CVE-2007-6196

CVE-2007-6196 – Calacode @Mail prior to 5.2 : A cross-site scripting (XSS) vulnerability exists in util.php where an attacker can inject arbitrary script/HTML via the func parameter. The issue is documented in multiple sources (e.g., NVD) with a base score of 4.3 (Medium) and an attack vector ove...

CVE-2007-6197

The CVE-2007-6197 entry affects BEA AquaLogic Interaction Plumtree Portal 5.0.2–5.0.4 and 6.0.1.218452. The root cause is information disclosure via comments in the HTML source of any page, allowing remote attackers to learn version numbers and internal hostnames. Impact is partial confidentialit...

CVE-2007-6200

CVE-2007-6200 affects rsync prior to 3.0.0pre6. When running a writable rsync daemon, it allows remote attackers to bypass exclude, exclude_from, and filter options and read or write hidden files via (1) symlink, (2) partial-dir, (3) backup-dir, and (4) dest options. The initial documents do not ...

CVE-2007-6198

The CVE-2007-6198 issue affects the Plumtree Portal component (portal/server.pt) in BEA AquaLogic Interaction versions 5.0.2–5.0.4 and 6.0.1.218452. The vulnerability allows wildcards in advanced searches for usernames via the in_tx_fulltext parameter, enabling remote attackers to enumerate valid...

CVE-2007-6199

CVE-2007-6199 affects rsync before 3.0.0pre6 where a writable rsync daemon not using chroot can be tricked into creating a symlink outside the module hierarchy, allowing remote access to restricted files. Available connected documents confirm the vulnerability details and note fixes in rsync upda...

CVE-2007-5494

MiracleLinux 3 kernel (2.6.18-53.11AXS3) is listed as affected by CVE-2007-5494 in AXSA:2008-150:05. The Nessus entry cites CVE-2007-5494 as ‘missing dput in do_lookup error leaks dentries for fs.’ No additional technical details, affected package names, versions, or remediation steps are provide...

CVE-2007-6193

The web management interface in Citrix NetScaler 8.0 build 47.8 stores the device's primary IP address in a cookie, which might allow remote attackers to obtain sensitive network configuration information if this address is not the same as the address being used by the web interface...

CVE-2007-6187

CVE-2007-6187 describes multiple directory traversal vulnerabilities in PHP Content Architect (aka NoAh) versions 0.9 pre 1.2 and earlier. The issue allows remote attackers to read arbitrary files by inserting ".." in the filepath parameter to css_file.php, js_file.php, or xml_file.php within noa...

CVE-2007-5503

CVE-2007-5503 relates to Cairo before 1.4.12, where multiple integer overflows in the read_png function can allow remote attackers to execute arbitrary code via a crafted PNG file. The issue affects Cairo’s PNG handling and is addressed by upgrading Cairo to 1.4.12 or later (vulnerable code path:...

CVE-2007-6171

Vulnerability: CVE-2007-6171 describes an SQL injection in the Postgres Realtime Engine (res_config_pgsql) of Asterisk 1.4.x (before 1.4.15) and Asterisk C.x (before C.1.0-beta6) . Affected component: Postgres Realtime Engine, res_config_pgsql. Root cause / impact: Remote attackers can exploit un...

CVE-2007-6189

CVE-2007-6189 affects BitDefender Online Anti-Virus Scanner 8.0 via two ActiveX controls (OScan8.ocx and Oscan81.ocx). A long argument to the InitX method that begins with the sequence “%%” is misparsed as a Unicode string and decoded twice, leading to improper memory allocation and a heap-based ...

CVE-2007-6190

The CVE affects Cisco Unified IP Phone devices with Extension Mobility enabled. The HTTP daemon can be abused by remote authenticated users on other phones within the same CUCM domain to eavesdrop on the physical environment by triggering a CiscoIPPhoneExecute message that points to an RTP audio ...

CVE-2007-6150

CVE-2007-6150 concerns a bug in FreeBSD where the internal state tracking for the random(4) and urandom(4) devices can be exploited to replay data distributed during subsequent reads. Affected: FreeBSD 5.5, 6.1–6.3, and 7.0 beta4. Impact: local adversaries could deduce fragments of previously rea...

CVE-2007-6192

The web management interface in Citrix NetScaler 8.0 build 47.8 uses weak encryption XOR of unpadded data to store credentials within a cookie, which makes it easier for remote attackers to obtain cleartext credentials when a cookie is captured via a known-plaintext attack...

CVE-2007-6192

The CVE-2007-6192 entry describes an information disclosure vulnerability in the Citrix NetScaler Web Management Interface (NetScaler 8.0 build 47.8). The issue arises from using weak encryption to protect cookie contents by XORing sensitive values (including credentials) with a fixed key stream,...

CVE-2007-6191

CVE-2007-6191 : The connected records confirm multiple PHP remote file inclusion vulnerabilities in the Armin Burger p.mapper 3.2.0 beta3. An attacker could trigger remote PHP code execution by supplying a URL in the _SESSION[PM_INCPHP] parameter that is read by incphp/globals.php or plugins/expo...

CVE-2007-6193

CVE-2007-6193 concerns the Citrix NetScaler web management interface. The OpenVAS entries and the NVD record indicate that NetScaler 8.0 build 47.8 exposes the device’s primary IP address (and, per OpenVAS, software version) via the web management cookie, enabling information disclosure. The impa...

CVE-2007-6188

TuMusika Evolution 1.7R5 is affected by multiple directory traversal flaws enabling remote attackers to include/execute arbitrary local files via ".." in language parameters (languages_n.php, languages_f.php, languages.php in inc/) and to read local files via ".." in the uri parameter to frames/n...

Buffer overflow

Buffer overflow in Lhaplus 1.55 and earlier allows remote attackers to execute arbitrary code via a crafted LZH archive, a different vector than CVE-2007-5048...

CVE-2007-6183

Format string vulnerability in the mdiaginitialize function in gtk/src/rbgtkmessagedialog.c in Ruby-GNOME 2 aka Ruby/Gnome2 0.16.0, and SVN versions before 20071127, allows context-dependent attackers to execute arbitrary code via format string specifiers in the message parameter...