DSA-1640-1 python-django - cross site request forgery

Bulletin has no description...

Fedora 8 : tomcat5-5.5.27-0jpp.2.fc8 (2008-8130)

Mon Sep 15 2008 David Walluck 0:5.5.27-0jpp.2 - add commons-io symlink - Mon Sep 15 2008 David Walluck 0:5.5.27-0jpp.1 - 5.5.27 Resolves: rhbz456120 Resolves: rhbz457934 Resolves: rhbz446393 Resolves: rhbz457597 - Tue Feb 12 2008 Devrim GUNDUZ 0:5.5.26-1jpp.2 - Rebuilt - Fri Feb 8 2008 Devrim...

CVE-2008-4095

Affected product: Flip4Mac WMV plugin for Mac OS X. The issue resides in the Flip4Mac WMV decoder/importer prior to version 2.2.1, per multiple sources. A remote attacker could exploit a malformed WMV file to execute arbitrary commands on the vulnerable host when a user opens a crafted file, with...

PHPCMS2007 SP6 vote模块SQL注射漏洞

vote/vote.php // 22行 $optionids = isarray$op ? implode',',$op : $op; ... $db-query"UPDATE ".TABLEVOTEOPTION." SET number = number+1 WHERE optionid IN $optionids "; PHPCMS2007 SP6 暂无 !/usr/bin/php ?php printr' +---------------------------------------------------------------------------+ Phpcms 200...

hotelresv-sql.txt

Hotel reservation System city.asp city Blind SQL Injection Vulnerability url: http://www.softacid.net/scripts/web-hotel-reservation-system.asp Author: JosS mail: sys-projectathotmaildotcom site: http://spanish-hackers.com team: Spanish Hackers Team - SHT This was written for educational purpose...

Sql injection

SQL injection vulnerability in index.php in PHP Coupon Script 4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in an addtocart action, a different vector than CVE-2007-2672...

Design/Logic Flaw

swcons in bos.rte.console in IBM AIX 5.2.0 through 6.1.1 allows local users in the system group to create or overwrite an arbitrary file, and establish weak permissions and root ownership for this file, via unspecified vectors. NOTE: this can be leveraged to gain privileges. NOTE: this issue exis...

Code injection

gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite 2006,...

CVE-2007-5348

Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite...

Microsoft Office OneNote URL处理远程代码执行漏洞（MS08-055）

BUGTRAQ ID: 31067 CVE ID：CVE-2008-3007 CNCVE ID：CNCVE-20083007 Microsoft Office OneNote是一款Microsoft Office 系统的一个集成部分，用于帮助管理信息过载，更加轻松地共享信息，并且更加高效地与他人协作的程序。 Microsoft Office处理使用OneNote协议处理器onenote://的URL存在缓冲区溢出，远程攻击者可以利用漏洞以应用程序权限执行任意指令。 构建特殊的onenote:// URL可触发此漏洞。目前没有详细漏洞细节提供。 Microsoft OneNote 2007...

CVE-2008-4018

CVE-2008-4018 applies to IBM AIX: the swcons component in bos.rte.console on AIX 5.2.0–6.1.1 can allow local users who are members of the system group to create or overwrite an arbitrary file, assign root ownership, and set weak permissions via unspecified vectors. This vulnerability stems from a...

CVE-2007-5348

The CVE-2007-5348 entry concerns an IMAGE processing vulnerability in Microsoft GDI+ that could enable remote code execution. The connected KB954593 article MS08-052 describes multiple vulnerabilities in GDI+ across Windows and Office components that could be exploited by viewing a specially craf...

CVE-2007-6717

CVE-2007-6717 details a buffer overflow in the AIX component bos.net.tcp.client (affecting IBM AIX 5.2.0 and 5.3.0) that allows local users to gain privileges via unspecified vectors. The vulnerability lies in tftp handling within bos.net.tcp.client. AIX remediation referenced in connected data i...

CVE-2008-3007: Improper Input Validation

Argument injection vulnerability in a URI handler in Microsoft Office XP SP3, 2003 SP2 and SP3, 2007 Office System Gold and SP1, and Office OneNote 2007 Gold and SP1 allow remote attackers to execute arbitrary code via a crafted onenote:// URL, aka "Uniform Resource Locator Validation Error...

Microsoft Security Bulletin MS08-052 – Critical Vulnerabilities in GDI+ Could Allow Remote Code Execution (954593)

Microsoft Security Bulletin MS08-052 – Critical Vulnerabilities in GDI+ Could Allow Remote Code Execution 954593 Published: September 9, 2008 Version: 1.0 General Information Executive Summary This security update resolves several privately reported vulnerabilities in Microsoft Windows GDI+. Thes...

MS08-052: Vulnerabilities in GDI+ Could Allow Remote Code Execution (954593)

The remote host is running a version of Windows that has multiple buffer overflow vulnerabilities when viewing VML, EMF, GIF, WMF and BMP files that could allow an attacker to execute arbitrary code on the remote host. To exploit these flaws, an attacker would need to send a malformed image file ...

iDefense Security Advisory 09.09.08: Microsoft Windows GDI+ Gradient Fill Heap Overflow Vulnerability

iDefense Security Advisory 09.09.08 http://labs.idefense.com/intelligence/vulnerabilities/ Sep 09, 2008 I. BACKGROUND The GDI+ library, or "GdiPlus.dll", provides access to a number of graphics methods, via a class-based API. Vector Markup Language VML is a component of the Extensible Markup...

Microgaming Download Helper ActiveX Remote Code Execution (CVE-2007-2177)

ActiveX controls are reusable software components based on Microsoft Component Object Model COM. A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error in a Microgaming Download Helper ActiveX control. To trigger this issue, an...

Microsoft Office OneNote URL Handler Remote Code Execution Vulnerability

Description Microsoft Office OneNote is prone to a remote code-execution vulnerability. An attacker could exploit this issue by enticing a victim to follow maliciously crafted URIs. Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the current...

CVE-2007-5474

CVE-2007-5474 affects Linksys WRT350N (firmware 2.00.17) using Atheros AR5416-AC1E. The vulnerability arises from incorrect parsing of the Atheros vendor-specific information element in an association request, allowing a too-long information element to cause a denial of service (device reboot or ...