CVE-2007-5985

CVE-2007-5985: Multiple XSS vulnerabilities in BtiTracker prior to 1.4.5 allow remote attackers to inject arbitrary script/HTML via unspecified vectors to account.php, moresmiles.php, recover.php, or via the to parameter in usercp.php. The NVD entry confirms the same description, with a base scor...

CVE-2007-5987

The CVE-2007-5987 issue affects BtiTracker prior to 1.4.5. It allows remote attackers to bypass access protections via direct requests to details.php when guest torrent viewing is disabled, enabling reading torrent details and potentially modifying a torrent owned by a guest. Root cause is improp...

[Full-disclosure] iDefense Security Advisory 11.14.07: Apple Mac OS X Mach Port Inheritance Privilege Escalation Vulnerability

iDefense Security Advisory 11.14.07 http://labs.idefense.com/intelligence/vulnerabilities/ Nov 14, 2007 I. BACKGROUND Mach ports are used to provide inter-process communication IPC facilities on Mac OS X. More information can be found on the vendor's site at the following URL...

Apple QuickTime heap buffer overflow vulnerability

Overview Apple QuickTime contains a buffer overflow vulnerability. If exploited, this vulnerability may allow an attacker to execute code. Description Apple QuickTime is a media player that includes a browser plugin. Color table atoms can set a list of preferred colors for displaying movieson...

CVE-2007-5976

CVE-2007-5976 affects phpMyAdmin prior to 2.11.2.1. The vulnerability is an SQL injection in db_create.php that allows remote authenticated users with CREATE DATABASE privileges to execute arbitrary SQL commands via the db parameter. This can enable database modification or creation under the att...

CVE-2007-5978

CVE-2007-5978 describes an SQL injection in the XOOPS mylinks module, via brokenlink.php parameter lid. The vulnerability allows remote attackers to execute arbitrary SQL commands. CVSS v2.0 base score 7.5 (HIGH) with network access, low attack complexity, no authentication required, and partial ...

CVE-2007-4692

The CVE-2007-4692 issue affects Apple Safari 3 (pre-Beta Update 3.0.4) on Windows and Mac OS X 10.4–10.4.10. The vulnerability arises in the tabbed browsing feature, allowing remote attackers to spoof HTTP authentication for other sites by displaying an authentication sheet for a non-active tab, ...

CVE-2007-5975

CVE-2007-5975 affects TBSource’s index.php as used in TBDev and TorrentStrike 0.4. The vulnerability is a SQL injection in the choice parameter, exploitable by remote authenticated users to execute arbitrary SQL commands. The NVD entry lists a CVSS v2 base score of 6.5 (Medium) with network acces...

CVE-2007-5977

Cross-site scripting XSS vulnerability in dbcreate.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than...

Fedora 8 : php-pear-MDB2-2.4.1-2.fc8 / php-pear-MDB2-Driver-mysql-1.4.1-3.fc8.1 / etc (2007-3376)

This update fixes a security flaw CVE-2007-5934 with critical impact. All users of php-pear-MDB2 are strongly advised to upgrade to these updated packages. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...

Fedora 7 : php-pear-MDB2-2.4.1-2.fc7 / php-pear-MDB2-Driver-mysql-1.4.1-3.fc7 / etc (2007-3369)

This update fixes a security flaw CVE-2007-5934 with critical impact. All users of php-pear-MDB2 are strongly advised to upgrade to these updated packages. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...

openSUSE 10 Security Update : rubygem-activesupport (rubygem-activesupport-4568)

A cross site scripting XSS bug allowed attackers to execute JavaScript code in the context of other websites CVE-2007-3227. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

Fedora 7 : link-grammar-4.2.5-1.fc7 (2007-3339)

CVE-2007-5395 is fixed in this release Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

CVE-2007-5974

CVE-2007-5974 is an SQL injection vulnerability in the mailer.php component of JPortal 2, enabling remote attackers to manipulate the database via the to parameter. The NVD/NVD-derived entries confirm the affected software (JPortal 2) and the vulnerable parameter, with base severity HIGH (CVSS 2....

CVE-2007-5977

CVE-2007-5977 is an XSS vulnerability in phpMyAdmin (db_create.php) affecting versions before 2.11.2.1, where remote authenticated users with CREATE DATABASE privileges can inject script via a hex-encoded IMG in the db parameter of a POST request. Connected advisories note related issues in phpMy...

[Full-disclosure] iDefense Security Advisory 11.14.07: Apple Mac OS X AppleTalk mbuf Kernel Heap Overflow Vulnerability

iDefense Security Advisory 11.14.07 http://labs.idefense.com/intelligence/vulnerabilities/ Nov 14, 2007 I. BACKGROUND AppleTalk, a set of networking protocols developed by Apple, was originally implemented on early Mac operating systems. Although it is a legacy protocol, it is still supported on...

CVE-2007-5988

CVE-2007-5988 affects BtiTracker 1.4.4. The issue lies in blocks/shoutbox_block.php, where user accounts are not verified, enabling remote attackers to post shoutbox entries as arbitrary users by modifying the nick field. Impact: allows impersonation within the shoutbox; the documentation does no...

CVE-2007-5979

The CVE-2007-5979 entry describes a Cross-site scripting (XSS) vulnerability in F5 Firepass 4100 SSL VPN, specifically in the download_plugin.php3 component. The root cause is untrusted input in the backurl parameter, allowing remote attackers to inject arbitrary web script or HTML. Affected soft...

GLSA-200711-19 : TikiWiki: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200711-19 TikiWiki: Multiple vulnerabilities Stefan Esser reported that a previous vulnerability CVE-2007-5423, GLSA 200710-21 was not properly fixed in TikiWiki 1.9.8.1 CVE-2007-5682. The TikiWiki development team also added...

CVE-2007-3694

CVE-2007-3694 is an XSS vulnerability in Miro Project Broadcast Machine 0.9.9.9, exploitable via the login.php username parameter to inject arbitrary script/HTML. CVSS from NVD: 4.3 (Medium). Affected component: login form handling in login.php; root cause: reflected/XSS via username input. Impac...