[slackware-security] kdebase, kdelibs

New kdebase packages are available for Slackware 12.0 to fix security issues. A long URL padded with spaces could be used to display a false URL in Konqueror's addressbar, and KDM when used with no-password login could be tricked into logging a different user in without a password. This is not th...

Unfixed XSS vulnerability at www.linkz.net

Security researcher Babaconda, has submitted on 22/09/2007 a cross-site-scripting XSS vulnerability affecting www.linkz.net, which at the time of submission ranked 271309 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 28/09/2007. It is current...

Unfixed XSS vulnerability at md5encryption.com

Security researcher Uber0n, has submitted on 22/09/2007 a cross-site-scripting XSS vulnerability affecting md5encryption.com, which at the time of submission ranked 308707 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/09/2007. It is...

Unfixed XSS vulnerability at www.everyclick.com

Security researcher kusomiso.com, has submitted on 22/09/2007 a cross-site-scripting XSS vulnerability affecting www.everyclick.com, which at the time of submission ranked 22828 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 28/09/2007. It is...

Black Lily 2007 - products.php?class SQL Injection

Black Lily 2007 - products.php?class SQL Injection SnIper-sa.com SSSSS nnn nn ii ppppppp eeeeeeeee rrrrr ss nn nn nn ii pp p ee rr rr s nn nn nn ii pp p ee rr r ss nn nn nn ii ppppppp ee rr rr sssss nn nn nn ii pp eeeeee rrrr ss nn nn nn ii pp ee rrrr s nn nn nn ii pp ee rr rr ss nn nnn ii pp ee ...

Unfixed XSS vulnerability at locoboard.net

Security researcher kusomiso.com, has submitted on 22/09/2007 a cross-site-scripting XSS vulnerability affecting locoboard.net, which at the time of submission ranked 174667 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/09/2007. It is...

Unfixed XSS vulnerability at www.floorball-shop.eu

Security researcher www.r3t.n3t.nl, has submitted on 22/09/2007 a cross-site-scripting XSS vulnerability affecting www.floorball-shop.eu, which at the time of submission ranked 8546178 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/09/2007...

Black Lily 2007 - 'products.php?class' SQL Injection

SnIper-sa.com SSSSS nnn nn ii ppppppp eeeeeeeee rrrrr ss nn nn nn ii pp p ee rr rr s nn nn nn ii pp p ee rr r ss nn nn nn ii ppppppp ee rr rr sssss nn nn nn ii pp eeeeee rrrr ss nn nn nn ii pp ee rrrr s nn nn nn ii pp ee rr rr ss nn nnn ii pp ee rr rr sssss nn nnn ii pp eeeeeeeeee rr rr VerY-SecR...

Unfixed XSS vulnerability at www.marsflag.com

Security researcher kusomiso.com, has submitted on 22/09/2007 a cross-site-scripting XSS vulnerability affecting www.marsflag.com, which at the time of submission ranked 93196 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/09/2007. It is...

Black Lily 2007 (products.php class) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ======================================================================= Black Lily 2007 products.php class Remote SQL Injection Vulnerability ======================================================================= SnIper-sa.com SSSSS nnn n...

CVE-2007-5034

ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy ...

CVE-2007-5034

CVE-2007-5034 affects ELinks prior to 0.11.3. When sending a POST over HTTPS via a proxy, the body and headers of the POST are appended to the CONNECT request in cleartext, enabling potential disclosure of sensitive data. Impact: information disclosure via TLS-protected traffic when a HTTPS proxy...

CVE-2007-4065

lib/vorbisfile.c in libvorbisfile in Xiph.Org libvorbis before 1.2.0 allows context-dependent attackers to cause a denial of service infinite loop via a crafted OGG file, aka trac Changeset 13217...

Immunity Canvas: VMWARE_DHCPD

Name| vmwaredhcpd ---|--- CVE| CVE-2007-0063 Exploit Pack| CANVAS Description| VMware dhcpd Overflow Notes| CVE Name: CVE-2007-0063 VENDOR: VMWare VersionsAffected: Repeatability: One shot References: http://lists.vmware.com/pipermail/security-announce/2007/000001.html CVE Url:...

CVE-2007-4066

Multiple buffer overflows in Xiph.Org libvorbis before 1.2.0 allow context-dependent attackers to cause a denial of service or have other unspecified impact via a crafted OGG file, aka trac Changesets 13162, 13168, 13169, 13170, 13172, 13211, and 13215, as demonstrated by an overflow in oggenc.ex...

CVE-2007-0061

The DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528 allows remote attackers ...

CVE-2007-5029

Dibbler 0.6.0 does not verify that certain length parameters are appropriate for buffer sizes, which allows remote attackers to trigger a buffer over-read and cause a denial of service daemon crash, as demonstrated by incorrect behavior of the TSrvMsg constructor in SrvMessages/SrvMsg.cpp when 1...

CVE-2007-5030

Multiple integer overflows in Dibbler 0.6.0 allow remote attackers to cause a denial of service daemon crash via packets containing options with large lengths, which trigger attempts at excessive memory allocation, as demonstrated by 1 the TSrvMsg constructor in SrvMessages/SrvMsg.cpp; the 2...

CVE-2007-4065

lib/vorbisfile.c in libvorbisfile in Xiph.Org libvorbis before 1.2.0 allows context-dependent attackers to cause a denial of service infinite loop via a crafted OGG file, aka trac Changeset 13217...

CVE-2007-5021

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2007-4880. Reason: This candidate is a duplicate of CVE-2007-4880. Notes: All CVE users should reference CVE-2007-4880 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...