CVE-2007-5891

ManageEngine OpManager MSP Edition and OpManager 7.0 are affected by multiple XSS vulnerabilities in jsp/Login.do, exploitable via the requestid, fileid, woMode, and woID parameters. The root cause is inadequate input sanitization in the Login.do script, allowing an unauthenticated, remote attack...

CVE-2007-5890

CVE-2007-5890 describes a directory traversal vulnerability affecting easyGB 2.1.1 . The flaw is in index.php where an attacker can influence the DatabaseType parameter to cause inclusion of arbitrary files. This corresponds to a high-severity issue with a CVSS v2 base score of 10.0 (Network vect...

CVE-2007-4352

The CVE-2007-4352 issue affects Xpdf (Xpdf 3.02pl1 and related components) where an array index error in DCTStream::readProgressiveDataUnit in xpdf/Stream.cc can lead to memory corruption and remote code execution via a crafted PDF. MiracleLinux AXSA:2007-64:02 lists this CVE alongside other Xpdf...

CVE-2007-5395

CVE-2007-5395 is a stack-based buffer overflow in the separate_word function of tokenize.c in Link Grammar 4.1b (used by AbiWord Link Grammar 4.2.4) that can be triggered by a long word through separate_sentence, enabling remote code execution. Connected advisories indicate fixes/updates: Ubuntu ...

Mono System.Math BigInteger整数溢出漏洞

BUGTRAQ ID: 26279 CVECAN ID: CVE-2007-5197 Mono是基于.NET框架的开源开发平台，允许开发人员构建Linux和跨平台的应用。 Mono的Mono.Math.BigInteger类在实现BigInteger数据类型时存在整数溢出漏洞，允许本地攻击者执行任意指令。 Mono Mono 2.0 Mono Mono 1.x 厂商补丁： Debian ------ Debian已经为此发布了一个安全公告（DSA-1397-1）以及相应补丁: DSA-1397-1：New mono packages fix integer overflow...

Secunia Research: AbiWord Link Grammar "separate_sentence()" Buffer Overflow

====================================================================== Secunia Research 07/11/2007 - AbiWord Link Grammar "separatesentence" Buffer Overflow - ====================================================================== Table of Contents Affected...

iDefense Security Advisory 11.07.07: Oracle 10g R2 PITRIG_DROPMETADATA Buffer Overflow Vulnerability

iDefense Security Advisory 11.07.07 http://labs.idefense.com/intelligence/vulnerabilities/ Nov 07, 2007 I. BACKGROUND Oracle Database Server is a family of database products that range from personal databases to enterprise solutions. Further information is available at the following URL...

Perl Unicode正则表达式堆溢出漏洞

BUGTRAQ ID: 26350 CVECAN ID: CVE-2007-5116 Perl是一种免费且功能强大的编程语言。 Perl的正则表达式引擎在计算处理正则表达式所需空间的方式存在错误，本地攻击者可能利用此漏洞提升权限。 如果用户所发送到正则表达式中包含有Unicode数据的话，就会导致运行时自动切换到Unicode字符主题，之后再传送的表达式就可能触发堆溢出，导致在用户机器上执行任意指令。 Larry Wall Perl 5.8.8 厂商补丁： Debian ------ Debian已经为此发布了一个安全公告（DSA-1400-1）以及相应补丁: DSA-1400-1：Ne...

Mozilla-based browsers jar: URI cross-site scripting vulnerability

Overview Mozilla-based web browsers including Firefox contain a vulnerability that may allow an attacker to execute code, or conduct cross-site scripting attacks. Description The jar: protocol is designed to extract content from ZIP compressed files. Mozilla-based browsers include support for jar...

RHEL 2.1 : xpdf (RHSA-2007:1031)

Updated xpdf packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having important security impact by the Red Hat Security Response Team. Xpdf is an X Window System-based viewer for Portable Document Format PDF files. Alin Rad...

Unfixed XSS vulnerability at www.bamjoongsori.org

Security researcher cyber, has submitted on 11/08/2007 a cross-site-scripting XSS vulnerability affecting www.bamjoongsori.org, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/08/2007. It is currently...

Unfixed XSS vulnerability at www.iranmedfair.ir

Security researcher br0d, has submitted on 11/08/2007 a cross-site-scripting XSS vulnerability affecting www.iranmedfair.ir, which at the time of submission ranked 717431 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/08/2007. It is current...

Secunia Research: Link Grammar "separate_sentence()" Buffer Overflow

====================================================================== Secunia Research 07/11/2007 - Link Grammar "separatesentence" Buffer Overflow - ====================================================================== Table of Contents Affected...

RHEL 5 : poppler (RHSA-2007:1026)

Updated poppler packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Poppler is a PDF rendering library, used by applications such as evince. Alin Rad Pop...

RHEL 2.1 / 3 : tetex (RHSA-2007:1028)

Updated tetex packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having important security impact by the Red Hat Security Response Team. TeTeX is an implementation of TeX. TeX takes a text file and a set of formatting command...

RHEL 5 : pam (RHSA-2007:0555)

Updated pam packages that fix two security flaws, resolve several bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Pluggable Authentication Modules PAM provide a system...

RHEL 5 : mcstrans (RHSA-2007:0542)

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2007:0542 advisory. mcstrans is the translation daemon used on SELinux machines to translate program context into human readable form. An algorithmic complexity weakness...

Apple QuickTime for Java may allow Java applets to gain elevated privileges

Overview Apple QuickTime for Java contains a vulnerability that may allow a malicious Java applet to gain elevated privileges. Description Apple QuickTime is a media player that includes a browser plugin. QuickTime for Java provides APIs which allow Java developers to include multimedia in Java...

Unfixed XSS vulnerability at www.sir.ac.ir

Security researcher br0d, has submitted on 11/08/2007 a cross-site-scripting XSS vulnerability affecting www.sir.ac.ir, which at the time of submission ranked 1070011 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/08/2007. It is currently...

Unfixed XSS vulnerability at www.youhak.com

Security researcher cyber, has submitted on 11/08/2007 a cross-site-scripting XSS vulnerability affecting www.youhak.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/08/2007. It is currently...