MPlayer is prone to a remote HTTP header buffer overflow vulnerability. This issue occurs due to a failure of the application to properly verify buffer bounds on the 'Location' HTTP header during parsing. Successful exploitation would immediately produce a denial of service condition in the affected process. This issue may also be leveraged to execute code on the affected system within the security context of the user running the vulnerable process.
Interchange is prone to a remote information disclosure vulnerability that allows attackers to disclose contents of arbitrary variables via URI requests. This vulnerability can be exploited by sending a crafted request to the affected application.
The WebCT Campus Edition is prone to an HTML injection vulnerability that may allow a remote attacker to execute arbitrary HTML or script code in the browser of an unsuspecting user. A malicious user could supply malicious HTML or script code to the application via the @import url() function of Microsoft Internet Explorer when posting a message on a forum, which would then be rendered in the browser of an unsuspecting user whenever the malicious message is viewed.
Systrace is prone to a vulnerability that may permit an application to completely bypass a Systrace policy. This issue occurs due to insufficient sanity checks while handling a traced process with ptrace.
A-Cart is prone to multiple input validation vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied input prior to its use in SQL queries and generation of dynamic content. The SQL injection issue may allow a remote attacker to manipulate SQL query logic, potentially leading to access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation. The cross-site scripting issue could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
The application is prone to multiple vulnerabilities including SQL injection, cross-site scripting, and HTML injection. These vulnerabilities may allow an attacker to execute arbitrary HTML or script code in a user's browser and/or influence SQL query logic to disclose sensitive information and carry out other attacks.
The vulnerability exists due to a failure of NSTX to handle network strings of excessive length. A remote attacker can exploit this vulnerability by sending a specially crafted network string, causing the affected process to crash and denying service to legitimate users.
The AIX invscoutd process insecurely handles temporary files, allowing a local attacker to destroy data on the vulnerable system. This is due to a design error that allows a user to specify a log file that the process writes to while holding escalated privileges. A malicious user can exploit this issue to corrupt arbitrary files on the affected system, potentially leading to a system-wide denial of service. There is also a possibility that an attacker could gain escalated privileges, although this has not been confirmed.
NetSupport School is prone to a password-encryption vulnerability because the application fails to protect passwords with a sufficiently effective encryption scheme.Exploiting this issue may allow an attacker to access user and administrator passwords for the affected application.
Multiple locally and remotely exploitable buffer overrun and format strings were reported in emil. This could permit execution of arbitrary code in the context of the software.
Services By CQR