Unfixed XSS vulnerability at 1.tool.ms

Security researcher kusomiso.com, has submitted on 24/09/2007 a cross-site-scripting XSS vulnerability affecting 1.tool.ms, which at the time of submission ranked 81982 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 28/09/2007. It is currently...

CVE-2007-5037

CVE-2007-5037 affects the inotify-tools library prior to 3.11, where a buffer overflow in inotifytools_snprintf in src/inotifytools.c can be triggered by a long filename. Public records in connected feeds confirm versions affected include the inotify-tools package used on Debian (DSA-1440-1) and ...

CVE-2007-5043

The CVE-2007-5043 entry affects Kaspersky Internet Security 7.0.0.125, where the kernel driver layer (kylif.sys) does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers. This insecure handling enables local attackers to cause a denial of service (...

Unfixed XSS vulnerability at www.techsoup.org

Security researcher Narcoticxs, has submitted on 24/09/2007 a cross-site-scripting XSS vulnerability affecting www.techsoup.org, which at the time of submission ranked 62702 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 28/09/2007. It is...

CVE-2007-5044

CVE-2007-5044 affects ZoneAlarm Pro 7.0.362.000. The issue is insufficient validation of parameters passed to SSDT function handlers, enabling a local user to crash the system and potentially gain privileges via the kernel SSDT hooks for NtCreatePort and NtDeleteFile. This is described as a parti...

CVE-2007-5040

CVE-2007-5040 affects Ghost Security Suite alpha 1.200. The issue is improper validation of certain parameters to System Service Descriptor Table (SSDT) function handlers, leading to denial of service (crash) and potential privilege elevation via kernel SSDT hooks. Affected kernel interfaces incl...

CVE-2007-5048

Lhaplus vulnerability (CVE-2007-5048): heap-based buffer overflow in Lhaplus before 1.55 when handling ARJ archives, triggered by a long filename. ARJ filenames can overflow the buffer, allowing remote code execution with the user’s privileges if a crafted file is opened. Affected product: Lhaplu...

CVE-2007-5045

CVE-2007-5045 describes an argument injection in Apple QuickTime 7.1.5 and earlier when used with Mozilla Firefox

CVE-2007-5039

CVE-2007-5039 : Ghost Security Suite beta 1.110 contains improper validation of parameters to System Service Descriptor Table (SSDT) function handlers. This allows local users to trigger a crash (DoS) and potentially gain privileges via kernel SSDT hooks for (1) NtCreateKey, (2) NtDeleteValueKey,...

CVE-2007-5035

OpenEngine 1.9 beta1 is associated with a PHP remote file inclusion risk in html/modules/extranet_profile/main.php via the this_module_path parameter. The underlying issue is disputed by CVE because PHP may terminate with a fatal function-call error on direct requests before the include, which af...

RHEL 3 / 4 / 5 : openoffice.org (RHSA-2007:0848)

Updated openoffice.org packages to correct a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. OpenOffice.org is an office productivity suite that includes desktop...

Debian DSA-1376-1 : kdebase - programming error

iKees Huijgen discovered that under certain circumstances KDM, an X session manager for KDE, could be tricked into allowing user logins without a password. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Securi...

Fedora Core 6 : qt-3.3.8-2.fc6 (2007-703)

Mon Sep 17 2007 Than Ngo - 1:3.3.8-2.fc6 - bz292951, CVE-2007-4137 - Wed Aug 29 2007 Than Ngo - 1:3.3.8-1.fc6.1 - CVE-2007-3388 qt format string flaw - bz234635, CVE-2007-0242 qt UTF8 improper character expansion Note that Tenable Network Security has extracted the preceding description block...

Unfixed XSS vulnerability at www.illinchetto.it

Security researcher BackDoor, has submitted on 24/09/2007 a cross-site-scripting XSS vulnerability affecting www.illinchetto.it, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 28/09/2007. It is currentl...

Unfixed XSS vulnerability at www.spisales.com

Security researcher iNs, has submitted on 24/09/2007 a cross-site-scripting XSS vulnerability affecting www.spisales.com, which at the time of submission ranked 1133214 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/09/2007. It is currently...

Unfixed XSS vulnerability at www.indirsek.org

Security researcher Comando, has submitted on 24/09/2007 a cross-site-scripting XSS vulnerability affecting www.indirsek.org, which at the time of submission ranked 574689 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 28/09/2007. It is...

CVE-2007-3916

CVE-2007-3916 affects SKK Tools 1.2 (skkdic-expr.c): it insecurely writes temporary files to $TMPDIR/skkdic$PID.{pag,dir,db}, enabling a local attacker to create symbolic links and potentially overwrite or modify arbitrary files. The issue is caused by writing to a temporary file named with the p...

CVE-2007-5049

CVE-2007-5049 is a duplicate entry for CVE-2007-3387; the connected sources provide concrete details for CVE-3387 across multiple PDF viewers. The LGPL/GNOME PDF tools affected include gpdf (GNOME PDF viewer), kdegraphics/kpdf, and xpdf, as well as CUPS-related components in some contexts. The un...

Slackware 12.0 : kdebase, kdelibs (SSA:2007-264-01)

New kdebase packages are available for Slackware 12.0 to fix security issues. A long URL padded with spaces could be used to display a false URL in Konqueror's addressbar, and KDM when used with no-password login could be tricked into logging a different user in without a password. This is not th...

FreeBSD : coppermine -- multiple vulnerabilities (12488805-6773-11dc-8be8-02e0185f8d72)

The coppermine development team reports two vulnerabilities with the coppermine application. These vulnerabilities are caused by improper checking of the log variable in 'viewlog.php' and improper checking of the referer variable in 'mode.php'. This could allow local file inclusion, potentially...