Immunity Canvas: JOOMPANA_INCLUDE

Name| joompanainclude ---|--- CVE| CVE-2007-5363 Exploit Pack| CANVAS Description| Joomla panaoramic Component Remote File Inclusion Notes| CVE Name: CVE-2007-5363 VENDOR: Joomla Repeatability: Infinite References: http://www.milw0rm.com/exploits/4489 CVE Url: https://vulners.com/cve/CVE-2007-536...

CVE-2007-5362

The CVE-2007-5362 entry describes multiple PHP remote file inclusion (RFI) vulnerabilities in Avant-Garde Solutions MOSMedia Lite (com_mosmedia) 4.5.1 for Mambo/Joomla!, allowing an attacker to execute arbitrary PHP code via mosConfig_absolute_path in includes/ (credits.html.php, info.html.php, m...

CVE-2007-5363

CVE-2007-5363 affects the Panoramic Picture Viewer (com_panoramic) mambot 1.0 for Joomla!, with a PHP remote file inclusion vulnerability exploitable via the mosConfig_live_site parameter. The root cause is unsanitized user input allowing inclusion of arbitrary PHP code, enabling remote attackers...

CVE-2007-5364

CVE-2007-5364 affects ViArt Shopping Cart (payments/ideal_process.php) where a directory traversal in the filename parameter passed to createCertFingerprint can be exploited by remote attackers. The NVD entry notes an unknown impact and that the CVE’s claim is disputed because PHP may encounter a...

CVE-2007-4992

Stack-based buffer overflow in the processpacket function in fbserver.exe in Firebird SQL 2.0.2 allows remote attackers to execute arbitrary code via a long request to TCP port 3050...

Design/Logic Flaw

The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid "%" sequences in a mailto: or other URI handler, as demonstrated using mIRC, Outlook, Firefox, Adobe...

Unfixed XSS vulnerability at 4gr.net

Security researcher St@R-gaZ3r, has submitted on 10/11/2007 a cross-site-scripting XSS vulnerability affecting 4gr.net, which at the time of submission ranked 593092 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 17/11/2007. It is currently...

iDefense Security Advisory 10.10.07: Kaspersky Web Scanner ActiveX Format String Vulnerability

Kaspersky Web Scanner ActiveX Format String Vulnerability iDefense Security Advisory 10.10.07 http://labs.idefense.com/intelligence/vulnerabilities/ Oct 10, 2007 I. BACKGROUND Kaspersky Lab Online Virus Scanner is a free online virus scanner service, enabling a user to scan their system for...

Unfixed XSS vulnerability at www.asxetos.gr

Security researcher St@R-gaZ3r, has submitted on 10/11/2007 a cross-site-scripting XSS vulnerability affecting www.asxetos.gr, which at the time of submission ranked 40048 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 17/11/2007. It is...

TikiWiki tiki-graph_formula.php f Parameter Arbitrary Command Execution

The remote host is running TikiWiki, an open source wiki application written in PHP. The version of TikiWiki on the remote host fails to sanitize input to the 'f' parameter of the 'tiki-graphformula.php' script before using it as a function call. Regardless of PHP's 'registerglobals' setting, an...

Important: hplip security update

1.6.7-4.1.el50.3 - Fixed post scriptlet to make sure it restarts the daemon on upgrade part of bug 320011. 1.6.7-4.1.el50.2 - Build requires openssl-devel part of bug 320011. 1.6.7-4.1.el50.1 - Applied patch to fix CVE-2007-5208 bug 320011...

CVE-2007-3896

The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid "%" sequences in a mailto: or other URI handler, as demonstrated using mIRC, Outlook, Firefox, Adobe...

CVE-2007-4992

CVE-2007-4992 is a stack-based overflow in Firebird SQL 2.0.2’s fbserver.exe process_packet when processing oversized requests on TCP port 3050. This remote vulnerability could allow arbitrary code execution with the Firebird user’s privileges. Affected product: Firebird SQL server (fbserver.exe)...

Microsoft SQL Server Distributed Management Objects buffer overflow

Added: 10/11/2007 CVE: CVE-2007-4814 BID: 25594 OSVDB: 38399 Background Microsoft SQL Server includes a Distributed Management Object model which offers a modern, object-oriented alternative to using stored procedures. The Distributed Management Object model is implemented by the sqldmo.dll Activ...

CVE-2007-3896

CVE-2007-3896 affects Windows Shell32 (Windows XP/Server 2003 with IE7) where URL handling in the shell misparses invalid % sequences in mailto: or other URI handlers, allowing remote code execution. The issue can be triggered by launching external programs via URI handlers invoked by application...

Microsoft SQL Server Distributed Management Objects buffer overflow

Added: 10/11/2007 CVE: CVE-2007-4814 BID: 25594 OSVDB: 38399 Background Microsoft SQL Server includes a Distributed Management Object model which offers a modern, object-oriented alternative to using stored procedures. The Distributed Management Object model is implemented by the sqldmo.dll Activ...

Immunity Canvas: IE7WMP

Name| ie7wmp ---|--- CVE| CVE-2007-3896 Exploit Pack| CANVAS Description| Microsoft IE 7 url-handling error MS07-061 Notes| CVE Name: CVE-2007-3896 VENDOR: Microsoft MSADV: MS07-061 Repeatability: Infinite client side - no crash MSRC: http://www.microsoft.com/technet/security/bulletin/MS07-061.ms...

Immunity Canvas: IEPDF

Name| iepdf ---|--- CVE| CVE-2007-3896 Exploit Pack| CANVAS Description| Microsoft IE 7 url-handling error MS07-061 Notes| CVE Name: CVE-2007-3896 VENDOR: Microsoft MSADV: MS07-061 Repeatability: Infinite client side - no crash MSRC: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3896...

[SECURITY] [DSA 1379-2] New openssl packages fix arbitrary code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1379-2 [email protected] http://www.debian.org/security/ Noah Meyerhans October 10, 2007 - ------------------------------------------------------------------------ Package : openssl097,...

Unfixed XSS vulnerability at www.yangzhi.com

Security researcher z0mb.ie, has submitted on 10/10/2007 a cross-site-scripting XSS vulnerability affecting www.yangzhi.com, which at the time of submission ranked 179169 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 01/11/2007. It is current...