CVE-2007-6621

Joovili 3.0.0–3.0.6 is affected by a directory traversal flaw in joovili.images.php that allows remote attackers to read arbitrary files via a .. sequence in the picture parameter. The underlying cause is improper handling of the picture input, enabling file reads outside the web root. Impact is ...

CVE-2007-6625

Technical details (affected product/version, root cause, remediation) are not publicly available in the provided connected documents. Monitor for updates. The CVE entry describes a denial-of-service via invalid format string in IDM 3.5.1, but no further specifics are given here.

CVE-2007-6628

CVE-2007-6628 affects LScube Feng 0.1.15 and earlier. The issue allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via two malformed headers: (1) Transport header triggering misparsing in RTSP_setup.c’s parse_transport_header (example: a header containing onl...

CVE-2007-6636

CVE-2007-6636 affects Bitflu (StorageFarabDb module) before version 0.42. A user-assisted remote attacker can craft a .torrent file to create or append data to arbitrary files on the affected system. The description specifies the vulnerability but does not provide a patch or mitigation detail wit...

CVE-2007-6632

The CVE-2007-6632 entry concerns showCode.php in xml2owl 0.1.1 where remote attackers can execute arbitrary commands via shell metacharacters in the path parameter. The affected component is the xml2owl PHP application (version 0.1.1). The vulnerability is a shell command injection in the path pa...

MacroVision InstallShield Update Service DownloadAndExecute buffer overflow

Added: 01/04/2008 CVE: CVE-2007-6654 BID: 27013 OSVDB: 39980 Background MacroVision InstallShield is software for creating installers or software packages. Problem A buffer overflow in the DownloadAndExecute function in the Update Service ActiveX control allows command execution when a user loads...

CVE-2007-6631

CVE-2007-6631 describes multiple buffer overflows in the LScube libnemesi 0.6.4-rc1 and earlier. The vulnerability allows remote code execution via crafted RTSP traffic, including: a reply beginning with a long version string that overflows handle_rtsp_pkt in rtsp_handlers.c; excessively long hea...

Fedora 7 : qt4-4.3.3-1.fc7 (2007-4354)

An update to the latest upstream release. Includes fix for security issue CVE-2007-5965 rhbz411751. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

Debian DSA-1446-1 : wireshark - several vulnerabilities

Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to denial of service. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-6450 The RPL dissector could be tricked into an infinite loop. -...

CVE-2007-6635

FAQMasterFlexPlus (likely Version 1.5 or 1.52) stores the admin password in cleartext in a database. The underlying issue is the insecure storage of credentials, enabling context-dependent attackers who gain access to the database to obtain the password. The documents do not specify additional af...

CVE-2007-6624

The CVE-2007-6624 issue is a directory traversal/local file inclusion vulnerability in PNphpBB2 1.2i and earlier, exploitable via a .. in the phpEx parameter of printview.php. The active impact is indicated as partial confidentiality, integrity, and availability (CVSS v2 base score 6.8). The vuln...

CVE-2007-6629

The CVE-2007-6629 entry concerns LScube Feng 0.1.15 and earlier, where an interpretation conflict in a User-Agent line containing a carriage-return character can trigger a NULL dereference and daemon crash, causing a denial of service. The issue arises because the line-delimiter handling differs ...

Debian DSA-1443-1 : tcpreen - buffer overflows

It was discovered that several buffer overflows in tcpreen, a tool for monitoring a TCP connection, may lead to denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-1443. The...

CVE-2007-6614

PHP remote file inclusion vulnerability in admin/frontpageright.php in Agares Media phpAutoVideo 2.21 allows remote attackers to execute arbitrary PHP code via a URL in the loadadminpage parameter, a related issue to CVE-2007-6542...

Remote file inclusion

PHP remote file inclusion vulnerability in admin/frontpageright.php in Agares Media phpAutoVideo 2.21 allows remote attackers to execute arbitrary PHP code via a URL in the loadadminpage parameter, a related issue to CVE-2007-6542...

CVE-2007-6617

CVE-2007-6617 is a documented XSS vulnerability in the Atlassian Jira product, specifically in 500page.jsp for Jira Enterprise Edition before 3.12.1. The issue arises from improper handling of error messages, allowing a remote attacker to inject arbitrary script/HTML via input originally sent in ...

CVE-2007-6616

CVE-2007-6616 describes a Cross-site Scripting (XSS) flaw in SimpleForum, exploitable via the searchkey parameter in the search action of simpleforum.cgi. Affected software includes SimpleForum 4.6.2 and earlier releases. The vulnerability allows remote attackers to inject arbitrary web script or...

CVE-2007-6614

CVE-2007-6614 : PHP remote file inclusion in Agares Media phpAutoVideo 2.21. The vulnerability affects the admin/frontpage_right.php script and allows remote attackers to execute arbitrary PHP code via a URL supplied to the loadadminpage parameter. This is described as related to CVE-2007-6542. N...

CVE-2007-6619

CVE-2007-6619 affects Atlassian Jira Enterprise Edition prior to 3.12.1. The Setup Wizard does not properly restrict setup attempts after completion, enabling remote actors to change the default language. The issue is described alongside related vulnerabilities in 3.12.0-era Jira (noted in Nessus...

CVE-2007-6615

The CVE-2007-6615 entry concerns Agares Media phpAutoVideo 2.21. The vulnerability is a directory traversal in includes/block.php that allows remote attackers to include and execute arbitrary local files through crafted directory traversal sequences in the selected_provider parameter. This is con...