CVE-2007-6183

Format string vulnerability in the mdiaginitialize function in gtk/src/rbgtkmessagedialog.c in Ruby-GNOME 2 aka Ruby/Gnome2 0.16.0, and SVN versions before 20071127, allows context-dependent attackers to execute arbitrary code via format string specifiers in the message parameter...

CVE-2007-6179

CVE-2007-6179 concerns multiple PHP remote file inclusion vulnerabilities in Charray’s CMS 0.9.3. The flaw allows an attacker to execute arbitrary PHP code by supplying a URL via the ccms_library_path parameter to the files in decoder/ (markdown.php and gallery.php). The underlying issue is a rem...

CVE-2007-6175

Buffer overflow in Lhaplus 1.55 and earlier allows remote attackers to execute arbitrary code via a crafted LZH archive, a different vector than CVE-2007-5048...

CVE-2007-6174

CVE-2007-6174 affects PHPDevShell prior to 0.7.0. The vuln allows remote authenticated users to escalate privileges by sending a crafted request to update a user profile, leading to complete confidentiality, integrity, and availability impact as per CVSS metrics (base score 8.5, HIGH). Root cause...

CVE-2007-6178

CVE-2007-6178 is a known remote file inclusion in Easy Hosting Control Panel (EHCP) for Ubuntu up to version 0.22.8 and earlier. The vulnerability allows an attacker to supply a URL in the confdir parameter to config/dbutil.bck.php and config/dbutil.php, potentially enabling arbitrary PHP code ex...

CVE-2007-6182

The CVE identifies a local privilege-escalation in the ISPsystem ISPmanager (ISPmgr) component, specifically the responder program in version 4.2.15.1. The vulnerability is triggered by shell metacharacters in command line arguments, allowing a local attacker to gain privileges. The CVSS vector i...

Unfixed XSS vulnerability at software.myetoolsonline.com

Security researcher Uber0n, has submitted on 30/11/2007 a cross-site-scripting XSS vulnerability affecting software.myetoolsonline.com, which at the time of submission ranked 2664183 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/12/2007. I...

CVE-2007-6173

CVE-2007-6173 is a cross-site scripting (XSS) vulnerability affecting Liferay Enterprise Portal 4.3.1, exploitable via the emailAddress parameter in a Send New Password action (c/portal/login). The provided data states the impact as confidentiality impact: none, integrity impact: partial, availab...

CVE-2007-6185

CVE-2007-6185 describes a directory traversal vulnerability in Eurologon CMS, specifically in the users/files.php download action. The underlying issue allows remote attackers to read arbitrary files by injecting a “..” in the file parameter, with a real-world demonstration involving a PHP file c...

ftpadmin-multi.txt

FTP Admin v0.1.0 - MULTIPLE VULNERABILITIES by Omni 1 Infos --------- Date : 2007-11-28 Product : FTP Admin Version : v0.1.0 Vendor : http://sourceforge.net/projects/ftpadmin/ Vendor Status : 2007-11-30 Informed! Description : FTP admin is a web-based user administration tool, for usage in...

CVE-2007-6176

Affected product/component: K+B-Bestellsystem, kb_whois.cgi. Vulnerability: remote attackers can execute arbitrary commands via shell metacharacters in the (1) domain or (2) tld parameter of the check_owner action. Impact: complete compromise of confidentiality, integrity, and availability (CVSS ...

QuickTime RTSP Content-Type header buffer overflow

Added: 11/30/2007 CVE: CVE-2007-6166 BID: 26549 OSVDB: 40876 Background QuickTime is a media player for Windows and Mac OS platforms. Problem A buffer overflow vulnerability in QuickTime allows command execution when a user opens an RTSP stream containing a specially crafted Content-Type header...

CVE-2007-6181

CVE-2007-6181: A heap-based buffer overflow in cygwin1.dll affects Cygwin 1.5.7 and earlier. An authenticated remote attacker can exploit a long filename via SCP to trigger overwrite of heap memory in scp.exe, enabling arbitrary code execution on the Cygwin host. Related reports extend exposure t...

CVE-2007-6184

CVE-2007-6184 affects Project Alumni 1.0.9. The vulnerability arises in index.php where an attacker can use a .. in the act parameter to perform a directory traversal, allowing remote inclusion and execution of local files. The condition is an unrestricted act parameter that leads to file inclusi...

CVE-2007-6175

CVE-2007-6175 affects Lhaplus 1.55 and earlier. A buffer overflow in LZH archive handling could allow remote attackers to execute arbitrary code when decompressing a crafted LZH file. Connected documents corroborate a vulnerable Lhaplus prior to 1.55 and note this is a separate issue from CVE-200...

AST-2007-026 - SQL Injection issue in cdr_pgsql

Asterisk Project Security Advisory - AST-2007-026 +------------------------------------------------------------------------+ | Product | Asterisk | |----------------------+-------------------------------------------------| | Summary | SQL Injection issue in cdrpgsql |...

CVE-2007-6177

CVE-2007-6177 concerns a PHP remote file inclusion in Exchange/include.php of PHP_CON 1.3. The vulnerability enables an attacker to execute arbitrary PHP code by supplying a URL in the webappcfg[APPPATH] parameter. Documents consistently reference this exact vector and affected component, with no...

RHEL 3 : pcre (RHSA-2007:1063)

Updated pcre packages that resolve several security issues are now available for Red Hat Enterprise Linux 3. This update has been rated as having important security impact by the Red Hat Security Response Team. PCRE is a Perl-compatible regular expression library. Flaws were discovered in the way...

FreeBSD Security Advisory FreeBSD-SA-07:09.random

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-07:09.random Security Advisory The FreeBSD Project Topic: Random value disclosure Category: core Module: sysdevrandom Announced: 2007-11-29 Credits: Robert Woolle...

CVE-2007-6186

Technical details about CVE-2007-6186 are not publicly provided in the supplied documents; no affected products, root cause, or remediation are specified here. Monitor for updates.