CVE-2007-6435

CVE-2007-6435 is a stack-based buffer overflow in the Novell GroupWise Client triggered when processing HTML emails containing a crafted IMG SRC attribute. The vulnerability requires the HTML Preview feature and user action (reply/forward) to exploit, enabling remote code execution on vulnerable ...

CVE-2007-6433

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter...

CVE-2007-6354

Unspecified vulnerability in exiftags before 1.01 has unknown impact and attack vectors, resulting from a "field offset overflow" that triggers an "illegal memory access," a different vulnerability than CVE-2007-6355...

CVE-2007-6434

CVE-2007-6434 affects Linux kernel 2.6.23. A local attacker can create low pages in virtual userspace memory and bypass mmap_min_addr protection by supplying a crafted executable that calls do_brk. This is a local-attack scenario with partial impact on availability as per CVSS 2.0 (low base score...

CVE-2007-6424

CVE-2007-6424 affects Fonality Trixbox 2.0 PBX; the registry.pl script reads commands from a remote site without proper origin validation, enabling a DNS spoofing vector that lets remote attackers disable Trixbox and execute arbitrary commands. Affected component: registry.pl; root cause: insuffi...

Important: Red Hat Security Advisory: mysql security update

Updated mysql packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server...

Apple OS X Software Update Command Execution

This module exploits a feature in the Distribution Packages, which are used in the Apple Software Update mechanism. This feature allows for arbitrary command execution through JavaScript. This exploit provides the malicious update server. Requests must be redirected to this server by other means...

CVE-2007-5583

Cisco IP Phone 7940 with firmware P0S3-08-7-00 allows remote attackers to cause a denial of service "486 Busy" responses or device reboot via a sequence of SIP INVITE transactions in which the Request-URI lacks a user name, a different vulnerability than CVE-2007-4459...

CVE-2007-6283

Red Hat Enterprise Linux 5 and Fedora install the Bind /etc/rndc.key file with world-readable permissions, which allows local users to perform unauthorized named commands, such as causing a denial of service by stopping named...

CVE-2007-6283

Red Hat Enterprise Linux 5 and Fedora install the Bind /etc/rndc.key file with world-readable permissions, which allows local users to perform unauthorized named commands, such as causing a denial of service by stopping named...

CVE-2007-5583

Cisco IP Phone 7940 with firmware P0S3-08-7-00 is affected by CVE-2007-5583, a denial-of-service vulnerability caused by a sequence of SIP INVITE transactions where the Request-URI lacks a user name. Remote attackers can trigger 486 Busy responses or a device reboot. The vulnerability is document...

ZDI-07-078: St. Bernard Open File Manager Heap Overflow Vulnerability

ZDI-07-078: St. Bernard Open File Manager Heap Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-07-078.html December 17, 2007 -- CVE ID: CVE-2007-6281 -- Affected Vendor: St. Bernard -- Affected Products: Open File Manager 9.5 -- TippingPointTM IPS Customer Protection:...

Moderate: squid security update

2.5.STABLE3-8.3E - fix for 410181 - CVE-2007-6239 Squid DoS in cache updates 2.5.STABLE3-7 - resolves: 238103: 'forwardedfor off' in squid.conf does not work...

VulnCheck KEV: CVE-2007-6436

Stack-based buffer overflow in JSGCI.DLL in JustSystems Ichitaro 2005, 2006, and 2007 allows user-assisted remote attackers to execute arbitrary code via a crafted document, as actively exploited in December 2007 by the Tarodrop.F trojan. NOTE: some of these details are obtained from third party...

Easylon OPC Server任意代码执行漏洞

BUGTRAQ ID: 26876 CVE ID:CVE-2007-4473 CNCVE ID:CNCVE-20074473 OLE for Process Control OPC是一款用于进程控制和制造业使用的标准OLE COM对象集规 格。OPC servers是OPC实现的服务程序。 Easylon OPC Server不正确验证服务处理，远程攻击者可以利用漏洞未授权访问服务器OPC 接口。 攻击者可以借此访问Easylon OPC Server执行任意代码或进行拒绝服务攻击，目前没有详细 漏洞细节提供。 Gesytec GmbH Easylon OPC Server 2.30.3...

PeerCast servhs.cpp handshakeHTTP Function SOURCE Request Remote Overflow

The version of PeerCast installed on the remote host fails to check the length of user-supplied data in its 'handshakeHTTP' function in 'servhs.cpp' before copying it to the 'loginPassword' and 'loginMount' heap-based buffers. An unauthenticated attacker can leverage this issue to crash the...

Mac OS X Multiple Vulnerabilities (Security Update 2007-009)

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2007-009 applied. This update contains several security fixes for a large number of programs. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid29723; scriptversion"1.28";...

Microsoft Windows Media Format ASF Parsing Code Execution (MS07-068; CVE-2007-0064)

The Microsoft Windows Media Format Runtime provides information and tools for applications that use Windows Media content. The core component of Windows Media Format is the Advanced Systems Format ASF. ASF is a file format that stores audio and video information and is specially designed to run...

Important: mysql security update

4.1.20-3.RHEL4.1.el46.1 - Back-port upstream fixes for CVE-2007-5925, CVE-2007-5969. Resolves: 422181...

CVE-2007-6417

The shmemgetpage function mm/shmem.c in Linux kernel 2.6.11 through 2.6.23 does not properly clear allocated memory in some rare circumstances related to tmpfs, which might allow local users to read sensitive kernel data or cause a denial of service crash...