CVE-2007-6276

The acceptconnections function in the virtual private network daemon vpnd in Apple Mac OS X 10.5 before 10.5.4 allows remote attackers to cause a denial of service divide-by-zero error and daemon crash via a crafted load balancing packet to UDP port 4112...

CVE-2007-6266

Multiple SQL injection vulnerabilities in bcoos 1.0.10 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the gid parameter to modules/arcade/index.php in a showstats action, or the lid parameter to 2 modules/myalbum/ratephoto.php or 3 modules/mylinks/ratelink.php, differe...

CVE-2007-6276

Summary: CVE-2007-6276 affects Apple Mac OS X 10.5 before 10.5.4. The vulnerability resides in the accept_connections function of vpnd (VPN daemon), which can be triggered remotely by sending a crafted load-balancing UDP packet to port 4112, causing a divide-by-zero error and a daemon crash (deni...

CVE-2007-6265

CVE-2007-6265 affects avast! 4 Home and Professional Editions prior to 4.7.1098. The vulnerability allows remote attackers to influence the system via a crafted TAR archive, with the impact described as unknown in the available sources. No exploitation details, affected subcomponents, or remediat...

CVE-2007-6272

CVE-2007-6272 describes multiple SQL injection vulnerabilities in Joomla! 1.5 RC3. The flaws reside in index.php, allowing remote attackers to inject arbitrary SQL via: (1) the view parameter to the com_content component, (2) the task parameter to the com_search component, or (3) the option param...

CVE-2007-6266

CVE-2007-6266 applies to the bcoos CMS (versions 1.0.10 and earlier). The affected components expose multiple SQL injection weaknesses that allow remote attackers to run arbitrary SQL commands. Attack vectors include: (1) gid parameter to modules/arcade/index.php in a show_stats action, (2) lid p...

CVE-2007-6275

CVE-2007-6275 affects bcoos 1.0.10 and earlier. The vulnerability is a SQL injection in modules/adresses/ratefile.php that allows remote attackers to execute arbitrary SQL commands via the lid parameter, representing a vector different from CVE-2007-6266. The connected records confirm the affecte...

CVE-2007-6278

CVE-2007-6278 affects the FLAC library (libFLAC) prior to 1.2.1. A crafted .FLAC file can trigger the MIME-Type URL flag in the FLAC image block, allowing a user-assisted remote attacker to cause the client to download arbitrary files. The vulnerability stems from (unexplicit) handling of the ima...

CVE-2007-6109

CVE-2007-6109 describes a stack-based buffer overflow in Emacs triggered by a large precision value in an integer format specifier to the format function, leading to denial of service (crash) and potentially other impacts. Concrete references in connected docs indicate the vulnerability affects E...

CVE-2007-6277

Multiple buffer overflows in Free Lossless Audio Codec FLAC libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via large 1 Metadata Block Size, 2 VORBIS Comment String Size, 3 Picture Metadata MIME-TYPE Size, 4 Picture Description Size, 5 Picture Data Length, 6...

CVE-2007-6279

The vulnerability is in the Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1, where multiple double-free flaws affect parsing .FLAC files. Specifically, malformed Seektable values or Seektable Data Offsets can allow user‑assisted remote attackers to execute arbitrary code. Practical impact i...

CVE-2007-6273

The CVE-2007-6273 issue affects SonicWALL Global VPN Client versions 3.1.556 and 4.0.0.810, where the configuration file’s formatting strings in the Hostname tag and the Connection tag name attribute can be exploited by a user-assisted remote attacker to execute arbitrary code. The vulnerability ...

CVE-2007-5497

CVE-2007-5497 describes multiple integer overflow flaws in libext2fs of e2fsprogs up to version 1.40.3 . The root cause is integer overflows in processing filesystem data, which can be exploited by a crafted filesystem image to cause arbitrary code execution. The impact is remote code execution w...

CVE-2007-6267

CVE-2007-6267 affects Citrix EdgeSight components: Presentation Server (4.2/4.5), Endpoints (4.2/4.5), and NetScaler EdgeSight (1.0/1.1). The root cause is improper storage of database credentials in configuration files, enabling local users to obtain sensitive information. The available sources ...

CVE-2007-6276

The acceptconnections function in the virtual private network daemon vpnd in Apple Mac OS X 10.5 before 10.5.4 allows remote attackers to cause a denial of service divide-by-zero error and daemon crash via a crafted load balancing packet to UDP port 4112...

CVE-2007-6269

CVE-2007-6269 affects Absolute News Manager.NET 5.1. Multiple SQL injection vulnerabilities exist in xlaabsolutenm.aspx exploitable via the (1) z, (2) pz, (3) ord, and (4) sort parameters. Remote attackers can execute arbitrary SQL commands. CVSS v2 base score 7.5 (HIGH) with network attack vecto...

CVE-2007-6277

The CVE-2007-6277 entry covers multiple heap- and stack-based overflow vulnerabilities in the FLAC library (libFLAC) prior to 1.2.1 that could allow remote code execution when processing specially crafted FLAC files. Connected advisories confirm concrete details: several overflow vectors (heap/st...

CVE-2007-6271

CVE-2007-6271 affects Absolute News Manager.NET 5.1. The vulnerability is an information disclosure: remote attackers can obtain the installation path by requesting getpath.aspx, which leads to an error message revealing path details. The connected sources confirm this specific behavior across mu...

CVE-2007-6274

CVE-2007-6274 describes multiple cross-site scripting (XSS) vulnerabilities in the Event Calendar module ec al/display.php for the product family/bcoos, affecting versions 1.0.10 and earlier. The flaw allows remote attackers to inject arbitrary web script or HTML by manipulating the (1) day or (2...

MacroVision InstallShield Update Service isusweb.dll unsafe method

Added: 12/07/2007 CVE: CVE-2007-5660 BID: 26280 OSVDB: 38347 Background MacroVision InstallShield is software for creating installers or software packages. Problem Several unsafe methods in the Update Service ActiveX control allow command execution when a user loads a specially crafted web page...