4714 matches found
Internet Explorer tblinf32.dll ActiveX IObjectsafety vulnerability
Added: 08/17/2007 CVE: CVE-2007-2216 BID: 25289 OSVDB: 36396 Background The IObjectsafety interface provides methods to get and set safety options for objects which support untrusted clients. Problem The tblinf32.dll ActiveX control implements IObjectsafety incorrectly, allowing execution of code...
Internet Explorer tblinf32.dll ActiveX IObjectsafety vulnerability
Added: 08/17/2007 CVE: CVE-2007-2216 BID: 25289 OSVDB: 36396 Background The IObjectsafety interface provides methods to get and set safety options for objects which support untrusted clients. Problem The tblinf32.dll ActiveX control implements IObjectsafety incorrectly, allowing execution of code...
Design/Logic Flaw
AlstraSoft Video Share Enterprise allows remote attackers to obtain sensitive information the full path via 1 a ' quote character in the category parameter to viewvideo.php, or 2 an XSS sequence in the UID parameter to a uprofile.php, b channeldetail.php, c uvideos.php, d groupshome.php, or e...
CVE-2007-4086
Multiple SQL injection vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to execute arbitrary SQL commands via 1 the gid parameter to gmembers.php, or 2 the UID parameter to a uvideos.php, b ugroups.php, c uprofile.php, d ufavour.php, e ufriends.php, or f uplaylist.php...
Sql injection
Multiple SQL injection vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to execute arbitrary SQL commands via 1 the gid parameter to gmembers.php, or 2 the UID parameter to a uvideos.php, b ugroups.php, c uprofile.php, d ufavour.php, e ufriends.php, or f uplaylist.php...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to inject arbitrary web script or HTML via the 1 msg, 2 page, 3 viewkey, or 4 viewtype parameter to a viewvideo.php; the 5 next parameter to b signup.php; the 6 searchid parameter to c...
CVE-2007-4087
AlstraSoft Video Share Enterprise allows remote attackers to obtain sensitive information the full path via 1 a ' quote character in the category parameter to viewvideo.php, or 2 an XSS sequence in the UID parameter to a uprofile.php, b channeldetail.php, c uvideos.php, d groupshome.php, or e...
CVE-2007-4087
CVE-2007-4087 affects AlstraSoft Video Share Enterprise. Affected component: the web application handling category and UID inputs. The root cause is improper input handling leading to information disclosure: sending a single quote (') in the category parameter to view_video.php can reveal the ful...
CVE-2007-4086
The CVE-2007-4086 entry describes multiple SQL injection vulnerabilities in AlstraSoft Video Share Enterprise. The affected components are server-side scripts that accept user-supplied input: gid to gmembers.php, and UID to uvideos.php, ugroups.php, uprofile.php, ufavour.php, ufriends.php, or upl...
CVE-2007-4086
Multiple SQL injection vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to execute arbitrary SQL commands via 1 the gid parameter to gmembers.php, or 2 the UID parameter to a uvideos.php, b ugroups.php, c uprofile.php, d ufavour.php, e ufriends.php, or f uplaylist.php...
CVE-2007-4077
Affected product/variant : AlstraSoft Video Share Enterprise. Vulnerability type : Multiple cross-site scripting (XSS) vulnerabilities. Root cause : Reflected XSS via unvalidated user-supplied parameters in multiple PHP pages. Affected vectors/params : (1) msg, (2) page, (3) viewkey, (4) viewtype...
CVE-2007-4077
Multiple cross-site scripting XSS vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to inject arbitrary web script or HTML via the 1 msg, 2 page, 3 viewkey, or 4 viewtype parameter to a viewvideo.php; the 5 next parameter to b signup.php; the 6 searchid parameter to c...
CVE-2007-4087
AlstraSoft Video Share Enterprise allows remote attackers to obtain sensitive information the full path via 1 a ' quote character in the category parameter to viewvideo.php, or 2 an XSS sequence in the UID parameter to a uprofile.php, b channeldetail.php, c uvideos.php, d groupshome.php, or e...
alstrasoft-multi.txt
AlstraSoft Multiple products multiple Vulnerabilities Vendor urL:http://www.alstrasoft.com/products.htm Advisore url:http://lostmon.blogspot.com/2007/07/ alstrasoft-multiple-products-multiple.html Vendor notify:yes webform Exploit included: yes Multiple products of Alstrasoft Are prone vulnerable...
Code injection
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the 1 SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute...
CVE-2007-2447
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the 1 SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute...
DEBIAN-CVE-2007-2447
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the 1 SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute...
samba code injection
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the 1 SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute...
Design/Logic Flaw
Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of restore points images are configured, uses weak permissions world readable for a configuration file with network share credentials, which allows local users to...
Default credentials
Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of restore point images are configured, encrypt network share credentials with a key formed by a hash of the username, which allows local users to obtain the...