[email protected], [email protected]

=========================================================== Ubuntu Security Notice USN-528-1 October 11, 2007 mysql-dfsg-5.0 vulnerabilities CVE-2007-2583, CVE-2007-2691, CVE-2007-3780, CVE-2007-3782 =========================================================== A security issue affects the followin...

CVE-2007-5208

hpssd in Hewlett-Packard Linux Imaging and Printing Project hplip 1.x and 2.x before 2.7.10 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a from address, which is not properly handled when invoking sendmail...

[SECURITY] [DSA 1381-2] New Linux 2.6.18 packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1381-2 [email protected] http://www.debian.org/security/ Dann Frazier October 12th, 2007 http://www.debian.org/security/faq -...

Immunity Canvas: TIKIWIKI_EXEC

Name| tikiwikiexec ---|--- CVE| CVE-2007-5423 Exploit Pack| CANVAS Description| TikiWiki function create exploit Notes| CVSS: 7.5 Repeatability: Infinite VENDOR: Tikiwiki CVE Url: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5423 CVE Name: CVE-2007-5423...

CVE-2007-5423

tiki-graphformula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter, which are processed by createfunction...

CVE-2007-5427

Cross-site scripting XSS vulnerability in the comsearch component in Joomla! 1.0.13 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchword parameter. NOTE: this might be related to CVE-2007-4189.1...

CVE-2007-5425

SQL injection vulnerability in admin/index.php in Interspire ActiveKB 1.5 allows remote attackers to execute arbitrary SQL commands via the questId parameter in a hideQuestion ToDo action. NOTE: the catId vector is already covered by CVE-2007-5131...

CVE-2007-5358

CVE-2007-5358 affects Asterisk 1.4.x (before 1.4.13) voicemail functionality when using IMAP storage. The issue is described as multiple buffer overflows in voicemail handling, potentially allowing arbitrary code execution. Two attack vectors are noted: (1) remote attackers could execute arbitrar...

CVE-2007-5425

CVE-2007-5425 is a SQL injection vulnerability in Interspire ActiveKB 1.5, exploitable via the questId parameter in admin/index.php under a hideQuestion ToDo action. The issue affects ActiveKB 1.5 (and relates to CVE-2007-5131 for the catId vector). The provided documents do not specify a patch o...

CVE-2007-5427

CVE-2007-5427 is an XSS vulnerability affecting Joomla! prior to 1.0.13 in the com_search component, exploitable via the searchword parameter. The NVD entry ties it to a remote attacker scenario, with an impact profile indicating no confidentiality or availability impact and partial integrity imp...

CVE-2007-5432

Stride 1.0 has a default administrator username of "scott" with the password "running", which allows remote attackers to obtain administrative access through login.php...

CVE-2007-5433

CVE-2007-5433 describes multiple cross-site scripting (XSS) vulnerabilities in Site-Up 2.64 and earlier within the index.cgi component. The affected vectors are the (1) search and (2) search mask fields, allowing remote attackers to inject arbitrary web script or HTML. The consolidated records al...

CVE-2007-5426

CVE-2007-5426 : The provided documents identify multiple cross-site scripting (XSS) vulnerabilities in ActiveKB NX 2.5.4 . The issue arises from injectable content via the page parameter to the default URI for some directories (examples include ActiveKB/ and default/categories/ActiveKB/). The roo...

CVE-2007-5431

The CVE-2007-5431 entry affects Stride 1.0’s MyFTPUploader module, specifically the include/imageupload.js component. The root cause is that sensitive FTP login credentials are present in the source code, which could allow remote attackers to gain unauthorized access to the FTP server used by the...

CVE-2007-5429

The CVE-2007-5429 entry concerns Nucleus CMS version 3.01, where the vulnerability exists in index.php via the archive parameter. The issue is a cross-site scripting (XSS) flaw that could allow remote attackers to inject arbitrary web script or HTML. The available connected documents confirm the ...

CVE-2007-5434

The CVE-2007-5434 entry describes a cross-site scripting (XSS) vulnerability in PRO-search versions up to 0.17.1, where an attacker can inject arbitrary script or HTML via the q parameter to the default URI. The issue stems from unsanitized user input in the query parameter, enabling remote scrip...

CVE-2007-5432

CVE-2007-5432 refers to a vulnerability in Stride 1.0 where a default administrator account uses username "scott" and password "running". According to the provided documents, remote attackers could obtain administrative access via login.php. The core issue is the use of a hardcoded default creden...

CVE-2007-5428

CVE-2007-5428 is a cross-site scripting (XSS) vulnerability in UMI CMS. The flaw allows remote attackers to inject arbitrary web script or HTML via the search_string parameter to the default URI in search_do/. The issue is documented with CVSS v2.0 base metrics: AV:N/AC:M/Au:N/C:N/I:P/A:N, base s...

CVE-2007-5423

Summary: CVE-2007-5423 affects TikiWiki up to version 1.9.8, where tiki-graph_formula.php unsafely processes input in the f array via create_function(), enabling remote PHP code execution with the web server’s privileges. This is evidenced by multiple public advisories and exploit references (Met...

CVE-2007-5431

include/imageupload.js in the MyFTPUploader module in Stride 1.0 contains sensitive information including FTP login credentials, which might allow remote attackers to gain unauthorized access to the FTP server being used by the module by viewing the source code...