BELL-CVE-2007-6422 CVE-2007-6422 does not affect BellSoft software

Bulletin has no description...

CVE-2007-6422

The balancerhandler function in modproxybalancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to cause a denial of service child process crash via an invalid bb variable...

CVE-2007-6388

CVE-2007-6388 is an XSS vulnerability in Apache HTTP Server mod_status when the server-status page is enabled. The initial description covers affected versions: Apache HTTP Server 2.2.0–2.2.6, 2.0.35–2.0.61, and 1.3.2–1.3.39, with arbitrary web script/HTML injection possible via unspecified vecto...

CVE-2007-6422

CVE-2007-6422 affects Apache HTTP Server 2.2.0–2.2.6 when using a threaded MPM. The vulnerability in the mod_proxy_balancer module allows remote authenticated users to cause a denial of service by triggering a crash of the Apache child process via an invalid bb variable. This is documented in mul...

e2fsprogs security update

CentOS Errata and Security Advisory CESA-2008:0003 Updated e2fsprogs packages that fix several security issues are now available for Red Hat Enterprise Linux. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The e2fsprogs packages contain a numb...

CVE-2007-6673

Cross-site scripting XSS vulnerability in Makale Scripti allows remote attackers to inject arbitrary web script or HTML via the ara parameter to the default URI under Ara/ in a search action...

Sql injection

SQL injection vulnerability in loginform.asp in Instant Softwares Dating Site allows remote attackers to execute arbitrary SQL commands via the Username parameter, a different vulnerability than CVE-2007-6671. NOTE: the provenance of this information is unknown; the details are obtained solely fr...

CVE-2007-6671

CVE-2007-6671 is a SQL injection vulnerability in the login_form.asp of the Instant Softwares Dating Site. The flaw allows remote attackers to execute arbitrary SQL commands through the Password parameter (the description notes it is a different product than CVE-2006-6021). Other connected source...

CVE-2007-6672

Jetty 6.1.5 and 6.1.6 are affected by CVE-2007-6672, an information-disclosure vulnerability where remote attackers can read restricted files by crafting URIs containing multiple forward slashes (//). The root cause is improper processing of URLs with multiple ‘/’ characters, allowing access to r...

CVE-2007-6673

CVE-2007-6673 describes a cross-site scripting (XSS) vulnerability in the Makale Scripti application. According to the provided sources, the issue allows remote attackers to inject arbitrary web script or HTML through the aria parameter to the default Ara/ URI in a search action. The entries do n...

CVE-2007-6668

admin/uploadgames.php in MySpace Content Zone MCZ 3.x does not require administrative privileges, which allows remote attackers to perform unrestricted file uploads, as demonstrated by uploading 1 a .php file and 2 a .php%00.jpeg file...

CVE-2007-6668

admin/uploadgames.php in MySpace Content Zone MCZ 3.x does not require administrative privileges, which allows remote attackers to perform unrestricted file uploads, as demonstrated by uploading 1 a .php file and 2 a .php%00.jpeg file...

CVE-2007-6670

CVE-2007-6670 corresponds to a SQL injection in PHCDownload 1.1.0. The vulnerable element is search.php, where the string parameter is unsafely used in SQL queries, enabling remote attackers to execute arbitrary SQL commands. This affects PHCDownload 1.1.0 as described in multiple sources. The do...

CVE-2007-6668

CVE-2007-6668 affects admin/uploadgames.php in MySpace Content Zone (MCZ) 3.x, where a missing requirement for administrative privileges enables remote attackers to upload arbitrary files (demonstrated with a .php file and a .php%00.jpeg). The connected records confirm the vulnerability’s existen...

CVE-2007-6669

CVE-2007-6669 describes a Cross-site Scripting (XSS) vulnerability in the search.php component of PHCDownload 1.1.0 . The issue allows remote attackers to inject arbitrary web script or HTML by supplying the attacker-controlled string parameter, enabling potential user session or browser context ...

CVE-2007-5965

QSslSocket in Trolltech Qt 4.3.0 through 4.3.2 does not properly verify SSL certificates, which might make it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service, or trick a service into accepting an invalid client certificate for a user...

CVE-2007-5965

CVE-2007-5965 affects Trolltech Qt 4.3.0–4.3.2, where QSslSocket does not correctly verify SSL certificates. This can allow remote attackers to trick users into accepting an invalid server certificate for a spoofed service or cause a service to accept an invalid client certificate (I) as describe...

CVE-2007-6388

Cross-site scripting XSS vulnerability in modstatus in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Novell ZENworks ESM客户端STEngine.exe本地权限提升漏洞

BUGTRAQ ID: 27146 CVECAN ID: CVE-2007-5665 Novell ZENworks Endpoint Security Management（ESM）的安全客户端允许集中管理防火墙保护策略。 ESM在处理命令的执行时存在漏洞，本地攻击者可能利用此漏洞提升自己的权限。 当在工作站上安装ZENworks ESM的安全客户端时，就会将STEngine服务设置为在本地SYSTEM帐号下运行。以下可执行程序中实现这个服务： 文件名：STEngine.exe（1,847,296字节） 版本：3.5.0.20...

openSUSE 10 Security Update : xen (xen-4764)

This update fixes various Xen issues. Two security problems were fixed: CVE-2007-5906: Xen allowed virtual guest system users to cause a denial of service hypervisor crash by using a debug register DR7 to set certain breakpoints. CVE-2007-5907: Xen 3.1.1 does not prevent modification of the CR4 T...