Secunia Research: Symantec Backup Exec Job Engine Denial of Service

====================================================================== Secunia Research 28/11/2007 - Symantec Backup Exec Job Engine Denial of Service - ====================================================================== Table of Contents Affected...

[SECURITY] [DSA 1414-1] New wireshark packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1414-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 27, 2007 http://www.debian.org/security/faq -...

[ MDKSA-2007:232 ] - Updated kernel packages fix multiple vulnerabilities and bugs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2007:232 http://www.mandriva.com/security/ Package : kernel Date : November 28, 2007 Affected: 2008.0 Problem Description: Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel: The minix...

Mozilla Firefox及SeaMonkey Windows.Location属性HTTP Referer头欺骗漏洞

BUGTRAQ ID: 26589 CVECAN ID: CVE-2007-5960 Firefox是一款流行的开源WEB浏览器， 当由于设置了window.location属性而进行导航的时候，Referer头应反映初始化脚本的内容的地址，而实际上referer被设置成为运行脚本的窗口或帧的地址。攻击者可以使用形式上的alert对话框中止攻击脚本，在预期的引用页面替换了攻击者的初始内容之前不加载目标URI。如果将Referer设置为脚本窗口的当前URI，就可以对站点执行跨站请求伪造攻击。 Mozilla Firefox 2.0.x Mozilla SeaMonkey 1.1.7...

Mandrake Linux Security Advisory : cpio (MDKSA-2007:233)

Buffer overflow in the safernamesuffix function in GNU cpio has unspecified attack vectors and impact, resulting in a crashing stack. This problem is originally found in tar, but affects cpio too, due to similar code fragments. CVE-2007-4476 Directory traversal vulnerability in cpio 2.6 and earli...

Debian DSA-1414-1 : wireshark - several vulnerabilities

Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to denial of service or execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-6114 Stefan Esser discovered a buffer...

Unfixed XSS vulnerability at www.namedrive.com

Security researcher WHK, has submitted on 29/11/2007 a cross-site-scripting XSS vulnerability affecting www.namedrive.com, which at the time of submission ranked 6867 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 29/11/2007. It is currently...

[SECURITY] [DSA 1416-1] New tk8.3 packages fix arbitrary code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1416-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 27, 2007 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1415-1] New tk8.4 packages fix arbitrary code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1415-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 27, 2007 http://www.debian.org/security/faq -...

CVE-2007-4674

CVE-2007-4674 concerns Apple QuickTime 7.2. The vulnerability arises in parsing a movie atom with a large size value, triggering a stack-based buffer overflow in QuickTime’s parser. This allows remote code execution when a user opens a crafted movie file (or visits a malicious page). According to...

CVE-2007-6132

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2007-6138

SQL injection vulnerability in redir.asp in VU Mass Mailer allows remote attackers to execute arbitrary SQL commands via the password parameter to Default.asp aka the Login Page. NOTE: some of these details are obtained from third party information...

CVE-2007-6141

Cross-site scripting XSS vulnerability in vBTube.php in vBTube 1.1 Beta allows remote attackers to inject arbitrary web script or HTML via the search parameter...

CVE-2007-6135

Cross-site scripting XSS vulnerability in phpslideshow.php in PHPSlideShow 0.9.9.2, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the directory parameter. NOTE: this issue was originally reported for toonchapter8.php, but this is probably a site-specific...

CVE-2007-6142

Multiple cross-site scripting XSS vulnerabilities in ph03y3nk just another flat file JAF CMS 4.0 RC2 allow remote attackers to inject arbitrary web script or HTML via the 1 show parameter to index.php and the 2 print parameter to print.php. NOTE: the provenance of this information is unknown; the...

CVE-2007-6135

PHPSlideShow 0.9.9.2 contains a Cross-site Scripting (XSS) vulnerability in phpslideshow.php, exploitable via the directory parameter. The issue, originally noted for toonchapter8.php, allows remote attackers to inject arbitrary web script or HTML. The available data describe the vulnerable compo...

CVE-2007-6136

CVE-2007-6136 involves multiple XSS vulnerabilities in index.php of M2Scripts MySpace Scripts Poll Creator. The flaws allow remote attackers to inject arbitrary web script or HTML via parameters (title, intro, question, and unspecified answer parameters) in the create_new action. The affected sof...

CVE-2007-6144

A heap-based buffer overflow vulnerability exists in the PPlayer.XPPlayer.1 ActiveX control within the pplayer.dll_1_work file of Xunlei Thunder 5.7.4.401 . Remote attackers can exploit this by providing a long string in a FlvPlayerUrl property value, potentially leading to arbitrary code executi...

CVE-2007-6147

CVE-2007-6147 affects IAPR COMMENCE 1.3 and describes multiple PHP remote file inclusion vulnerabilities. The flaw allows an attacker to cause arbitrary PHP code execution by supplying a URL in the php_root_path (and sometimes privilege_root_path) parameter to various PHP scripts under admin/incl...

CVE-2007-6137

Content Injector 1.52 has a SQL injection in news.php via the cat parameter to index.php, allowing remote attackers to execute arbitrary SQL. Root cause: unsafe query construction in the affected script. Impact: confidentiality, integrity, and availability partially affected; CVSS v2 base score 7...