Unfixed XSS vulnerability at www.pakistans.com

Security researcher GURUS, has submitted on 11/02/2007 a cross-site-scripting XSS vulnerability affecting www.pakistans.com, which at the time of submission ranked 741280 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/02/2007. It is current...

iDefense Security Advisory 10.31.07: Macrovision InstallShield Update Service ActiveX Unsafe Method Vulnerability

Macrovision InstallShield Update Service ActiveX Unsafe Method Vulnerability iDefense Security Advisory 10.31.07 http://labs.idefense.com/intelligence/vulnerabilities/ Oct 31, 2007 I. BACKGROUND MacroVision InstallShield is an installer solution utilized by many software vendors in order to ensur...

Unfixed XSS vulnerability at www.ubbi.com.es

Security researcher 0ssi3, has submitted on 11/02/2007 a cross-site-scripting XSS vulnerability affecting www.ubbi.com.es, which at the time of submission ranked 6986384 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 12/02/2007. It is currentl...

GLSA-200711-01 : gFTP: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200711-01 gFTP: Multiple vulnerabilities Kalle Olavi Niemitalo discovered two boundary errors in fsplib code included in gFTP when processing overly long directory or file names. Impact : A remote attacker could trigger these...

Lotus Domino IMAP mailbox name buffer overflow

Added: 11/02/2007 CVE: CVE-2007-3510 BID: 26176 OSVDB: 40953 Background IBM Lotus Domino is a messaging and collaboration solution for multiple platforms. Problem A buffer overflow vulnerability in Lotus Domino could allow a remote, authenticated attacker to execute arbitrary commands by sending ...

ZDI-07-063: RealPlayer RA Field Size File Processing Heap Oveflow Vulnerability

ZDI-07-063: RealPlayer RA Field Size File Processing Heap Oveflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-07-063.html October 25, 2007 -- CVE ID: CVE-2007-2264 -- Affected Vendor: RealNetworks RealPlayer version 10.5 -- Affected Products: RealPlayer 6.x -- TippingPointTM IPS...

Secunia Research: ACDSee Products Image and Archive Plug-ins Buffer Overflows

====================================================================== Secunia Research 02/11/2007 - ACDSee Products Image and Archive Plug-ins Buffer Overflows - ====================================================================== Table of Contents Affected...

ZDI-07-061: RealNetworks RealPlayer SWF Processing Remote Code Execution Vulnerability

ZDI-07-061: RealNetworks RealPlayer SWF Processing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-07-061.html October 25, 2007 -- CVE ID: CVE-2007-2263 -- Affected Vendor: RealNetworks -- Affected Products: RealNetworks RealPlayer version 10.5 -- TippingPointT...

SonicWall SSL-VPN NetExtender ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in SonicWall SSL-VPN NetExtender. By sending an overly long string to the "AddRouteEntry" method located in the NELaunchX.dll 1.0.0.26 Control, an attacker may be able to execute arbitrary code. This module requires Metasploit:...

CVE-2007-5793

CVE-2007-5793 affects Stonesoft StoneGate IPS before 4.0, where the product fails to properly decode Fullwidth/Halfwidth Unicode encoded data. This vulnerability could allow remote attackers to scan or penetrate systems and avoid detection, per the NVD description. No explicit exploit details or ...

Immunity Canvas: GOMPLAYER

Name| gomplayer ---|--- CVE| CVE-2007-5779 Exploit Pack| CANVAS Description| GOMPlayer 2.1.6.3499 OpenURL Buffer Overflow Notes| CVE Name: CVE-2007-5779 VENDOR: Gomlab Repeatability: Infinite client side - no crash CVE Url: https://vulners.com/cve/CVE-2007-5779 Date public: 10/29/2007 CVSS: 7.5...

Immunity Canvas: SIGE_INCLUDE

Name| sigeinclude ---|--- CVE| CVE-2007-5781 Exploit Pack| CANVAS Description| SIGE remote file include Notes| CVSS: 6.8 Repeatability: Infinite VENDOR: pfadmin CVE Url: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5781 CVE Name: CVE-2007-5781...

CVE-2007-5782

CVE-2007-5782 affects FireConfig 0.5, where a vulnerability in the dl.php file parameter enables directory traversal via a .. (dot dot) path. The root cause is insufficient validation of the file parameter, allowing an attacker to read arbitrary server files. Documented impact is read access to f...

CVE-2007-5779

CVE-2007-5779 affects Gretech Open URL/ GomPlayer stack: a buffer overflow in the GomManager (GomWeb3.dll 1.0.0.12) ActiveX control allows remote code execution via a long argument to OpenUrl in GOM Player 2.1.6.3499. Connected records reference a Metasploit module and advisories, but the provide...

CVE-2007-5774

CVE-2007-5774 affects the File Manager module of Flatnuke 3. An error condition triggered by an invalid argumentname in a disc op action allows remote attackers to disclose the server path via an error message. The provided connected resources confirm the vulnerability description but do not spec...

CVE-2007-5771

CVE-2007-5771 affects Flatnuke 3 (aka FlatnuX). The issue allows remote attackers to obtain administrative access by manipulating a myforum%00 cookie. The description in multiple sources confirms remote exploitation without user interaction, enabling elevation of privileges to an admin level. No ...

CVE-2007-5780

CVE-2007-5780 is a PHP remote file inclusion vulnerability in teatro 1.6, specifically in pub/pub08_comments.php. An attacker can supply a URL in the basePath parameter to execute arbitrary PHP code. The CVE entry notes a MEDIUM severity (base score 6.8) per NVD, but the connected documents do no...

CVE-2007-5776

The CVE-2007-5776 issue affects Blue-Collar Productions i-Gallery 3.4, where a directory traversal flaw in igallery.asp allows remote attackers to read arbitrary files by supplying encoded backslash sequences via the d parameter (example: %5c../../%5c). Multiple sources (NVD, CVE listings) confir...

CVE-2007-5773

CSRF in the File Manager module (index.php) of Flatnuke 3 allows remote attackers to perform administrative actions via forged requests that include the dir parameter (pathname) and the ffile parameter (filename). The vulnerability originates from the module’s index.php handling of these paramete...

CVE-2007-5791

The CVE-2007-5791 entry concerns the Vonage Motorola Phone Adapter VT 2142-VD failing to verify that SIP INVITE messages originate from a legitimate server, enabling remote attackers to spoof INVITEs. This can trigger a flood of messages causing a denial of service and may facilitate calls with m...