Unfixed XSS vulnerability at www.ufukhalisaha.com

Security researcher Narcoticxs, has submitted on 12/08/2007 a cross-site-scripting XSS vulnerability affecting www.ufukhalisaha.com, which at the time of submission ranked 3256534 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/08/2007. It i...

[SECURITY] [DSA 1422-1] New e2fsprogs packages fix arbitrary code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1422 [email protected] http://www.debian.org/security/ Steve Kemp December 07, 2007 http://www.debian.org/security/faq - ------------------------------------------------------------------------...

Sql injection

Multiple SQL injection vulnerabilities in bcoos 1.0.10 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the gid parameter to modules/arcade/index.php in a showstats action, or the lid parameter to 2 modules/myalbum/ratephoto.php or 3 modules/mylinks/ratelink.php, differe...

CVE-2007-6266

Multiple SQL injection vulnerabilities in bcoos 1.0.10 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the gid parameter to modules/arcade/index.php in a showstats action, or the lid parameter to 2 modules/myalbum/ratephoto.php or 3 modules/mylinks/ratelink.php, differe...

CVE-2007-6276

The acceptconnections function in the virtual private network daemon vpnd in Apple Mac OS X 10.5 before 10.5.4 allows remote attackers to cause a denial of service divide-by-zero error and daemon crash via a crafted load balancing packet to UDP port 4112...

CVE-2007-6279

Multiple double free vulnerabilities in Free Lossless Audio Codec FLAC libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via malformed 1 Seektable values or 2 Seektable Data Offsets in a .FLAC file...

CVE-2007-6274

CVE-2007-6274 describes multiple cross-site scripting (XSS) vulnerabilities in the Event Calendar module ec al/display.php for the product family/bcoos, affecting versions 1.0.10 and earlier. The flaw allows remote attackers to inject arbitrary web script or HTML by manipulating the (1) day or (2...

CVE-2007-6276

The acceptconnections function in the virtual private network daemon vpnd in Apple Mac OS X 10.5 before 10.5.4 allows remote attackers to cause a denial of service divide-by-zero error and daemon crash via a crafted load balancing packet to UDP port 4112...

CVE-2007-6278

CVE-2007-6278 affects the FLAC library (libFLAC) prior to 1.2.1. A crafted .FLAC file can trigger the MIME-Type URL flag in the FLAC image block, allowing a user-assisted remote attacker to cause the client to download arbitrary files. The vulnerability stems from (unexplicit) handling of the ima...

CVE-2007-5497

CVE-2007-5497 describes multiple integer overflow flaws in libext2fs of e2fsprogs up to version 1.40.3 . The root cause is integer overflows in processing filesystem data, which can be exploited by a crafted filesystem image to cause arbitrary code execution. The impact is remote code execution w...

CVE-2007-6277

The CVE-2007-6277 entry covers multiple heap- and stack-based overflow vulnerabilities in the FLAC library (libFLAC) prior to 1.2.1 that could allow remote code execution when processing specially crafted FLAC files. Connected advisories confirm concrete details: several overflow vectors (heap/st...

CVE-2007-6266

CVE-2007-6266 applies to the bcoos CMS (versions 1.0.10 and earlier). The affected components expose multiple SQL injection weaknesses that allow remote attackers to run arbitrary SQL commands. Attack vectors include: (1) gid parameter to modules/arcade/index.php in a show_stats action, (2) lid p...

CVE-2007-6273

The CVE-2007-6273 issue affects SonicWALL Global VPN Client versions 3.1.556 and 4.0.0.810, where the configuration file’s formatting strings in the Hostname tag and the Connection tag name attribute can be exploited by a user-assisted remote attacker to execute arbitrary code. The vulnerability ...

CVE-2007-6275

CVE-2007-6275 affects bcoos 1.0.10 and earlier. The vulnerability is a SQL injection in modules/adresses/ratefile.php that allows remote attackers to execute arbitrary SQL commands via the lid parameter, representing a vector different from CVE-2007-6266. The connected records confirm the affecte...

CVE-2007-6272

CVE-2007-6272 describes multiple SQL injection vulnerabilities in Joomla! 1.5 RC3. The flaws reside in index.php, allowing remote attackers to inject arbitrary SQL via: (1) the view parameter to the com_content component, (2) the task parameter to the com_search component, or (3) the option param...

CVE-2007-6271

CVE-2007-6271 affects Absolute News Manager.NET 5.1. The vulnerability is an information disclosure: remote attackers can obtain the installation path by requesting getpath.aspx, which leads to an error message revealing path details. The connected sources confirm this specific behavior across mu...

CVE-2007-6269

CVE-2007-6269 affects Absolute News Manager.NET 5.1. Multiple SQL injection vulnerabilities exist in xlaabsolutenm.aspx exploitable via the (1) z, (2) pz, (3) ord, and (4) sort parameters. Remote attackers can execute arbitrary SQL commands. CVSS v2 base score 7.5 (HIGH) with network attack vecto...

CVE-2007-6265

CVE-2007-6265 affects avast! 4 Home and Professional Editions prior to 4.7.1098. The vulnerability allows remote attackers to influence the system via a crafted TAR archive, with the impact described as unknown in the available sources. No exploitation details, affected subcomponents, or remediat...

CVE-2007-6267

CVE-2007-6267 affects Citrix EdgeSight components: Presentation Server (4.2/4.5), Endpoints (4.2/4.5), and NetScaler EdgeSight (1.0/1.1). The root cause is improper storage of database credentials in configuration files, enabling local users to obtain sensitive information. The available sources ...

CVE-2007-6277

Multiple buffer overflows in Free Lossless Audio Codec FLAC libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via large 1 Metadata Block Size, 2 VORBIS Comment String Size, 3 Picture Metadata MIME-TYPE Size, 4 Picture Description Size, 5 Picture Data Length, 6...