CVE-2007-3924

Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Netscape installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a -chrome argument to the...

Sql injection

SQL injection vulnerability in Infinite Responder before 1.48 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: some of these details are obtained from third party information...

ServerView Servername Parameter Arbitrary Command Execution

The remote host is running ServerView, a web-based suite of asset management tools. The version of ServerView installed on the remote host fails to sanitize user-supplied input to the 'Servername' parameter of the 'SnmpView/SnmpListMibValues' script before using it to execute a shell command. An...

AsteriDex callboth.php Multiple Parameter CRLF Injection Arbitrary Command Execution

The remote host is running AsteriDex, a web-based dialer and address book for Asterisk. The version of AsteriDex installed on the remote host fails to sanitize input to the 'IN' parameter of the 'callboth.php' script before passing it to the Asterisk Call Manager as part of the data stream of an...

CVE-2007-2839

gfax 0.4.2 (and probably other versions) creates temporary files insecurely, which can allow local users to execute arbitrary commands via unknown vectors. Debian security advisory DSA-1329-1 fixes the issue by updating gfax; the advisory describes privilege escalation and root-level impact for v...

FreeType位图字体处理远程溢出漏洞

BUGTRAQ ID: 24708 FreeType是一个流行的字体函数库。 FreeType的src/base/ftbimap.c文件没有正确地处理位图字体，如果用户受骗打开了特制的字体文件的话，就可能触发缓冲区溢出，导致拒绝服务或执行任意指令。 FreeType FreeType 2.3.3 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://downloads.sourceforge.net/freetype/freetype-2.3.4.tar.gz?modtime=1176187387&bigmirror=0...

CVE-2007-2951

The parseIrcUrl function in src/kvirc/kernel/kviircurl.cpp in KVIrc 3.2.0 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in an 1 irc:// or 2 irc6:// URI...

W3M浏览器InputAnswer格式串漏洞

W3M是一款开放源代码的文字式网页浏览器。 W3M不正确过滤用户提交给格式打印函数的输入，远程攻击者可以利用漏洞进行格式串攻击，可能以进程权限执行任意指令。 目前没有详细漏洞细节提供。 W3M W3M 0.5.1 W3M W3M 0.3.2 .2 W3M W3M 0.3.2 .1 W3M W3M 0.3.2 W3M W3M 0.3.1 + RedHat Linux 8.0 i386 + RedHat Linux 8.0 W3M W3M 0.3 + RedHat Linux 7.3 i386 + RedHat Linux 7.3 W3M W3M 0.2.5 .1 W3M W3M 0.2.5...

Xoops iContent模块Spaw_Control.Class.PHP远程文件包含漏洞

Xoops iContent模块是一款基于PHP的WEB应用程序。 Xoops iContent模块不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'SpawControl.Class.PHP'脚本对用户提交的WEB参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 Xoops iContent Module 1.0 目前没有解决方案提供： http://mirror.in.th/sourceforge.net/x/xo/xoops...

Macrovision FLEXnet DWUpdateService ActiveX (agent.exe) Multiple Method Arbitrary Command Execution

Macrovision FLEXnet Connect, formerly known as InstallShield Update Service, is installed on the remote host. It is a software management solution for internally-developed and third-party applications, and may have been installed as part of the FLEXnet Connect SDK, other InstallShield software, o...

RHEL 5 : vim (RHSA-2007:0346)

Updated vim packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. VIM VIsual editor iMproved is a version of the vi editor. An arbitrary command execution flaw was...

OPeNDAP arbitrary command execution vulnerability

Overview The BES daemon in OPeNDAP server version 4 contains a vulnerability. This vulnerability may allow an attacker to execute arbitrary commands, or upload files to a remote server. Description OPeNDAP is a software package designed to help researchers exchange data sets that are stored in...

CentOS 5 : vim (CESA-2007:0346)

Updated vim packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. VIM VIsual editor iMproved is a version of the vi editor. An arbitrary command execution flaw was...

vim security update

CentOS Errata and Security Advisory CESA-2007:0346 Updated vim packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. VIM VIsual editor iMproved is a version of the v...

[security bulletin] HPSBMA02138 SSRT061184 rev.3 - HP OpenView Storage Data Protector, Remote Unauthorized Arbitrary Command Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c00742778 Version: 3 HPSBMA02138 SSRT061184 rev.3 - HP OpenView Storage Data Protector, Remote Unauthorized Arbitrary Command Execution NOTICE: The information in this Security Bulletin should be...

CVE-2007-0655

The CVE concerns the MicroWorld Agent service (MWAGENT.EXE) in MicroWorld Technologies eScan 8.0.671.1 (and possibly other versions). Affected component: MWAGENT.EXE running as a service. Vulnerability: remote or local attackers can gain privileges and execute arbitrary commands by connecting dir...

Arbitrary Command Execution in DataDomain Administrator Interface

SUMMARY ======= An arbitrary command execution vulnerability exists in the command line administration interface of the software used by DataDomain appliances. An attacker who is able to access the administration interface could exploit this vulnerability to install malicious software and use the...

datadomain-exec.txt

SUMMARY ======= An arbitrary command execution vulnerability exists in the command line administration interface of the software used by DataDomain appliances. An attacker who is able to access the administration interface could exploit this vulnerability to install malicious software and use the...

[Full-disclosure] dproxy - arbitrary code execution through stack buffer overflow vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================ ||| Security Advisory AKLINK-SA-2007-001 ||| ||| CVE-2007-1465 CVE candidate ||| ============================================ dproxy - remotely exploitable buffer overflow...

CVE-2007-1572

CVE-2007-1572 describes a SQL injection vulnerability in search.asp of JGBBS 3.0 Beta 1 and earlier. The flaw allows remote attackers to inject arbitrary SQL commands through the title parameter, representing a different vector than CVE-2007-1440. The description notes the vulnerability is presen...