7870 matches found
Design/Logic Flaw
The XML DB XMLDB component in Oracle Database 9.2.0.8, 9.2.0.8DV, and 10.1.0.5 generates incorrect audit entries in the USERID column in which 1 long usernames are trimmed to 5 characters, or 2 short entries contain any extra characters from usernames in previous entries, aka DB23...
CVE-2007-5513
The XML DB XMLDB component in Oracle Database 9.2.0.8, 9.2.0.8DV, and 10.1.0.5 generates incorrect audit entries in the USERID column in which 1 long usernames are trimmed to 5 characters, or 2 short entries contain any extra characters from usernames in previous entries, aka DB23...
CVE-2007-5513
The CVE-2007-5513 entry concerns Oracle Database XML DB (XMLDB) component in versions 9.2.0.8, 9.2.0.8DV, and 10.1.0.5. The issue is in audit trail entries for USERID: long usernames get trimmed to five characters, and shorter entries may contain extra characters from previous usernames (DB23). T...
CVE-2007-5513
The XML DB XMLDB component in Oracle Database 9.2.0.8, 9.2.0.8DV, and 10.1.0.5 generates incorrect audit entries in the USERID column in which 1 long usernames are trimmed to 5 characters, or 2 short entries contain any extra characters from usernames in previous entries, aka DB23...
SA-2007-029 - Drupal core - User deletion cross site request forgery
The Drupal Forms API protects against cross site request forgeries CSRF, where a malicous site can cause a user to unintentionally submit a form to a site where he is authenticated. The user deletion form does not follow the standard Forms API submission model and is therefore not protected again...
CVE-2007-5513: Undefined Security Weakness
The XML DB XMLDB component in Oracle Database 9.2.0.8, 9.2.0.8DV, and 10.1.0.5 generates incorrect audit entries in the USERID column in which 1 long usernames are trimmed to 5 characters, or 2 short entries contain any extra characters from usernames in previous entries, aka DB23...
openSUSE 10 Security Update : dovecot (dovecot-3135)
A bug in dovecot allowed users to read compressed mailboxes of other users under certain circumstances. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update dovecot-3135. The text description of th...
Fedora Core 6 : openssh-4.3p2-25.fc6 (2007-715)
Tue Oct 2 2007 Tomas Mraz - 4.3p2-25 - do not fall back on trusted X11 cookies CVE-2007-4752 280471 - Fri Jul 13 2007 Tomas Mraz - 4.3p2-24 - fixed audit log injection problem CVE-2007-3102 248059 - Thu Jun 21 2007 Tomas Mraz - 4.3p2-23 - document where the nss certificate and token dbs are...
LedgerSMB < 1.2.8, SQL-Ledger 2.x Multiple SQL Injection Issues
Severity: Critical Effect: Compromise of FInancial Data, deletion of audit trails, alteration of system settings, disclosure of confidential information possible in some setups. Affected products: LedgerSMB 1.0.0-1.2.7 , SQL-Ledger 2.x all versions. 1: SQL injection issue in invoice quantity fiel...
Marshal MailMarshal TAR Unpacking Vulnerability
Marshal MailMarshal TAR Unpacking Vulnerability Overview -------- Vendor: Marshal www.marshal.com Product: MailMarshal = 6.2.1.3253 Vulnerability: Remote file overwrite, Remote execution Risk: HIGH Description ----------- During a security audit for a customer we have discovered a serios...
Race condition
Multiple race conditions in certain system call wrappers in Generic Software Wrappers Toolkit GSWTK allow local users to defeat system call interposition and possibly gain privileges or bypass auditing...
CVE-2007-4302: Undefined Security Weakness
Multiple race conditions in certain system call wrappers in Generic Software Wrappers Toolkit GSWTK allow local users to defeat system call interposition and possibly gain privileges or bypass auditing...
CVE-2007-4303: Undefined Security Weakness
Multiple race conditions in 1 certain rules and 2 argument copying during VM protection, in CerbNG for FreeBSD 4.8 allow local users to defeat system call interposition and possibly gain privileges or bypass auditing, as demonstrated by modifying command lines in log-exec.cb...
CVE-2007-4150
The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 uses weak cryptography XOR when 1 transmitting passwords, which allows remote attackers to obtain sensitive information by sniffing the network; and 2 storing passwords in the configuration file, which allows local users to...
Command injection
The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 allows remote attackers to obtain sensitive information via 1 a LOG.ON command, which reveals the logging pathname in the server response; 2 a VER command, which reveals the version number in the server response; and 3 a...
Heap overflow
Heap-based buffer overflow in the Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 allows remote attackers to cause a denial of service persistent daemon crashes or execute arbitrary code via a long filename in a "LOG." command...
Command injection
The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 does not require authentication for 1 the "LOG." command, which allows remote attackers to create or overwrite arbitrary files; 2 the SETTINGSFILE command, which allows remote attackers to overwrite the ini file, and...
CVE-2007-4152
The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 allows remote attackers to conduct replay attacks by capturing and resending data from the DETAILS and PROCESS sections of a session that schedules an audit...
CVE-2007-4148
Heap-based buffer overflow in the Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 allows remote attackers to cause a denial of service persistent daemon crashes or execute arbitrary code via a long filename in a "LOG." command...
CVE-2007-4149
The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 does not require authentication for 1 the "LOG." command, which allows remote attackers to create or overwrite arbitrary files; 2 the SETTINGSFILE command, which allows remote attackers to overwrite the ini file, and...