[Full-disclosure] Miranda IM Multiple Buffer Overflow Vulnerabilities

Miranda IM Multiple Buffer Overflow Vulnerabilities Summary Multiple buffer overflow vulnerabilities exist in Miranda IM, a popular open source instant messaging client. Scope These vulnerabilities have been verified in the following Miranda IM versions: 0.6.8 0.7.0 Note: one vulnerability in...

CVE-2007-5336

CVE-2007-5336 is rejected/not used; reference CVE-2007-5339 instead.

iDefense Security Advisory 10.23.07: IBM Lotus Notes Client TagAttributeListCopy Buffer Overflow Vulnerability

IBM Lotus Notes Client TagAttributeListCopy Buffer Overflow Vulnerability iDefense Security Advisory 10.23.07 http://labs.idefense.com/intelligence/vulnerabilities/ Oct 23, 2007 I. BACKGROUND IBM Corp.'s Lotus Notes software is an integrated desktop client option for accessing e-mail, calendars a...

Microsoft Visual Studio PDWizard.ocx ActiveX Control Code Execution (CVE-2007-4891)

Microsoft Visual Studio is a software development product for computer programmers. It centers on an integrated development environment which lets programmers create standalone applications, web sites, web applications, and web services.The vulnerability is due to an error in the Microsoft Visual...

Unfixed XSS vulnerability at www.calarkendinlet.turkcell.com.tr

Security researcher BackDoor, has submitted on 24/10/2007 a cross-site-scripting XSS vulnerability affecting www.calarkendinlet.turkcell.com.tr, which at the time of submission ranked 5158 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on...

openSUSE 10 Security Update : opera (opera-4575)

This version update of Opera to 9.24 fixes numerous defects including some security problems. CVE-2007-5540,CVE-2007-5541 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update opera-4575. The text...

openSUSE 10 Security Update : libopenssl-devel (libopenssl-devel-4560)

A buffer overflow in the DTLS implementation of openssl could be exploited by attackers to potentially execute arbitrary code CVE-2007-4995. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

HPSBMA02279 SSRT071298 rev.1 - HP OpenView Configuration Management (CM) Infrastructure (Radia) and Client Configuration Manager (CCM) Running httpd.tkd, Remote Unauthorized Access to Data

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01205079 Version: 1 HPSBMA02279 SSRT071298 rev.1 - HP OpenView Configuration Management CM Infrastructure Radia and Client Configuration Manager CCM Running httpd.tkd,...

CVE-2007-5335

CVE-2007-5335 affects Mozilla Firefox 2.0 prior to 2.0.0.8. According to the description, a remote attacker could obtain sensitive information by abusing the addMicrosummaryGenerator sidebar method to access file: URIs. The CVSS base score is 4.3 (Medium) with network access and no authentication...

Unfixed XSS vulnerability at turkcell-imbenim.turkcell.com.tr

Security researcher BackDoor, has submitted on 24/10/2007 a cross-site-scripting XSS vulnerability affecting turkcell-imbenim.turkcell.com.tr, which at the time of submission ranked 5158 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/11/200...

openSUSE 10 Security Update : MozillaFirefox (MozillaFirefox-4574)

This update brings Mozilla Firefox to security update version 2.0.0.8 Following security problems were fixed : - MFSA 2007-26 / CVE-2007-3844: Privilege escalation through chrome-loaded about:blank windows Mozilla researcher mozbugra4 reported that a flaw was introduced by the fix for MFSA 2007-2...

openSUSE 10 Security Update : opal (opal-4531)

A bug in the SIP protocol handler could be exploited by attackers to crash applications using opal CVE-2007-4924. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update opal-4531. The text descriptio...

openSUSE 10 Security Update : flac (flac-4571)

Multiple integer overflows in flac could potentially be exploited by attackers via specially crafted files to execute code in the context of the user opening the file CVE-2007-4619. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

openssl security update

CentOS Errata and Security Advisory CESA-2007:0813-01 Updated OpenSSL packages that correct security issues are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. OpenSSL is a toolkit that...

CVE-2007-5649

Cross-site scripting XSS vulnerability in lostpwd.php in Creative Digital Resources SocketMail 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the lostid parameter...

Immunity Canvas: PHPPM_INCLUDE

Name| phppminclude ---|--- CVE| CVE-2007-5641 Exploit Pack| CANVAS Description| PHP Project Management = 0.8.10 remote file include Notes| CVSS: 6.8 Repeatability: Infinite VENDOR: php-pm CVE Url: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5641 CVE Name: CVE-2007-5641...

CVE-2007-5651

The CVE-2007-5651 entry affects Cisco EAP implementations: Cisco IOS 12.3/12.4 on Access Points and 1310 Wireless Bridges, IOS 12.1/12.2 on switches, and CatOS 6.x–8.x on Cisco switches. The vulnerability allows remote attackers to cause a denial of service (device reload) by sending a crafted EA...

CVE-2007-5641

CVE-2007-5641 affects PHP Project Management 0.8.10 and earlier. The vulnerability is a remote file inclusion (RFI) weakness allowing an attacker to supply a URL in the full_path parameter to multiple modules (e.g., certinfo, emails, events, files, projects, etc.) to execute arbitrary PHP code on...

CVE-2007-5652

CVE-2007-5652 affects IBM DB2 UDB 9.1 before Fixpak 4. The issue concerns improper management of storage of a list containing authentication information, which could allow a denial of service (instance crash) or memory corruption. The vendor description notes uncertainty about whether this is sec...

CVE-2007-5646

SMF SQL injection (CVE-2007-5646) affects Simple Machines Forum (SMF) 1.1.3. The flaw is in Sources/Search.php where the vulnerable userspec parameter used in the search2 action to index.php is not sanitized, enabling arbitrary SQL execution when using MySQL 5.x. An unauthenticated or authenticat...