CVE-2007-4918

CVE-2007-4918 describes a SQL injection in Gelato’s web app: classes/gelato.class.php vulnerable to arbitrary SQL via the post parameter to index.php . Affected: Gelato (web application). Root cause: unsafely constructed SQL from user input (no sufficient input validation/sanitization). Impact: r...

Microsoft Foundation Classes FindFile buffer overflow

Buffer overflow on oversized thirst argument...

CVE-2007-4918: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in classes/gelato.class.php in Gelato allows remote attackers to execute arbitrary SQL commands via the post parameter to index.php...

javaws vulnerabilities

Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.213 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to...

javaws vulnerabilities

Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.213 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in LimeSurvey aka PHPSurveyor 1.49RC2 allow remote attackers to execute arbitrary PHP code via a URL in the homedir parameter to 1 OLE/PPS/File.php, 2 OLE/PPS/Root.php, 3 Spreadsheet/Excel/Writer.php, or 4 OLE/PPS.php in admin/classes/pear/; or 5...

CVE-2007-3632: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in LimeSurvey aka PHPSurveyor 1.49RC2 allow remote attackers to execute arbitrary PHP code via a URL in the homedir parameter to 1 OLE/PPS/File.php, 2 OLE/PPS/Root.php, 3 Spreadsheet/Excel/Writer.php, or 4 OLE/PPS.php in admin/classes/pear/; or 5...

LimeSurvey (PHPSurveyor) 1.49RC2 Remote File Inclusion Vulnerability

No description provided by source. Owner : Pr0T3cT10n Email : [email protected] Homepage : www.kamikaz-team.com Script site : www.limesurvey.org Script name : LimeSurvey PHPSurveyor Version : 1.49RC2 Type : RFIRemote File Include Source :...

GLSA-200706-08 : emul-linux-x86-java: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200706-08 emul-linux-x86-java: Multiple vulnerabilities Chris Evans of the Google Security Team has discovered an integer overflow in the ICC parser, and another vulnerability in the BMP parser. An unspecified vulnerability...

Sun JRE / JDK multiple security vulnerabilities

Buffer and integer overflows in JPG and BMP processing, sandbox protection bypass with system classes...

Sun JDK/JRE: Multiple vulnerabilities

Background The Sun Java Development Kit JDK and the Sun Java Runtime Environment JRE provide the Sun Java platform. Description An unspecified vulnerability involving an "incorrect use of system classes" was reported by the Fujitsu security team. Additionally, Chris Evans from the Google Security...

CVE-2007-2465

Unspecified vulnerability in Sun Solaris 9, when Solaris Auditing BSM is enabled for file read, write, attribute modify, create, or delete audit classes, allows local users to cause a denial of service panic via unknown vectors, possibly related to the auditsavepath function...

Design/Logic Flaw

Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.213 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to...

CVE-2007-2435

Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.213 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to...

CVE-2007-2435

Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.213 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to...

CVE-2007-2435

Affected software: Sun Java Web Start in JDK/JRE 5.0 Update 10 and earlier; and Java Web Start in SDK/JRE 1.4.2_13 and earlier. Root cause: incorrect use of system classes related to JNLP processing. Impact: remote attacker could cause the application to perform unauthorized actions by granting p...

CVE-2007-2149: Undefined Security Weakness

Stephen Craton aka WiredPHP Chatness 2.5.3 and earlier stores usernames and unencrypted passwords in 1 classes/vars.php and 2 classes/varstuff.php, and recommends 0666 or 0777 permissions for these files, which allows local users to gain privileges by reading the files, and allows remote attacker...

CVE-2007-2115

Unspecified vulnerability in the Change Data Capture CDC component in Oracle Database 9.2.0.7, 10.1.0.5, and 10.2.0.2 has unknown impact and attack vectors, aka DB09. NOTE: as of 20070424, oracle has not disputed reliable claims that this issue involves multiple SQL injection vulnerabilities in t...

CVE-2007-1992: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in the comzoom 2.5 beta 2 and earlier module for Mambo allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to 1 EXIFMakernote.php or 2 EXIF.php in classes/iptc/...

CVE-2007-1848: Undefined Security Weakness

Cross-site scripting XSS vulnerability in admin/classes/ui.dta.php in Drake CMS allows remote attackers to inject arbitrary web script or HTML via the desctitle field. NOTE: Drake CMS has only a beta version available, and the vendor has previously stated "We do not consider security reports vali...