CVE-2007-6400

CVE-2007-6400 affects PolDoc CMS (aka PDDMS) 0.96 in download_file.php. The vulnerability is a directory traversal flaw that lets remote attackers read arbitrary files by supplying a .. or absolute path in the filename parameter. This exposes partial confidentiality (per the CVSS 2.0 entry: AV:N/...

CVE-2007-6392

CVE-2007-6392 is an SQL injection vulnerability in DWdirectory 2.1 and earlier. The flaw allows remote attackers to execute arbitrary SQL commands via the search parameter to the /search URI. The connected documents confirm affected software (DWdirectory 2.1 and earlier) and the underlying cause ...

Security fix for the ALT Linux 7 package libexif version 0.6.16-alt2

Dec. 17, 2007 Dmitriy Khanzhin 0.6.16-alt2 - security fixes: + CVE-2007-6351, CVE-2007-6352 upstream patches + thanks ldv@ for information - licence tag changed to LGPLv2+...

Unfixed XSS vulnerability at www.hugegaypass.com

Security researcher TreX, has submitted on 17/12/2007 a cross-site-scripting XSS vulnerability affecting www.hugegaypass.com, which at the time of submission ranked 336558 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 19/12/2007. It is...

Fedora 7 : autofs-5.0.1-29 (2007-4469)

Thu Dec 13 2007 Ian Kent - 5.0.1-29 - Bug 421351: CVE-2007-5964 autofs defaults don't restrict suid in /net f7 - use mount option 'nosuid' for '-hosts' map unless 'suid' is explicily specified. - Wed Sep 5 2007 Ian Kent - 5.0.1-28 - add ldaps support required by schema discovery. - add back LDAP...

Debian DSA-1432-1 : link-grammar - buffer overflow

Alin Rad Pop discovered that link-grammar, Carnegie Mellon University's link grammar parser for English, performed insufficient validation within its tokenizer, which could allow a malicious input file to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Slackware 11.0 / 12.0 / current : mysql (SSA:2007-348-01)

New mysql packages are available for Slackware 11.0, 12.0, and -current to fix bugs and security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2007-348-01. The text itself is...

Fedora 8 : mysql-5.0.45-6.fc8 (2007-4465)

Thu Dec 13 2007 Tom Lane 5.0.45-6 - Back-port upstream fixes for CVE-2007-5925, CVE-2007-5969, CVE-2007-6303. Related: 422211 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean...

Mac OS X : Java for Mac OS X 10.4 Release 6

The remote Mac OS X 10.4 host is running a version of Java for Mac OS X that is older than release 6. The remote version of this software contains several security vulnerabilities that may allow a rogue Java applet to escalate its privileges and to add or remove arbitrary items from the user's...

Fedora 7 : squid-2.6.STABLE16-2.fc7 (2007-4161)

Thu Dec 6 2007 Martin Nagy - 7:2.6.STABLE16-1 - Upstream patch to fix CVE-2007-6239 410181 - Fri Sep 7 2007 Martin Bacovsky - 7:2.6.STABLE16-1 - upgrade to latest upstream 2.6.STABLE14 - Wed Aug 1 2007 Martin Bacovsky - 7:2.6.STABLE14-1 - upgrade to latest upstream 2.6.STABLE14 - Mon Jun 4 2007...

Fedora 7 : mysql-5.0.45-6.fc7 (2007-4471)

Thu Dec 13 2007 Tom Lane 5.0.45-6 - Back-port upstream fixes for CVE-2007-5925, CVE-2007-5969, CVE-2007-6303. Related: 422211 - Update License tag to match code. - Sun Jul 22 2007 Tom Lane 5.0.45-1 - Update to MySQL 5.0.45 Resolves: 246535 - Move mysqlconfig's man page to base package Resolves:...

[SECURITY] [DSA 1434-1] New mydns packages fix denial of service

------------------------------------------------------------------------ Debian Security Advisory DSA-1434-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst December 16, 2007 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1433-1] New centericq packages fix execution of code

------------------------------------------------------------------------ Debian Security Advisory DSA-1433-1 [email protected] http://www.debian.org/security/ Steve Kemp December 16, 2007 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1432-1] New link-grammar packages fix execution of code

------------------------------------------------------------------------ Debian Security Advisory DSA-1432-1 [email protected] http://www.debian.org/security/ Steve Kemp December 16, 2007 http://www.debian.org/security/faq -...

Hosting Controller - Multiple Security Bugs (Extremely Critical)

Title: Multiple Security Bugs In Hosting Controller Critical: Extremely critical Impact: Full system administrator access Vendor: Hosting Controller Version: 6.1 Hot fix = 3.3 Vendor URL: www.hostingcontroller.com Solution: N/A From company - There is temporary solution in this report Exploit:...

Unfixed XSS vulnerability at www.airasia.com

Security researcher DerickTham, has submitted on 16/12/2007 a cross-site-scripting XSS vulnerability affecting www.airasia.com, which at the time of submission ranked 2421 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 16/12/2007. It is...

[security bulletin] HPSBUX02294 SSRT071451 rev.1 - HP-UX Running DCE, Remote Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01294212 Version: 1 HPSBUX02294 SSRT071451 rev.1 - HP-UX Running DCE, Remote Denial of Service DoS NOTICE: The information in this Security Bulletin should be acted upon as soon as possible...

+ Trivantis CourseMill Enterprise Learning Management System - SQL Injection - CVE-2007-6338

+==================================================================================================+ + Trivantis CourseMill Enterprise Learning Management System - SQL Injection - CVE-2007-6338 + +==================================================================================================+...

Unfixed XSS vulnerability at www.behtarinbazi.com

Security researcher TreX, has submitted on 16/12/2007 a cross-site-scripting XSS vulnerability affecting www.behtarinbazi.com, which at the time of submission ranked 227825 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 12/01/2008. It is...

MS Office 2007: Target of Hyperlinks not covered by Digital Signatures

Affects: Microsoft Office 2007 12.0.6015.5000 MSO 12.0.6017.5000 possibly older versions I. Background Microsoft Office is a suite containing several programs to handle Office documents like text documents or spreadsheets. The latest version uses an XML based document format. Microsoft Office...