CVE-2007-5130

SimpGB 1.46.02 is affected by an information-disclosure vulnerability. An invalid lang parameter to admin/index.php or a direct request to admin/trailer.php can cause error messages to reveal the installation path, exposing sensitive information. The CVE entry documents this behavior and the affe...

Unfixed XSS vulnerability at www5.info-mapping.com

Security researcher kusomiso.com, has submitted on 27/09/2007 a cross-site-scripting XSS vulnerability affecting www5.info-mapping.com, which at the time of submission ranked 50765 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 02/10/2007. It ...

php cross-site cookie insertion

The sessionstart function in ext/session in PHP 4.x up to 4.4.7 and 5.x up to 5.2.3 allows remote attackers to insert arbitrary attributes into the session cookie via special characters in a cookie that is obtained from 1 PATHINFO, 2 the sessionid function, and 3 the sessionstart function, which...

Unfixed XSS vulnerability at www.spaininfogroup.com

Security researcher BackDoor, has submitted on 23/09/2007 a cross-site-scripting XSS vulnerability affecting www.spaininfogroup.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/09/2007. It is...

CVE-2007-5026

CVE-2007-5026 affects dBlog CMS (likely version 2.0). The issue arises from storing sensitive data under the web root with insufficient access control, enabling remote attackers to directly request dblog.mdb and download the admin password hash database. Public details confirm the vulnerability d...

Unfixed XSS vulnerability at verno.ueda.info.waseda.ac.jp

Security researcher kusomiso.com, has submitted on 19/09/2007 a cross-site-scripting XSS vulnerability affecting verno.ueda.info.waseda.ac.jp, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 20/09/2007. ...

CVE-2007-0997

CVE-2007-0997 describes a race condition in the Linux kernel 2.6.17 through 2.6.17.6 affecting the tee (sys_tee) system call. The issue could allow local users to cause a denial of service (system crash), obtain sensitive information (kernel memory contents), or gain privileges via unspecified ve...

CVE-2007-4138

The Winbind nssinfo extension nsswitch/idmapad.c in idmapad.so in Samba 3.0.25 through 3.0.25c, when the "winbind nss info" option is set to rfc2307 or sfu, grants all local users the privileges of gid 0 when the 1 RFC2307 or 2 Services for UNIX SFU primary group attribute is not defined...

DEBIAN-CVE-2007-4138

The Winbind nssinfo extension nsswitch/idmapad.c in idmapad.so in Samba 3.0.25 through 3.0.25c, when the "winbind nss info" option is set to rfc2307 or sfu, grants all local users the privileges of gid 0 when the 1 RFC2307 or 2 Services for UNIX SFU primary group attribute is not defined...

[SECURITY] [DSA 1374-1] New jffnms packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA 1374-1 [email protected] http://www.debian.org/security/ Steve Kemp September 11, 2007 http://www.debian.org/security/faq -...

Samba nss_info extension privilege escalation

Gid 0 is assigned to user, if "winbind nss info" configuration parameter has value "sfu" or "rfc2307"...

CARE2X php Integ Hospital Info System 2G Deployment 2.2 Multi Remote File Include

X---- w w w . u N k n 0 w n . e u ----X CARE2X php Integ Hospital Info System 2G Deployment 2.2 Multi Remote File Include ::Home: http://care2x.org/ http://sourceforge.net/projects/care2002/ ::Vuln Type : Remote File Include RFI ::Discovered by : iNs ::Vuln Code: /language/en/encopyrite.php ?php...

CVE-2007-4742

CVE-2007-4742 affects Claroline prior to 1.8.6. Affected component: admin/adminusers.php sort parameter. Root cause: invalid value in sort leads to error message that may leak the file path, demonstrated by input containing an XSS sequence; authenticated remote admins can obtain sensitive informa...

Yahoo Messenger ActiveX buffer overflow

Buffer overflows in fvCom and info methods of YVerInfo.GetInfo.1...

Unwanted Access to File System via Import Pages Functionality

security vulnerability found in Confluence 2.5.6 Space administrator can use the "Import Pages from Disk" feature to browse the server file system by pointing the importer at "/" folder or any other folder. Because this folder doesn't contain expected files, an error message is displayed,...

DEBIAN-CVE-2007-4483

Cross-site scripting XSS vulnerability in index.php in the WordPress Classic 1.5 theme in WordPress before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO PHPSELF...

Unfixed XSS vulnerability at www.hau1.info

Security researcher st@rext, has submitted on 22/08/2007 a cross-site-scripting XSS vulnerability affecting www.hau1.info, which at the time of submission ranked 708596 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 23/08/2007. It is currently...

CVE-2007-4397

Multiple CRLF injection vulnerabilities in 1 xmms-thing 1.0, 2 XMMS Remote Control Script 1.07, 3 Disrok 1.0, 4 a2x 0.0.1, 5 Another xmms-info script 1.0, 6 XChat-XMMS 0.8.1, and other unspecified scripts for XChat allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF...

An online shopping system can traverse a directory vulnerability-vulnerability warning-the black bar safety net

Friends let help take a stand. Said for a long time..today only take the time to look at the next station..through the search sites keyword..view the page source to know this program called"mobile phone Online Sales website management system source code" Demo website: Download address: Under the...

CA.View/view-law.asp/view-info.asp sql injection

CA.View/view-law.asp/view-info.asp sql injection Credit : CodeXpLoder'tq mail : codexploderathotmaildotcom site : Biyosecurity.net,expw0rm.com thx : BiyoSecurityTeam all members thx 3APA3A spec.note : "Live The Life"...