CVE-2007-6166

CVE-2007-6166 is a stack-based buffer overflow in Apple QuickTime

CVE-2007-6161

This CVE (CVE-2007-6161) affects index.php in Tilde CMS 4.x and earlier, where a specific value in a search action can disclose the path of sensitive information. In the sources, the vulnerability is described as a path-disclosure issue via a search parameter, with a CVSS v2 base score of 5.0 (Me...

CVE-2007-6168

CVE-2007-6168 affects VU Case Manager: SQL injection in default.asp (Login Page) via the username parameter, enabling remote SQL execution. This is a different vector from CVE-2007-6143, which uses the password parameter. No remediation or exploit details are provided in the supplied documents.

CVE-2007-6157

The CVE-2007-6157 entry describes a Cross-site Scripting (XSS) vulnerability in SimpleGallery 0.1.3, specifically in index.php, exploitable via the album parameter. The underlying issue allows remote attackers to inject arbitrary web script or HTML. Eligible affected component: SimpleGallery 0.1....

CVE-2007-6164

Eurologon CMS is affected by multiple SQL injection vulnerabilities: the id parameter in reviews.php, links.php, and articles.php can be exploited to execute arbitrary SQL remotely. Root cause is improper input handling in these PHP scripts. The provided documents do not specify affected version ...

CVE-2007-6169

CVE-2007-6169 concerns a SQL injection in admin/index2.asp of GOUAE DWD Realty. The vulnerable parameter is uname (distinct from CVE-2007-6163’s pword); exploitation would allow remote attackers to execute arbitrary SQL commands. The connected sources confirm a similar vulnerability in the same a...

CVE-2007-6162

CVE-2007-6162 affects FMDeluxe 2.1.0 and is caused by an XSS vulnerability in index.php where the id parameter used by a category action can inject arbitrary script/HTML. The vulnerability allows remote attackers to execute script in the victim’s browser; exploitation details are not provided in ...

CVE-2007-6159

The CVE-2007-6159 entry describes an SQL injection in index.php of Tilde CMS 4.x and earlier, exploitable via the aarstal parameter in the yeardetail action. This allows remote attackers to execute arbitrary SQL commands and is noted as a vector different from CVE-2006-1500.

Secunia Research: Symantec Backup Exec Job Engine Denial of Service

====================================================================== Secunia Research 28/11/2007 - Symantec Backup Exec Job Engine Denial of Service - ====================================================================== Table of Contents Affected...

[SECURITY] [DSA 1416-1] New tk8.3 packages fix arbitrary code execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1416-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 27, 2007 http://www.debian.org/security/faq -...

Unfixed XSS vulnerability at www.illegal-rap.com

Security researcher CCC, has submitted on 29/11/2007 a cross-site-scripting XSS vulnerability affecting www.illegal-rap.com, which at the time of submission ranked 7302367 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 30/11/2007. It is...

Unfixed XSS vulnerability at www.abooo.net

Security researcher kusomiso.com, has submitted on 29/11/2007 a cross-site-scripting XSS vulnerability affecting www.abooo.net, which at the time of submission ranked 2440449 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 29/11/2007. It is...

FreeBSD-SA-07:10.gtar

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-07:10.gtar Security Advisory The FreeBSD Project Topic: gtar directory traversal vulnerability Category: contrib Module: contribtar Announced: 2007-11-29 Credits:...

Debian DSA-1413-1 : mysql - multiple vulnerabilities

Several vulnerabilities have been found in the MySQL database packages with implications ranging from unauthorized database modifications to remotely triggered server crashes. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-2583 The indecimal::set...

Unfixed XSS vulnerability at www.neagenia.gr

Security researcher St@R-gaZ3r, has submitted on 29/11/2007 a cross-site-scripting XSS vulnerability affecting www.neagenia.gr, which at the time of submission ranked 435413 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 29/11/2007. It is...

[ MDKSA-2007:232 ] - Updated kernel packages fix multiple vulnerabilities and bugs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2007:232 http://www.mandriva.com/security/ Package : kernel Date : November 28, 2007 Affected: 2008.0 Problem Description: Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel: The minix...

Fedora 7 : htdig-3.2.0b6-12.fc7 (2007-3907)

CVE-2007-6110 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable Network...

Mandrake Linux Security Advisory : cpio (MDKSA-2007:233)

Buffer overflow in the safernamesuffix function in GNU cpio has unspecified attack vectors and impact, resulting in a crashing stack. This problem is originally found in tar, but affects cpio too, due to similar code fragments. CVE-2007-4476 Directory traversal vulnerability in cpio 2.6 and earli...

Debian DSA-1414-1 : wireshark - several vulnerabilities

Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to denial of service or execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-6114 Stefan Esser discovered a buffer...

Mozilla Firefox及SeaMonkey Windows.Location属性HTTP Referer头欺骗漏洞

BUGTRAQ ID: 26589 CVECAN ID: CVE-2007-5960 Firefox是一款流行的开源WEB浏览器， 当由于设置了window.location属性而进行导航的时候，Referer头应反映初始化脚本的内容的地址，而实际上referer被设置成为运行脚本的窗口或帧的地址。攻击者可以使用形式上的alert对话框中止攻击脚本，在预期的引用页面替换了攻击者的初始内容之前不加载目标URI。如果将Referer设置为脚本窗口的当前URI，就可以对站点执行跨站请求伪造攻击。 Mozilla Firefox 2.0.x Mozilla SeaMonkey 1.1.7...