CVE-2008-5828

Microsoft Windows Live Messenger Client 8.5.1 and earlier, when MSN Protocol Version 15 MSNP15 is used over a NAT session, allows remote attackers to discover intranet IP addresses and port numbers by reading the 1 IPv4InternalAddrsAndPorts, 2 IPv4Internal-Addrs, and 3 IPv4Internal-Port header...

CVE-2008-5828

Microsoft Windows Live Messenger Client 8.5.1 and earlier, when MSN Protocol Version 15 MSNP15 is used over a NAT session, allows remote attackers to discover intranet IP addresses and port numbers by reading the 1 IPv4InternalAddrsAndPorts, 2 IPv4Internal-Addrs, and 3 IPv4Internal-Port header...

CVE-2008-5828

Microsoft Windows Live Messenger Client (

Visual FoxPro vfp6r.dll ActiveX Control DoCmd command execution

Added: 12/19/2008 CVE: CVE-2008-0236 BID: 27205 OSVDB: 40380 Background Visual FoxPro is a tool for developing database applications. Problem The vfp6r.dll ActiveX control allows command execution when a user opens a web page which uses the DoCmd method. Resolution Set the kill bit for class ID...

Visual FoxPro vfp6r.dll ActiveX Control DoCmd command execution

Added: 12/19/2008 CVE: CVE-2008-0236 BID: 27205 OSVDB: 40380 Background Visual FoxPro is a tool for developing database applications. Problem The vfp6r.dll ActiveX control allows command execution when a user opens a web page which uses the DoCmd method. Resolution Set the kill bit for class ID...

Visual FoxPro vfp6r.dll ActiveX Control DoCmd command execution

Added: 12/19/2008 CVE: CVE-2008-0236 BID: 27205 OSVDB: 40380 Background Visual FoxPro is a tool for developing database applications. Problem The vfp6r.dll ActiveX control allows command execution when a user opens a web page which uses the DoCmd method. Resolution Set the kill bit for class ID...

CVE-2008-3010

Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1 and 9 incorrectly associate ISATAP addresses with the Local Intranet zone, which allows remote servers to capture NTLM credentials, and execute arbitrary code through...

IBM Workplace Web Content Management远程跨站脚本漏洞

BUGTRAQ ID: 32408 IBM Workplace Web Content Management是IBM Workplace家族的产品之一，帮助用户在Internet和内网上发布公司内容。 Web Content Management的页面导航组件没有正确地验证通过URL参数所传送的输入便返回给了用户，远程攻击者可以通过提交恶意请求执行跨站脚本攻击，导致在用户浏览器会话中执行任意HTML和脚本代码。 IBM Workplace Web Content Management 60G 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Owl Intranet Engine register.php跨站脚本执行漏洞

BUGTRAQ ID: 30410 CVECAN ID: CVE-2008-3100 Owl Intranet Engine是一种用于多用户维护知识库的基于Web软件。 Owl Intranet Engine没有正确地验证提交给register.php文件输入参数，允许远程攻击者通过提交恶意请求执行跨站脚本攻击。 Owl Intranet Engine = 0.95 Owl --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://owl.cvs.sourceforge.net/checkout/owl/owl-0.90/lib/owl.lib.php...

CVE-2008-3100

Cross-site scripting XSS vulnerability in lib/owl.lib.php in Steve Bourgeois and Chris Vincent Owl Intranet Knowledgebase 0.95 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter in a getpasswd action to register.php...

CVE-2008-3359

SQL injection vulnerability in register.php in Steve Bourgeois and Chris Vincent Owl Intranet Knowledgebase 0.95 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained solely...

CVE-2008-3100

Cross-site scripting XSS vulnerability in lib/owl.lib.php in Steve Bourgeois and Chris Vincent Owl Intranet Knowledgebase 0.95 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter in a getpasswd action to register.php...

Owl Intranet Engine 0.95 - 'register.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/30410/info Owl Intranet Engine is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...

[SECURITY] Fedora Core 6 Update: htdig-3.2.0b6-9.fc6

The ht://Dig system is a complete world wide web indexing and searching system for a small domain or intranet. This system is not meant to replace the need for powerful internet-wide search systems like Lycos, Infoseek, Webcrawler and AltaVista. Instead it is meant to cover the search needs for a...

[SECURITY] Fedora 8 Update: htdig-3.2.0b6-13.fc8

The ht://Dig system is a complete world wide web indexing and searching system for a small domain or intranet. This system is not meant to replace the need for powerful internet-wide search systems like Lycos, Infoseek, Webcrawler and AltaVista. Instead it is meant to cover the search needs for a...

[SECURITY] Fedora 7 Update: htdig-3.2.0b6-12.fc7

The ht://Dig system is a complete world wide web indexing and searching system for a small domain or intranet. This system is not meant to replace the need for powerful internet-wide search systems like Lycos, Infoseek, Webcrawler and AltaVista. Instead it is meant to cover the search needs for a...

CVE-2007-5383

The Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allows remote attackers on an intranet to bypass authentication and gain administrative access via vectors including a '/' slash character at the end of the PATHINFO to cgi/b, aka "double-slash auth bypass....

Hardcoded credentials

Interpretation conflict in the Sun Java Virtual Machine JVM allows user-assisted remote attackers to conduct a multi-pin DNS rebinding attack and execute arbitrary JavaScript in an intranet context, when an intranet web server has an HTML document that references a "mayscript=true" Java applet...

CVE-2007-5375

Interpretation conflict in the Sun Java Virtual Machine JVM allows user-assisted remote attackers to conduct a multi-pin DNS rebinding attack and execute arbitrary JavaScript in an intranet context, when an intranet web server has an HTML document that references a "mayscript=true" Java applet...

SOL6916 - Case change in URL host name circumvents Accessibility Scope

It is possible to bypass the Deny list configured in the Accessibility Scope section located on the Portal Access : Web Applications : Master Group Settings page using a URL whose hostname portion differs in case upper vs. lower from the URL pattern in the Deny list. After logging in to the...