Rafel Ivgi

A buffer overflow issue in Microsoft Office XP allows remote attackers to execute arbitrary code. This can be achieved via a link with a URL file location containing long inputs, specifically after encountering a "%00 (null byte) in .doc filenames or a "%0a" (carriage return) in .rtf filenames.

The issue allows remote attackers to gain sensitive information by modifying the `g2 subView` parameter in the `main.php` file, which reveals the path in an error message.

A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `username` field in the login.php file.

The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various fields in different scripts, including the index field in `add comment.php`, `set albumName`, `slide index`, `slide full`, `slide loop`, `slide pause`, `slide dir` fields in `slideshow low.php`, or the `username` field in `search.php`.

A directory traversal issue allows remote attackers to overwrite arbitrary files by including a .. (dot dot) in a zip file.

A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `g2 form[subject]` field in the login.php file.

The issue allows remote attackers to bypass the file download warning dialog, potentially tricking users into executing arbitrary code. This can be achieved through a web page containing a body element with an onclick tag, utilizing the createElement function.

The issue allows remote attackers to cause a denial of service, potentially triggering a buffer overflow, by sending a long `pwd` parameter to the sysinfo script.

A directory traversal issue allows remote attackers to read protected files by using .. (dot dot) sequences in an HTTP request. This has been demonstrated using the home.asp file.

The issue allows remote attackers to execute arbitrary code via the `Internacional` property followed by a long string, which leads to a buffer overflow in the `ascontrol.dll` component.

The issue allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long string in the `ScanParam` property of a COM object. This may trigger a buffer overflow.

The issue allows remote attackers to cause a denial of service, resulting in a crash, by sending a long string to the `GetPrivateProfileString` function. It was initially reported as a potential buffer overflow, although this claim is disputed by the vendor. The vendor acknowledges that a crash can occur.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary HTML or web script as other users via a specially crafted URL. This could potentially lead to unauthorized actions being taken on behalf of other users.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `test` parameter. This can lead to the execution of malicious scripts on the victim's browser.

The issue allows remote attackers to read arbitrary .htt files by providing a full pathname in the `error` parameter of the webacc servlet.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary scripts as other users. The exploitation is possible via the `action`, `username`, or `password` parameters in an isqlplus request.

The issue allows remote attackers to read and download arbitrary files due to multiple directory traversal vulnerabilities. This can be achieved via multi-dot "......" sequences or "%5c%2e%2e" (encoded "..") sequences in the URL.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected API endpoints include "productdetail.asp", "searchresults.asp", and possibly "ListCategories.asp". The vulnerable parameters are the `level` parameter in "productdetail.asp" and the `searchKey` parameter in "searchresults.asp", as well as possibly the `level` parameter in "ListCategories.asp".

A directory traversal issue allows remote attackers to read arbitrary files by including a .. (dot dot) in a URL.

The issue allows remote attackers to gain sensitive information via the mail login form. This form contains the path to the mail directory, which can be exploited to obtain sensitive data.