1136 matches found
CVE-2007-6712
Integer overflow in the hrtimerforward function hrtimer.c in Linux kernel 2.6.21-rc4, when running on 64-bit systems, allows local users to cause a denial of service infinite loop via a timer with a large expiry value, which causes the timer to always be expired...
Design/Logic Flaw
The Printing component in Apple Mac OS X 10.5.2 uses 40-bit RC4 when printing to an encrypted PDF file, which makes it easier for attackers to decrypt the file via brute force methods...
CVE-2008-0994
Preview in Apple Mac OS X 10.5.2 uses 40-bit RC4 when saving a PDF file with encryption, which makes it easier for attackers to decrypt the file via brute force methods...
CVE-2007-6340
Geert Moernaut LSrunasE 1.0 and Supercrypt 1.0 use the RC4 stream cipher without constructing a unique initialization vector IV, which makes it easier for local users to obtain cleartext passwords...
Default credentials
Geert Moernaut LSrunasE 1.0 and Supercrypt 1.0 use the RC4 stream cipher without constructing a unique initialization vector IV, which makes it easier for local users to obtain cleartext passwords...
CVE-2007-6340
Geert Moernaut LSrunasE 1.0 and Supercrypt 1.0 use the RC4 stream cipher without constructing a unique initialization vector IV, which makes it easier for local users to obtain cleartext passwords...
CVE-2007-6340
The connected advisory confirms CVE-2007-6340 affects LSrunasE 1.0 and Supercrypt 1.0 and explains the root cause: RC4 is used without a unique initialization vector, deriving a constant keystream across all passwords. This insecure design allows an attacker with local access to break encryption ...
CVE-2008-0552
Cross-site scripting XSS vulnerability in index.php in eTicket 1.5.6-RC4 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...
CVE-2008-0552
CVE-2008-0552 is an XSS vulnerability in index.php of eTicket 1.5.6-RC4 that allows remote attackers to inject arbitrary script/HTML via PATH_INFO. Documented by NVD and multiple sources; CVSS v2 base score 4.3 (medium). No exploitation details or remediation are provided in the connected documen...
Insecure Use of RC4 in LSrunasE and Supercrypt (CVE-2007-6340)
COMPASS SECURITY ADVISORY http://www.csnc.ch/ Product: LSrunasE, Supercrypt Vendor: Geert Moernaut Type: Flawed Encryption Risk: Medium Author: Daniel Roethlisberger Date: 2008-01-29 CVE Name: CVE-2007-6340 Introduction ------------ LSrunasE 1 and Supercrypt 2 are utilities used to run commands...
eTicket 1.5.6-RC4 - index.php Cross-Site Scripting
eTicket 1.5.6-RC4 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/27473/info eTicket is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data. An attacker may leverage this issue to execute arbitrary script code...
eticket156-xss.txt
eTicket 'index.php' Cross Site Scripting Path Vulnerability Name: eTicket 'index.php' Cross Site Scripting Path Vulnerability Application: eTicket Versions Affected: 1.5.6-RC4 Severity: Medium Vendor: eTicket, http://sourceforge.net/projects/eticket Bug: XSS Path vulnerability Exploitation: Clien...
MyBB多个远程PHP代码执行漏洞
BUGTRAQ ID: 27322 CNCAN ID:CNCAN-2008011706 MyBB是一款基于PHP的WEB应用程序。 MyBB不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限执行任意代码. 问题是由于'forumdisplay.php'和'search.php'脚本对用户提交的'fid'参数处理缺少充分过滤，提交恶意数据，在获得"sid"的情况下，可导致任意代码执行。 MyBulletinBoard MyBulletinBoard 1.2.10 MyBulletinBoard MyBulletinBoard 1.2.5 MyBulletinBoard...
CVE-2007-6643
Cross-site scripting XSS vulnerability in the compoll component in Joomla! before 1.5 RC4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2007-6645
Joomla! CVE-2007-6645 affects Joomla before 1.5 RC4, allowing remote authenticated users to escalate privileges via unspecified vectors. Public docs confirm the issue and point to a fixed package in Joomla 1.0.15 per Mandriva MDVSA-2008:060; no exploit details are provided in the supplied sources.
CVE-2007-6644
CVE-2007-6644 concerns Joomla! prior to version 1.5 RC4, where remote authenticated administrators could elevate arbitrary users to the administrator group, violating the intended security model. The description indicates an authenticated-admin privilege escalation vulnerability in the Joomla cor...
Sql injection
SQL injection vulnerability in 1 index.php, and possibly 2 admin/index.php, in Falt4Extreme RC4 10.9.2007 allows remote attackers to execute arbitrary SQL commands via the navID parameter...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Falt4Extreme RC4 10.9.2007 allow remote attackers to inject arbitrary web script or HTML via the handler parameter to 1 index.php and possibly 2 admin/index.php, and 3 the topic parameter to modules/feed/feed.php aka modules/feed.php...
CVE-2007-6310
Multiple cross-site scripting XSS vulnerabilities in Falt4Extreme RC4 10.9.2007 allow remote attackers to inject arbitrary web script or HTML via the handler parameter to 1 index.php and possibly 2 admin/index.php, and 3 the topic parameter to modules/feed/feed.php aka modules/feed.php...