CVE-2007-5709

CVE-2007-5709 affects Sony SonicStage CP (CONNECT Player) 4.3. A stack-based buffer overflow is triggered by a long file name in an M3U file, which can allow a remote attacker to execute arbitrary code. The vulnerability is a remote, unauthenticated condition over the network and is linked to buf...

CVE-2007-4348

CVE-2007-4348 affects IBM Tivoli Storage Manager Client CAD Service (Windows) versions 5.3.5.3 and 5.4.1.2. The vulnerability arises from insufficient sanitisation of input in HTTP requests to port 1581, which is logged to dsmerror.log and exposed via a web interface. This XSS can allow remote at...

CVE-2007-5715

DenyHosts 2.6 is vulnerable due to an incorrect regular expression used to parse failed SSH login attempts, which may allow remote attackers to evade detection/block when attempting logins with a username not present in AllowUsers (the issue demonstrated using the root username). Affected impleme...

CVE-2007-5711

The CVE-2007-5711 entry concerns Massive Entertainment’s World in Conflict (versions 1.001 and earlier). The vulnerability allows remote attackers to cause a denial-of-service (via a large packet) by targeting TCP or UDP port 48000. The provided documents do not include concrete exploitation vect...

CVE-2007-5713

AMX Mod X 1.76d GeoIP module (Half-Life Server) is affected by an off-by-one error in geoip_code2/geoip_code3 that leads to a buffer overflow, potentially allowing arbitrary code execution or DoS. This CVE-2007-5713 entry documents the impact; no explicit exploit details or remediation versions a...

CVE-2007-5712

The CVE-2007-5712 issue affects Django’s i18n framework (versions 0.91, 0.95, 0.95.1, 0.96) and is also observed when used in PyLucid. The vulnerability allows remote attackers to induce memory consumption (DoS) by sending many HTTP requests with large Accept-Language headers. Public docs record ...

CVE-2007-5707

CVE-2007-5707 affects OpenLDAP’s slapd prior to 2.3.39, where crafted LDAP requests with malformed objectClasses can crash slapd (DoS). Remediation referenced in advisories is upgrading to OpenLDAP 2.3.39 or newer (RHSA-2007:1038, related vendor advisories). OpenVAS/Nessus entries corroborate Ope...

CVE-2007-5714

Removed by vendor...

CVE-2007-5714

CVE-2007-5714 affects the Gentoo MLDonkey ebuild prior to 2.9.0-r3, where a system user named “p2p” was created with a valid login shell and no password. This could allow remote attackers to log in as the p2p user and execute arbitrary code on the host if an empty-password login service is enable...

CVE-2007-5710

CVE-2007-5710 describes a Cross-site scripting (XSS) vulnerability in WordPress 2.3, specifically in wp-admin/edit-post-rows.php where the posts_columns array parameter is not properly sanitized. This allows remote attackers to inject arbitrary HTML/Script that runs in a user’s browser session. A...

CVE-2007-5708

CVE-2007-5708 affects OpenLDAP’s slapd, specifically the slapo-pcache module (overlays/pcache.c). When OpenLDAP runs as a proxy‑caching server, it allocates memory with a malloc variant instead of calloc, which can prevent an array from being properly initialized and may lead to a denial of servi...

Debian DSA-1396-1 : iceweasel - several vulnerabilities

Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-1095 Michal Zalewski discovered that the unload event handler had access t...

openSUSE 10 Security Update : openssh (openssh-4579)

This update fixes a bug in ssh's cookie handling code. It does not properly handle the situation when an untrusted cookie cannot be created and uses a trusted X11 cookie instead. This allows attackers to violate the intended policy and gain privileges by causing an X client to be treated as...

iDefense Security Advisory 10.30.07: IBM AIX dig dns_name_fromtext Integer Underflow Vulnerability

IBM AIX dig dnsnamefromtext Integer Underflow Vulnerability iDefense Security Advisory 10.30.07 http://labs.idefense.com/intelligence/vulnerabilities/ Oct 30, 2007 I. BACKGROUND dig is a utility that is commonly used for DNS diagnostics. Under AIX 5.2, the dig program is installed by default and ...

Unfixed XSS vulnerability at is.lsu.edu

Security researcher Sr., has submitted on 30/10/2007 a cross-site-scripting XSS vulnerability affecting is.lsu.edu, which at the time of submission ranked 15125 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/11/2007. It is currently unfixed...

iDefense Security Advisory 10.30.07: IBM AIX 5.2 crontab BSS Buffer Overflow Vulnerability

IBM AIX 5.2 crontab BSS Buffer Overflow Vulnerability iDefense Security Advisory 10.30.07 http://labs.idefense.com/intelligence/vulnerabilities/ Oct 30, 2007 I. BACKGROUND The crontab program is a user utility that enables users to create, remove, and edit cron jobs. The cron jobs will then later...

CVE-2007-4999

libpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows remote attackers to cause a denial of service NULL dereference and application crash via a message that contains invalid HTML data, a different vector than CVE-2007-4996...

CVE-2007-4999

libpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows remote attackers to cause a denial of service NULL dereference and application crash via a message that contains invalid HTML data, a different vector than CVE-2007-4996...

DEBIAN-CVE-2007-4999

libpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows remote attackers to cause a denial of service NULL dereference and application crash via a message that contains invalid HTML data, a different vector than CVE-2007-4996...

CVE-2007-5704

CVE-2007-5704 concerns the CodeWidgets.com Online Event Registration Template, where the (1) Email Address and (2) Password fields in login.asp and admin_login.asp are vulnerable to SQL injection. The underlying issue permits remote attackers to craft input that may result in arbitrary SQL execut...