Andreas Sandblad

The issue allows remote user-assisted attackers to execute arbitrary commands via a crafted file with a "/" character in the filename of the Command Line property, followed by a valid file extension. This could cause the command before the slash to be executed. A remote code execution vulnerability exists due to the way file extensions are handled, potentially allowing an attacker to take complete control of an affected system if a user visits a specially crafted Web site. Significant user interaction is required to exploit this vulnerability.

The issue allows remote attackers to execute arbitrary PHP code via the query string in specific API endpoints, including "tags.php", "sign.php", and "admin/index.php".

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters and fields, including the `news id` parameter in the news module, `searchstring` parameter in the search module, `id` parameter in the webshop module, `username` parameter in index.php, and various fields during a user profile update, such as `Name`, `Address`, `Zip`, `City`, `Country`, and `Email`.

The issue allows remote attackers to execute arbitrary SQL commands during account registration. This is achieved via the `hideemail`, `languagex`, `xthetimeoffset`, and `xthetimeformat` parameters.

The issue allows remote attackers to execute arbitrary code via a URL in the `templatefolder` parameter to various PHP files, including 'postreply.php', 'posting.php', and 'pm/newpm.php' in both the 'deluxe/' and 'default/' directories.

The issue allows remote attackers to execute arbitrary PHP code via the `username` field. This is possible due to the use of a preg replace function call with a /e (executable) modifier in the domecode function, located in inc/functions post.php.

The issue allows remote attackers to execute arbitrary code via exceptional conditions that trigger memory corruption. This can occur when a user visits a specially crafted Web site, potentially allowing an attacker to take complete control of an affected system.

A remote code execution issue exists due to the way Internet Explorer handles certain method calls to HTML objects, potentially corrupting system memory and allowing an attacker to execute arbitrary code if a user visits a malicious website. This could result in an attacker taking complete control of an affected system.

Name of the Vulnerable Software and Affected Versions: Microsoft PowerPoint 2000 in Office 2000 SP3 Description: The issue is related to an interaction between Microsoft PowerPoint 2000 and Internet Explorer, allowing remote attackers to obtain sensitive information. This occurs when a PowerPoint presentation attempts to access objects in the Temporary Internet Files Folder (TIFF). Recommendations: For Microsoft PowerPoint 2000 in Office 2000 SP3, consider restricting access to the Temporary Internet Files Folder to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows user-assisted attackers to execute arbitrary code via an attachment with a filename containing a large number of spaces ending with a dangerous extension that is not displayed by the software, along with an inconsistent Content-Type header. This could be used to trick a user into downloading dangerous content by dragging or saving the attachment.

The issue allows remote attackers to execute arbitrary SQL commands when the MySQL root password is empty. This is possible through the `sql` parameter in the server.php test script.

The issue is related to design errors that allow user-assisted attackers to execute arbitrary code. This is achieved by overlaying a malicious new window above a file download box and then using a keyboard shortcut. The file download box is delayed until the user hits a shortcut that activates the "Run" button.

A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via a chat message. This is possible by including Javascript in style attributes within tags, which can be processed by Internet Explorer.

The issue allows remote attackers to execute arbitrary PHP functions. This is possibly due to an eval injection vulnerability, where an attacker can make a direct request to the "forum.inc.php" endpoint with a modified `addslashes` parameter. The attack can be performed by setting either the `asc` or `desc` parameters.

The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is possible via the ` base href` parameter in `translate.php`, the ` base path` parameter in `news.inc.php`, and the `p` parameter in `add note.php`.

The issue allows remote attackers to include arbitrary files via the `section` parameter followed by a null byte (%00) in files such as `body header.inc.php` and `print.php`.

The issue allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the `t core path` parameter in the bug sponsorship list view inc.php file.

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `activate` parameter in "register.php" and the `cat id` parameter in "faq.php".

The issue allows remote malicious web sites to spoof the extensions of files to download via the Content-Disposition header. This could be used to trick users into downloading dangerous content.

The issue allows remote attackers to write arbitrary files to known locations due to the predictable nature of temporary file names on file systems that use 8.3 style short names. This can facilitate the exploitation of vulnerabilities in applications that rely on unpredictable file names.