18185 matches found
Unfixed XSS vulnerability at www.randallspears.com
Security researcher Norehem, has submitted on 10/08/2007 a cross-site-scripting XSS vulnerability affecting www.randallspears.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/08/2007. It is...
Unfixed XSS vulnerability at kimmckeel.mfr.mlxchange.com
Security researcher Norehem, has submitted on 10/08/2007 a cross-site-scripting XSS vulnerability affecting kimmckeel.mfr.mlxchange.com, which at the time of submission ranked 3383 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 19/08/2007. It ...
[SECURITY] [DSA 1362-2] New lighttpd packages fix buffer overflow
------------------------------------------------------------------------ Debian Security Advisory 1362-2 [email protected] http://www.debian.org/security/ Steve Kemp October 7th, 2007 http://www.debian.org/security/faq - ------------------------------------------------------------------------...
WzdFTPD 0.8.0 - 'USER' Remote Denial of Service
Indonesian Newhack Security Advisory ------------------------------------ wzdftpd new Proto = "tcp", PeerAddr = "$ip", PeerPort = "$port" || die "\n- K...
CVE-2007-5249
CVE-2007-5249 describes multiple buffer overflows in the Unreal Engine logging function (used by America’s Army and America’s Army Special Forces 2.8.2 and earlier) that occur when PunkBuster is enabled, allowing remote DoS via long PB_Y (to YPG on UDP 1716) or PB_U (to UCON on UDP 1716) packets....
CVE-2007-5250
The CVE-2007-5250 entry concerns the Windows dedicated server for the Unreal engine used by America’s Army (and AA Special Forces 2.8.2 and earlier). The vulnerability allows remote attackers to cause a denial of service (server hang) by sending packets containing 0x07 characters or other unspeci...
CVE-2007-5255
CVE-2007-5255 describes an XSS vulnerability in Google Mini Search Appliance 3.4.14. The flaw allows remote attackers to inject arbitrary web script or HTML by supplying content to the ie parameter of the /search URI. The issue is evidenced in multiple sources (NVD/NVD-affiliates, Nessus plugin) ...
CVE-2007-5248
CVE-2007-5248 affects the ID Software Doom 3 engine (Doom 3 1.3.1 and earlier; Quake 4 1.4.2 and earlier; Prey 1.3 and earlier) when Punkbuster (PB) is enabled. The vulnerability arises from format string handling in two PB packets (PB_Y to YPG server; PB_U to UCON), enabling remote attackers to ...
CVE-2007-5243
Multiple stack-based buffer overflows in Borland InterBase LI 8.0.0.53 through 8.1.0.253, and WI 5.1.1.680 through 8.1.0.257, allow remote attackers to execute arbitrary code via 1 a long service attach request on TCP port 3050 to the a SVCattach or b INETconnect function, 2 a long create request...
CVE-2007-5254
VirusBlokAda Vba32 AntiVirus 3.12.2 is affected by a local privilege escalation due to weak directory permissions (Everyone:Write) on its installation path, enabling a local user to replace programs such as vba32ldr.exe. The underlying issue is improper permissions configuration that allows tampe...
CVE-2007-5243
CVE-2007-5243 covers multiple stack-based buffer overflows in Borland InterBase/Firebird components (LI 8.0.0.53–8.1.0.253 and WI 5.1.1.680–8.1.0.257) that enable remote code execution via crafted requests over TCP port 3050. Affected entry points include long service attach or create requests ta...
CVE-2007-5253
Cart32 (shopping cart app) vulnerability CVE-2007-5253 affects the GetImage function in c32web.exe prior to Cart32 6.4. An attacker can read arbitrary files by supplying an ImageName parameter that appends a NULL byte then a file extension (e.g., ".txt%00.gif"), potentially enabling directory tra...
CVE-2007-5257
CVE-2007-5257 affects the EDraw Office Viewer Component (officeviewer.ocx) in the EDraw.OfficeViewer ActiveX control. The vulnerability is a stack-based/buffer overflow in the FtpDownloadFile method that can be triggered by long values in the first and second arguments, affecting versions up to 5...
CVE-2007-5251
CVE-2007-5251: Multiple cross-site scripting (XSS) vulnerabilities in Helm 3.2.16. The XSS vectors affect the web interface via the showOption parameter to domain.asp and the Folder or StartPath parameters to FileManager.asp. Affected component: Helm 3.2.16 web UI. Exploitation details/impact are...
CVE-2007-5247
CVE-2007-5247 describes multiple format-string vulnerabilities in the Lithtech-based engine as used by F.E.A.R. 1.08 and earlier, with PunkBuster enabled. The issue allows remote attackers to potentially execute arbitrary code or cause a denial of service via format specifiers in specific PunkBus...
CVE-2007-5261
CVE-2007-5261 affects MultiCart 1.0 with SQL injection via the catid parameter in categorydetail.php and the ddlCategory parameter in search.php, enabling remote arbitrary SQL execution. CVSS v2 base score 6.4 (Medium) with network access and low complexity; no remediation details are provided in...
CVE-2007-5252
Buffer overflow in NetSupport Manager NSM Client 10.00 and 10.20, and NetSupport School Student NSS 9.00, allows remote NSM servers to cause a denial of service or possibly execute arbitrary code via crafted data in the configuration exchange phase of an initial connection setup. NOTE: a vendor...
CVE-2007-5258
CVE-2007-5258 affects phpFreeLog v0.2.0 (log.php) with a remote file inclusion vulnerability that allows an attacker to include and execute arbitrary files via unspecified vectors. The underlying cause is not detailed in the provided sources beyond RFI in log.php. No concrete exploitation details...
CVE-2007-5246
CVE-2007-5246 describes multiple stack-based buffer overflows in Firebird LI 2.0.0.12748/2.0.1.12855 and Firebird WI 2.0.0.12748/2.0.1.12855 that allow a remote attacker to execute arbitrary code by sending overly long requests to the isc_attach_database or isc_create_database functions over TCP ...