CentOS 4 / 5 : thunderbird (CESA-2007:0981)

Updated thunderbird packages that fix several security bugs are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws wer...

Debian DSA-1389-2 : zoph - missing input sanitising

It was discovered that zoph, a web-based photo management system, performs insufficient input sanitising, which allows SQL injection. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-1389...

CentOS 3 / 4 / 5 : libpng (CESA-2007:0992)

Updated libpng packages that fix security issues are now available for Red Hat Enterprise Linux. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The libpng package contains a library of functions for creating and manipulating PNG Portable Netwo...

CentOS 4 / 5 : firefox (CESA-2007:0979)

Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. Several flaws were found in the way i...

CentOS 3 : openssl (CESA-2007:0813)

Updated OpenSSL packages that correct security issues are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. OpenSSL is a toolkit that implements Secure Sockets Layer SSL v2/v3 and Transport...

GLSA-200710-27 : ImageMagick: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200710-27 ImageMagick: Multiple vulnerabilities regenrecht reported multiple infinite loops in functions ReadDCMImage and ReadXCFImage CVE-2007-4985, multiple integer overflows when handling certain types of images CVE-2007-4986,...

FreeBSD : ldapscripts -- Command Line User Credentials Disclosure (3a81017a-8154-11dc-9283-0016179b2dd5)

Ganael Laplanche reports : Up to now, each ldap command was called with the -w parameter, which allows to specify the bind password on the command line. Unfortunately, this could make the password appear to anybody performing a ps during the call. This is now avoided by using the -y parameter and...

RHEL 5 : kernel (RHSA-2007:0940)

Updated kernel packages that fix various security issues in the Red Hat Enterprise Linux 5 kernel are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. These ne...

CVE-2007-5678

SQL injection vulnerability in the Music module in phpBasic allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to the default URI...

CVE-2007-5676

CVE-2007-5676 relates to a PHP remote file inclusion in PHP-Nuke Platinum 7.6.b.5, specifically in modules/Forums/favorites.php. The underlying issue allows an attacker to execute arbitrary PHP code via a URL supplied to the nuke_bb_root_path parameter, enabling remote code execution. The affecte...

CVE-2007-5675

CVE-2007-5675 affects the MultiXTpm Application Server, with the vulnerable component/function identified as the DebugPrint function. The root cause is described as a stack-based buffer overflow, allowing an attacker to supply a long string argument that could lead to remote code execution. Affec...

CVE-2007-5674

CVE-2007-5674 concerns InstaGuide Weather (aka Weather for PHP) 1.0. a directory traversal flaw in index.php allows remote attackers to include and execute arbitrary local files through a .. in the PageName parameter when magic_quotes_gpc is disabled. Affected component is the web application’s i...

CVE-2007-5678

The CVE-2007-5678 entry describes an SQL injection in the Music module of phpBasic, exploitable via the id parameter in a view action. Affected component: phpBasic Music module; vulnerability arises from unsanitized input used in SQL queries, enabling remote attackers to alter or access data. Imp...

CVE-2007-5673

CVE-2007-5673 is a confirmed cross-site scripting (XSS) vulnerability in the device’s web interface: specifically the cgi-bin/webif.exe component of the ifnet WebIf. The issue allows remote attackers to inject arbitrary web script or HTML via the cmd parameter, resulting in likely client-side scr...

CVE-2007-5677

CVE-2007-5677 describes a cross-site scripting (XSS) vulnerability in the Hackish BETA 1.1 software, specifically in the shoutbox/blocco.php component. The issue allows remote attackers to inject arbitrary web script or HTML by supplying a crafted value to the go_shout parameter. The vulnerabilit...

php security update

CentOS Errata and Security Advisory CESA-2007:0888-01 Updated PHP packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1 This update has been rated as having moderate security impact by the Red Hat Security Response Team. PHP is an embedded-HTML scripting...

CVE-2007-5336

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2007-5339. Reason: This candidate is a reservation duplicate of CVE-2007-5339. Notes: All CVE users should reference CVE-2007-5339 instead of this candidate. All references and descriptions in this candidate have been removed to...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2007-5339. Reason: This candidate is a reservation duplicate of CVE-2007-5339. Notes: All CVE users should reference CVE-2007-5339 instead of this candidate. All references and descriptions in this candidate have been removed to...

CVE-2007-5336

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2007-5339. Reason: This candidate is a reservation duplicate of CVE-2007-5339. Notes: All CVE users should reference CVE-2007-5339 instead of this candidate. All references and descriptions in this candidate have been removed to...

CVE-2007-5336

...