CVE-2007-6178

CVE-2007-6178 is a known remote file inclusion in Easy Hosting Control Panel (EHCP) for Ubuntu up to version 0.22.8 and earlier. The vulnerability allows an attacker to supply a URL in the confdir parameter to config/dbutil.bck.php and config/dbutil.php, potentially enabling arbitrary PHP code ex...

CVE-2007-6179

CVE-2007-6179 concerns multiple PHP remote file inclusion vulnerabilities in Charray’s CMS 0.9.3. The flaw allows an attacker to execute arbitrary PHP code by supplying a URL via the ccms_library_path parameter to the files in decoder/ (markdown.php and gallery.php). The underlying issue is a rem...

CVE-2007-6180

CVE-2007-6180: Solaris rpcmod race condition in the Remote Procedure Call kernel module affects SunOS/Solaris 8–10. The vulnerability allows local users to trigger a denial of service via a NULL dereference/panic, with the exact vectors not detailed in the provided sources. Publicly documented fi...

RHEL 3 : pcre (RHSA-2007:1063)

Updated pcre packages that resolve several security issues are now available for Red Hat Enterprise Linux 3. This update has been rated as having important security impact by the Red Hat Security Response Team. PCRE is a Perl-compatible regular expression library. Flaws were discovered in the way...

Security fix for the ALT Linux 5 package tomcat5 version 0:5.5.25-alt1_1.1jpp5.0

Nov. 30, 2007 Igor Vlasenko 0:5.5.25-alt11.1jpp5.0 - Updated to 5.5.25, to fix the following issues: CVE-2007-1355 CVE-2007-3386 CVE-2007-3385 CVE-2007-3382 CVE-2007-2450 CVE-2007-2449 - Applied patch20 for CVE-2007-5461 - Applied patch21 for CVE-2007-1358 - Add jasper-eclipse subpackage which is...

Unfixed XSS vulnerability at software.myetoolsonline.com

Security researcher Uber0n, has submitted on 30/11/2007 a cross-site-scripting XSS vulnerability affecting software.myetoolsonline.com, which at the time of submission ranked 2664183 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/12/2007. I...

ftpadmin-multi.txt

FTP Admin v0.1.0 - MULTIPLE VULNERABILITIES by Omni 1 Infos --------- Date : 2007-11-28 Product : FTP Admin Version : v0.1.0 Vendor : http://sourceforge.net/projects/ftpadmin/ Vendor Status : 2007-11-30 Informed! Description : FTP admin is a web-based user administration tool, for usage in...

CVE-2007-6181

CVE-2007-6181: A heap-based buffer overflow in cygwin1.dll affects Cygwin 1.5.7 and earlier. An authenticated remote attacker can exploit a long filename via SCP to trigger overwrite of heap memory in scp.exe, enabling arbitrary code execution on the Cygwin host. Related reports extend exposure t...

CVE-2007-6183

CVE-2007-6183: A format-string vulnerability in Ruby-GNOME 2 (Ruby-GNOME2) 0.16.0 and SVN builds before 20071127 affects the mdiag_initialize function in gtk/src/rbgtkmessagedialog.c. The message parameter’s format specifiers can allow context-dependent attackers to execute arbitrary code. The is...

CVE-2007-6173

CVE-2007-6173 is a cross-site scripting (XSS) vulnerability affecting Liferay Enterprise Portal 4.3.1, exploitable via the emailAddress parameter in a Send New Password action (c/portal/login). The provided data states the impact as confidentiality impact: none, integrity impact: partial, availab...

CVE-2007-6185

CVE-2007-6185 describes a directory traversal vulnerability in Eurologon CMS, specifically in the users/files.php download action. The underlying issue allows remote attackers to read arbitrary files by injecting a “..” in the file parameter, with a real-world demonstration involving a PHP file c...

QuickTime RTSP Content-Type header buffer overflow

Added: 11/30/2007 CVE: CVE-2007-6166 BID: 26549 OSVDB: 40876 Background QuickTime is a media player for Windows and Mac OS platforms. Problem A buffer overflow vulnerability in QuickTime allows command execution when a user opens an RTSP stream containing a specially crafted Content-Type header...

CVE-2007-6176

Affected product/component: K+B-Bestellsystem, kb_whois.cgi. Vulnerability: remote attackers can execute arbitrary commands via shell metacharacters in the (1) domain or (2) tld parameter of the check_owner action. Impact: complete compromise of confidentiality, integrity, and availability (CVSS ...

AST-2007-026 - SQL Injection issue in cdr_pgsql

Asterisk Project Security Advisory - AST-2007-026 +------------------------------------------------------------------------+ | Product | Asterisk | |----------------------+-------------------------------------------------| | Summary | SQL Injection issue in cdrpgsql |...

openSUSE 10 Security Update : MozillaFirefox (MozillaFirefox-4758)

This update brings Mozilla Firefox to security update version 2.0.0.10 Following security problems were fixed: MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have t...

openSUSE 10 Security Update : cifs-mount (cifs-mount-4740)

This update fixes two buffer overflows in nmbd CVE-2007-4572, CVE-2007-5398. Remote attackers could potentially exploit them to execute arbitrary code. The updated packages additionally contain fixes for numerous other defects. Please refer to the package changelog for details. %NASLMINLEVEL 7030...

CVE-2007-6186

Technical details about CVE-2007-6186 are not publicly provided in the supplied documents; no affected products, root cause, or remediation are specified here. Monitor for updates.

CVE-2007-6177

CVE-2007-6177 concerns a PHP remote file inclusion in Exchange/include.php of PHP_CON 1.3. The vulnerability enables an attacker to execute arbitrary PHP code by supplying a URL in the webappcfg[APPPATH] parameter. Documents consistently reference this exact vector and affected component, with no...

CVE-2007-6175

Buffer overflow in Lhaplus 1.55 and earlier allows remote attackers to execute arbitrary code via a crafted LZH archive, a different vector than CVE-2007-5048...

FreeBSD Security Advisory FreeBSD-SA-07:09.random

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-07:09.random Security Advisory The FreeBSD Project Topic: Random value disclosure Category: core Module: sysdevrandom Announced: 2007-11-29 Credits: Robert Woolle...