CVE-2007-6228

The CVE-2007-6228 issue is a stack-based buffer overflow in the yt.ythelper.2 ActiveX control used by Yahoo! Toolbar 1.4.1. A long argument to the c() method can remotely trigger a denial of service (browser crash). Public documentation notes no patch from the vendor at the time of reports; users...

CVE-2007-6220

typespeed before 0.6.4 allows remote attackers to cause a denial of service application crash via unspecified network behavior that triggers a divide-by-zero error...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Ossigeno CMS 2.2 pre1 allow remote attackers to execute arbitrary PHP code via a URL in the 1 level parameter to a installmodule.php and b uninstallmodule.php in upload/xax/admin/modules/, c upload/xax/admin/patch/index.php, and d...

CVE-2007-6222

The CheckCustomerAccess function in functions.php in CRM-CTT Interleave before 4.2.0 formerly CRM-CTT does not properly verify user privileges, which allows remote authenticated users with the LIMITTOCUSTOMERS privilege to bypass intended access restrictions and edit non-active user settings. NOT...

CVE-2007-6221

The vulnerability CVE-2007-6221 affects TuMusika Evolution 1.7R5. A direct request to phpinfo.php calls phpinfo, enabling remote attackers to disclose configuration information. No remediation details are provided in the connected documents. The exact root cause is exposure of PHP configuration d...

CVE-2007-6222

The vulnerability CVE-2007-6222 affects CRM-CTT Interleave prior to 4.2.0 (formerly CRM-CTT). The CheckCustomerAccess function in functions.php does not properly verify user privileges, allowing remote authenticated users with the LIMITTOCUSTOMERS privilege to bypass access restrictions and edit ...

CVE-2007-6219

The CVE-2007-6219 entry concerns IBM Tivoli Netcool Security Manager 1.3.0 and describes a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The connected documents confirm the affected product/version and the XSS...

CVE-2007-6220

CVE-2007-6220 affects the typespeed project prior to 0.6.4. The vulnerability allows remote attackers to cause an application crash (denial of service) through unspecified network behavior that triggers a divide-by-zero error. The provided documents consistently describe the flaw and its impact b...

CVE-2007-6218

Summary (CVE-2007-6218) : The provided documents describe multiple PHP remote file inclusion vulnerabilities in Ossigeno CMS 2.2 pre1. The flaws allow remote attackers to execute arbitrary PHP code by supplying a URL to various parameters in the application, notably the level parameter to install...

CVE-2007-6223

CVE-2007-6223 describes an SQL injection in garage.php of phpBB Garage 1.2.0 Beta3. The vulnerability allows remote attackers to manipulate the database by injecting SQL through the make_id parameter in a browse-mode search action, potentially impacting data confidentiality, integrity, and availa...

CVE-2007-6212

Directory traversal vulnerability in region.php in KML share 1.1 allows remote attackers to read arbitrary files via a .. dot dot in the layer parameter...

CVE-2007-6214

CVE-2007-6214 relates to a directory traversal vulnerability in LearnLoop 2.0 beta7. The flaw is in the include/file_download.php component, where an attacker can supply a".." sequence via the sFilePath parameter to read arbitrary files on the server. The vulnerability’s impact is described as re...

CVE-2007-6212

Directory traversal vulnerability in region.php in KML share 1.1 allows remote attackers to read arbitrary files via a .. dot dot in the layer parameter...

CVE-2007-6212

CVE-2007-6212: Directory traversal in region.php of KML share 1.1 lets remote attackers read arbitrary server files by passing ".." in the layer parameter. Affected: KML share 1.1 (region.php). Root cause: improper validation leading to directory traversal. Impact: partial confidentiality breach ...

CVE-2007-6213

CVE-2007-6213 concerns WebED 0.0.9. Multiple directory traversal flaws in mod/chat/index.php allow remote reading of arbitrary files via a .. in the Root and Path parameters, affecting confidentiality (C:P) with no integrity/availability impact stated. CVSS v2 score is 5.0 (Medium) with network a...

CVE-2007-6215

CVE-2007-6215 involves Web-MeetMe 3.0.3, where the PHP script play.php is vulnerable to directory traversal via user-supplied inputs in the roomNo and possibly bookid parameters. This can allow remote attackers to read arbitrary files on the server, exposing partial confidentiality (per the cited...

CVE-2007-6216

CVE-2007-6216 concerns a race condition in the Fibre Channel protocol (fcp) driver and the Solaris 10 devfs. Connected sources (Tenable Nessus patches 128491-01 for SPARC and 128492-01 for x86) indicate a patch-based remediation: install Solaris patch 128491-01 (SPARC) or 128492-01 (x86) to addre...

CVE-2007-6217

CVE-2007-6217 describes multiple SQL injection vulnerabilities in login.asp of Irola My-Time (Timesheet) 3.5. The flaws allow remote attackers to execute arbitrary SQL commands via the login (Username) and password parameters. The provided documents do not specify affected versions beyond 3.5, no...

CVE-2007-6214

Directory traversal vulnerability in include/filedownload.php in LearnLoop 2.0 beta7 allows remote attackers to read arbitrary files via a .. dot dot in the sFilePath parameter. NOTE: exploitation requires that the product is configured, but has zero files in the database...

[slackware-security] cairo

New cairo packages are available for Slackware 11.0, 12.0, and -current to fix security issues. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2007-5503 Here are the details from the Slackware 12.0 ChangeLog:...