CVE-2007-6469

SQL injection vulnerability in index.php in phpRPG 0.8, when magicqutoesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...

CVE-2007-6452

CVE-2007-6452 affects Google Web Toolkit (GWT) – specifically the benchmark reporting system. The connected JVN entry states a cross-site scripting (XSS) vulnerability in GWT before version 1.4.61, enabling arbitrary script execution in the user’s browser. No exploit details are provided beyond t...

CVE-2007-6456

Technical details are not publicly provided in the supplied documents. No concrete product/version/impact details are present. Monitor for updates from official sources.

CVE-2007-6459

The CVE-2007-6459 entry affects Anon Proxy Server 0.100 (and likely 0.101). The vulnerability allows remote command execution via shell metacharacters in the host parameter to diagdns.php and in the host (and possibly the port) parameter to diagconnect.php. This is explicitly described as a separ...

CVE-2007-6460

CVE-2007-6460 refers to multiple cross-site scripting (XSS) vulnerabilities in Anon Proxy Server prior to 0.101. The affected software is Anon Proxy Server; the vulnerable component is the URI handling that is later displayed by log.php or logerror.php. The description consistently notes XSS enab...

CVE-2007-6462

CVE-2007-6462 affects PHP Real Estate Classifieds (fullnews.php) where the id parameter is vulnerable to SQL injection. Remote attackers could potentially execute arbitrary SQL commands through this parameter. The vulnerability is documented across multiple feeds (NVD, CVE lists) with a consisten...

CVE-2007-6463

CVE-2007-6463 affects PHP Real Estate Classifieds: multiple XSS flaws in the admin panel allow remote injection of arbitrary script via unspecified text areas/boxes. Base score 4.3 (MEDIUM); impact limited to partial integrity compromise and non-sensitive disclosure, with no authentication requir...

CVE-2007-6465

The CVE-2007-6465 entry is verified by multiple sources describing XSS vulnerabilities in ganglia-web prior to 3.0.6. Applicable components are web/host_gmetrics.php, web/graph.php, and web/get_context.php, with vulnerable parameters including (c, h) and (G, me, x, n, v, l, vl, st, and others) as...

HP-UX swagentd远程溢出漏洞

BUGTRAQ ID: 26855 CVECAN ID: CVE-2007-6195 HP-UX是一款HP公司开发的UNIX操作系统。 HP-UX操作系统的swagentd中所定义的swrpcagentinit函数（opcode 0x04）中存在缓冲区溢出漏洞，如果远程攻击者向该函数传送了畸形参数的话，就可以触发这个溢出，导致覆盖指针，因此可能会出现拒绝服务或执行任意指令。 HP HP-UX B.11.23 HP HP-UX B.11.11 HP已经为此发布了一个安全公告（HPSBUX02294）以及相应补丁: HPSBUX02294：SSRT071451 rev.1 - HP-UX...

CVE-2007-6468

CVE-2007-6468 is a buffer overflow in the HuffDecode function(s) located in hw_utils/hwrcon/huffman.c and hexenworld/Client/huffman.c for Hammer of Thyrion 1.4.2. A crafted Huffman-encoded packet can trigger memory corruption, enabling remote code execution or a denial of service. The available s...

CVE-2007-6453

RaidenHTTPD 2.0.19 contains a directory traversal vulnerability in raidenhttpd-admin/workspace.php (WebAdmin must be enabled) that allows remote unauthenticated attackers to include and execute arbitrary local files via a .. in the ulang parameter. Multiple sources (NVD/NVDCVE, vendor/JVN entries...

CVE-2007-6455

CVE-2007-6455 involves multiple cross-site scripting (XSS) vulnerabilities in index.php of Mambo 4.6.2. The issues allow remote attackers to inject arbitrary web script or HTML via the (1) Itemid parameter in a com_frontpage option and (2) the option parameter. Documents provided identify the aff...

CVE-2007-6457

CVE-2007-6457: SurgeMail 38k4 webmail has a stack-based buffer overflow in its webmail feature; a long Host header can trigger remote DoS (crash). Impact is partial availability. Public fix/remediation details are not provided in the provided documents; monitor for updates.

CVE-2007-6458

CVE-2007-6458 describes an SQL injection in 123tkShop 0.9.1. The vulnerability is in shop/mainfile.php, enabling remote attackers to inject SQL through a base64-encoded value of the admin parameter sent to shop/admin.php. This stems from improper handling of the admin parameter, allowing arbitrar...

CVE-2007-6281

St. Bernard Open File Manager 9.5 is affected by a heap-based buffer overflow in the ofmnt.exe Open File Manager service. The flaw allows remote code execution by sending an oversized request; authentication is not required. Affected product/version: St. Bernard Open File Manager 9.5. Root cause:...

Unfixed XSS vulnerability at www.caenlamer.fr

Security researcher TreX, has submitted on 20/12/2007 a cross-site-scripting XSS vulnerability affecting www.caenlamer.fr, which at the time of submission ranked 625309 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/01/2008. It is currently...

CVE-2007-6461

CVE-2007-6461 affects Flyspray 0.9.9–0.9.9.3, with cross-site scripting vulnerabilities in index.php. An attacker can inject arbitrary web script or HTML via (1) the query string in an index action (related to savesearch JavaScript) and (2) the details parameter in a details action (related to th...

CVE-2007-6469

CVE-2007-6469 affects phpRPG 0.8 with an SQL injection in index.php triggered via the username parameter when magic_quotes_gpc is disabled. Remote attackers could potentially execute arbitrary SQL commands. The public records supplied do not include exploitation details or a confirmed remediation...

[Full-disclosure] TPTI-07-21: Adobe Flash Player JPG Processing Heap Overflow Vulnerability

TPTI-07-21: Adobe Flash Player JPG Processing Heap Overflow Vulnerability http://dvlabs.tippingpoint.com/advisory/TPTI-07-21 December 19, 2007 -- CVE ID: CVE-2007-6242 -- Affected Vendor: Adobe -- Affected Products: Flash Player -- TippingPointTM IPS Customer Protection: TippingPoint IPS customer...

CVE-2007-6453

Directory traversal vulnerability in raidenhttpd-admin/workspace.php in RaidenHTTPD 2.0.19, when the WebAdmin function is enabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the ulang parameter...