CVE-2007-5959

CVE-2007-5959 affects Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7, with memory corruption in the layout/jar handling that could crash the browser and potentially allow arbitrary code execution. Connected advisories note that SeaMonkey updates fixed these issues (and related CVEs li...

Mail.app Image Attachment Command Execution

This module exploits a command execution vulnerability in the Mail.app application shipped with Mac OS X 10.5.0. This flaw was patched in 10.4 in March of 2007, but reintroduced into the final release of 10.5. This module requires Metasploit: https://metasploit.com/download Current source:...

CVE-2007-6123

CVE-2007-6123 is linked to IRC Services 5.1.8. Connected data cites “Code injection” as the vulnerability type, but the public records here do not provide explicit root-cause details, vectors, affected components beyond the product/version, or concrete impact. No remediation or exploitation statu...

CVE-2007-6126

CVE-2007-6126 affects Project Alumni versions 1.0.9 and earlier. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary scripts via the year parameter in (1) xml/index.php and (2) view.page.inc.php, reachable through a view action to index.php. The...

CVE-2007-6126

Multiple cross-site scripting XSS vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the year parameter to 1 xml/index.php; or 2 the year parameter to view.page.inc.php, which is reachable through a view action to the top-level...

CVE-2007-6130

The CVE-2007-6130 issue affects gnump3d 2.9final, where password protection is not applied to plugins, potentially allowing remote attackers to bypass intended access restrictions. The vulnerability concerns plugin-level access controls rather than core authentication, with the NVD and SUSE entri...

CVE-2007-6127

CVE-2007-6127 affects project alumni 1.0.9 and earlier. The vulnerability is a SQL injection in the year parameter of two PHP entry points: view.page.inc.php (accessed via a view action to index.php) and news.page.inc.php (via a news action to index.php). Exploitation allows remote attackers to e...

CVE-2007-6128

CVE-2007-6128 affects WorkingOnWeb 2.0.1400. A SQL injection in events.php via the idevent parameter enables remote attackers to execute arbitrary SQL commands. The provided documents do not include remediation details; no patch/version info is present here.

CVE-2007-6131

CVE-2007-6131 affects scanbuttond 0.2.3: a local attacker can overwrite arbitrary files via a symlink attack on temporary files (scan.pnm and scan.jpg). Root cause is improper handling of temp file names leading to a symlink race; impact is local privilege-related due to file overwrites. The NVD ...

CVE-2007-6125

CVE-2007-6125 is a SQL injection vulnerability in the Softbiz Freelancers Script 1, exploitable via the sb_protype parameter in search_form.php. The issue allows remote attackers to execute arbitrary SQL commands; impact vectors are stated as partial confidentiality, integrity, and availability. ...

CVE-2007-6129

CVE-2007-6129 affects Amber Script 1.0, where a directory traversal flaw in scripts/include/show_content.php allows remote attackers to include and execute arbitrary local files by supplying a .. in the id parameter. In some environments, this can enable remote file inclusion via UNC share paths ...

CVE-2007-6122

CVE-2007-6122 affects IRC Services. The default_encrypt() function in encrypt.c fails to handle overly long passwords, enabling a remote attacker to crash the daemon (DoS). Affected versions are IRC Services prior to 5.0.63 and 5.1.x prior to 5.1.7. Multiple sources (Gentoo GLSA 200712-12; OpenVA...

CVE-2007-6124

CVE-2007-6124 describes a cross-site scripting (XSS) vulnerability in the Softbiz Freelancers Script 1, specifically in signin.php. The vulnerability allows a remote attacker to inject arbitrary web script or HTML by supplying a value for the errmsg parameter. The NVD entry lists a MEDIUM base sc...

[SECURITY] [DSA 1413-1] New mysql packages fix multiple vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1413-1 [email protected] http://www.debian.org/security/ Noah Meyerhans November 26, 2007 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1413-1] New mysql packages fix multiple vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1413-1 [email protected] http://www.debian.org/security/ Noah Meyerhans November 26, 2007 http://www.debian.org/security/faq -...

Important: Red Hat Security Advisory: java-1.5.0-ibm security update

Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary. This update has been rated as having important security impact by the Red Hat Security Response Team. IBM's 1.5.0 Java release includes the IBM Java 2...

[SECURITY] [DSA 1409-2] New samba packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1409-2 [email protected] http://www.debian.org/security/ Steve Kemp November 26, 2007 http://www.debian.org/security/faq -...

PHPCMS 2007 show_pic.inc.php本地包含漏洞

PHPCMS 网站管理系统是一个基于PHP+MYSQL的全站生成html的建站系统，经过完善设计并适用于各种服务器环境如UNIX、LINUX、WINDOWS等的高效、全新、快速、优秀的网站解决方案 showpic.inc.php 是否配置了src变量，如果有的话就把路径值赋给file。 这里src的类型没有判断。跳到根目录提交配置文件就可以读取数据库的连接密码了。 PHPCMS2007 官方暂时没有解决方案 http://www.phpcms.cn/ POST /picture/showpic.php?src=/../../../config.inc.php...

Fedora 7 : tetex-3.0-40.3.fc7 (2007-3390)

fix t1lib flaw CVE-2007-4033 352271 - fix CVE-2007-4352 CVE-2007-5392 CVE-2007-5393, various xpdf flaws 345121 - xdvi won't segfault if DVI file contains character which is not present in font 243630 - fix dvips -z buffer overflow with long href CVE-2007-5935 368591 - fix insecure usage of...

lizard-rfi.txt

Lizardware CMS Remote File Inclusion ---------| Download:| ---------|---------------------------------------------------------| http://sourceforge.net/project/platformdownload.php?groupid=183519| -------------------------------------------------------------------| -----------------------| Launche...