CVE-2008-0604: Undefined Security Weakness

The LDAP authentication feature in XLight FTP Server before 2.83, when used with some unspecified LDAP servers, does not check for blank passwords, which allows remote attackers to bypass intended access restrictions...

GE Fanuc CIMPLICITY HMI heap buffer overflow

Overview GE Fanuc CIMPLICITY HMI contains a remotely accessible heap buffer overflow vulnerability which may allow a remote attacker to execute arbitrary code. Description GE Fanuc CIMPLICITY HMI is software used for monitoring and control in Supervisory Control And Data Acquisition SCADA systems...

GE Fanuc Proficy Information Portal transmits authentication credentials in plain text

Overview GE Fanuc Proficy Information Portal can transmit authentication credentials in plain text. An attacker could monitor traffic, obtain valid credentials, and gain access to the portal. Description GE Fanuc Proficy Information Portal is a web-based systems reporting tool often used to...

GE Fanuc Proficy Information Portal allows arbitrary file upload and execution

Overview GE Fanuc Proficy Information Portal allows authenticated users to upload arbitrary files. An attacker could upload an executable server-side script e.g., an .asp shell on a Microsoft Internet Information Server platform and execute arbitrary commands with the privileges of the web server...

CVE-2008-0402: Undefined Security Weakness

Unspecified vulnerability in IBM WebSphere Business Modeler Basic and Advanced 6.0.2.1 before Interim Fix 11 allows remote authenticated users to bypass intended access restrictions and delete unspecified repository resources via unknown vectors, even when they are not administrators or members o...

Code injection

LulieBlog 1.0.1 and 1.0.2 does not restrict access to 1 articlesuppr.php, 2 commentaccepter.php, and 3 commentrefuser.php in Admin/, which allows remote attackers to accept comments, delete comments, and delete articles via the id parameter...

CVE-2008-0329

LulieBlog 1.0.1 and 1.0.2 does not restrict access to 1 articlesuppr.php, 2 commentaccepter.php, and 3 commentrefuser.php in Admin/, which allows remote attackers to accept comments, delete comments, and delete articles via the id parameter...

IBM Director fails to properly time-out connection requests from clients

Overview IBM Director Systems, specifically CIM Server, contains a denial-of-service vulnerability that can allow a remote, unauthenticated attacker to render Director inoperative. Description IBM Director is a suite of system management tools.When a rogue connection request is made to IBM Direct...

CVE-2007-4703: Undefined Security Weakness

The Application Firewall in Apple Mac OS X 10.5 does not prevent a root process from accepting incoming connections, even when "Block incoming connections" has been set for its associated executable, which might allow remote attackers or local root processes to bypass intended access restrictions...

CVE-2007-4702: Undefined Security Weakness

The Application Firewall in Apple Mac OS X 10.5, when "Block all incoming connections" is enabled, does not prevent root processes or mDNSResponder from accepting connections, which might allow remote attackers or local root processes to bypass intended access restrictions...

CVE-2007-4704: Undefined Security Weakness

The Application Firewall in Apple Mac OS X 10.5 does not apply changed settings to processes that are started by launchd until the processes are restarted, which might allow attackers to bypass intended access restrictions...

CVE-2007-4699: Undefined Security Weakness

The default configuration of Safari in Apple Mac OS X 10.4 through 10.4.10 adds a private key to the keychain with permissions that allow other applications to access the key without warning the user, which might allow other applications to bypass intended access restrictions...

CVE-2007-5597

CVE-2007-5597 affects Drupal core: hook_comments in Drupal 4.7.x (before 4.7.8) and 5.x (before 5.3) does not pass the publication status of comments. This can allow attackers to bypass access restrictions and cause modules (e.g., Organic groups, Subscriptions) to mail or process unpublished comm...

Design/Logic Flaw

The "Protect Worksheet" functionality in Mathsoft Mathcad 12 through 13.1, and PTC Mathcad 14, implements file access restrictions via a protection element in a gzipped XML file, which allows attackers to bypass these restrictions by removing this element...

openSUSE 10 Security Update : java-1_5_0-sun (java-1_5_0-sun-4527)

The Sun JAVA JDK 1.5.0 was upgraded to release 13 to fix various bugs, including the following security bugs : http://sunsolve.sun.com/search/document.do?assetkey=1-26-103 079-1 CVE-2007-5232: Sun Java Runtime Environment JRE in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and...

CVE-2007-4600: Undefined Security Weakness

The "Protect Worksheet" functionality in Mathsoft Mathcad 12 through 13.1, and PTC Mathcad 14, implements file access restrictions via a protection element in a gzipped XML file, which allows attackers to bypass these restrictions by removing this element...

Cisco IOS LPD buffer overflow vulnerability

Overview The Cisco IOS Line Printer Daemon contains a buffer overflow vulnerability. If successfully exploited, this vulnerability may allow an attacker to execute arbitrary code or create a denial-of-service condition . Description The Cisco IOS includes support for the UNIX Line Printer Daemon...

Design/Logic Flaw

Java Web Start in Sun JDK and JRE 5.0 Update 12 and earlier, and SDK and JRE 1.4.215 and earlier, on Windows does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to read local files via an untrusted application...

CVE-2007-5236

Java Web Start in Sun JDK and JRE 5.0 Update 12 and earlier, and SDK and JRE 1.4.215 and earlier, on Windows does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to read local files via an untrusted application...

CVE-2007-5236

Java Web Start in Sun JDK and JRE 5.0 Update 12 and earlier, and SDK and JRE 1.4.215 and earlier, on Windows does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to read local files via an untrusted application...