CVE-2007-6089

CVE-2007-6089 affects meBiblio 0.4.5. The vulnerability is a PHP remote file inclusion in index.php, allowing an attacker to execute arbitrary PHP code via the action parameter. Root cause appears to be unsafe handling of a user-supplied URL in a file-inclusion operation. Affected component: inde...

CVE-2007-6097

Affected products: Ingate Firewall (before 4.6.0) and SIParator (before 4.6.0). The vulnerability lies in their ICMP implementation, with the issue described as ICMP packets being “incorrectly accepted.” The impact is not explicitly quantified in the provided documents, but the CVE notes unknown ...

CVE-2007-6085

CVE-2007-6085 relates to multiple cross-site scripting (XSS) flaws in VigileCMS 1.4 affecting index.php, where an attacker can inject arbitrary script/HTML through the message field in the vedipm or live_chat modules. Impact is described as partial integrity impact with no confidentiality or avai...

CVE-2007-6087

CVE-2007-6087 is a CSRF vulnerability in VigileCMS 1.4. The index.php changepass module accepts certain parameters that allow remote attackers to change the admin password. Affected component is the VigileCMS 1.4 web application; underlying issue is cross-site request forgery enabling unauthorize...

CVE-2007-6085

Multiple cross-site scripting XSS vulnerabilities in index.php in VigileCMS 1.4 allow remote attackers to inject arbitrary web script or HTML via the message field in the 1 vedipm or 2 livechat module...

CVE-2007-6091

CVE-2007-6091 relates to multiple SQL injection vulnerabilities in JiRo’s Banner System (JBS) 2.0, and possibly JiRo’s Upload Manager (JUS). The flaws reside in the login routine (files/login.asp), where the attacker can inject via the (1) Username (Login/Email) or (2) Password fields to execute ...

CVE-2007-6088

The CVE affects phpBBViet versions 02.03.07 and earlier, with a PHP remote file inclusion in includes/functions_mod_user.php. The underlying issue is that an attacker can supply a URL to the phpbb_root_path parameter, enabling remote arbitrary PHP code execution. The impact is labeled as complete...

BitDefender在线扫描器OScan.OCX ActiveX控件堆溢出漏洞

BUGTRAQ ID: 26210 CVECAN ID: CVE-2007-5775 BitDefender Online Scanner是一款免费的在线杀毒软件。 BitDefender在线扫描器所捆绑的OScan.ocx控件中存在远程代码执行漏洞，远程攻击者可能利用此漏洞在用户系统上执行任意指令。 OScan.ocx的有漏洞函数为InitX，该函数取得了bstrLocation的字符串参数值用于确认调用域。InitX的IDL类似于以下： Function InitX ByVal bstrLocation as String As Boolean...

Unfixed XSS vulnerability at fedho.com

Security researcher Uber0n, has submitted on 22/11/2007 a cross-site-scripting XSS vulnerability affecting fedho.com, which at the time of submission ranked 250260 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 29/11/2007. It is currently...

Unfixed XSS vulnerability at www.levhayaar.co.il

Security researcher CCC, has submitted on 22/11/2007 a cross-site-scripting XSS vulnerability affecting www.levhayaar.co.il, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 23/11/2007. It is currently...

CVE-2007-6096

Ingate Firewall before 4.6.0 and SIParator before 4.6.0 store passwords for “administrators with less privileges” in cleartext, enabling possible reading by an attacker via unspecified vectors. Affected components are the password storage mechanism; root cause indicated as cleartext storage. No e...

CVE-2007-6099

Technical details (affected products, versions, root cause, and remediation) are not publicly provided in the connected documents. Monitor for updates from Red Hat, NVD, and vendors for concrete exposure, fixes, and mitigations.

CVE-2007-6086

CVE-2007-6086 is a directory-traversal vulnerability in VigileCMS 1.4. The issue occurs in index.php where directory traversal sequences in the module parameter allow remote attackers to include and execute arbitrary local files. This leads to arbitrary code execution and partial/complete comprom...

CVE-2007-6093

CVE-2007-6093 affects Ingate Firewall and SIParator prior to 4.6.0; the SRTP implementation can be coerced into a kernel crash (DoS) by an RTCP index that is ‘much more than expected.’ Upgrading to version 4.6.0 or later is the stated mitigation.

CVE-2007-6095

The CVE-2007-6095 entry applies to the SIP component in Ingate Firewall before 4.6.0 and SIParator before 4.6.0. When Remote NAT Traversal is used, the system does not correctly perform user registration and message distribution, which may allow remote authenticated users to receive messages inte...

CVE-2007-6092

CVE-2007-6092 affects Ingate Firewall prior to 4.6.0 and SIParator prior to 4.6.0 via a buffer overflow in libsrtp. The available descriptions state unknown impact and attack vectors, with uncertainty about privilege boundaries. No remediation or mitigation details are provided in the connected d...

CVE-2007-6081

AdventNet EventLog Analyzer (Windows, build 4030, and possibly other versions) ships a MySQL instance with a default root/passwordless account, enabling remote attackers to gain privileges and modify logs. The vulnerability is fixed in EventLog Analyzer Build 6000. Affected component: bundled MyS...

CVE-2007-5499

...

CVE-2007-6078

SkyPortal RC6 contains multiple SQL injection vulnerabilities that could allow a remote, unauthenticated attacker to gain access to the back-end database and add, modify, or remove data by exploiting vulnerable endpoints such as nc_top.asp, inc_bookmarks.asp, inc_profile_functions.asp, inc_SUBSCR...

CVE-2007-6080

CVE-2007-6080 : SQL injection in the banners module of bcoos, via bid parameter in modules/banners/click.php. Affected versions include 1.0.10 and 1.0.13; remote attackers could execute arbitrary SQL commands. Root cause identified as improper handling of input in the banners/click.php script. No...