Fedora 8 : php-pear-MDB2-2.4.1-2.fc8 / php-pear-MDB2-Driver-mysql-1.4.1-3.fc8.1 / etc (2007-3376)

This update fixes a security flaw CVE-2007-5934 with critical impact. All users of php-pear-MDB2 are strongly advised to upgrade to these updated packages. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...

CVE-2007-5977

Cross-site scripting XSS vulnerability in dbcreate.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than...

Unfixed XSS vulnerability at www.cec.org

Security researcher Uber0n, has submitted on 15/11/2007 a cross-site-scripting XSS vulnerability affecting www.cec.org, which at the time of submission ranked 242614 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 23/11/2007. It is currently...

Apple QuickTime heap buffer overflow vulnerability

Overview Apple QuickTime contains a buffer overflow vulnerability. If exploited, this vulnerability may allow an attacker to execute code. Description Apple QuickTime is a media player that includes a browser plugin. Color table atoms can set a list of preferred colors for displaying movieson...

CVE-2007-5987

The CVE-2007-5987 issue affects BtiTracker prior to 1.4.5. It allows remote attackers to bypass access protections via direct requests to details.php when guest torrent viewing is disabled, enabling reading torrent details and potentially modifying a torrent owned by a guest. Root cause is improp...

CVE-2007-5974

SQL injection vulnerability in mailer.php in JPortal 2 allows remote attackers to execute arbitrary SQL commands via the to parameter...

CVE-2007-5984

classes/Url.php in Justin Hagstrom AutoIndex PHP Script before 2.2.4 allows remote attackers to cause a denial of service CPU and memory consumption via a %00 sequence in the dir parameter to index.php, which triggers an erroneous "recursive calculation."...

Unfixed XSS vulnerability at info.prevx.com

Security researcher Hexspirit, has submitted on 15/11/2007 a cross-site-scripting XSS vulnerability affecting info.prevx.com, which at the time of submission ranked 27387 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 15/11/2007. It is current...

[ GLSA 200711-17 ] Ruby on Rails: Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200711-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - -...

CVE-2007-5984

The CVE-2007-5984 issue affects Justin Hagstrom AutoIndex PHP Script prior to 2.2.4. A crafted %00 sequence in the dir parameter to index.php triggers an erroneous recursive calculation, leading to a denial of service (high CPU and memory consumption). The vulnerability is remote and does not spe...

CVE-2007-5988

CVE-2007-5988 affects BtiTracker 1.4.4. The issue lies in blocks/shoutbox_block.php, where user accounts are not verified, enabling remote attackers to post shoutbox entries as arbitrary users by modifying the nick field. Impact: allows impersonation within the shoutbox; the documentation does no...

CVE-2007-5986

CVE-2007-5986 describes an SQL injection in BtiTracker (affected in versions before 1.4.5). The vulnerability exists in include/functions.php and allows remote attackers to execute arbitrary SQL commands via unspecified vectors. The connected sources confirm the product and vulnerable component b...

CVE-2007-5981

CVE-2007-5981 affects Lantronix SCS3200. The device reportedly does not properly handle public-key requests, enabling remote attackers to cause a denial of service (unresponsive device) via unspecified keyscan requests. This entry’s provenance is described as originating from third-party informat...

CVE-2007-5978

CVE-2007-5978 describes an SQL injection in the XOOPS mylinks module, via brokenlink.php parameter lid. The vulnerability allows remote attackers to execute arbitrary SQL commands. CVSS v2.0 base score 7.5 (HIGH) with network access, low attack complexity, no authentication required, and partial ...

[Full-disclosure] iDefense Security Advisory 11.14.07: Apple Mac OS X AppleTalk mbuf Kernel Heap Overflow Vulnerability

iDefense Security Advisory 11.14.07 http://labs.idefense.com/intelligence/vulnerabilities/ Nov 14, 2007 I. BACKGROUND AppleTalk, a set of networking protocols developed by Apple, was originally implemented on early Mac operating systems. Although it is a legacy protocol, it is still supported on...

CVE-2007-3694

CVE-2007-3694 is an XSS vulnerability in Miro Project Broadcast Machine 0.9.9.9, exploitable via the login.php username parameter to inject arbitrary script/HTML. CVSS from NVD: 4.3 (Medium). Affected component: login form handling in login.php; root cause: reflected/XSS via username input. Impac...

CVE-2007-5956

CVE-2007-5956 concerns IBM Informix Dynamic Server (IDS) prior to 10.00.xC7W1. The vulnerability arises from directory traversal using modified NLS message files via the DBLANG environment variable, enabling local users to gain privileges. The description specifies a local-execution/privilege-esc...

CVE-2007-5955

CVE-2007-5955 describes a cross-site scripting (XSS) vulnerability in UPDIR.NET’s updir.php prior to version 2.04, affecting the full‑text search and file upload functions. The JVN entry notes that updir.php allows uploading and publishing files and that an attacker could execute arbitrary script...

CVE-2007-5944

Cross-site scripting XSS vulnerability in Servlet Engine / Web Container in IBM WebSphere Application Server WAS 5.1.1.4 through 5.1.1.16 allows remote attackers to inject arbitrary web script or HTML via the Expect HTTP header. NOTE: this might be the same issue as CVE-2006-3918, but there are...

CVE-2007-5950

NetCommons has a cross-site scripting (XSS) vulnerability tracked as CVE-2007-5950 affecting NetCommons before 1.0.11 and 1.1.x before 1.1.2. The vulnerability allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The exact root cause and vectors are not detailed...