CVE-2007-3871

Stampit Web uses guessable id values for online stamp purchases, which allows remote attackers to cause a denial of service stamp invalidation via a SOAP request with an id value for a stamp that has not yet been printed...

USN-485-1: PHP vulnerabilities

It was discovered that the PHP xmlrpc extension did not correctly check heap memory allocation sizes. A remote attacker could send a specially crafted request to a PHP application using xmlrpc and execute arbitrary code as the Apache user. CVE-2007-1864 Stefan Esser discovered a flaw in the rando...

Classic: Web2. 0 client components vulnerability scanning one-vulnerability warning-the black bar safety net

A, Web2. 0 is the several technology of integrated application of the results, these techniques are: AJAX（Asynchronous JavaScript and XML,Flash, JSONJavaScript Object Notation,SOAP Simple Object Access Protocol and REST, Representational State Transfer, etc. These techniques coupled with...

CVE-2007-3602

The SOAP webservice in vtiger CRM before 5.0.3 does not ensure that authenticated accounts are active, which allows remote authenticated users with inactive accounts to access and modify data, as demonstrated by the Thunderbird plugin...

Code injection

The SOAP webservice in vtiger CRM before 5.0.3 does not ensure that authenticated accounts are active, which allows remote authenticated users with inactive accounts to access and modify data, as demonstrated by the Thunderbird plugin...

CVE-2007-3602

The CVE concerns vtiger CRM’s SOAP webservice prior to 5.0.3. The vulnerability arises because the service does not verify that authenticated accounts are active, allowing remote authenticated users with inactive accounts to access and modify data, as demonstrated by the Thunderbird plugin. Affec...

CVE-2007-3602

The SOAP webservice in vtiger CRM before 5.0.3 does not ensure that authenticated accounts are active, which allows remote authenticated users with inactive accounts to access and modify data, as demonstrated by the Thunderbird plugin...

Important: php security update

5.1.6-12.el5 - add security fix for CVE-2007-1864, SOAP redirect handling issue, FTP CRLF injection issue 235016 5.1.6-11.el5 - add security fix for CVE-2007-1718 235016 5.1.6-9.el5 - add security fix for CVE-2007-1583 235016 - add security fixes for CVE-2007-0455, CVE-2007-1001 235036 5.1.6-7.el...

Debian DSA-1295-1 : php5 - several vulnerabilities

Several remote vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-2509 It was discovered that missing input...

RHEL 5 : php (RHSA-2007:0348)

Updated PHP packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. A...

USN-462-1: PHP vulnerabilities

A flaw was discovered in the FTP command handler in PHP. Commands were not correctly filtered for control characters. An attacker could issue arbitrary FTP commands using specially crafted arguments. CVE-2007-2509 Ilia Alshanetsky discovered a buffer overflow in the SOAP request handler in PHP...

PHP SOAP extension buffer overflow

Buffer overflow in makehttpsoaprequest function...

CVE-2007-2728

The soap extension in PHP calls phprandr with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the mcryptcreateiv issue covered by CVE-2007-2727. Note: The PHP team argue that this is not a valid security issue...

Sql injection

The soap extension in PHP calls phprandr with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the mcryptcreateiv issue covered by CVE-2007-2727...

CVE-2007-2728

The soap extension in PHP calls phprandr with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the mcryptcreateiv issue covered by CVE-2007-2727. Note: The PHP team argue that this is not a valid security issue...

CVE-2007-2728

CVE-2007-2728 concerns the PHP soap extension calling php_rand_r with an uninitialized seed variable. The impact and attack vectors are not clearly defined in the provided documents; it is noted as related to CVE-2007-2727 and the PHP team argued it is not a valid security issue. No exploitation ...

CVE-2007-2728

The soap extension in PHP calls phprandr with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the mcryptcreateiv issue covered by CVE-2007-2727. Note: The PHP team argue that this is not a valid security issue...

CVE-2007-2728

The soap extension in PHP calls phprandr with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the mcryptcreateiv issue covered by CVE-2007-2727. Note: The PHP team argue that this is not a valid security issue...

PT-2007-4044 · Php · Php

Name of the Vulnerable Software and Affected Versions: PHP affected versions not specified Description: A design error in the make http soap request function in PHP's soap extension causes it to call php rand r with an uninitialized variable, potentially leading to weak encryption of sensitive...

Fedora Core 6 : php-5.1.6-3.6.fc6 (2007-503)

This update fixes a number of security issues in PHP. A heap buffer overflow flaw was found in the PHP 'xmlrpc' extension. A PHP script which implements an XML-RPC server using this extension could allow a remote attacker to execute arbitrary code as the 'apache' user. Note that this flaw does no...