CVE-2007-6618

JIRA Enterprise Edition prior to 3.12.1 is affected by CVE-2007-6618: remote attackers can delete another user’s shared filter by supplying a modified filter ID. The publicly provided documents confirm the affected product version range and the underlying flaw being insufficient access control on...

CVE-2007-6619

CVE-2007-6619 affects Atlassian Jira Enterprise Edition prior to 3.12.1. The Setup Wizard does not properly restrict setup attempts after completion, enabling remote actors to change the default language. The issue is described alongside related vulnerabilities in 3.12.0-era Jira (noted in Nessus...

CVE-2007-6617

CVE-2007-6617 is a documented XSS vulnerability in the Atlassian Jira product, specifically in 500page.jsp for Jira Enterprise Edition before 3.12.1. The issue arises from improper handling of error messages, allowing a remote attacker to inject arbitrary script/HTML via input originally sent in ...

CVE-2007-6611

Cross-site scripting XSS vulnerability in view.php in Mantis before 1.1.0 allows remote attackers to inject arbitrary web script or HTML via a filename, related to bugreport.php...

CVE-2007-6611

Cross-site scripting XSS vulnerability in view.php in Mantis before 1.1.0 allows remote attackers to inject arbitrary web script or HTML via a filename, related to bugreport.php...

CVE-2007-6611

Cross-site scripting XSS vulnerability in view.php in Mantis before 1.1.0 allows remote attackers to inject arbitrary web script or HTML via a filename, related to bugreport.php...

CVE-2007-6612

Vulnerability: Mongrel contains a directory traversal flaw in DirHandler (lib/mongrel/handlers.rb) affecting Mongrel 1.0.4 and 1.1.x prior to 1.1.3. An HTTP request with double-encoded sequences (.%252e) can cause reading of arbitrary files. MITRE/Exploit specifics are not provided in the sources...

CVE-2007-6613

CVE-2007-6613 is a stack-based buffer overflow in libcdio (libcdio 0.79 and earlier) within the print_iso9660_recurse function of iso-info.c. The overflow can be triggered by a disk or image containing a long Joliet filename, allowing a context-dependent attacker to cause a denial of service (cor...

CVE-2007-6611

CVE-2007-6611 affects MantisBT prior to 1.1.0. The vulnerability is an XSS in view.php via the uploaded filename in bug_report.php, exploitable by authenticated users to inject arbitrary HTML/JS in the browser. Affected product: MantisBT; root cause: insufficient sanitization of the uploaded file...

[SECURITY] [DSA 1447-1] New tomcat5.5 packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1447-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 03, 2008 http://www.debian.org/security/faq -...

CVE-2007-6610

unp 1.0.12, and other versions before 1.0.14, does not properly escape file names, which might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument. NOTE: this might only be a vulnerability when unp is invoked by a third party product...

CVE-2007-6610

CVE-2007-6610 affects unp up to 1.0.12 and older than 1.0.14. The vulnerability arises because unp does not properly escape file names before passing them to shell calls, enabling a context-dependent attacker to execute arbitrary shell commands via crafted filenames (potentially when invoked by a...

[SECURITY] [DSA 1443-1] New tcpreen packages fix denial of service

------------------------------------------------------------------------ Debian Security Advisory DSA-1443-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 03, 2008 http://www.debian.org/security/faq -...

DivX Player 6.6.0 ActiveX SetPassword() Denial of Service PoC

No description provided by source. object id="divx" classid="clsid:D050D736-2D21-4723-AD58-5B541FFB6C11" style="display:none;" /object script function crash var buff = ''; fori=0;i=500;i++ buff+="AAAAAAAAAA"; object = document.getElementById"divx"; object.SetPasswordbuff; /script pre h3uDivX...

Lotus Notes WPD attachment viewer buffer overflow

Added: 01/03/2008 CVE: CVE-2007-5910 BID: 26175 OSVDB: 40783 Background Lotus Notes is the client for Lotus Domino servers. Problem A buffer overflow in the KeyView Viewer included in Lotus Notes allows command execution when a user views a specially crafted WordPerfect WPD attachment. Resolution...

Jetty fails to properly process URLs that contain double / characters

Overview The Jetty web server contains a vulnerability that may allow an attacker to access private files or directories. Description Jetty is a web server that is implemented in Java. Jetty contains a vulnerability in the way it processes URLs with multiple "/" slash characters. See the Jetty...

OpenSSL FIPS Object Module fails to properly generate random seeds

Overview The OpenSSL FIPS Module fails to perform auto-seeding, which may allow an attacker to predict pseudo-randomly generated data. Description OpenSSL is a toolkit that provides SSL and TLS protocols as well as a general purpose cryptography library. The OpenSSL FIPS Object Module provides an...

[Full-disclosure] IBM Domino Web Access Upload Module inotes6w.dll SEH Overwrite Exploit

This one is the same offset as dwa7w and the same class id as inotes6. Basically inotes6 and inotes6w share the same class id, except that inotes6w is unicode. dwa7w is unicode and has a different class id. Code is inline, I would attach it except for the fact that I set off way to many av scanne...

[Full-disclosure] IBM Domino Web Access inotes6.dll SEH Overwrite Exploit

My first attempt at an SEH overwrite exploit. Anyhow, I first posted about this issue regarding version 7 of this control, Will Dormann of the CERT/CC discovered versions 6 and 6.5 are vulnerable too, see http://www.kb.cert.org/vuls/id/963889. Dwa7w.dll and inotes6w.dll are unicode, thats my next...

[Full-disclosure] IBM Domino Web Access Upload Module dwa7w.dll SEH Overwrite Exploit

This one is unicode based, so is inotes6w. Exploitation for inotes6w is probably the same just with a different offset. Code is inline and attached. --------------------- !-- written by e.b. IBM Domino Web Access Upload Module dwa7w.dll SEH Overwrite Exploit CVE-2007-4474 Tested on Windows XP...