Vantage Linguistics AnswerWorks 4 API ActiveX Control BoF Exploit

No description provided by source. !-- Vantage Linguistics AnswerWorks 4 API ActiveX Control Buffer Overflow Exploit Vulnerability discovered by Parvez Anwar Exploit written by e.b. References: http://secunia.com/advisories/26566/ CVE-2007-6387 Tested on Windows XP SP2fully patched English, IE6,...

Security fix for the ALT Linux 5 package MySQL version 5.0.51-alt1

Jan. 1, 2008 Konstantin Lepikhov 5.0.51-alt1 - 5.0.51. - Security fixes: + CVE-2007-5969 RENAME TABLE System Table Overwrite Vulnerability + CVE-2007-6303 CVE-2007-6304 Server Privilege Escalation And Denial Of Service Vulnerabilities - Update html documentation to 9232 revision...

CVE-2007-6603

Hot or Not Clone has insufficient access control for producing and reading database backups, which allows remote attackers to obtain the administrator username and password via a direct request to control/backup/backup.php, which generates a backup/dump/backup.sql file that can be downloaded via ...

CVE-2007-6603

CVE-2007-6603 affects Hot or Not Clone. The issue is insufficient access control for producing/reading database backups: an attacker can trigger control/backup/backup.php to generate a backup.sql and then download it via control/downloadfile.php, exposing administrator credentials. The NVD entry ...

CVE-2007-6602

CVE-2007-6602 describes a SQL injection in NoseRub, affecting version 0.5.2 and earlier. The vulnerability occurs in the login script via the username field and targets the code path in app/models/identity.php . Root cause is improper handling of user input leading to arbitrary SQL execution by r...

CVE-2007-6606

CVE-2007-6606 affects OpenBiblio 0.5.2-pre4 and earlier: remote attackers can disclose configuration information via a direct request to phpinfo.php, which uses phpinfo(). The entry notes a MEDIUM severity (CVSSv2 base score 5.0) with network attack vector and no authentication. The provided docu...

CVE-2007-6607

OpenBiblio 0.5.2-pre4 and earlier is affected. The vulnerability allows remote attackers to obtain sensitive information by directly requesting (1) shared/footer.php, (2) circ/mbr_fields.php, or (3) admin/custom_marc_form_fields.php, with error messages revealing internal paths. The CVE entry doc...

CVE-2007-6604

CVE-2007-6604 affects XCMS 1.82 and earlier. The vulnerability is in index.php, where directory traversal via a dot-dot sequence in two parameters (s on the admin page, or pg for an arbitrary module) lets remote attackers read arbitrary files. Demonstrations include reading a password hash from a...

CVE-2007-6608

CVE-2007-6608 : OpenBiblio 0.5.2-pre4 and earlier suffer multiple cross-site scripting (XSS) vulnerabilities due to unsanitized input in several admin pages. Specifically, the parameters (1) LAST and (2) FIRST to admin/staff_del_confirm.php, (3) name to admin/theme_del_confirm.php, and (4) themeN...

CVE-2007-6609

Summary of CVE-2007-6609 (CPI_PlaylistItem.c, CoolPlayer) : The vulnerability is a chain of stack-based buffer overflows in CPLI_ReadTag_OGG within CPI_PlaylistItem.c affecting CoolPlayer 217 and earlier. A long (cTag or cValue) field in an OGG Vorbis file can allow user-assisted remote code exec...

CVE-2007-6605

CVE-2007-6605 describes a buffer overflow in the SkyFex Client ActiveX control SkyFexClient.ocx 1.0.2.77, where long strings passed to the Start method’s first four arguments can allow remote code execution. The vulnerability affects SkyFex Client 1.0 and is triggered via crafted input sent to th...

CVE-2007-6595

ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on 1 temporary files used by the cligentempfd function in libclamav/others.c or on 2 .ascii files used by sigtool, when utf16-decode is enabled...

CVE-2007-6597

CVE-2007-6597 concerns multiple XSS vulnerabilities in IPortalX prior to Build 033. The affected components are the web endpoints forum/login_user.asp and blogs.asp , with vulnerable parameters KW , SF (forum/login_user.asp) and Date (blogs.asp). Root cause is cross-site scripting that could allo...

CVE-2007-6596

CVE-2007-6596 affects ClamAV 0.92: Base64 UUEncoded archives bypass the scanner. CVSSv2 base score 5.0 (Medium). Connected documents reiterate the issue but do not specify a patched version or remediation details; no explicit exploit details are provided.

CVE-2007-6337

CVE-2007-6337 refers to a vulnerability in the bzip2 decompression code used by clamav (nsis/bzlib_private.h) prior to version 0.92. The connected documents corroborate that this family of issues includes CVE-2007-6335, CVE-2007-6336, and CVE-2007-6337 and indicate vendor advisories and updates t...

inotes6-overwrite.txt

My first attempt at an SEH overwrite exploit. Anyhow, I first posted about this issue regarding version 7 of this control, Will Dormann of the CERT/CC discovered versions 6 and 6.5 are vulnerable too, see http://www.kb.cert.org/vuls/id/963889. Dwa7w.dll and inotes6w.dll are unicode, thats my next...

Lotus Domino Web Access ActiveX control dwa7w.dll buffer overflow

Added: 12/31/2007 CVE: CVE-2007-4474 BID: 26972 OSVDB: 40954 Background Lotus Domino Web Access provides capabilities similar to those of the Lotus Notes client, delivered through a web browser. Problem A buffer overflow vulnerability in the Lotus Domino Web Access ActiveX control in the dwa7w.dl...

IBM Domino Web Access Upload Module SEH Overwrite Exploit

No description provided by source. !-- written by e.b. IBM Domino Web Access Upload Module inotes6.dll SEH Overwrite Exploit Bad chars: 0x80+ CVE-2007-4474 Tested on Windows XP SP2fully patched English, IE6, inotes6.dll version 6.0.40.0 and version 6.0.48.0...

openSUSE 10 Security Update : squid (squid-4779)

This update of squid fixes a denial-of-service bug during cache update reply processing. CVE-2007-6239 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update squid-4779. The text description of this...

Debian DSA-1440-1 : inotify-tools - buffer overflow

It was discovered that a buffer overflow in the filename processing of the inotify-tools, a command-line interface to inotify, may lead to the execution of arbitrary code. This only affects the internal library and none of the frontend tools shipped in Debian. The old stable distribution sarge do...