Debian DSA-1453-1 : tomcat5 - several vulnerabilities

Several remote vulnerabilities have been discovered in the Tomcat servlet and JSP engine. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-3382 It was discovered that single quotes ' in cookies were treated as a delimiter, which could lead to an...

Debian DSA-1447-1 : tomcat5.5 - several vulnerabilities

Several remote vulnerabilities have been discovered in the Tomcat servlet and JSP engine. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-3382 It was discovered that single quotes ' in cookies were treated as a delimiter, which could lead to an...

DSA-1453-1 tomcat5 - several vulnerabilities

Bulletin has no description...

CVE-2007-6623

CVE-2007-6623 describes an absolute path traversal vulnerability in ZeusCMS 0.3 and earlier. The issue allows remote attackers to list arbitrary directories by supplying a full pathname in the dir parameter. This is a server-side path disclosure risk that could enable traversal beyond intended di...

[SECURITY] [DSA 1447-1] New tomcat5.5 packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1447-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 03, 2008 http://www.debian.org/security/faq -...

Joomla mosDirectory Component mosConfig_absolute_path远程文件包含漏洞

Phil Taylor mosDirectory是一款基于PHP的WEB应用程序。 Phil Taylor mosDirectory不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限执行任意PHP代码。 问题是由于脚本对用户提交的WEB参数缺少过滤，提交远程服务器上的任意文件作为包含对象，可导致以WEB权限执行任意PHP代码。 Phil Taylor mosDirectory 2.3.2 目前没有解决方案提供： http://www.phil-taylor.com/...

CVE-2007-6331

CVE-2007-6331 describes an absolute path traversal in the HPInfoDLL.HPInfo.1 ActiveX control (HPInfoDLL.dll 1.0) shipped with HP Info Center and the HP Quick Launch Button (QLB) software, up to version 6.3. The vulnerability allows remote attackers to execute arbitrary programs by passing a craft...

Sql injection

SQL injection vulnerability in abm.aspx in Xigla Absolute Banner Manager .NET 4.0 allows remote attackers to execute arbitrary SQL commands via the z parameter...

CVE-2007-6291

CVE-2007-6291 affects Xigla Absolute Banner Manager .NET 4.0. The vulnerability is a SQL injection in abm.aspx accessible via the z parameter, enabling remote attackers to execute arbitrary SQL commands. The entry is rated CVSS v2 base score 7.5 (HIGH) with network access and low complexity. Expl...

CVE-2007-6291

SQL injection vulnerability in abm.aspx in Xigla Absolute Banner Manager .NET 4.0 allows remote attackers to execute arbitrary SQL commands via the z parameter...

xigla-sql.txt

HackerSafe Labs - Security Advisory http://www.hackersafelabs.com/ Date: 12/06/2007 Vendor: http://www.xigla.com Package: Xigla Absolute Banner Manager Versions: v4.0 Credit: Joseph Pierini - HackerSafe Labs Risk: Related Exploit Range: Remote Attack Complexity: Medium Level of Authentication...

Information disclosure

Absolute News Manager.NET 5.1 allows remote attackers to obtain sensitive information via a direct request to getpath.aspx, which reveals the installation path in an error message...

CVE-2007-6268

Directory traversal vulnerability in pages/default.aspx in Absolute News Manager.NET 5.1 allows remote attackers to read arbitrary files via a .. dot dot in the template parameter...

CVE-2007-6271

Absolute News Manager.NET 5.1 allows remote attackers to obtain sensitive information via a direct request to getpath.aspx, which reveals the installation path in an error message...

CVE-2007-6270

Multiple cross-site scripting XSS vulnerabilities in Absolute News Manager.NET 5.1 allow remote attackers to inject arbitrary web script or HTML via the 1 rmore parameter to xlaabsolutenm.aspx and the 2 template parameter to pages/default.aspx...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Absolute News Manager.NET 5.1 allow remote attackers to inject arbitrary web script or HTML via the 1 rmore parameter to xlaabsolutenm.aspx and the 2 template parameter to pages/default.aspx...

CVE-2007-6269

Multiple SQL injection vulnerabilities in xlaabsolutenm.aspx in Absolute News Manager.NET 5.1 allow remote attackers to execute arbitrary SQL commands via the 1 z, 2 pz, 3 ord, and 4 sort parameters...

Directory traversal

Directory traversal vulnerability in pages/default.aspx in Absolute News Manager.NET 5.1 allows remote attackers to read arbitrary files via a .. dot dot in the template parameter...

CVE-2007-6271

CVE-2007-6271 affects Absolute News Manager.NET 5.1. The vulnerability is an information disclosure: remote attackers can obtain the installation path by requesting getpath.aspx, which leads to an error message revealing path details. The connected sources confirm this specific behavior across mu...

CVE-2007-6270

Absolute News Manager.NET 5.1 is affected by multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary script or HTML via the rmore parameter in xlaabsolutenm.aspx and the template parameter in pages/default.aspx. The issue arises from unsafely handling u...