Stefano Di Paola

The issue is related to insufficient access control in the JMX-Console web application. This allows remote attackers to send requests to the application's handler using a different method, potentially disclosing protected information.

The issue is related to a cross-site scripting (XSS) vulnerability in ActionScript within arbitrary Shockwave Flash (SWF) files created by InfoSoft FusionCharts. This allows remote attackers to inject arbitrary additional SWF content via a URL in the SRC attribute of an IMG element in the `dataURL` parameter.

The issue allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields, such as the `Transfer-Encoding` field. This could enable an attacker to read data from a Web page in another domain in Internet Explorer if a user browses a Web site that contains specially crafted content or opens specially crafted HTML e-mail.

A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via vectors related to loose interpretation of an ActionScript attribute.

The issue concerns the setRequestHeader method of the XMLHttpRequest object, which fails to restrict the dangerous Transfer-Encoding HTTP request header. This allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks by sending a POST request containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.

A CRLF injection issue exists in the Digest Authentication support, allowing remote attackers to conduct HTTP response splitting attacks by including a LF (%0a) in the `username` attribute.

The issue concerns a problem with cross-site request forgery (CSRF) protection. It does not properly validate the HTTP REFERER, allowing remote attackers to conduct CSRF attacks.

The issue allows remote attackers to cause a denial of service, specifically memory consumption, when a long sequence of # (hash) characters is appended to a PDF URL. This is related to a cross-site scripting issue and can occur when the plugin is used with browsers such as Internet Explorer, Google Chrome, or Opera.

Name of the Vulnerable Software and Affected Versions: MySQL versions 5.0.x up to 5.0.20 Description: A buffer overflow issue exists in the open table function in sql base.cc, potentially allowing remote attackers to execute arbitrary code via crafted COM TABLE DUMP packets with invalid length values. Recommendations: For MySQL versions 5.0.x up to 5.0.20, update to a version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: MySQL versions 4.0.x up to 4.0.26 MySQL versions 4.1.x up to 4.1.18 MySQL versions 5.0.x up to 5.0.20 Description: The issue allows remote attackers to obtain sensitive information via a COM TABLE DUMP request with an incorrect packet length, which includes portions of memory in an error message. Recommendations: For MySQL versions 4.0.x up to 4.0.26, update to a version later than 4.0.26 to resolve the issue. For MySQL versions 4.1.x up to 4.1.18, update to a version later than 4.1.18 to resolve the issue. For MySQL versions 5.0.x up to 5.0.20, update to a version later than 5.0.20 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: MySQL versions 4.0.x up to 4.0.26 MySQL versions 4.1.x up to 4.1.18 MySQL versions 5.0.x up to 5.0.20 Description: The issue allows remote attackers to read portions of memory via a username without a trailing null byte, which causes a buffer over-read. This occurs due to the `check connection` function in sql parse.cc. Recommendations: For MySQL versions 4.0.x up to 4.0.26, update to a version later than 4.0.26 to resolve the issue. For MySQL versions 4.1.x up to 4.1.18, update to a version later than 4.1.18 to resolve the issue. For MySQL versions 5.0.x up to 5.0.20, update to a version later than 5.0.20 to resolve the issue.

The issue allows remote authenticated users with INSERT and DELETE privileges to bypass library path restrictions and execute arbitrary libraries. This is achieved by using INSERT INTO to modify the `mysql.func` table, which is processed by the `udf init` function.

The issue allows local users with CREATE TEMPORARY TABLE privileges to overwrite arbitrary files via a symlink attack, due to the use of predictable file names when creating temporary tables.

The issue allows remote authenticated users with INSERT and DELETE privileges to execute arbitrary code by using CREATE FUNCTION to access libc calls, such as `strcat`, `on exit`, and `exit`.