CVE-2008-0872

CVE-2008-0872 affects SmarterTools SmarterMail Enterprise 4.3. The issue is a cross-site scripting (XSS) vulnerability in the webmail Subject field where the STYLE attribute can carry arbitrary HTML/Script reflected in the user’s browser. Root cause: inadequate sanitization of the Subject field b...

SmarterMail Enterprise 4.3 - malformed mail XSS

Product: SmarterMail Enterprise 4.3 Web product: http://www.smartertools.com/Products/SmarterMail/O verview.aspx web product demo: http://maildemo.smartertools.com/Login.aspx Apparently this webmail is vulnerable to an attack xss very dangerous because it runs automatically when you open the inbo...

Fedora 7 : scponly-4.6-10.fc7 (2008-1728)

Wed Feb 13 2008 Tomas Hoger - 4.6-10 - Add patch to prevent restriction bypass using OpenSSH's scp options -F and -o CVE-2007-6415, 426072 - Mon Feb 11 2008 Warren Togami - 4.6-9 - rebuild with gcc-4.3 - Tue Dec 11 2007 Toshio Kuratomi - 4.6-8 - Disable rsync support due to security concerns: RH...

Fedora 8 : scponly-4.6-10.fc8 (2008-1743)

Wed Feb 13 2008 Tomas Hoger - 4.6-10 - Add patch to prevent restriction bypass using OpenSSH's scp options -F and -o CVE-2007-6415, 426072 - Mon Feb 11 2008 Warren Togami - 4.6-9 - rebuild with gcc-4.3 - Tue Dec 11 2007 Toshio Kuratomi - 4.6-8 - Disable rsync support due to security concerns: RH...

CVE-2008-0509

Multiple buffer overflows in IBM AIX 4.3 allow remote attackers to cause a denial of service crash or possibly gain privileges via a long argument to 1 piox25, related to piox25.c; or 2 piox25remote, related to piox25remote.sh...

CVE-2008-0509

IBM AIX 4.3 contains buffer overflow vulnerabilities in the piox25 component and the piox25remote script. A long argument to either piox25 (piox25.c) or piox25remote.sh can be exploited by remote attackers to cause a denial of service (crash) or potentially gain privileges. The provided documents...

Cisco Unified Communications Manager CTL提供者堆缓冲区溢出漏洞

Cisco Unified Communications Manager（CUCM，之前被称为CallManager）是Cisco IP电话解决方案中的呼叫处理组件。 Cisco Unified Communications Manager包含的CTL Provider服务CTLProvider.exe存在设计缺陷，远程攻击者可以利用漏洞进行基于堆的缓冲区溢出攻击，可能以应用程序进程权限执行任意指令。 CTLProvider.exe服务绑定在TCP 2444端口，服务通过SSL加密传送进行操作，存在一个逻辑错误，接收到数据后进行堆分配可造成覆盖后续的堆块结构，导致任意代码执行。...

JVN#66291445 SonicStage CP buffer overflow vulnerability

Sony SonicStage CP is software for music management. SonicStage CP contains a vulnerability that can be exploited to cause a buffer overflow when importing a specially crafted playlist file with the .m3u extension. Impact Importing a specially crafted playlist file with the .m3u extension can cau...

Code injection

rmpvc on IBM AIX 4.3 allows local users to cause a denial of service system crash via long port logical name -l argument...

Remote file inclusion

PHP remote file inclusion vulnerability in data/inc/theme.php in Pluck 4.3, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter. NOTE: A reliable third party disputes this vulnerability because the applicable include is within a...

CVE-2007-4180

Directory traversal vulnerability in data/inc/theme.php in Pluck 4.3, when registerglobals is enabled, allows remote attackers to read arbitrary local files via a .. dot dot in the file parameter. NOTE: CVE and a reliable third party dispute this vulnerability because the code uses a fixed argume...

CVE-2007-4181

PHP remote file inclusion vulnerability in data/inc/theme.php in Pluck 4.3, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter. NOTE: A reliable third party disputes this vulnerability because the applicable include is within a...

CVE-2007-4180

Directory traversal vulnerability in data/inc/theme.php in Pluck 4.3, when registerglobals is enabled, allows remote attackers to read arbitrary local files via a .. dot dot in the file parameter. NOTE: CVE and a reliable third party dispute this vulnerability because the code uses a fixed argume...

CVE-2007-4180

Affects Pluck 4.3: directory traversal in data/inc/theme.php via the file parameter (..), exploitable when register_globals is enabled. The claim is that remote reading of local files is possible, but the note across sources indicates this vulnerability is disputed because the code uses a fixed a...

CVE-2007-4181

PHP remote file inclusion vulnerability in data/inc/theme.php in Pluck 4.3, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter. NOTE: A reliable third party disputes this vulnerability because the applicable include is within a...

PT-2007-5376 · Pluck · Pluck

Name of the Vulnerable Software and Affected Versions: Pluck version 4.3 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter when register globals is enabled. However, a reliable third party disputes this vulnerability, stating that the...

Immunity Canvas: MKNOBOARD_INCLUDE

Name| mknoboardinclude ---|--- CVE| CVE-2007-3813 Exploit Pack| CANVAS Description| MkNoBoard Include Notes| CVSS: 4.3 Repeatability: Infinite VENDOR: mkportal.it CVE Url: https://vulners.com/cve/CVE-2007-3813 CVE Name: CVE-2007-3813...

TrueCrypt <= 4.3 Local Privilege Escalation Exploit (CVE-2007-1738)

No description provided by source. $Id: raptortruecrypt,v 1.1.1.1 2007/04/04 11:31:56 raptor Exp $ raptortruecrypt - setuid truecrypt privilege escalation Copyright c 2007 Marco Ivaldi [email protected] TrueCrypt 4.3, when installed setuid root, allows local users to cause a denial of servic...

AIX 4.3 lsmcode local root command execution

It has been reported on http://www.securityfocus.com/bid/18114/ about this vulnerability in AIX 5.1 - 5.3, some exploits is published in milw0rm to exploits this issue http://milw0rm.com/exploits/701 I have an AIX 4.3 box and it seems vulnerable with this issue too bash-2.04$ mkdirhier /tmp/aap/b...

Design/Logic Flaw

TrueCrypt 4.3, when installed setuid root, allows local users to cause a denial of service filesystem unavailability or gain privileges by mounting a crafted TrueCrypt volume, as demonstrated using 1 /usr/bin or 2 another user's home directory, a different issue than CVE-2007-1589...