CVE-2007-5178

The CVE describes a vulnerability in the mx_glance 2.3.3 module for mxBB where a missing delimiter inside a security check placed within a comment enables remote file inclusion (RFI) and arbitrary PHP code execution via a URL in the mx_root_path parameter. Affected software is mx_glance 2.3.3 for...

[SECURITY] [DSA 1379-1] New quagga packages fix denial of service

------------------------------------------------------------------------ Debian Security Advisory DSA 1379-1 [email protected] http://www.debian.org/security/ Florian Weimer October 1st, 2007 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1381-1] New Linux 2.6.18 packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1381-1 [email protected] http://www.debian.org/security/ Dann Frazier October 2nd, 2007 http://www.debian.org/security/faq -...

Unfixed XSS vulnerability at www.doc.com

Security researcher MaXWeL, has submitted on 10/03/2007 a cross-site-scripting XSS vulnerability affecting www.doc.com, which at the time of submission ranked 1512710 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/03/2007. It is currently...

RHEL 4 : kernel (RHSA-2007:0937)

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2007:0937 advisory. - x8664 syscall vulnerability CVE-2007-4573 Note that Nessus has not tested for this issue but has instead relied only on the application's...

Unfixed XSS vulnerability at www.rrdonnelley.com

Security researcher MaXWeL, has submitted on 10/03/2007 a cross-site-scripting XSS vulnerability affecting www.rrdonnelley.com, which at the time of submission ranked 350546 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/03/2007. It is...

RHEL 3 : kernel (RHSA-2007:0938)

Updated kernel packages that fix a security issue in the Red Hat Enterprise Linux 3 kernel are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. A flaw was foun...

Debian DSA-1380-1 : elinks - programming error

Kalle Olavi Niemitalo discovered that elinks, an advanced text-mode WWW browser, sent HTTP POST data in cleartext when using an HTTPS proxy server potentially allowing private information to be disclosed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks...

FreeBSD : bugzilla -- 'createmailregexp' security bypass vulnerability (f8d3689e-6770-11dc-8be8-02e0185f8d72)

The Bugzilla development team reports : Bugzilla::WebService::User::offeraccountbyemail does not check the 'createemailregexp' parameter, and thus allows users to create accounts who would normally be denied account creation. The 'emailregexp' parameter is still checked. If you do not have the...

FreeBSD : id3lib -- insecure temporary file creation (15ec9123-7061-11dc-b372-001921ab2fa4)

Debian Bug report log reports : When tagging file $foo, a temporary copy of the file is created, and for some reason, libid3 doesn't use mkstemp but just creates $foo.XXXXXX literally, without any checking. This would silently truncate and overwrite an existing $foo.XXXXXX. %NASLMINLEVEL 70300 C...

Moderate: elinks security update

0.9.2-3.3.5.2 - fix elinks-0.9.2-httpspostdata.patch 303881 0.9.2-3.3.5.1 - fix 297611 - CVE-2007-5034 elinks reveals POST data to HTTPS proxy 0.9.2-3.3 - fix 215731 - elinks smb protocol arbitrary file access...

Unfixed XSS vulnerability at keznews.com

Security researcher MaXWeL, has submitted on 10/03/2007 a cross-site-scripting XSS vulnerability affecting keznews.com, which at the time of submission ranked 15924 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/03/2007. It is currently...

Borland Interbase 20072007 SP2 - jrd8_create_database Remote Buffer Overflow (Metasploit)

Borland Interbase 20072007 SP2 - jrd8createdatabase Remote Buffer Overflow Metasploit $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of us...

Unfixed XSS vulnerability at www.barbour.info

Security researcher MaXWeL, has submitted on 10/03/2007 a cross-site-scripting XSS vulnerability affecting www.barbour.info, which at the time of submission ranked 1024391 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 12/03/2007. It is...

Borland InterBase 2007 PWD_db_aliased Buffer Overflow

No description provided by source. $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require...

Unfixed XSS vulnerability at www.scisys.co.uk

Security researcher MaXWeL, has submitted on 10/03/2007 a cross-site-scripting XSS vulnerability affecting www.scisys.co.uk, which at the time of submission ranked 2164883 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/03/2007. It is...

Unfixed XSS vulnerability at www.adstech.com

Security researcher MaXWeL, has submitted on 10/03/2007 a cross-site-scripting XSS vulnerability affecting www.adstech.com, which at the time of submission ranked 103401 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 11/03/2007. It is currentl...

Borland Interbase 2007 2007SP2 INET_connect Buffer Overflow

No description provided by source. $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require...

Borland InterBase 2007 2007 sp2 jrd8_create_database Buffer Overflow

No description provided by source. $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require...

RHEL 5 : kernel (RHSA-2007:0936)

Updated kernel packages that fix a security issue in the Red Hat Enterprise Linux 5 kernel are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. A flaw was foun...