CVE-2007-4040

Argument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in an unspecified URI, which are inserted into the command...

CVE-2007-4040

The software Microsoft Outlook and Outlook Express is susceptible to an argument injection vulnerability. When specific URIs are registered, a remote attacker can conduct cross-browser scripting attacks and execute arbitrary commands . This occurs because shell metacharacters in an unspecified UR...

CVE-2007-4040: Improper Neutralization of Input During Web Page Generation

Argument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in an unspecified URI, which are inserted into the command...

Sql injection

Unspecified vulnerability in Oracle Application Express formerly Oracle HTML DB 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have an unknown impact via unknown attack vectors, aka APEX01. NOTE: a reliable researcher states that this is SQL injection in the wwvflowsecurity.checkdbpassword...

CVE-2007-3860

Unspecified vulnerability in Oracle Application Express formerly Oracle HTML DB 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have an unknown impact via unknown attack vectors, aka APEX01. NOTE: a reliable researcher states that this is SQL injection in the wwvflowsecurity.checkdbpassword...

CVE-2007-3860

Unspecified vulnerability in Oracle Application Express formerly Oracle HTML DB 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have an unknown impact via unknown attack vectors, aka APEX01. NOTE: a reliable researcher states that this is SQL injection in the wwvflowsecurity.checkdbpassword...

CVE-2007-3860

CVE-2007-3860 affects Oracle Application Express (APEX) versions 2.2.0.00.32 through 3.0.0.00.20. The vulnerability is described as an SQL injection in wwv_flow_security.check_db_password due to insufficient checks for the '"' character. The connected sources indicate this is a SQL injection vuln...

CVE-2007-3860: Undefined Security Weakness

Unspecified vulnerability in Oracle Application Express formerly Oracle HTML DB 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have an unknown impact via unknown attack vectors, aka APEX01. NOTE: a reliable researcher states that this is SQL injection in the wwvflowsecurity.checkdbpassword...

Microsoft Windows Active Directory LDAP Request Validation Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability because Microsoft Active Directory fails to handle specially crafted user-supplied Lightweight Directory Access Protocol LDAP requests. An attacker can exploit this issue to execute arbitrary code with SYSTEM-level...

Microsoft .NET Framework PE Loader Remote Buffer Overflow Vulnerability

Description Microsoft .NET Framework is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. An attacker can exploit this issue to execute arbitrary code in the context of a user running the application. Successful exploits ca...

Microsoft .NET Framework JIT Compiler Remote Buffer Overflow Vulnerability

Description Microsoft .NET Framework is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. An attacker can exploit this issue to execute arbitrary code in the context of a user running the application. Successful exploits ca...

Microsoft Windows Active Directory LDAP Request Validation Remote Denial Of Service Vulnerability

Description Microsoft Windows is prone to a remote denial-of-service vulnerability because Microsoft Active Directory fails to handle specially crafted Lightweight Directory Access Protocol LDAP requests. An attacker can exploit this issue to cause the affected application to stop responding,...

Sql injection

Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the cid parameter to 1 login.php, 2 auth.php, and 3 subscribe.php. NOTE: the month.php, year.php, week.php, and day.php vectors are already covered by CVE-2005-4009...

CVE-2007-3627

Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the cid parameter to 1 login.php, 2 auth.php, and 3 subscribe.php. NOTE: the month.php, year.php, week.php, and day.php vectors are already covered by CVE-2005-4009...

CVE-2007-3627

Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the cid parameter to 1 login.php, 2 auth.php, and 3 subscribe.php. NOTE: the month.php, year.php, week.php, and day.php vectors are already covered by CVE-2005-4009...

CVE-2007-3627

CVE-2007-3627 concerns PHP Lite Calendar Express 2.2 with multiple SQL injection flaws exploitable via the cid parameter in login.php, auth.php, and subscribe.php. The vulnerability allows remote attackers to inject arbitrary SQL commands. The note states that month.php, year.php, week.php, and d...

CVE-2007-3627: Undefined Security Weakness

Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the cid parameter to 1 login.php, 2 auth.php, and 3 subscribe.php. NOTE: the month.php, year.php, week.php, and day.php vectors are already covered by CVE-2005-4009...

Microsoft Outlook Express / Windows Mail multiple security vulnerabilities

Multiple vulnerabilities on MHTML parsing. Code execution with UNC URLs...

JVN#27203006 Internet Explorer vulnerable in MHTML handling

When Internet Explorer accesses a website with the MHTML protocol, Internet Explorer processes the contents as MHTML data, ignoring their actual content types. This behavior may result in executing the scripts embedded in the contents. The MHTML protocol handler is included in the Outlook Express...

JVN#95019167 Internet Explorer vulnerable in handling MHTML protocol

When Internet Explorer accesses a website using MHTML MIME Encapsulation of Aggregate HTML, Internet Explorer processes the contents as MHTML data, ignoring their actual content types, and it does not properly handle the Content-Disposition header field. This could cause a dialog box not to be...