Unfixed XSS vulnerability at www.xpbargains.com

Security researcher tenest, has submitted on 10/09/2007 a cross-site-scripting XSS vulnerability affecting www.xpbargains.com, which at the time of submission ranked 24643 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 12/09/2007. It is...

CVE-2007-5281

CVE-2007-3698 is referenced in the JSSE component that processes SSL/TLS handshake requests. In the Hitachi Cosminexus context, JSSE in Hitachi Cosminexus Developer’s Kit for Java (Cosminexus 7.5) prior to 07-50-01 is affected in environments using JSSE for SSL/TLS, allowing a remote attacker to ...

Fedora Core 6 : elinks-0.11.3-1.fc6 (2007-710)

Jump to new upstream version because of security issue 297991/done some other changes already committed to devel Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it ...

CVE-2007-5280

CVE-2007-5280 describes multiple XSS vulnerabilities in AppFuse before 2.0 Final, triggered via input recorded in (1) success or (2) error messages within messages.jsp. The affected component is the messages.jsp handling in AppFuse; root cause is improper sanitization/encoding of user input leadi...

CVE-2007-5282

Cosminexus components Hitachi Cosminexus Agent 03-00..03-05 and Cosminexus Library Standard/Web Edition 04-00/04-01 are affected. A specially crafted data payload from processes other than Cosminexus Manager can cause the Cosminexus Agent process to crash, per JVNDB details. The vulnerability is ...

CVE-2007-5280

Multiple cross-site scripting XSS vulnerabilities in messages.jsp in AppFuse before 2.0 Final allow remote attackers to inject arbitrary web script or HTML via unspecified input that is recorded in 1 success or 2 error messages...

MS07-059: Vulnerability in Windows SharePoint Could Result in Elevation of Privilege (942017)

The remote host is running a version of SharePoint Server 2007 or SharePoint Services 3.0 that is vulnerable to a privilege elevation attack in the SharePoint site. An attacker may use this to execute scripts in the context of the SharePoint site. C Tenable Network Security, Inc...

Solaris 10 (sparc) : 127716-01

SunOS 5.10: ip Patch. Date this patch was last updated by Sun : Oct/05/07 %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/10/24. C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0...

CVE-2007-5286

CVE-2007-5286 is rejected/not used; it is a duplicate of CVE-2007-5281.

CVE-2007-5274

Sun Java Runtime Environment JRE in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.215 and earlier, and SDK and JRE 1.3.120 and earlier, when Firefox or Opera is used, allows remote attackers to violate the security model for JavaScript outbound...

Immunity Canvas: TRIONIC_INCLUDE

Name| trionicinclude ---|--- CVE| CVE-2007-5271 Exploit Pack| CANVAS Description| Trionic Cite remote file include Notes| CVSS: 6.8 Repeatability: Infinite VENDOR: Trionic Cite CVE Url: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5271 CVE Name: CVE-2007-5271...

Design/Logic Flaw

Sun Java Runtime Environment JRE in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.215 and earlier, and SDK and JRE 1.3.120 and earlier, when Firefox or Opera is used, allows remote attackers to violate the security model for JavaScript outbound...

CVE-2007-5273

Sun Java Runtime Environment JRE in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.215 and earlier, and SDK and JRE 1.3.120 and earlier, when an HTTP proxy server is used, allows remote attackers to violate the security model for an applet's outbound...

CVE-2007-5271

CVE-2007-5271 affects Trionic Cite CMS (1.2 rev9 and earlier). The issue is multiple PHP remote file inclusion vulnerabilities that allow an attacker to execute arbitrary PHP code by providing a URL in the bField[bf_data] parameter to either interface/editors/-custom.php or interface/editors/cust...

CVE-2007-5272

CVE-2007-5272 is a SQL injection in kategori.asp of Furkan Tastan Blog, exploitable remotely via the id parameter in a goster kat action. Root cause is unsanitized/unsafe input leading to arbitrary SQL execution; impact includes partial disclosure, modification, and potential disruption. Exploita...

CVE-2007-5273

CVE-2007-5273 affects Sun JRE/JDK across multiple versions (JDK/JRE 6 Update 2 and earlier; 5.0 Update 12 and earlier; 1.4.2_15 and earlier; 1.3.1_20 and earlier). Root cause described as a multi-pin DNS rebinding issue when using an HTTP proxy: the applet download relies on DNS on the proxy whil...

CVE-2007-5274

The CVE-2007-5274 entry concerns Sun JRE/JDK/J2SE (various 4.x/5.x/6.x releases) where, when a user runs Firefox or Opera, JavaScript outbound connections could be violated due to a multi-pin DNS rebinding flaw tied to the LiveConnect API. The vulnerability arises because JavaScript code relies o...

CVE-2007-5270

CVE-2007-5270 affects Drupal via the Boost module prior to 4.7.x-1.0 and 5.x prior to 5.x-1.0. The vulnerability allows remote attackers to create or overwrite arbitrary files and perform cross-site scripting (XSS) through unspecified vectors. The available connected documents confirm the affecte...

CVE-2007-5278

CVE-2007-5278 affects Zomplog 3.8.1 and earlier, where sensitive information may be stored under the web root due to insufficient access control. The vulnerability allows remote attackers to download user-uploaded files by enumerating the /upload directory and then retrieving individual files. In...

CVE-2007-5277

CVE-2007-5277 concerns Microsoft Internet Explorer 6 on Windows XP where DNS pins can be dropped after failed connections to irrelevant TCP ports, making DNS rebinding attacks more feasible. The provided description demonstrates a scenario using a port 81 URL in an IMG SRC, where the DNS pin was ...