MS Office 2007: Target of Hyperlinks not covered by Digital Signatures

Affects: Microsoft Office 2007 12.0.6015.5000 MSO 12.0.6017.5000 possibly older versions I. Background Microsoft Office is a suite containing several programs to handle Office documents like text documents or spreadsheets. The latest version uses an XML based document format. Microsoft Office...

[ GLSA 200712-11 ] Portage: Information disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200712-11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - -...

+ Trivantis CourseMill Enterprise Learning Management System - SQL Injection - CVE-2007-6338

+==================================================================================================+ + Trivantis CourseMill Enterprise Learning Management System - SQL Injection - CVE-2007-6338 + +==================================================================================================+...

CVE-2007-6381

SQL injection vulnerability in the indexedsearch system extension in TYPO3 3.x, 4.0 through 4.0.7, and 4.1 through 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2007-6387

Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics AnswerWorks, and Intuit Clearly Bookkeeping, ProSeries, QuickBooks, Quicken, QuickTax, and TurboTax, allow remote attackers to execute arbitrary code via long...

[slackware-security] mysql

New mysql packages are available for Slackware 11.0, 12.0, and -current to fix bugs and security issues. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2007-3781 https://vulners.com/cve/CVE-2007-5925...

CVE-2007-6383

The CVE-2007-6383 entry concerns Chandler Server (Cosmo) prior to 0.10.1, where the DAV component fails to enforce resource creation permissions. This allows remote authenticated users to create arbitrary resources in another user’s home collection. The public documents specify the affected produ...

CVE-2007-6381

SQL injection vulnerability in the indexedsearch system extension in TYPO3 3.x, 4.0 through 4.0.7, and 4.1 through 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2007-6382

Summary: Robocode versions before 1.5.1 are affected by an arbitrary code execution vulnerability involving the Event Dispatch Thread (EDT). According to the documents, a robot can trigger Java code execution by invoking SwingUtilities.invokeLater on the EDT. Affected product/component: Robocode ...

CVE-2007-6385

CVE-2007-6385 affects Kerio WinRoute Firewall (pre-6.4.1). The proxy server component does not properly enforce authentication for HTTPS pages. The underlying impact is stated as unknown within the available documents, and there is no detail on exploit vectors or specific conditions required for ...

CVE-2007-6381

TYPO3 indexed_search SQL Injection (CVE-2007-6381) affects TYPO3 3.x and 4.x (4.0.x up to 4.0.7; 4.1 up to 4.1.3). The issue stems from insufficient input sanitising, enabling remote authenticated users to execute arbitrary SQL commands via unspecified vectors in the indexed_search extension. Imp...

CVE-2007-6386

CVE-2007-6386 : A stack-based buffer overflow in PccScan.dll (before build 1451) affects Trend Micro AntiVirus plus AntiSpyware 2008, Internet Security 2008, and Internet Security Pro 2008. The overflow occurs when processing a malformed ZIP archive with a long name (constructed via format string...

CVE-2007-6384

The CVE-2007-6384 entry affects BEA WebLogic Mobility Server (3.3, 3.5, 3.6 through 3.6 SP1) in the Image Converter functionality. The vulnerability allows remote attackers to obtain application file and resource access via unspecified vectors; CVSS v2 base score 7.5 (HIGH) with network attack ve...

CVE-2007-6387

The CVE-2007-6387 issue affects the awApi4.dll ActiveX control (awApi4.AnswerWorks.1, version 4.0.0.42) used by Vantage Linguistics AnswerWorks and related Intuit products. It enables remote code execution via multiple stack-based buffer overflows when long arguments are passed to methods such as...

CVE-2007-6387

Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics AnswerWorks, and Intuit Clearly Bookkeeping, ProSeries, QuickBooks, Quicken, QuickTax, and TurboTax, allow remote attackers to execute arbitrary code via long...

Cross site scripting

Cross-site scripting XSS vulnerability in modules/ecal/display.php in the Event Calendar in bcoos 1.0.10 allows remote attackers to inject arbitrary web script or HTML via the month parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2007-4706

Heap-based buffer overflow in Apple QuickTime before 7.3.1 allows remote attackers to execute arbitrary code via a crafted QTL file...

CVE-2007-6370

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2007-5583. Reason: This candidate is a duplicate of CVE-2007-5583. Notes: All CVE users should reference CVE-2007-5583 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2007-6249

etc-update in Portage before 2.1.3.11 on Gentoo Linux relies on the umask to set permissions for the merge file, often resulting in permissions weaker than those of the original files, which might allow local users to obtain sensitive information by reading the merge file...

CVE-2007-6367

Multiple cross-site scripting XSS vulnerabilities in the guestbook in SineCMS 2.3.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 username user or 2 comment commento field, different vectors than CVE-2007-2357...