A denial of service vulnerability has been reported in KPhone. This issue may be triggered by a malformed SIP (Session Initiation Protocol) STUN message. This is due to insufficient validation of user-specified STUN packet attribute lengths, causing an out of bounds read and subsequent crash.
Real Networks Helix Universal Server is affected by a remote denial of service vulnerability. This issue is due to a failure of the application to properly handle malformed RTSP (Real-Time Streaming Protocol) requests. An attacker may leverage this issue to trigger a denial of service condition in the affected server.
This is a buffer overflow exploit for WS_FTP LE 5.08. It targets the PASV response and allows for remote code execution. The exploit code is written in C and includes a reverse shellcode. The exploit has been tested on Windows XP SP2 Polish and Windows 2000 SP4 Polish.
A vulnerability has been identified in the handling of input by Gemitel. Because of this, it may be possible for a remote user to gain unauthorized access to a system using the vulnerable software. It is possible to influence the include path of certain files, which could lead to an attacker including arbitrary PHP files from an external system.
The vulnerability allows remote attackers to inject and execute arbitrary script code through email attachments in Campus Pipeline. By manipulating the victim's email account, an attacker can potentially gain control of the account and steal authentication credentials. The issue is caused by the application's failure to properly sanitize user-supplied HTML and script code in email documents.
Multiple input validation vulnerabilities in phpBugTracker allow remote attackers to execute arbitrary SQL commands via (1) the bugid parameter in bug.php?op=show, (2) the bugid parameter in bug.php?op=vote, (3) the bugid parameter in bug.php?op=viewvotes, or (4) the project parameter in bug.php?op=add, which are not properly sanitized before being used in SQL queries. This can lead to unauthorized access to sensitive information, corruption of database data, and exploitation of underlying database vulnerabilities. Additionally, phpBugTracker is prone to cross-site scripting (XSS) and HTML injection issues, which enable attackers to execute arbitrary script code in the browser of unsuspecting users. This can result in the theft of authentication credentials and other sensitive information.
Multiple input validation vulnerabilities in phpBugTracker allow remote attackers to execute arbitrary SQL commands via the (1) bugid parameter in bug.php, or execute arbitrary script code via the (2) op parameter in bug.php or (3) op parameter in user.php.
phpBugTracker is prone to multiple input validation vulnerabilities, including SQL injection, cross-site scripting, and HTML injection. These vulnerabilities are a result of the application failing to properly sanitize user-supplied input. The SQL injection vulnerabilities can allow remote attackers to manipulate query logic, potentially leading to unauthorized access to sensitive information or database corruption. The cross-site scripting and HTML injection vulnerabilities can allow attackers to execute arbitrary script code in the browser of unsuspecting users, potentially stealing authentication credentials and other sensitive information.
A remote attacker can exploit a vulnerability in Microsoft Outlook and Outlook Express by sending a malicious email containing a NULL character in the message body. This can cause the GUI to stop responding, resulting in a denial of service condition for users.
Zaep AntiSpam is prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user supplied URI input. This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
Services By CQR