Unfixed XSS vulnerability at allspeed.com.tw

Security researcher tweetycoaster, has submitted on 28/12/2007 a cross-site-scripting XSS vulnerability affecting allspeed.com.tw, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 16/01/2008. It is...

CVE-2007-6558

CVE-2007-6558: TotalPlayer 3.0 is affected by a user-assisted DoS via a large .m3u file, potentially a duplicate of CVE-2006-6288. Connected records show CVE-2006-6288 affecting CoolPlayer 216 and earlier, describing multiple buffer overflows that allow remote code execution; however, for CVE-200...

CVE-2007-6553

The CVE-2007-6553 entries describe multiple PHP remote file inclusion vulnerabilities in TeamCal Pro (versions up to 3.1.000 and earlier) that allow remote attackers to execute arbitrary PHP code by supplying a URL in the CONF[app_root] parameter to various includes/modules (e.g., tcuser.class.ph...

CVE-2007-6543

The CVE-2007-6543 issue affects the eSyndiCat Link Exchange Script, specifically the suggest-link.php file. The underlying vulnerability is a SQL injection via the id parameter, enabling remote attackers to execute arbitrary SQL commands. This is evidenced by the description in the CVE records, i...

CVE-2007-6554

CVE-2007-6554 affects TeamCal Pro 3.1.000 and earlier. A directory traversal flaw allows remote attackers to include and execute arbitrary local files by supplying a .. (dot dot) in the lang parameter to index.php, register.php, login.php, or statistics.php. The vulnerability is rooted in imprope...

CVE-2007-6557

CVE-2007-6557 affects MeGaCheatZ 1.1 and describes multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL via the ItemID parameter in comments.php, view.php, and siteadmin/ViewItem.php (and other vectors). The cited metrics indicate a HIGH severity (CVSS v2 ba...

CVE-2007-6545

CVE-2007-6545 concerns RunCMS pre-1.6.1, with multiple XSS vectors: (1) subject parameter in modules/news/submit.php, (2) PATH_INFO to modules/news/index.php (potentially related to XoopsPageNav), and (3) an avatar image to edituser.php. The connected documents do not provide exploitation details...

CVE-2007-6550

PMOS Help Desk 2.4 and earlier is affected by CVE-2007-6550. form.php redirects without exiting, enabling remote attackers to perform eval injection and execute arbitrary PHP code via the options array parameter. Affected component: PMOS Help Desk’s PHP form handling. Root cause: missing exit aft...

Trend Micro ServerProtect RPCFN_CMON_SetSvcImpersonateUser buffer overflow

Added: 12/28/2007 CVE: CVE-2007-4218 BID: 25395 OSVDB: 39752 Background Trend Micro ServerProtect is a virus scanner for servers. Problem A buffer overflow in the ServerProtect service allows remote attackers to execute arbitrary commands by sending a specially crafted RPC request which is...

CVE-2007-6564

CVE-2007-6564 is a cross-site scripting (XSS) vulnerability in Limbo CMS 1.0.4.2, occurring in admin.php and exploitable via the com_option parameter. The affected component is the admin.php handler; the underlying cause is an input handling vulnerability that allows injection of arbitrary web sc...

Unfixed XSS vulnerability at www.reason-gaming.net

Security researcher DerickTham, has submitted on 28/12/2007 a cross-site-scripting XSS vulnerability affecting www.reason-gaming.net, which at the time of submission ranked 710451 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/01/2008. It i...

CVE-2007-6552

AuraCMS 2.2 contains a directory traversal vulnerability in index.php: remote authenticated users can include and execute arbitrary local files by supplying a .. (dot dot) in the act parameter, potentially involving the news pilih component. The example given is including admin/admin_users.php to...

Trend Micro ServerProtect RPCFN_CMON_SetSvcImpersonateUser buffer overflow

Added: 12/28/2007 CVE: CVE-2007-4218 BID: 25395 OSVDB: 39752 Background Trend Micro ServerProtect is a virus scanner for servers. Problem A buffer overflow in the ServerProtect service allows remote attackers to execute arbitrary commands by sending a specially crafted RPC request which is...

CVE-2007-6551

SQL injection vulnerability in showMsg.php in MailMachine Pro 2.2.4, and other versions before 2.2.6, allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2007-6549

Technical details (affected products, components, versions, impact, or fix) are not publicly available in the provided documents; monitor for updates.

CVE-2007-6548

CVE-2007-6548 affects RunCMS up to version 1.6.1 and involves multiple direct static code injection vulnerabilities. Remote authenticated administrators can inject arbitrary PHP code via specific parameters in admin interfaces: header/footer (modules/system/admin.php), disclaimer (modules/system/...

CVE-2007-6546

CVE-2007-6546 affects RunCMS prior to 1.6.1. The issue is a predictable session ID that enables remote attackers to hijack a user session by modifying the session identifier. The available data states the vulnerability could allow such session hijacking, with a base severity of medium (CVSSv2 6.4...

CVE-2007-6547

CVE-2007-6547 affects RunCMS prior to 1.6.1. The issue arises because the password-change flow does not require the entry of the old password, enabling a context-dependent attacker with temporary session access to change the password. The CVSSv2 base score listed is 6.8 (Medium) with network atta...

CVE-2007-6551

The CVE-2007-6551 entry describes an SQL injection in showMsg.php affecting MailMachine Pro 2.2.4 and earlier versions up to 2.2.5 (before 2.2.6). The vulnerability allows remote attackers to execute arbitrary SQL commands via the id parameter. The provided references confirm the flaw and general...

[Full-disclosure] [SECURITY] [DSA 1440-1] New inotify-tools packages fix arbitrary code execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1440-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 28, 2007 http://www.debian.org/security/faq -...