CVE-2007-5956

CVE-2007-5956 concerns IBM Informix Dynamic Server (IDS) prior to 10.00.xC7W1. The vulnerability arises from directory traversal using modified NLS message files via the DBLANG environment variable, enabling local users to gain privileges. The description specifies a local-execution/privilege-esc...

CVE-2007-5955

CVE-2007-5955 describes a cross-site scripting (XSS) vulnerability in UPDIR.NET’s updir.php prior to version 2.04, affecting the full‑text search and file upload functions. The JVN entry notes that updir.php allows uploading and publishing files and that an attacker could execute arbitrary script...

CVE-2007-5944

Cross-site scripting XSS vulnerability in Servlet Engine / Web Container in IBM WebSphere Application Server WAS 5.1.1.4 through 5.1.1.16 allows remote attackers to inject arbitrary web script or HTML via the Expect HTTP header. NOTE: this might be the same issue as CVE-2006-3918, but there are...

CVE-2007-3880

CVE-2007-3880 is a format-string vulnerability in the srsexec binary of Sun Remote Services Net Connect (SUNWsrspx), affecting Solaris 8/9/10 via NetConnect 3.2.3/3.2.4. An attacker with local access to a set-UID root srsexec can trigger syslog handling of crafted input containing format specifie...

CVE-2007-5941

The CVE-2007-5941 issue is a stack-based buffer overflow in the SWCtl.SWCtl ActiveX control of Adobe Shockwave. The vulnerability allows remote attackers to cause a denial of service and potentially execute arbitrary code via a long argument to the ShockwaveVersion method. Connected documents con...

CVE-2007-5945

CVE-2007-5945 affects USVN prior to 0.6.5. The vulnerability allows remote attackers to obtain a list of repository contents via unspecified vectors, impacting confidentiality (partial). The available documents do not specify root cause details or a remediation/fix. Exploit specifics, affected co...

CVE-2007-5667

CVE-2007-5667 affects the Novell NetWare Client for Windows, where the nwfilter.sys driver is loaded at startup and exposes the local-device .wfilter via METHOD_NEITHER IOCTLs. The vulnerability allows an unprivileged local user to pass kernel addresses as arguments and overwrite kernel memory, e...

CVE-2007-5947

The CVE-2007-5947 issue affects Mozilla Firefox up to 2.0.0.10 and SeaMonkey up to 1.1.7, where the jar protocol handler retrieves the inner URL regardless of MIME type and treats HTML documents inside a jar as same-origin with the inner URL. This enables cross-site scripting (XSS) via jar: URIs....

CVE-2007-5948

SF-Shoutbox 1.2.1 through 1.4 contains multiple XSS vulnerabilities in main.php that allow remote attackers to inject arbitrary script or HTML via the nick (Name) and shout (Shout) parameters. Affected component: SF-Shoutbox main.php; vulnerable versions: 1.2.1–1.4. The root cause is improper san...

CVE-2007-3898

The CVE-2007-3898 issue affects the DNS server in Microsoft Windows 2000 Server SP4 and Windows Server 2003 SP1/SP2. The underlying problem is the use of predictable DNS transaction IDs when the server queries other DNS servers, which enables remote spoofing of DNS replies and can lead to DNS cac...

CVE-2007-5951

CVE-2007-5951 describes an SQL injection vulnerability in the PHP script articles.php of the E-Vendejo 0.2 application, exploitable via the id parameter. The issue affects the script used to retrieve articles and allows remote attackers to execute arbitrary SQL commands. The CVSS v2 metrics repor...

CVE-2007-5755

CVE-2007-5755 : Multiple stack-based buffer overflows in AOL Radio’s AmpX ActiveX control (AmpX.dll 2.6.1.11) allow remote attackers to execute arbitrary code via long arguments to unspecified methods. Root cause: boundary/size handling with unsafe strcpy() copying attacker-supplied data into fix...

CVE-2007-5946

The CVE-2007-5946 entry concerns the Aries PA-RISC PA Emulator on HP-UX IA-64 (B.11.23/11.31). It indicates a local unauthorized access vulnerability in the Aries PA Emulator. HP patches PHSS_35528 (for 11.23) and PHSS_36311 (for 11.31) address this issue, with corresponding OpenVAS/Nessus refere...

CVE-2007-5952

The vulnerability CVE-2007-5952 targets Helios Calendar 1.2.1 Beta, affecting the admin/index.php component. It is a Cross-site Scripting (XSS) flaw that allows an attacker to inject arbitrary script or HTML through the username parameter. The root cause is unvalidated input in the username field...

CVE-2007-5954

CVE-2007-5954 describes a cross-site scripting (XSS) in JLMForo System via the buscador.php script, exploitable through the clave parameter. The vulnerability allows remote attackers to inject arbitrary web script or HTML. Affected component: buscador.php ; root cause: unsafe handling of user inp...

CVE-2007-5770

Concrete details found: CVE-2007-5162 and CVE-2007-5770 affect Ruby 1.8.5/1.8.6. The MiracleLinux AXSA-2007-63:01 advisory states that the CN field in a server certificate is not verified against the domain in the request for (1) Net::HTTP/Net::HTTPS and (2) multiple Net modules (ftptls, telnets,...

CVE-2007-5756

CVE-2007-5756 : A local privilege-escalation flaw in WinPcap’s NPF.SYS driver (bpf_filter_init) arises from multiple array-indexing errors when handling IOCTLs, allowing crafted IOCTL requests to gain kernel-mode privileges. Affected: WinPcap up to version 4.0.1 (and variants used by Wireshark). ...

CVE-2007-5944

Technical details about CVE-2007-5944 are not publicly available in the provided connected documents; no affected products, versions, vectors, or fixes are specified here. Monitor for updates.

CVE-2007-5950

NetCommons has a cross-site scripting (XSS) vulnerability tracked as CVE-2007-5950 affecting NetCommons before 1.0.11 and 1.1.x before 1.1.2. The vulnerability allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The exact root cause and vectors are not detailed...

CVE-2007-5948

Multiple cross-site scripting XSS vulnerabilities in main.php in SF-Shoutbox 1.2.1 through 1.4 allow remote attackers to inject arbitrary web script or HTML via the 1 nick aka Name and 2 shout aka Shout parameters...