Moderate: util-linux security update

2.11y-31.24 - fix 324431 - CVE-2007-5191 util-linux mount doesn't drop privileges properly when calling helpers...

DEBIAN-CVE-2007-6010

Unspecified vulnerability in pioneers formerly gnocatan 0.11.3 allows remote attackers to cause a denial of service daemon crash via unspecified vectors that trigger an assert error. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-5933...

CVE-2007-6010

CVE-2007-6010 affects pioneers (formerly gnocatan) 0.11.3. The vulnerability allows remote denial of service (daemon crash) via unspecified vectors that trigger an assert error. The issue is reportedly related to an incomplete fix for CVE-2007-5933. Connected sources (NVD, OSV, Debian, Gentoo GLS...

CVE-2007-5994

PHP remote file inclusion vulnerability in checknoimage.php in Fritz Berger yet another php photo album - next generation yappa-ng 2.3.2 allows remote attackers to execute arbitrary PHP code via a URL in the configpathsrcinclude parameter...

CVE-2007-6001

Multiple cross-site scripting XSS vulnerabilities in index.php in Bandersnatch 0.4 allow remote attackers to inject arbitrary web script or HTML via the 1 func or 2 date parameter, or the jid parameter in a 3 log or 4 user action, a different vulnerability than CVE-2007-3910...

Sql injection

SQL injection vulnerability in searchresult.php in Softbiz Link Directory Script allows remote attackers to execute arbitrary SQL commands via the sbcatid parameter, a related issue to CVE-2007-5449...

CVE-2007-5996

CVE-2007-5996 describes an SQL injection vulnerability in the Softbiz Link Directory Script. The vulnerable component is the searchresult.php script, where user-provided sbcat_id can be exploited to execute arbitrary SQL commands. This CVE is related to CVE-2007-5449 (Softbiz Recipes Portal Scrip...

CVE-2007-5991

CVE-2007-5991 affects ExoPHPdesk: SQL injection in index.php via the user parameter in the profile fn action, enabling remote execution of arbitrary SQL commands. Documented in NVD with a base score of 7.5 (HIGH); attack vector is network and no authentication required. Connected sources also ref...

CVE-2007-6006

TestLink before 1.7.1 does not enforce an unspecified authorization mechanism, which has unknown impact and attack vectors...

CVE-2007-6007

The CVE-2007-6007 entry describes an integer overflow in the ID_PSP.apl plug-in used by ACDSee Photo Manager 9.0 (build 108), Pro Photo Manager 8.1 (build 99), and Photo Editor 4.0 (build 195). The overflow triggers a heap-based buffer overflow via a crafted PSP image, enabling user-assisted remo...

CVE-2007-4344

CVE-2007-4344 involves heap-based buffer overflows in ACDSee products: PSP images processed by ID_PSP.apl and LHA archives by AM_LHA.apl, leading to remote code execution with user-assisted input. Affects ACDSee Photo Manager 9.0 build 108, Pro Photo Manager 8.1 build 99, and Photo Editor 4.0 bui...

CVE-2007-6009

CVE-2007-6009 is a buffer-overflow vulnerability in ACDSee plug-ins used to process XPM files. Connected sources confirm a boundary/section-string overflow in ID_X.apl, IDE_ACDStd.apl, ID_PSP.apl, and AM_LHA.apl that could allow remote code execution when a user opens a crafted XPM file, with suc...

CVE-2007-6001

CVE-2007-6001 concerns Bandersnatch 0.4. The connected documents confirm multiple cross-site scripting (XSS) vulnerabilities in index.php, exploitable via parameters (func, date, jid) in actions (log, user). Root cause is improper handling of user-supplied input leading to script/HTML injection. ...

CVE-2007-6000

CVE-2007-6000 affects KDE Konqueror up to version 3.5.6, allowing remote attackers to trigger a denial of service (crash) by sending large HTTP cookie parameters. Affected software: Konqueror (KDE desktop) prior to 3.5.7(?) with reliance on cookie handling. Root cause details are not extensively ...

CVE-2007-6002

CVE-2007-6002 describes a cross-site scripting (XSS) vulnerability in Fenriru Sleipnir (≤ 2.5.17 R2) and Grani (≤ 3.0). The flaw allows remote attackers to inject arbitrary web script or HTML via the Search field when performing a search for additions to the Favorites section. The connected docum...

CVE-2007-5992

The CVE-2007-5992 case concerns SQL injection in the datecomm Social Networking Script (aka Myspace Clone Script). Affected code path is index.php via the seid parameter in a viewcat action on the forums page, enabling remote attackers to execute arbitrary SQL commands. The vulnerability is descr...

CVE-2007-6003

CVE-2007-6003 affects the Thomson SpeedTouch 716 router with firmware 5.4.0.14, where a cross-site scripting (XSS) vulnerability exists in the CGI endpoint cgi/b/ic/connect. The underlying issue allows remote attackers to inject arbitrary web script or HTML via the url parameter. The NVD entry li...

CVE-2007-5994

CVE-2007-5994 describes a PHP remote file inclusion in Fritz Berger’s yet another php photo album - next generation (yappa-ng) 2.3.2. The flaw occurs in check_noimage.php when an attacker supplies a URL in the config[path_src_include] parameter, allowing arbitrary PHP code execution on the affect...

CVE-2007-6004

Multiple SQL injection vulnerabilities in index.php in Toko Instan 7.6 allow remote attackers to execute arbitrary SQL commands via 1 the id parameter in an artikel action or 2 the katid parameter in a produk action...

CVE-2007-5990

CVE-2007-5990 is a Cross-site scripting (XSS) vulnerability in ExoPHPdesk. The issue is in register.php where unspecified vectors in a user profile may allow injection of arbitrary web script or HTML, potentially via the (1) name and (2) website fields. Metrics from NVD indicate no confidentialit...