CVE-2007-6079

CVE-2007-6079 : A directory traversal vulnerability in include/common.php of bcoos 1.0.10 allows remote attackers to include and execute arbitrary local files via .. in xoopsOption[pagetype] for the default URI of modules/news/. The issue arises from the ability to traverse directories and includ...

CVE-2007-5612

IBM Director CIM Server (IBM Director 5.20.1 and earlier) is affected by CVE-2007-5612. The vulnerability allows a remote, unauthenticated attacker to cause a denial of service through a flood of idle connections, leading to high CPU usage, exhaustion of connection slots, and potential daemon cra...

CVE-2007-5499

This CVE entry is rejected/not used and does not represent an active vulnerability.

Session fixation

The session fixation protection mechanism in cgiprocess.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookieonly attribute from the DEFAULTSESSIONOPTIONS constant, which effectively causes cookieonly to be applied only to the first instantiation of CgiRequest, which allows remote...

CVE-2007-6077

The session fixation protection mechanism in cgiprocess.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookieonly attribute from the DEFAULTSESSIONOPTIONS constant, which effectively causes cookieonly to be applied only to the first instantiation of CgiRequest, which allows remote...

[SECURITY] [DSA 1408-1] New kdegraphics packages fix arbitrary code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1408-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 21, 2007 http://www.debian.org/security/faq -...

[slackware-security] libpng for Slackware 10.1 and 10.2

New libpng packages are available for Slackware 10.1 and 10.2 that were left out of the last batch of updates. These fix the same security problems as the other 1.2.23 upgrades. More details about these issues may be found in the Common Vulnerabilities and Exposures CVE database:...

CVE-2007-6077

The CVE-2007-6077 issue affects Ruby on Rails (Rails 1.2.4) in the session handling code: the session fixation protection in cgi_process.rb removes the :cookie_only attribute from DEFAULT_SESSION_OPTIONS, causing cookie_only to apply only to the first CgiRequest instance. This enables remote atta...

[slackware-security] libpng

New libpng packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix security issues. More details about these issues may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2007-5266...

[slackware-security] mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 10.2, 11.0, 12.0, and -current to fix security issues. Slackware is not vulnerable to either of these in its default configuration, but watch out if you've enabled JavaScript. More information about the security issues may be found here...

Fixed XSS vulnerability at justme.ws

Security researcher CCC, has submitted on 21/11/2007 a cross-site-scripting XSS vulnerability affecting justme.ws, which at the time of submission ranked 2852284 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 23/11/2007. It is currently fixed...

Ability Mail Server < 2.61 Multiple Remote DoS

The remote host appears to be running Ability Mail Server. According to its banner, the installed version of Ability Mail Server is affected by two issues that could cause the application to crash. One involves messages that are changed to a blank string, the other IMAP4 commands with malformed...

alstrasoft E-Friends <= 4.98 (seid) Multiple SQL Injection Vulnerabilities

Exploit for unknown platform in category web applications ========================================================================== alstrasoft E-Friends = 4.98 seid Multiple SQL Injection Vulnerabilities ========================================================================== \ /\ \ / | \ \ | ...

Lotus Notes TagAttributeListCopy buffer overflow

Added: 11/21/2007 CVE: CVE-2007-4222 BID: 26200 OSVDB: 40949 Background Lotus Notes is the client for Lotus Domino servers. Problem A buffer overflow in the TagAttributeListCopy function in nnotes.dll could allow command execution when a user receives a specially crafted e-mail message and forwar...

CVE-2007-6063

CVE-2007-6063 is referenced in MiracleLinux AXSA-2008-150:05 as a fix for a possible isdn_net buffer overflow in the Linux kernel, specifically related to isdn_net_setcfg. The connected advisory notes the kernel vulnerability affects Miracl eLinux 3.x with kernel-2.6.18-53.11AXS3 and lists CVE-20...

Lotus Notes TagAttributeListCopy buffer overflow

Added: 11/21/2007 CVE: CVE-2007-4222 BID: 26200 OSVDB: 40949 Background Lotus Notes is the client for Lotus Domino servers. Problem A buffer overflow in the TagAttributeListCopy function in nnotes.dll could allow command execution when a user receives a specially crafted e-mail message and forwar...

CVE-2007-6062

CVE-2007-6062 affects ngIRCd prior to 0.10.3. The vulnerability is in irc-channel.c where a JOIN command without a channel argument can cause a remote crash, leading to a denial of service. Affected component: ngIRCd (irc-channel.c). Root cause: JOIN with missing channel argument described as cra...

CVE-2007-6061

CVE-2007-6061 affects Audacity 1.3.2, where Audacity creates a temporary directory with a predictable name without checking for prior existence, allowing local users to trigger a denial of service (recording deadlock) and potentially delete arbitrary files via a symlink attack. Connected advisori...

CVE-2007-6044

Multiple unspecified vulnerabilities in IBM WebSphere MQ 6.0 have unknown impact and remote attack vectors involving "memory corruption." NOTE: as of 20071116, the only disclosure is a vague pre-advisory with no actionable information. However, since it is from a well-known researcher, it is bein...

CVE-2007-6059

CVE-2007-6059 affects JavaMail/Javamail where processing a sequence of invalid logins using the same e-mail as username and password, with the domain portion triggering a Java UnknownHostException, can cause a denial of service via connection pool exhaustion and a SQLNestedException. SUSE/NVD/PT-...