DSA-1265-1 mozilla

Bulletin has no description...

CVE-2006-7157

Buffer overflow in Google Earth v4.0.2091 beta allows remote user-assisted attackers to cause a denial of service crash via a KML or KMZ file with a long href element...

CVE-2007-1161

Cross-site scripting XSS vulnerability in callentry.php in Call Center Software 0,93 allows remote attackers to inject arbitrary web script or HTML via the problemdesc parameter, as demonstrated by the ONLOAD attribute of a BODY element...

CVE-2006-7031

Microsoft Internet Explorer 6.0.2900 SP2 and earlier allows remote attackers to cause a denial of service crash via a table element with a CSS attribute that sets the position, which triggers an "unhandled exception" in mshtml.dll...

PT-2007-1310 · Microsoft · Internet Explorer

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer versions 6.0.2900 SP2 and earlier Description: The issue allows remote attackers to cause a denial of service, resulting in a crash, by utilizing a table element with a CSS attribute that sets the position. This...

Design/Logic Flaw

The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the keylength variable for a numerical key, which allows context-dependent attackers to read stack memory via a wddxPacket element that contains a variable with a string name befo...

Debian DSA-1258-1 : mozilla-thunderbird - several vulnerabilities

Several security related problems have been discovered in Mozilla and derived products such as Mozilla Firefox. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2006-6497 Several vulnerabilities in the layout engine allow remote attackers to cause ...

security flaw

backend/parser/parsecoerce.c in PostgreSQL 7.4.1 through 7.4.14, 8.0.x before 8.0.9, and 8.1.x before 8.1.5 allows remote authenticated users to cause a denial of service daemon crash via a coercion of an unknown element to ANYARRAY...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Contact Details functionality in Yahoo! Messenger 8.1.0.209 and earlier allow user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG element to the 1 First Name, 2 Last Nam...

CVE-2007-0758

PHP remote file inclusion vulnerability in lang.php in PHPProbid 5.24 allows remote attackers to execute arbitrary PHP code via a URL in the SRC attribute of an HTML element in the lang parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third part...

CVE-2007-0768

Multiple cross-site scripting XSS vulnerabilities in the Contact Details functionality in Yahoo! Messenger 8.1.0.209 and earlier allow user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG element to the 1 First Name, 2 Last Nam...

Remote file inclusion

PHP remote file inclusion vulnerability in lang.php in PHPProbid 5.24 allows remote attackers to execute arbitrary PHP code via a URL in the SRC attribute of an HTML element in the lang parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third part...

CVE-2007-0768

Multiple cross-site scripting XSS vulnerabilities in the Contact Details functionality in Yahoo! Messenger 8.1.0.209 and earlier allow user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG element to the 1 First Name, 2 Last Nam...

CVE-2007-0758

PHP remote file inclusion vulnerability in lang.php in PHPProbid 5.24 allows remote attackers to execute arbitrary PHP code via a URL in the SRC attribute of an HTML element in the lang parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third part...

Code injection

WebCore in Apple WebKit build 18794 allows remote attackers to cause a denial of service null dereference and application crash via a TD element with a large number in the ROWSPAN attribute, as demonstrated by a crash of OmniWeb 5.5.3 on Mac OS X 10.4.8, a different vulnerability than CVE-2006-20...

CVE-2007-0342

WebCore in Apple WebKit build 18794 allows remote attackers to cause a denial of service null dereference and application crash via a TD element with a large number in the ROWSPAN attribute, as demonstrated by a crash of OmniWeb 5.5.3 on Mac OS X 10.4.8, a different vulnerability than CVE-2006-20...

CVE-2007-0342

CVE-2007-0342 concerns WebCore in Apple WebKit build 18794. The vulnerability enables remote DoS via a TD element with an excessively large ROWSPAN value, causing a null dereference and application crash, as demonstrated by OmniWeb 5.5.3 on Mac OS X 10.4.8. Reports consistently reference this as ...

CVE-2007-0192

The CVE-2007-0192 CSRF vulnerability affects MKPortal’s admin.php in the save_main operation (ad_perms) where an attacker can induce privilege changes. The issue is exposed via a crafted getURL in a .swf loaded in an IFRAME, enabling remote modification of privilege settings (All Guests are Admin...

Apple QuickTime插件任意脚本执行漏洞

Apple QuickTime是一款流行的媒体播放程序。 Apple QuickTime处理Media Link文件存在问题，远程攻击者可以利用漏洞导致任意脚本代码执行，获得敏感信息。 Media Link文件提供对媒体文件更方便的访问模式，.qtl文件使用xml语言，类似语法如下： ?xml version="1.0" ?quicktime type="application/x-quicktime-media-link"? embed src="Sample.mov" autoplay="true"/...

CVE-2006-6701

Cross-site request forgery CSRF vulnerability in util.pl in @Mail WebMail 4.51, and util.php in 5.x before 5.03, allows remote attackers to modify arbitrary settings and perform unauthorized actions as an arbitrary user, as demonstrated using a settings action in the SRC attribute of an IMG eleme...