7-Zip ARJ archive handling buffer overflow

Added: 06/09/2006 CVE: CVE-2005-3051 BID: 14925 OSVDB: 19639 Background 7-Zip is a free file archiver for Windows platforms. Problem A buffer overflow vulnerability in 7-Zip could allow code execution when a specially crafted ARJ file is opened. Resolution Upgrade to 7-Zip 4.27 beta or higher...

[security bulletin] HPSBUX02090 SSRT051058 rev.2 - HP-UX Secure Shell Remote Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c00589050 Version: 2 HPSBUX02090 SSRT051058 rev.2 - HP-UX Secure Shell Remote Denial of Service DoS NOTICE: The information in this Security Bulletin should be acted upon as soon as possible...

7-Zip ARJ archive handling buffer overflow

Added: 06/09/2006 CVE: CVE-2005-3051 BID: 14925 OSVDB: 19639 Background 7-Zip is a free file archiver for Windows platforms. Problem A buffer overflow vulnerability in 7-Zip could allow code execution when a specially crafted ARJ file is opened. Resolution Upgrade to 7-Zip 4.27 beta or higher...

Mozilla Firefox GIF processing buffer overflow

Added: 06/09/2006 CVE: CVE-2005-0399 BID: 12881 OSVDB: 14937 Background Mozilla is a suite of Internet client products available for multiple platforms. Problem A heap overflow in Mozilla Firefox when processing GIF images with the obsolete Netscape extension 2 allows command execution when a use...

7-Zip ARJ archive handling buffer overflow

Added: 06/09/2006 CVE: CVE-2005-3051 BID: 14925 OSVDB: 19639 Background 7-Zip is a free file archiver for Windows platforms. Problem A buffer overflow vulnerability in 7-Zip could allow code execution when a specially crafted ARJ file is opened. Resolution Upgrade to 7-Zip 4.27 beta or higher...

CVE-2005-2463

Kayako LiveResponse 2.x vulnerability (CVE-2005-2463) lets remote attackers obtain sensitive information by directly requesting addressbook.php and other include scripts, with the path exposed in an error message. Affected software: Kayako LiveResponse 2.x. Impact: information disclosure with par...

CVE-2005-2465

CVE-2005-2465 is an XSS vulnerability affecting the pm.php component in PCXP/TOPPE CMS, exploitable by supplying crafted content to the msg variable. The available connected documents confirm the vulnerability exists but do not provide concrete remediation steps or version-specific scope (e.g., a...

CVE-2005-2467

CVE-2005-2467 describes multiple cross-site scripting (XSS) vulnerabilities in MySQL Eventum 1.5.5 and earlier . The flaws allow remote attackers to inject arbitrary web script or HTML via parameters: (1) the id parameter to view.php , (2) the release parameter to list.php , or (3) the F paramete...

CVE-2005-2466

OpenBook 1.2.2 is affected by multiple SQL injection vulnerabilities in the auth_user function of admin.php, allowing remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter. The vulnerability is detailed in CVE-2005-2466 with a NVD base score of 6.4 (MED...

CVE-2005-2462

Kayako LiveResponse 2.x is affected by a vulnerability where, during user login, the password is recorded in plaintext in the URL. This enables local users and possibly remote attackers to gain privileges and access sensitive information. The issue is discussed across multiple sources, and relate...

CVE-2005-2464

CVE-2005-2464 affects PCXP/TOPPE CMS. The issue allows remote attackers to bypass authentication and gain privileges by modifying the user’s cookie to match the target userid, enabling partial confidentiality/integrity/availability impact per CVSS. The provided documents do not specify affected v...

CVE-2005-2468

The CVE-2005-2468 entry describes multiple SQL injection vulnerabilities in MySQL Eventum 1.5.5 and earlier that allow remote attackers to execute arbitrary SQL commands. Affected functions include isCorrectPassword and userExist in class.auth.php, getCustomFieldReport in custom_fields.php, (5) c...

CVE-2005-2462

Kayako liveResponse 2.x, when logging in a user, records the password in plaintext in the URL, which allows local users and possibly remote attackers to gain privileges...

CVE-2005-2461

CVE-2005-2461 concerns Kayako LiveResponse 2.x, where the calendar feature exposes multiple SQL injection flaws exploitable via the (1) year or (2) date parameters. The NVD entry notes remote, unauthenticated access with network vector and low attack complexity, leading to potentially partial con...

CVE-2005-1976

Novell NetMail 3.5.2a, 3.5.2b, and 3.5.2c running on Linux reportedly set the owner and group of certain files to 500, which could allow users or groups with that ID to modify those files and potentially execute arbitrary code or cause a denial of service. The Red Hat advisory confirms this behav...

Internet Explorer Javaprxy.dll heap overflow

Added: 06/05/2006 CVE: CVE-2005-2087 BID: 14087 OSVDB: 17680 Background Windows operating systems use the Component Object Model COM to allow various program components to be run within different applications. One such object, the JView Profiler Javaprxy.dll, is a debugger interface for Microsoft...

[SECURITY] [DSA 1088-1] New centericq packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1088-1 [email protected] http://www.debian.org/security/ Martin Schulze June 3rd, 2006 http://www.debian.org/security/faq -...

CVE-2005-3619

Cross-site scripting XSS vulnerability in the management interface for VMware ESX 2.5.x before 2.5.2 upgrade patch 2, 2.1.x before 2.1.2 upgrade patch 6, and 2.0.x before 2.0.1 upgrade patch 6 allows remote attackers to inject arbitrary web script or HTML via messages that are not sanitized when...

CVE-2005-3619

CVE-2005-3619 affects VMware ESX Server management interface. The issue is a cross-site scripting (XSS) vulnerability in the web-based syslog viewer, where messages displayed without proper sanitization can inject arbitrary script/HTML. Affected versions include ESX 2.5.x prior to 2.5.2 upgrade p...

CVE-2006-2758

CVE-2006-2758 is a directory traversal vulnerability in Jetty 6.0.x (jetty6) beta16. A remote attacker can read arbitrary files by using an encoded path like %2e%2e%5c (../) in the URL, potentially impacting confidentiality. The issue is noted to possibly be the same as CVE-2005-3747. The connect...