kernel "shmem_delete_inode()" Local Denial of Service
• Linux Kernel "add_to_page_cache_lru()" Local Denial of Service
• Nokia E90 Communicator Remote Denial of Service
• Drupal Answers Module "answer" Field HTML Injection
• WordPress Random Password Generation Insufficient Entropy Weakness
• Horde Turba Contact Manager "/imp/test.php" Cross-Site Scripting
• Multiple Tor World CGI Scripts Remote Script Execution
• MyBB Prior to 1.4.1 Multiple Unspecified Vulnerabilities
• MyBB Prior to 1.4.1 Multiple Unspecified Vulnerabilities
• phpMyAdmin "server_databases.php" Remote Command Execution
• Fantastico De Luxe "fantasticopath" Parameter Local File Include