Cross site scripting

Cross-site scripting XSS vulnerability in modules/ecal/display.php in the Event Calendar in bcoos 1.0.10 allows remote attackers to inject arbitrary web script or HTML via the month parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2007-6249

etc-update in Portage before 2.1.3.11 on Gentoo Linux relies on the umask to set permissions for the merge file, often resulting in permissions weaker than those of the original files, which might allow local users to obtain sensitive information by reading the merge file...

CVE-2007-6364

Cross-site scripting XSS vulnerability in modificarPerfil.php in JLMForo System allows remote authenticated users to inject arbitrary web script or HTML via a signature...

CVE-2007-6370

...

CVE-2007-5580

CVE-2007-5580 is a remote buffer overflow in Cisco Security Agent on Windows caused by a driver not validating SMB data, exploitable via crafted SMB packets over TCP ports 139 or 445. Affected CSA versions include Windows 4.5.1 (<= 4.5.1.671/672 hotfix path), 5.0 (<= 5.0.0.225), 5.1 (<= ...

CVE-2007-6378

CVE-2007-6378 is a directory-traversal vulnerability in BadBlue 2.72b and earlier, affecting the upload.dll component. An attacker can supply a filename with ".." to create or overwrite arbitrary files remotely. The provided documents specify only the vulnerability description and do not include ...

CVE-2007-6367

CVE-2007-6367 describes multiple XSS vulnerabilities in SineCMS 2.3.4 and earlier in the guestbook, exploitable via the username (user) or commento fields. The description specifies different vectors from CVE-2007-2357 but does not provide concrete root-cause code or affected subcomponents beyond...

CVE-2007-6365

CVE-2007-6365 describes a cross-site scripting (XSS) vulnerability in the Event Calendar component of bcoos 1.0.10, specifically in modules/ecal/display.php, where an attacker can inject arbitrary script or HTML via the month parameter. The affected product is bcoos 1.0.10; the issue is a client-...

CVE-2007-6380

CVE-2007-6380 describes multiple SQL injection vulnerabilities in e-Xoops (exoops) versions 1.08 and 1.05 Rev 1–3. The flaws allow remote attackers to execute arbitrary SQL commands via the parameter lid targeting various scripts under modules/ (mylinks/ratelink.php, adresses/ratefile.php, mydown...

CVE-2007-6371

CVE-2007-6371 affects Nokia N95 with RM-159 firmware 12.0.013. A remote attacker can cause a denial of service by sending a SIP INVITE, followed by an immediate SIP CANCEL, then a second SIP INVITE in a different session. The connected documents do not specify a fix or patch version. No exploitat...

CVE-2007-6370

CVE-2007-5583 (Cisco IP Phone 7940, firmware P0S3-08-7-00) allows remote denial of service via a sequence of SIP INVITE requests where the Request-URI lacks a user name; CVE-2007-6370 is a duplicate of this vulnerability. No remediation details are provided in the connected documents.

CVE-2007-6195

HP-UX vulnerability CVE-2007-6195 affects swagentd (Software Distributor) on HP-UX B.11.11 and B.11.23. The flaw is in sw_rpc_agent_init (opcode 0x04) where malformed DCE RPC arguments can trigger a buffer overflow, enabling remote arbitrary code execution or a Denial of Service. HP released fixe...

CVE-2007-4707

CVE-2007-4707 concerns Apple QuickTime before 7.3.1, where the Flash media handler contains multiple vulnerabilities that can be exploited by a crafted QuickTime movie to remotely execute arbitrary code. Affected product: QuickTime (Windows and Mac OS X) prior to 7.3.1; vulnerability class is des...

CVE-2007-6361

CVE-2007-6361 affects Gekko 0.8.2 and earlier. The issue is that sensitive information is stored under the web root, with potentially insufficient access control, which could allow remote attackers to read certain files under temp/ (demonstrated by a log file recording blog-entry titles). Note th...

CVE-2007-6338

CVE-2007-6338 targets Trivantis CourseMill Enterprise Learning Management System 4.1 SP4. The vulnerability is an SQL injection in userlogin.jsp via the username parameter, enabling arbitrary SQL execution as described in the NVD entry. Connected documents corroborate a remote SQL injection capab...

CVE-2007-6359

CVE-2007-6359 affects the Apple XNU kernel (bsd/kern/ubc_subr.c) in Mac OS X 10.5.1 and earlier. A local user can trigger a null pointer dereference in the kernel’s handling of code signatures in cs_validate_page, allowing a crafted signed Mach-O binary to cause a denial of service (failed assert...

CVE-2007-6363

IBM Tivoli Netcool Security Manager 1.3.0 is affected by CVE-2007-6363: before Interim Fix 1, AD LDAP authentication allows remote attackers to obtain login access without a password via unspecified vectors. This impacts authentication bypass with AD LDAP and could permit unauthorized access. A f...

CVE-2007-6368

The CVE-2007-6368 entry concerns ezContents 1.4.5, where a directory traversal flaw in index.php allows remote attackers to read arbitrary files via a .. (dot dot) in the link parameter. This vulnerability is documented across multiple sources (NVD, CVE List, PRION, PRion, etc.), indicating the a...

CVE-2007-6374

CVE-2007-6374 concerns multiple XSS flaws in Bitweaver 2.0.0 and earlier, exploitable via PATH_INFO in four endpoints: /users/register.php, /search/index.php, /wiki/index.php (editcomments action), and /forums/index.php. The vulnerability allows remote attackers to inject arbitrary script or HTML...

CVE-2007-6366

CVE-2007-6366 affects SineCMS 2.3.4 and earlier . Multiple SQL injection flaws allow remote attackers to execute arbitrary SQL via: (1) the id parameter to mods/Calendar/index.php (Calendar info action), (2) the id parameter to admin/mods_adm.php for a Guestbook modification action, (3) the id pa...