CVE-2007-4927

CVE-2007-4927 describes a vulnerability in the AXIS 207W camera where unauthenticated? remote authenticated users can trigger a denial of service (reboot) by issuing many requests with unique buffer names to buffername in a start action of axis-cgi/buffer/command.cgi. The connected records corrob...

CVE-2007-4929

CVE-2007-4929 concerns the AXIS 207W network camera, where multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The primary vector cited is the camNo parameter to incl/image_incl.shtml, with other unspecified vectors also mentioned. Th...

CVE-2007-4926

The CVE-2007-4926 entry concerns the AXIS 207W camera. The affected component is the authentication mechanism that uses a base64-encoded cleartext username and password, enabling an attacker to obtain credentials by eavesdropping on wireless traffic or via other unspecified vectors. Practical imp...

CVE-2007-4931

HP System Management Homepage SMH for Windows, when used in conjunction with HP Version Control Agent or Version Control Repository Manager, leaves old OpenSSL software active after an OpenSSL update, which has unknown impact and attack vectors, probably related to previous vulnerabilities for...

CVE-2007-4932

Shop-Script FREE 2.0 and earlier is affected by CVE-2007-4932: admin.php fails to exit after a redirect when administrative credentials are missing, allowing an unauthenticated remote attacker to access the admin panel. The NVD entry confirms the bypass/panel access impact, and Nessus notes a lik...

CVE-2007-4934

CVE-2007-4934 and CVE-2007-4935 describe multiple PHP remote file inclusion (RFI) vulnerabilities in phpFFL 1.24. The issue allows an attacker to supply a URL via the PHPFFL_FILE_ROOT parameter to certain PHP files and cause arbitrary PHP code execution. For CVE-2007-4934, vectors include program...

CVE-2007-4930

The CVE-2007-4930 entry covers multiple CSRF vulnerabilities in the AXIS 207W camera. The affected product is the AXIS 207W network camera. The issues allow remote attackers to perform administrator actions via specific endpoints: (1) axis-cgi/admin/restart.cgi, (2) axis-cgi/admin/pwdgrp.cgi with...

CVE-2007-4925

The CVE-2007-4925 vulnerability affects eWire Payment Client (ePC) versions 1.60 and 1.70, where the ewirePC_Decrypt function in ewirepcfunctions.php permits remote command execution through shell metacharacters in the paymentinfo parameter sent to simplePHPLinux/3payment_receive.php. Impact is d...

openoffice.org, openoffice.org2 security update

CentOS Errata and Security Advisory CESA-2007:0848 Updated openoffice.org packages to correct a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. OpenOffice.org is an...

Unfixed XSS vulnerability at www.maildome.com

Security researcher T-Ping, has submitted on 18/09/2007 a cross-site-scripting XSS vulnerability affecting www.maildome.com, which at the time of submission ranked 524733 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 20/09/2007. It is current...

rt-sa-2007-001.txt

Advisory: Alcatel-Lucent OmniPCX Remote Command Execution RedTeam Pentesting discovered a remote command execution in the Alcatel-Lucent OmniPCX during a penetration test. The masterCGI script of the OmniPXC integrated communication solution web interface is vulnerable to a remote command...

Unfixed XSS vulnerability at www.tweakyourwindows.com

Security researcher www.r3t.n3t.nl, has submitted on 18/09/2007 a cross-site-scripting XSS vulnerability affecting www.tweakyourwindows.com, which at the time of submission ranked 489958 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 20/09/200...

Unfixed XSS vulnerability at www.x-max.net

Security researcher www.r3t.n3t.nl, has submitted on 18/09/2007 a cross-site-scripting XSS vulnerability affecting www.x-max.net, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 20/09/2007. It is current...

Unfixed XSS vulnerability at www.spanishdict.com

Security researcher turbocharged06, has submitted on 18/09/2007 a cross-site-scripting XSS vulnerability affecting www.spanishdict.com, which at the time of submission ranked 27658 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 20/09/2007. It ...

CVE-2007-0241

...

CVE-2007-3010

masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker...

Unfixed XSS vulnerability at www.servihoo.com

Security researcher tenest, has submitted on 18/09/2007 a cross-site-scripting XSS vulnerability affecting www.servihoo.com, which at the time of submission ranked 6732 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 20/09/2007. It is currently...

Unfixed XSS vulnerability at www.loopmail.de

Security researcher T-Ping, has submitted on 18/09/2007 a cross-site-scripting XSS vulnerability affecting www.loopmail.de, which at the time of submission ranked 8864695 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 20/09/2007. It is current...

modifyform - modifyform.html Remote File Inclusion

modifyform - modifyform.html Remote File Inclusion modifyform RFI author: mozi original post: http://darkcode.h1x.com/forum/ dork: inurl: modifyform.html?code= thanks: str0ke, d3hydr8 milw0rm.com 2007-09-18...

Unfixed XSS vulnerability at www.sentenceseek.com

Security researcher www.r3t.n3t.nl, has submitted on 18/09/2007 a cross-site-scripting XSS vulnerability affecting www.sentenceseek.com, which at the time of submission ranked 1405088 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 20/09/2007. ...