CVE-2007-5392

Integer overflow in the DCTStream::reset method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a crafted PDF file, resulting in a heap-based buffer overflow...

CVE-2007-4352

The CVE-2007-4352 issue affects Xpdf (Xpdf 3.02pl1 and related components) where an array index error in DCTStream::readProgressiveDataUnit in xpdf/Stream.cc can lead to memory corruption and remote code execution via a crafted PDF. MiracleLinux AXSA:2007-64:02 lists this CVE alongside other Xpdf...

CVE-2007-5891

ManageEngine OpManager MSP Edition and OpManager 7.0 are affected by multiple XSS vulnerabilities in jsp/Login.do, exploitable via the requestid, fileid, woMode, and woID parameters. The root cause is inadequate input sanitization in the Login.do script, allowing an unauthenticated, remote attack...

CVE-2007-5392

CVE-2007-5392 is a concrete vulnerability described in the connected document: Xpdf 3.02 (with xpdf-3.02pl1.patch) has an integer overflow in DCTStream::reset that can be exploited remotely by a crafted PDF to cause a heap-based buffer overflow and arbitrary code execution. The MiracleLinux Nessu...

CVE-2007-5581

Summary: CVE-2007-5581 affects Cisco Unified MeetingPlace (mpweb/scripts/mpx.dll). The vulnerability is a cross-site scripting flaw caused by insufficient validation of the FirstName and LastName parameters, allowing remote attackers to inject script/HTML into a user’s browser session in MeetingP...

CVE-2007-5393

CVE-2007-5393 is described in connected documents as a heap-based buffer overflow in the CCITTFaxStream::lookChar method of xpdf/Stream.cc in Xpdf 3.02p11. This vulnerability can be triggered by a crafted CCITTFaxDecode filter in a PDF, allowing remote attackers to execute arbitrary code. The Mir...

CVE-2007-5889

CVE-2007-5889 describes PHP remote file inclusion vulnerabilities in IDMOS 1.0 Alpha (aka Phoenix). The affected components are the admin-facing scripts (admin.php, menu_add.php, menu_operation.php) under the administrator/ path, where a URL passed to site_absolute_path can cause arbitrary PHP co...

CVE-2007-5892

CVE-2007-5892 affects SSReader 4.0 and earlier via the pdg2.dll ActiveX control. The issue is a stack-based buffer overflow triggered by a long argument to the Register method, enabling remote code execution. Affected: SSReader 4.0 and older; root cause: unchecked/overlong input in Register into ...

CVE-2007-5893

CVE-2007-5893 affects the C++ Sockets Library (HTTPSocket.cpp) prior to version 2.2.5. A crafted HTTP request with a missing protocol version number triggers an exception, allowing remote attackers to cause a denial of service (crash). No exploitation details or patch status are provided beyond t...

CVE-2007-5890

CVE-2007-5890 describes a directory traversal vulnerability affecting easyGB 2.1.1 . The flaw is in index.php where an attacker can influence the DatabaseType parameter to cause inclusion of arbitrary files. This corresponds to a high-severity issue with a CVSS v2 base score of 10.0 (Network vect...

CVE-2007-5395

CVE-2007-5395 is a stack-based buffer overflow in the separate_word function of tokenize.c in Link Grammar 4.1b (used by AbiWord Link Grammar 4.2.4) that can be triggered by a long word through separate_sentence, enabling remote code execution. Connected advisories indicate fixes/updates: Ubuntu ...

Unfixed XSS vulnerability at www.sir.ac.ir

Security researcher br0d, has submitted on 11/08/2007 a cross-site-scripting XSS vulnerability affecting www.sir.ac.ir, which at the time of submission ranked 1070011 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/08/2007. It is currently...

DSA-1403-1 phpmyadmin - cross-site scripting

Bulletin has no description...

RHEL 3 : xpdf (RHSA-2007:1030)

Updated xpdf packages that fix several security issues are now available for Red Hat Enterprise Linux 3. This update has been rated as having important security impact by the Red Hat Security Response Team. Xpdf is an X Window System-based viewer for Portable Document Format PDF files. Alin Rad P...

RHEL 5 : pam (RHSA-2007:0555)

Updated pam packages that fix two security flaws, resolve several bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Pluggable Authentication Modules PAM provide a system...

RHEL 5 : mcstrans (RHSA-2007:0542)

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2007:0542 advisory. mcstrans is the translation daemon used on SELinux machines to translate program context into human readable form. An algorithmic complexity weakness...

RHEL 2.1 : xpdf (RHSA-2007:1031)

Updated xpdf packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having important security impact by the Red Hat Security Response Team. Xpdf is an X Window System-based viewer for Portable Document Format PDF files. Alin Rad...

RHEL 2.1 / 3 : tetex (RHSA-2007:1028)

Updated tetex packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having important security impact by the Red Hat Security Response Team. TeTeX is an implementation of TeX. TeX takes a text file and a set of formatting command...

Fedora 8 : cups-1.3.4-2.fc8 (2007-2982)

This update fixes a remote code execution vulnerability in the IPP handling part of the CUPS scheduler, as well as several PDF handling security issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempt...

Unfixed XSS vulnerability at www.youhak.com

Security researcher cyber, has submitted on 11/08/2007 a cross-site-scripting XSS vulnerability affecting www.youhak.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/08/2007. It is currently...