CVE-2007-6329

CVE-2007-6329 affects Microsoft Office 2007 (builds 12.0.6015.5000) and MSO 12.0.6017.5000, where Office Open XML (OOXML) metadata is not signed. This allows an attacker to alter Dublin Core fields in the OOXML ZIP container, demonstrated in docProps/core.xml (LastModifiedBy and creator fields). ...

CVE-2007-6324

CVE-2007-6324 affects CityWriter 0.9.7 via a PHP remote file inclusion in head.php. The underlying issue is an RFI that allows an attacker to supply a URL in the path parameter, enabling arbitrary PHP code execution on the affected server. Connected sources confirm the vendor/product context and ...

CVE-2007-6326

The CVE-2007-6326 entry affects Sergey Lyubka Simple HTTPD (shttpd) 1.3 on Windows. The vulnerability allows remote denial of service when a request includes an MS-DOS device name, as demonstrated by the /aux URI. The issue is triggered by processing a device-name in the request, leading to a par...

CVE-2007-6332

The CVE-2007-6332 entry concerns the HPInfoDLL.HPInfo.1 ActiveX control (HPInfoDLL.dll 1.0) shipped with HP Info Center in HP Quick Launch Button 6.3 and earlier on Windows before Vista. The vulnerability, via the SetRegValue method, allows remote attackers to create or modify arbitrary registry ...

CVE-2007-6322

CVE-2007-6322 affects xml2owl 0.1.1 where filedownload.php is vulnerable to a directory traversal via the file parameter (..), allowing remote attackers to read arbitrary files. The vulnerability is a path-traversal flaw reported in multiple sources (NVD entry and CVE record). The provided docume...

CVE-2007-6330

Meridian Prolog Manager 2007 and earlier versions (including 7.5 and prior) transmit all usernames and passwords to the client in cleartext or weakly encrypted form to support client-side authentication. This can enable an attacker to capture credentials via network sniffing or a man-in-the-middl...

CVE-2007-6333

The CVE describes a vulnerability in the HPInfoDLL.HPInfo.1 ActiveX control (HPInfoDLL.dll 1.0) shipped with HP Info Center in HP Quick Launch Button (QLBCTRL.exe/QLB) 6.3 and earlier. The GetRegValue method allows a remote attacker to read arbitrary registry values. Affected software versions in...

CVE-2007-6329

Microsoft Office 2007 12.0.6015.5000 and MSO 12.0.6017.5000 do not sign the metadata of Office Open XML OOXML documents, which makes it easier for remote attackers to modify Dublin Core metadata fields, as demonstrated by the 1 LastModifiedBy and 2 creator fields in docProps/core.xml in the OOXML...

CVE-2007-6327

Summary (CVE-2007-6327) : A buffer overflow in the ActiveX control AVSMJPEGFILE.DLL version 1.1.1.102 from Online Media Technologies can allow remote code execution when a long first argument is passed to the CreateStill method. The affected component is an ActiveX control used by the application...

CVE-2007-6326

Sergey Lyubka Simple HTTPD shttpd 1.3 on Windows allows remote attackers to cause a denial of service via a request that includes an MS-DOS device name, as demonstrated by the /aux URI...

CVE-2007-6331

CVE-2007-6331 describes an absolute path traversal in the HPInfoDLL.HPInfo.1 ActiveX control (HPInfoDLL.dll 1.0) shipped with HP Info Center and the HP Quick Launch Button (QLB) software, up to version 6.3. The vulnerability allows remote attackers to execute arbitrary programs by passing a craft...

CVE-2007-6325

CVE-2007-6325 affects Fastpublish CMS 1.9999; vulnerability in adminbereich/designconfig.php allows remote PHP code execution via a URL in config[fsBase]. This is a different vector from CVE-2006-2726. No remediation details are provided in the documents.

CVE-2007-6328

CVE-2007-6328 affects DOSBox 0.72 and earlier. The mount command allows local users to access the host filesystem, with complete impact on confidentiality, integrity, and availability per the CVSS data. The root cause is a filesystem access pathway via mount in older DOSBox versions; exploitation...

CVE-2007-5000

Cross-site scripting XSS vulnerability in the 1 modimap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the 2 modimagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

BELL-CVE-2007-5000 CVE-2007-5000 does not affect BellSoft software

Bulletin has no description...

CVE-2007-5964

The CVE-2007-5964 issue affects autofs5 (notably in Red Hat Enterprise Linux 5 and related Oracle/CentOS variants) where the default hosts map did not apply the nosuid mount option. Root cause: /net (hosts) map mounted with suid by default, enabling a local attacker controlling a remote NFS serve...

CVE-2007-5000

CVE-2007-5000 affects Apache HTTP Server mod_imap and mod_imagemap (v1.3.0–1.3.39 and v2.0.35–2.0.61). The flaw is due to insufficient input validation, allowing remote script/HTML injection via unspecified vectors. Public advisories note fixes in later Apache releases (and related packages); mit...

CVE-2007-5964

The default configuration of autofs 5 in some Linux distributions, such as Red Hat Enterprise Linux RHEL 5, omits the nosuid option for the hosts /net filesystem map, which allows local users to gain privileges via a setuid program on a remote NFS server...

Unfixed XSS vulnerability at gallys.shemaletugjobs.com

Security researcher TreX, has submitted on 13/12/2007 a cross-site-scripting XSS vulnerability affecting gallys.shemaletugjobs.com, which at the time of submission ranked 22515 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 19/12/2007. It is...

hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities

hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities Title: Multiple Security Bugs In Hosting Controller Critical: Extremely critical Impact: Full system administrator access Vendor: Hosting Controller Version: 6.1 Hot fix = 3.3 Vendor URL: www.hostingcontroller.com Solution: N/A From...