18185 matches found
Unfixed XSS vulnerability at www.namedrive.com
Security researcher WHK, has submitted on 29/11/2007 a cross-site-scripting XSS vulnerability affecting www.namedrive.com, which at the time of submission ranked 6867 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 29/11/2007. It is currently...
[SECURITY] [DSA 1414-1] New wireshark packages fix several vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1414-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 27, 2007 http://www.debian.org/security/faq -...
FreeBSD-SA-07:09.random
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-07:09.random Security Advisory The FreeBSD Project Topic: Random value disclosure Category: core Module: sysdevrandom Announced: 2007-11-29 Credits: Robert Woolle...
[SECURITY] [DSA 1416-1] New tk8.3 packages fix arbitrary code execution
------------------------------------------------------------------------ Debian Security Advisory DSA-1416-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 27, 2007 http://www.debian.org/security/faq -...
[SECURITY] [DSA 1415-1] New tk8.4 packages fix arbitrary code execution
------------------------------------------------------------------------ Debian Security Advisory DSA-1415-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 27, 2007 http://www.debian.org/security/faq -...
CVE-2007-4674
CVE-2007-4674 concerns Apple QuickTime 7.2. The vulnerability arises in parsing a movie atom with a large size value, triggering a stack-based buffer overflow in QuickTime’s parser. This allows remote code execution when a user opens a crafted movie file (or visits a malicious page). According to...
CVE-2007-6132
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2007-6142
Multiple cross-site scripting XSS vulnerabilities in ph03y3nk just another flat file JAF CMS 4.0 RC2 allow remote attackers to inject arbitrary web script or HTML via the 1 show parameter to index.php and the 2 print parameter to print.php. NOTE: the provenance of this information is unknown; the...
CVE-2007-6138
SQL injection vulnerability in redir.asp in VU Mass Mailer allows remote attackers to execute arbitrary SQL commands via the password parameter to Default.asp aka the Login Page. NOTE: some of these details are obtained from third party information...
CVE-2007-6141
Cross-site scripting XSS vulnerability in vBTube.php in vBTube 1.1 Beta allows remote attackers to inject arbitrary web script or HTML via the search parameter...
CVE-2007-6135
Cross-site scripting XSS vulnerability in phpslideshow.php in PHPSlideShow 0.9.9.2, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the directory parameter. NOTE: this issue was originally reported for toonchapter8.php, but this is probably a site-specific...
CVE-2007-6136
CVE-2007-6136 involves multiple XSS vulnerabilities in index.php of M2Scripts MySpace Scripts Poll Creator. The flaws allow remote attackers to inject arbitrary web script or HTML via parameters (title, intro, question, and unspecified answer parameters) in the create_new action. The affected sof...
CVE-2007-6142
The CVE affects ph03y3nk just another flat file (JAF) CMS 4.0 RC2. It describes reflected Cross‑Site Scripting via the index.php show parameter and the print.php print parameter, enabling injection of arbitrary web script/HTML. The root cause is input handling in these two parameters leading to s...
CVE-2007-6135
PHPSlideShow 0.9.9.2 contains a Cross-site Scripting (XSS) vulnerability in phpslideshow.php, exploitable via the directory parameter. The issue, originally noted for toonchapter8.php, allows remote attackers to inject arbitrary web script or HTML. The available data describe the vulnerable compo...
CVE-2007-6134
CVE-2007-6134 is an SQL injection vulnerability affecting PHPKIT 1.6.4pl1 where the contentid parameter in an article action to include.php (via pkinc/public/article.php) can allow remote attackers to execute arbitrary SQL. This is a separate vector from CVE-2006-1773. The connected sources confi...
CVE-2007-6145
Hitachi JP1/File Transmission Server/FTP (versions 01-00 to 08-10-01) contains an authentication bypass vulnerability that could allow remote attackers to view files in a directory. The issue is described across multiple sources (e.g., Hitachi JP1/FTP authentication bypass). The connected documen...
CVE-2007-6141
The CVE-2007-6141 entry documents a Cross-site scripting (XSS) vulnerability in vbTube.php of vBTube 1.1 Beta, where an attacker can inject arbitrary script/HTML via the search parameter. Affected component: vbTube.php in vBTube 1.1 Beta. Root cause: insufficient input sanitization on the search ...
CVE-2007-6138
CVE-2007-6138 affects VU Mass Mailer via the login flow: the redir.asp path is vulnerable to SQL injection in the password parameter to Default.asp (Login Page). The underlying cause is unsafely concatenated SQL in the login logic, enabling remote attackers to execute arbitrary SQL commands. Docu...
CVE-2007-6146
Hitachi JP1/File Transmission Server/FTP (Windows) versions 01-00 through 08-10-02 may allow remote attackers to cause a denial of service (service stop) by supplying a crafted or certain file argument to an FTP command. The available sources describe the impact as a DoS but do not provide exploi...