CVE-2007-6162

CVE-2007-6162 affects FMDeluxe 2.1.0 and is caused by an XSS vulnerability in index.php where the id parameter used by a category action can inject arbitrary script/HTML. The vulnerability allows remote attackers to execute script in the victim’s browser; exploitation details are not provided in ...

CVE-2007-6168

CVE-2007-6168 affects VU Case Manager: SQL injection in default.asp (Login Page) via the username parameter, enabling remote SQL execution. This is a different vector from CVE-2007-6143, which uses the password parameter. No remediation or exploit details are provided in the supplied documents.

CVE-2007-6169

CVE-2007-6169 concerns a SQL injection in admin/index2.asp of GOUAE DWD Realty. The vulnerable parameter is uname (distinct from CVE-2007-6163’s pword); exploitation would allow remote attackers to execute arbitrary SQL commands. The connected sources confirm a similar vulnerability in the same a...

CVE-2007-6157

The CVE-2007-6157 entry describes a Cross-site Scripting (XSS) vulnerability in SimpleGallery 0.1.3, specifically in index.php, exploitable via the album parameter. The underlying issue allows remote attackers to inject arbitrary web script or HTML. Eligible affected component: SimpleGallery 0.1....

CVE-2007-6165

CVE-2007-6165 affects Mac OS X Mail.app on Leopard (10.5.1). The vulnerability allows user-assisted remote code execution via an AppleDouble attachment whose file type appears safe but contains a script in the resource fork, without warning that a separate program will run. This is a regression r...

CVE-2007-6158

Proverbs Web Calendar 1.1 and earlier have multiple SQL injection vulnerabilities in caladmin.inc.php that allow remote attackers to execute arbitrary SQL commands via loginname (Username) and loginpass (Password) parameters to caladmin.php. Affected component is caladmin.inc.php; vulnerability d...

CVE-2007-6159

The CVE-2007-6159 entry describes an SQL injection in index.php of Tilde CMS 4.x and earlier, exploitable via the aarstal parameter in the yeardetail action. This allows remote attackers to execute arbitrary SQL commands and is noted as a vector different from CVE-2006-1500.

CVE-2007-6167

CVE-2007-6167 concerns an untrusted search path vulnerability in the SUSE Linux component yast2-core . An attacker could cause local code execution by placing a malicious yast2 module in the current working directory, taking advantage of a search path weakness. The issue impacts local users who c...

CVE-2007-6156

BASE/Base Analysis and Security Engine (BASE) before 1.3.9 contains cross-site scripting in base_qry_main.php, exploitable via sig[0] and sig[1] parameters. This affects BASE 1.3.8 and earlier releases per CVE-2007-6156. Impact: remote attackers can inject arbitrary web script/HTML. Mitigation: u...

CVE-2007-6163

CVE-2007-6163: Concrete details across connected sources show a SQL injection vulnerability in admin/index2.asp of GOUAE DWD Realty. The pword (Password) parameter is exploitable to execute arbitrary SQL commands, enabling remote attackers to interact with the database. Related entries also note ...

CVE-2007-6166

A stack-based buffer overflow exists in Apple QuickTime versions prior to 7.3.1 , affecting QuickTime Player on Windows XP and Safari on Mac OS X . The vulnerability is triggered by processing an RTSP response containing an excessively long Content-Type header , which can allow a remote Real Time...

CVE-2007-6161

This CVE (CVE-2007-6161) affects index.php in Tilde CMS 4.x and earlier, where a specific value in a search action can disclose the path of sensitive information. In the sources, the vulnerability is described as a path-disclosure issue via a search parameter, with a CVSS v2 base score of 5.0 (Me...

Unfixed XSS vulnerability at www.illegal-rap.com

Security researcher CCC, has submitted on 29/11/2007 a cross-site-scripting XSS vulnerability affecting www.illegal-rap.com, which at the time of submission ranked 7302367 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 30/11/2007. It is...

[SECURITY] [DSA 1416-1] New tk8.3 packages fix arbitrary code execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1416-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 27, 2007 http://www.debian.org/security/faq -...

Unfixed XSS vulnerability at www.namedrive.com

Security researcher WHK, has submitted on 29/11/2007 a cross-site-scripting XSS vulnerability affecting www.namedrive.com, which at the time of submission ranked 6867 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 29/11/2007. It is currently...

Unfixed XSS vulnerability at www.neagenia.gr

Security researcher St@R-gaZ3r, has submitted on 29/11/2007 a cross-site-scripting XSS vulnerability affecting www.neagenia.gr, which at the time of submission ranked 435413 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 29/11/2007. It is...

Debian DSA-1413-1 : mysql - multiple vulnerabilities

Several vulnerabilities have been found in the MySQL database packages with implications ranging from unauthorized database modifications to remotely triggered server crashes. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-2583 The indecimal::set...

Secunia Research: Symantec Backup Exec Job Engine Denial of Service

====================================================================== Secunia Research 28/11/2007 - Symantec Backup Exec Job Engine Denial of Service - ====================================================================== Table of Contents Affected...

[ MDKSA-2007:232 ] - Updated kernel packages fix multiple vulnerabilities and bugs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2007:232 http://www.mandriva.com/security/ Package : kernel Date : November 28, 2007 Affected: 2008.0 Problem Description: Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel: The minix...

Unfixed XSS vulnerability at www.abooo.net

Security researcher kusomiso.com, has submitted on 29/11/2007 a cross-site-scripting XSS vulnerability affecting www.abooo.net, which at the time of submission ranked 2440449 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 29/11/2007. It is...