CWE-59 Archives - CVE Vulnerability

CVE-2008-7273

Sun, 26 Feb 2023 09:11:57 +0000

A symlink issue exists in Iceweasel-firegpg before 0.6 due to insecure tempfile handling.

The post CVE-2008-7273 appeared first on CVE Vulnerability.

CVE-2008-7247

Sun, 26 Feb 2023 09:11:56 +0000

sql/sql_table.cc in MySQL 5.0.x through 5.0.88, 5.1.x through 5.1.41, and 6.0 before 6.0.9-alpha, when the data home directory contains a symlink to a different filesystem, allows remote authenticated users to bypass intended access restrictions by calling CREATE TABLE with a (1) DATA DIRECTORY or (2) INDEX DIRECTORY argument referring to a subdirectory that requires following this symlink.

The post CVE-2008-7247 appeared first on CVE Vulnerability.

CVE-2008-6759

Sun, 26 Feb 2023 09:11:42 +0000

ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to obtain sensitive information via a URL in the POST_DATA parameter to manuals_search.php, which reveals the installation path in an error message.

The post CVE-2008-6759 appeared first on CVE Vulnerability.

CVE-2008-6760

Sun, 26 Feb 2023 09:11:42 +0000

ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to obtain sensitive information via an unauthenticated add and save action for a shopping cart in cart_save.php, which reveals the SQL table names in an error message, related to code that mishandles the lack of a user_id parameter.

The post CVE-2008-6760 appeared first on CVE Vulnerability.

CVE-2008-6762

Sun, 26 Feb 2023 09:11:42 +0000

Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backto parameter.

The post CVE-2008-6762 appeared first on CVE Vulnerability.

CVE-2008-6552

Sun, 26 Feb 2023 09:11:35 +0000

Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN – The Cluster Manager before 2.03.09-1 on Fedora 9.

The post CVE-2008-6552 appeared first on CVE Vulnerability.

CVE-2008-6397

Sun, 26 Feb 2023 09:11:30 +0000

rlatex in AlcoveBook sgml2x 1.0.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.

The post CVE-2008-6397 appeared first on CVE Vulnerability.

CVE-2008-6398

Sun, 26 Feb 2023 09:11:30 +0000

sng_regress in SNG 1.0.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/recompiled$$.png, (2) /tmp/decompiled$$.sng, and (3) /tmp/canonicalized$$.sng temporary files.

The post CVE-2008-6398 appeared first on CVE Vulnerability.

CVE-2008-5825

Sun, 26 Feb 2023 09:11:12 +0000

The SmartPoster implementation on the Nokia 6131 Near Field Communication (NFC) phone with 05.12 firmware does not properly display the URI record when the Title record contains a certain combination of space, CR (aka r), and . (dot) characters, which allows remote attackers to trick a user into loading an arbitrary URI via a crafted NDEF tag, as demonstrated by (1) an http: URI for a malicious web site, (2) a tel: URI for a premium-rate telephone number, and (3) an sms: URI that triggers purchase of a ringtone.

The post CVE-2008-5825 appeared first on CVE Vulnerability.

CVE-2008-5742

Sun, 26 Feb 2023 09:11:09 +0000

Multiple open redirect vulnerabilities in AIST NetCat 3.12 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the redirect parameter in a logoff action to modules/auth/index.php or (2) the url parameter to modules/linkmanager/redirect.php. NOTE: this was reported within an “HTTP Response Splitting” section in the original disclosure.

The post CVE-2008-5742 appeared first on CVE Vulnerability.