CVE-2007-5106

CVE-2007-5106 describes an XSS vulnerability in WordPress 2.0 related to wp-register.php where an attacker can inject arbitrary script/HTML via the user_login parameter. The issue is documented across multiple sources (NVD/Ubuntu/Debian/OSV and WPVulnDB) with the affected component being WordPres...

BELL-CVE-2007-5093 CVE-2007-5093 does not affect BellSoft software

Bulletin has no description...

[SECURITY] [DSA 1343-2] New file packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1343-2 [email protected] http://www.debian.org/security/ Florian Weimer September 25th, 2007 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1343-2] New file packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1343-2 [email protected] http://www.debian.org/security/ Florian Weimer September 25th, 2007 http://www.debian.org/security/faq -...

CVE-2007-5093

The CVE-2007-5093 issue affects the Linux kernel pwc (Philips USB Webcam) driver in 2.6.x up to 2.6.22.5, where disconnect relies on user space to close the device. This can allow a user-assisted local attacker to cause a denial of service (USB subsystem hang and khubd CPU usage) by not closing t...

CVE-2007-5092

Directory traversal vulnerability in index.php in the Dance Music module for phpNuke, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in an ACCEPTFILE array parameter to modules.php...

CVE-2007-5091

CVE-2007-5091 concerns multiple cross-site scripting (XSS) vulnerabilities in the web application eGroupWare 1.4.001. The flaws allow remote attackers to inject arbitrary web script or HTML via the cat_data[color] parameter to two PHP components: preferences/inc/class.uicategories.inc.php and adm...

CVE-2007-5089

CVE-2007-5089 affects the sk.log product (versions 0.5.3 and earlier). The vulnerability is a PHP remote file inclusion in php-inc/log.inc.php that allows an attacker to cause execution of arbitrary PHP code by supplying a crafted URL via the SKIN_URL parameter. The connected documents confirm th...

CVE-2007-5090

CVE-2007-5090 : IBM Rational ClearQuest contains an unspecified vulnerability that, when using Microsoft SQL Server or IBM DB2, could allow a local attacker to manipulate data. The connected IBM/DB2 bulletin confirms exposure in CQ and notes a low (1.2) CVSS base score with local access; no mitig...

CVE-2007-5092

Directory traversal vulnerability in index.php in the Dance Music module for phpNuke, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in an ACCEPTFILE array parameter to modules.php...

CVE-2007-4874

SimpNews 2.41.03 contains multiple XSS vulnerabilities allowing remote attackers to inject scripts via l_username (admin/layout2b.php) and backurl (comment.php). Underlying issue is cross-site scripting in input handling. The impact is to execute arbitrary script in user context (no data exfiltra...

CVE-2007-5088

Freeside 1.7.2 contains a cross-site scripting (XSS) vulnerability in search/cust_bill_event.cgi that allows remote attackers to inject arbitrary web script or HTML via the failed parameter. CVE-2007-5088 is described with a MEDIUM severity (CVSS v2 base 4.3), network attack vector, no authentica...

BELL-CVE-2007-5087 CVE-2007-5087 does not affect BellSoft software

Bulletin has no description...

CVE-2007-4571

CVE-2007-4571 affects the ALSA portion of the Linux kernel before 2.6.22.8. The snd_mem_proc_read function in sound/core/memalloc.c does not return the correct write size, enabling a local user to read kernel memory contents via a small count argument (demonstrated by reading /proc/driver/snd-pag...

CVE-2007-5085

CVE-2007-5085 affects Apache Geronimo’s management EJB (MEJB) and is exploitable before version 2.0.2. The vulnerability allows remote attackers to bypass authentication and gain access to Geronimo internals via unspecified vectors. Affected component is MEJB in Geronimo prior to 2.0.2; root caus...

CVE-2007-5087

The CVE-2007-5087 issue affects the Linux kernel ATM module prior to 2.4.35.3 with CLIP support enabled. Reading /proc/net/atm/arp before the CLIP module is loaded can cause a denial-of-service (kernel panic) for local users. The vulnerability is documented in multiple sources (NVD/SUSE/Red Hat) ...

php malformed cookie handling

Unspecified vulnerability in PHP before 5.2.4 has unknown impact and attack vectors, related to an "Improved fix for MOPB-03-2007," probably a variant of CVE-2007-1285...

simpnews24103-fdisclose.txt

netVigilance Security Advisory 69 SimpNews version 2.41.03 File Content Disclosure Vulnerability Description: SimpNews is a news system written in PHP. Features: Data stored in MySQL, admin interface, support for multiple languages, support for multiple instances in one database, own header,...

Moderate: php security update

4.3.2-43.ent - improve fix for CVE-2007-3996 278361 4.3.2-42.ent - add security fixes for CVE-2007-2509, CVE-2007-2756, CVE-2007-2872, CVE-2007-3799, CVE-2007-3996, CVE-2007-3998, CVE-2007-4658 278361...

Unfixed XSS vulnerability at www.tom.sfc.keio.ac.jp

Security researcher kusomiso.com, has submitted on 26/09/2007 a cross-site-scripting XSS vulnerability affecting www.tom.sfc.keio.ac.jp, which at the time of submission ranked 9526 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 01/10/2007. It ...