CVE-2007-5696

PHP remote file inclusion vulnerability in includes.php in phpBasic allows remote attackers to execute arbitrary PHP code via a URL in the root parameter, possibly related to the Music module...

CVE-2007-5695

CVE-2007-5695 is a real issue in SiteBar 3.3.x where an error in command.php allows remote attackers to redirect users to arbitrary websites via the forward parameter in a Log In action. Public sources (Debian, Gentoo GLSA, and OpenVAS) corroborate a family of related sitebar vulnerabilities, wit...

CVE-2007-5692

SiteBar 3.3.8 (and related releases) is affected by CVE-2007-5692 among several XSS issues. The vulnerabilities permit remote attackers to inject arbitrary scripts/HTML via multiple parameters (lang, token, nid_acl, uid, target) across integrator.php, New Password, Folder Properties, Modify User,...

CVE-2007-5696

CVE-2007-5696 describes a PHP remote file inclusion in includes.php of phpBasic that allows remote attackers to execute arbitrary PHP code via a URL in the root parameter, potentially linked to the Music module. The CVSSv2 base score is 6.8 (NETWORK, MEDIUM, no authentication; partial impacts to ...

CVE-2007-5694

The CVE-2007-5694 issue affects SiteBar 3.3.8 and earlier, originating from the translation module (translator.php) where an absolute path in dir enables remote authenticated users to read arbitrary files via the dir parameter (path traversal). Debian/DSA-1423-1 indicates fixes in sitebar 3.3.8-7...

CVE-2007-5693

SiteBar 3.3.8 contains an eval-injection vulnerability in the translation module (translator.php) that allows remote authenticated users to execute arbitrary PHP code via the edit parameter in an upd cmd action (CVE-2007-5693). Evidence across multiple advisories (Debian DSA-1423-1, GLSA, and OSS...

CVE-2007-5696

PHP remote file inclusion vulnerability in includes.php in phpBasic allows remote attackers to execute arbitrary PHP code via a URL in the root parameter, possibly related to the Music module...

CVE-2007-5693

Eval injection vulnerability in the translation module translator.php in SiteBar 3.3.8 allows remote authenticated users to execute arbitrary PHP code via the edit parameter in an upd cmd action, a different vulnerability than CVE-2007-5492...

CVE-2007-5689

The Java Virtual Machine JVM in Sun Java Runtime Environment JRE in SDK and JRE 1.3.x through 1.3.120 and 1.4.x through 1.4.215, and JDK and JRE 5.x through 5.0 Update 12 and 6.x through 6 Update 2, allows remote attackers to execute arbitrary programs, or read or modify arbitrary files, via...

CVE-2007-5691

CVE-2007-5691 affects Mozilla Firefox 2.0.0.7, where ParseFTPList.cpp can be triggered by a crafted FTP server response to an unspecified listing command, leading to a denial of service via an application crash (reading from invalid pointer). The available connected documents corroborate Firefox ...

CVE-2007-5689

CVE-2007-5689 affects Sun JRE/JDK in multiple lines: JVM in JRE 1.3.x–1.4.x and JDK/JRE 5.x–6.x allows remote code execution or reading/modifying files via applets granted privileges. Connected docs indicate remediation via updated JRE/JDK packages (e.g., JVM/JRE updates to address these issues; ...

CVE-2007-5688

CVE-2007-5688: Multiple SQL injection vulnerabilities in the Multi-Forums (aka Multi Host Forum Pro) module 1.3.3 for phpBB/IPB, in directory.php, allow remote attackers to execute arbitrary SQL via the (1) go and (2) cat parameters. Affected software is the Multi-Forums module version 1.3.3; roo...

CVE-2007-5690

CVE-2007-5690 affects the Asterisk Zaptel component (zaptel 1.4.x). The vulnerability is a buffer overflow in sethdlc.c triggered by a long device name (ifr_name) and could allow local privilege escalation. OpenVAS/Nessus entries indicate affected Fedora packages updated to mitigate this issue (e...

[SECURITY] [DSA 1388-3] New dhcp packages fix arbitrary code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1388-3 [email protected] http://www.debian.org/security/ Noah Meyerhans October 29, 2007 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1388-3] New dhcp packages fix arbitrary code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1388-3 [email protected] http://www.debian.org/security/ Noah Meyerhans October 29, 2007 http://www.debian.org/security/faq -...

Unfixed XSS vulnerability at health.mytelus.com

Security researcher www.r3t.n3t.nl, has submitted on 29/10/2007 a cross-site-scripting XSS vulnerability affecting health.mytelus.com, which at the time of submission ranked 11981 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/11/2007. It i...

SAXON version 5.4 SQL Injection Vulnerability

netVigilance Security Advisory 55 SAXON version 5.4 SQL Injection Vulnerability Description: SAXON is a simple accessible online news publishing system for personal and small corporate site owners. Publish news, using configurable templates, on any .php page on your site. Publish news on a 'per...

saxon-sql.txt

netVigilance Security Advisory 55 SAXON version 5.4 SQL Injection Vulnerability Description: SAXON is a simple accessible online news publishing system for personal and small corporate site owners. Publish news, using configurable templates, on any .php page on your site. Publish news on a 'per...

Secunia Research: IBM Tivoli Storage Manager Client CAD Service Script Insertion

====================================================================== Secunia Research 29/10/2007 - IBM Tivoli Storage Manager Client CAD Service Script Insertion - ====================================================================== Table of Contents Affected...

CVE-2007-5686

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging...