09 February 2010

• Drupal MP3 Player MP3 Filename HTML Injection
• XAMPP "showcode.php" Local File Include
• Joomla! "com_gambling" Component "gamblingEvent" Parameter SQL Injection
• Evernew Free Joke Script "id" Parameter SQL Injection
• XAMPP Multiple SQL Injection Vulnerabilities
• Comtrend CT-507 IT ADSL Router "scvrtsrv.cmd" Cross-Site Scripting
• HP System Management Homepage "servercert" Parameter Cross-Site Scripting
• lighttpd Slow Request Handling Remote Denial of Service
• Adobe ColdFusion Solr Service Information Disclosure
• Hitachi Multiple Products Image File Parsing Buffer Overflow
• Symantec Altiris Notification Server Static Encryption Key Unauthorized Access
• sudosh3 "replay.c" Multiple Buffer Overflow Vulnerabilities
• IRCD-Hybrid and ircd-ratbox "LINKS" Command Remote Integer Underflow
• Linux Kernel KVM "pit_ioport_read()" Local Denial of Service
• Corel Paint Shop Pro Photo X2 "FPX" File Heap Buffer Overflow

08 February 2010

• MoinMoin Unspecified Security
• Joomla! "com_ccnewsletter" Component Directory Traversal
• Joomla! JE Quiz Component "eid" Parameter SQL Injection
• Joomla! "com_dms" Component "category_id" Parameter SQL Injection
• jVideoDirect Component for Joomla! "v" Parameter SQL Injection
• XAMPP Multiple Cross-Site Scripting Vulnerabilities
• Citrix XenServer Authentication Bypass
• C++ Sockets Library HTTP Headers Remote Denial of Service
• Hybserv2 ":help" Command Denial of Service
• Sun Java System Application Server HTTP TRACE Information Disclosure
• Wireshark Dissector LWRES Multiple Buffer Overflow Vulnerabilities
• Apache 1.3 mod_proxy HTTP Chunked Encoding Integer Overflow Vulnerability
• IBM DB2 "REPEAT()" Heap Buffer Overflow
• Linux Kernel 64bit Personality Handling Local Denial of Service
• Vermillion FTP Daemon "Port" Command Buffer Overflow

05 February 2010

• Xerox WorkCentre Multiple Unspecified Authentication Bypass Vulnerabilities
• Apache Tomcat WAR File Directory Traversal
• cPanel and WHM "failurl" Parameter HTTP Response Splitting
• Joomla! "com_casino" Component "id" Parameter SQL Injection
• Joomla! JbPublishDownFp Component "cid" Parameter SQL Injection
• Joomla! "com_book" Component "cid[]" Parameter SQL Injection
• PunBB "viewtopic.php" Cross-Site Scripting
• Google Chrome prior to 4.0.249.78 Multiple Security Vulnerabilities
• Apple Safari Style Sheet Redirection Information Disclosure
• Tor Directory Authorities Directory Queries Remote Information Disclosure
• GNU Gzip Dynamic Huffman Decompression Remote Code Execution
• Xerox WorkCentre Network Controller Directory Structure Unauthorized Access
• Rising Antivirus Multiple IOCTL Request Handling Local Privilege Escalation Vulnerabilities
• Microsoft Internet Explorer (CVE-2010-0248) Uninitialized Memory Remote Code Execution

04 February 2010

• e107 Unspecified Remote
• Open Media Collectors Database Multiple Local File Include Vulnerabilities
• Drupal Recent Comments Module HTML Injection
• Joomla! "com_ContentBlogList" Component Multiple SQL Injection Vulnerabilities
• Joomla! Mochigames Component "cid" Parameter SQL Injection
• Joomla! "com_acprojects" Component SQL Injection
• Jetty JSP Snoop Page Multiple Cross-Site Scripting Vulnerabilities
• MySQL with yaSSL SSL Certificate Handling Remote Stack Buffer Overflow
• IBM Lotus Domino Web Access Prior to 229.131 Unspecified Security
• SAP BusinessObjects Multiple Input Validation Vulnerabilities
• glibc and eglibc "nis/nss_nis/nis-pwd.c" Remote Information Disclosure
• Google Chrome Style Sheet Redirection Information Disclosure
• Windows Live Messenger ActiveX Control "RichUploadControlContextData" Buffer Overflow
• Microsoft Internet Explorer (CVE-2010-0247) Uninitialized Memory Remote Code Execution

03 February 2010

• TinyBrowser Joomla! Component "folders.php" Local File Include
• boastMachine Arbitrary File Upload
• Drupal Control Panel Module HTML Injection
• Joomla! JBDiary Component Multiple SQL Injection Vulnerabilities
• Joomla! "com_biographies" Component "id" Parameter SQL Injection
• PHPMySpace Gold "gid" Parameter SQL Injection
• NetSupport Manager Denial of Service
• Apache Tomcat Directory Host Appbase Authentication Bypass
• IntelliTamper "defer" Attribute Handling Remote Buffer Overflow
• Sun Java System Directory Server LDAP Search Request Denial of Service
• Multiple RealNetworks Products Multiple Remote Vulnerabilities
• Embarcadero Technologies InterBase SMP 2009 Multiple Stack Buffer Overflow Vulnerabilities
• RadASM ".mnu" File Buffer Overflow
• Microsoft Internet Explorer (CVE-2010-0245) Uninitialized Memory Remote Code Execution

02 February 2010

• Novatel Wireless MiFi 2352 Password Information Disclosure
• Kayako SupportSuite "staff/index.php" Multiple HTML Injection Vulnerabilities
• Jetty Terminal Escape Sequence in Logs Command Injection
• phpBB Forum ID Security Bypass
• Joomla! "com_gameserver" Component "id" Parameter SQL Injection
• Joomla! Game Server Component "grp" Parameter SQL Injection
• OpenX SQL Injection
• South River Technologies WebDrive Security Descriptor Local Privilege Escalation
• Authentium SafeCentral Local Privilege Escalation
• Sun Java System Web Server WebDAV Format String
• Sun Java System Web Server Digest Authentication Remote Buffer Overflow
• Cisco CiscoWorks Internetwork Performance Monitor CORBA GIOP Remote Buffer Overflow
• Linux Kernel CVE-2010-0291 "mmap()" and "mremap()" Multiple Denial of Service Vulnerabilities
• Microsoft Internet Explorer Unspecified Information Disclosure
• Microsoft Internet Explorer (CVE-2010-0244) Uninitialized Memory Remote Code Execution

01 February 2010

• IBM Datapower XS40 Malformed ICMP Packet Denial of Service
• Apache Tomcat Host Working Directory WAR File Directory Traversal
• SilverStripe HTML Injection and Cross-Site Scripting Vulnerabilities
• VirtueMart Multiple SQL Injection Vulnerabilities
• Joomla! "com_gurujibook" Component "id" Parameter SQL Injection
• NetArt Media Blog System "blog.php" SQL Injection
• Joomla! 3D Cloud "tagcloud.swf" Cross-Site Scripting
• Support Incident Tracker Blank Password Authentication Bypass
• Oracle WebLogic Server Node Manager "beasvc.exe" Remote Command Execution
• Sun Java System Web Server "admin" Server Denial of Service
• GNU gzip LZW Compression Remote Integer Overflow
• Cisco IOS XR SSH Protocol Implementation Remote Denial of Service
• Linux Kernel ATI Radeon Drivers Local Privilege Escalation
• Microsoft Internet Explorer (CVE-2010-0246) Uninitialized Memory Remote Code Execution
• Microsoft Internet Explorer URI Validation Remote Code Execution

29 January 2010

• MicroLogix 1100 and 1400 Controllers Multiple Unspecified Vulnerabilities
• MoinMoin Unspecified Information Disclosure
• Php-residence "template_data_dir" Parameter Multiple Local File Include Vulnerabilities
• Drupal Bibliography Module HTML Injection
• TYPO3 TT_Products editor (ttpedit) Unspecified SQL Injection
• VisualShapers ezContents Authentication Bypass and Multiple SQL Injection Vulnerabilities
• xt:Commerce Direct URL Component "coID" Parameter SQL Injection
• TYPO3 zak_store_management Unspecified SQL Injection
• TYPO3 Helpdesk (mg_help) Extension Unspecified SQL Injection
• TYPO3 MK-AnydropdownMenu Unspecified SQL Injection
• IBM Lotus Web Content Management Login Page Cross-Site Scripting
• Joomla! "com_tienda" Component "categoria" Parameter Cross-Site Scripting
• TYPO3 Unit Converter Unspecified Cross-Site Scripting
• HP Power Manager Export Logs Buffer Overflow Remote Code Execution
• Zenoss Multiple Cross-Site Request Forgery Vulnerabilities
• Zeus Web Server Unspecified Remote Buffer Overflow
• TIBCO Runtime Agent Domain Properties Insecure File Permissions
• Google SketchUp 3DS File Remote Memory Corruption
• Linux Kernel "fasync_helper()" Local Privilege Escalation
• Gracenote CDDBControl ActiveX Control "ViewProfile" Method Heap Buffer Overflow

28 January 2010

• Datalife Engine Multiple Remote File Include Vulnerabilities
• LetoDMS
• TYPO3 Vote rank for news Extension Cross-Site Scripting and SQL Injection Vulnerabilities
• TYPO3 SB Folderdownload Unspecified Information Disclosure
• vBulletin "misc.php" SQL Injection
• Zenoss Multiple SQL Injection Vulnerabilities
• TYPO3 Clan Users List (pb_clanlist) Unspecified SQL Injection
• TYPO3 User Links (vm19_userlinks) Unspecified SQL Injection
• THELIA Multiple Cross-Site Scripting Vulnerabilities
• Joomla! "com_marketplace" Component "catid" Parameter Cross-Site Scripting
• TYPO3 Majordomo Extension Unspecified Cross-Site Scripting
• Sun Java System Web Server WebDAV Unspecified Remote Buffer Overflow
• HP Power Manager Script Login URI Buffer Overflow Remote Code Execution
• SystemTap "stat-server" Remote Arbitrary Command Injection
• phpMyAdmin Insecure Temporary File and Directory Creation Vulnerabilities
• aria2 "AbstractCommand::onAbort" Format String Vulnerability
• NetBSD VFS Filesystem Autoloading Local Denial of Service
• GNU Bash "ls" Control Character Command Injection
• BS.Player ".bsl" File Remote Buffer Overflow
• HP Power Manager "formExportDataLogs" Directory Traversal Remote Code Execution

27 January 2010

• phpMyAdmin "unserialize()" Remote Code Execution
• FreePBX Inbound Route Description HTML Injection
• Testlink Multiple Unspecified Directory Traversal Vulnerabilities
• Drupal Own Term Module "term description" Field HTML Injection
• TYPO3 kiddog_mysqldumper Unspecified Information Disclosure
• FreePBX "config.php" SQL Injection
• Joomla! "com_articlemanager" Component "artid" Parameter SQL Injection
• TYPO3 Reports for Job (job_reports) Unspecified SQL Injection
• TYPO3 tt_news Mail alert (dl3_tt_news_alerts) Unspecified SQL Injection
• EasySiteNetwork Jokes Complete Website Multiple Cross-Site Scripting Vulnerabilities
• Xforum "nbpageliste" Parameter Cross-Site Scripting
• TYPO3 VD / Geomap Extension Unspecified Cross-Site Scripting
• SAP Web Application Server Unspecified Remote Buffer Overflow
• ISC BIND 9 DNSSEC Bogus NXDOMAIN Response Remote Cache Poisoning
• Web Server Creator Web Portal Multiple Input Validation Vulnerabilities
• LibThai Unspecified Integer Overflow
• HP Web Jetadmin Remote Information Disclosure
• Red Hat Linux Kernel "qla2xxx" DriverSecurity Bypass
• Apple Mac OS X Image RAW "DNG" Image Handling Buffer Overflow
• Microsoft Internet Explorer Null Pointer Dereference Denial of Service Vulnerabilities

26 January 2010

• XOOPS Arbitrary File Deletion and HTTP Header Injection Vulnerabilities
• FreePBX "admin/config.php" Password Information Disclosure
• Dokuwiki File Enumeration Information Disclosure
• Drupal Node Block Module "Title" HTML Injection
• TYPO3 Photo Book Unspecified Directory Traversal
• SemanticScuttle "tags.php" SQL Injection
• Public Media Manager Multiple SQL Injection Vulnerabilities
• TYPO3 BB Simple Jobs (bb_simplejobs) Unspecified SQL Injection
• TYPO3 Google Maps for tt_news Extension Unspecified SQL Injection
• SurgeFTP "surgeftpmgr.cgi" Multiple Cross-Site Scripting Vulnerabilities
• Technology for Solutions "id" Parameter Cross-Site Scripting
• TYPO3 Tip many friends Extension Unspecified Cross-Site Scripting
• Adobe Shockwave Player Multiple Integer Overflow Vulnerabilities
• OpenOffice ".slk" File NULL Pointer Dereference Remote Denial of Service
• Oracle Internet Directory "oidldapd" Remote Memory Corruption
• IBM Tivoli Directory Server "ibmdiradm" Null Pointer Dereference Denial of Service
• Mozilla Firefox Yoono Extension "img" Tag DOM Event Handler Remote Code Injection
• Red Hat Linux Kernel Routing Implementation Multiple Remote Denial of Service Vulnerabilities
• Apple Mac OS X CoreAudio MP4 File Buffer Overflow
• Microsoft Internet Explorer CVE-2010-0249 Remote Code Execution

25 January 2010

• Novatel Wireless MiFi Mobile Hotspot Multiple Remote Vulnerabilities
• phpMySport Information Disclosure and SQL Injection Vulnerabilities
• Joomla! "com_uploader" Component Arbitrary File Upload
• DokuWiki "ajax.php" Multiple Security Bypass Vulnerabilities
• TYPO3 TV21 Talkshow Extension Unspecified Cross-Site Scripting and SQL Injection Vulnerabilities
• MySmartBB Multiple SQL Injection Vulnerabilities
• RoseOnlineCMS "username" Field Login SQL Injection
• TYPO3 Powermail Extension Unspecified SQL Injection
• TYPO3 MJS Event Pro (mjseventpro) Unspecified SQL Injection
• TYPO3 Customer Reference List Unspecified SQL Injection
• TestLink "order_by_login_dir" Parameter Cross-Site Scripting
• Tribisur "cat" Parameter Cross-Site Scripting
• TYPO3 KJ: Imagelightbox Unspecified Cross-Site Scripting
• Adobe Shockwave Player (CVE-2009-4002) Unspecified Remote Buffer Overflow
• Adobe Flash Player SWF File Denial of Service
• VLC Media Player ASS File Buffer Overflow
• OpenOffice ".csv" File Remote Denial of Service
• SAP MaxDB Unspecified Information Disclosure and Denial of Service Vulnerabilities
• Linux Kernel "ipv6_hop_jumbo()" Remote Denial of Service
• MediaMonkey ".mp3" File Remote Buffer Overflow
• Microsoft Windows #GP Trap Handler Local Privilege Escalation

22 January 2010

• Varnish Terminal Escape Sequence in Logs Command Injection
• Joomla! "com_jashowcase" Component Directory Traversal
• Novell iManager Importing/Exporting Schema Stack Buffer Overflow
• Docebo "modname" Parameter Local File Include
• LineWeb 1.0.5 Multiple Remote Vulnerabilities
• Dailymeals Joomla! Component "controller" Parameter Local File Include
• Novell ZENWorks Asset Management SQL Injection
• DeltaScripts PHP Links "index.php" SQL Injection
• "com_kk" Joomla! Component "kat" Parameter SQL Injection
• TYPO3 XDS Staff List Unspecified SQL Injection
• TYPO3 No indexed Search Unspecified SQL Injection
• Shape5 Bridge of Hope Template for Joomla! "id" Parameter SQL Injection
• joomlabamboo JB Simpla Joomla! Template "id" Parameter SQL Injection
• @lex Guestbook Multiple Cross-Site Scripting Vulnerabilities
• RoundCube Webmail Cross-Site Scripting
• TYPO3 File list Cross-Site Scripting
• LXR Cross Referencer Multiple Cross-Site Scripting Vulnerabilities
• SLAED CMS "stop" Parameter Cross-Site Scripting
• Adobe Reader and Acrobat Download Manager Remote Code Execution
• Adobe Flash Player 6 Multiple Remote Code Execution Vulnerabilities
• Oracle Database CVE-2009-3410 Remote RDBMS
• Oracle Application Server CVE-2010-0066 Access Manager Identity Server Remote
• Oracle Database and Application Server CVE-2009-3412 Local Unzip
• Oracle E-Business Suite CVE-2009-3416 Oracle Application Object Library Remote
• Boa Web Server Terminal Escape Sequence in Logs Command Injection
• AOLServer Terminal Escape Sequence in Logs Command Injection
• Multiple ACDSee Products "XMB" File Remote Buffer Overflow
• FreeBSD ZFS ZIL Insecure File Permissions
• Sun Java System Web Server Unspecified Remote Code Execution
• Gretech GOM Player ".asx" File Remote Denial of Service
• Sun OpenSolaris "hald" Daemon Unspecified
• NetworkManager Connection Verification Bypass and Information Disclosure Vulnerabilities

21 January 2010

• Ruby WEBrick Terminal Escape Sequence in Logs Command Injection
• Joomla! "com_jcollection" Component Directory Traversal
• Dada Mail Dada Bridge Plugin Unspecified Security Bypass
• Movable Type Unspecified Security Bypass
• Skype Technologies Skype for Linux GUI HTML Injection
• BLOG:CMS Comment Editing HTML Injection
• ProArcadeScript "id" Parameter SQL Injection
• Live Chat Joomla! Component "last" Parameter SQL Injection
• Joomla! "com_perchagallery" Component "id" Parameter SQL Injection
• TYPO3 Diocese of Portsmouth Resources Database Unspecified SQL Injection
• TYPO3 Diocese of Portsmouth Calendar Unspecified SQL Injection
• XOOPS "include/notification_update.php" SQL Injection
• Joomla! Module for Alfresco "id_pan" Parameter SQL Injection
• Zope "standard_error_message" Cross-Site Scripting
• Jamit Job Board "post_id" Parameter Cross-Site Scripting
• D-LINK DKVM-IP8 "auth.asp" Cross-Site Scripting
• TYPO3 vShoutbox Cross-Site Scripting
• MercuryBoard "index.php" Cross-Site Scripting
• Discuz! Multiple Cross-Site Scripting Vulnerabilities
• Adobe Reader and Acrobat U3D Remote Code Execution
• Oracle WebLogic Server CVE-2010-0074 Remote
• Oracle E-Business Suite CVE-2010-0077 CRM Technical Foundation (mobile) Remote
• Oracle Weblogic Server CVE-2010-0069 Unspecified Remote
• Oracle Database CVE-2010-0072 Oracle Secure Backup Remote Code Execution
• Oracle Database CVE-2009-3415 OLAP Remote Unspecified
• Orion Application Server Terminal Escape Sequence in Logs Command Injection
• nginx Terminal Escape Sequence in Logs Command Injection
• IBM Lotus Domino Web Access Multiple Unspecified Security Vulnerabilities
• PowerDNS Recursor Remote Cache Poisoning
• MySQL 5.0.51a Unspecified Remote Code Execution
• httpdx Space Character Remote File Disclosure
• Linux Kernel "ebtables" Security Bypass
• Mac OS X "libc/strtod(3)" Memory Corruption