CVE-2007-4781

CVE-2007-4781 affects Joomla! 1.5 Beta1, Beta2, and RC1, where the installer component (com_installer) allows remote authenticated administrators to upload arbitrary files to the tmp/ directory via the Upload Package File function when com_installer is selected as the option. This vulnerability e...

CVE-2007-4432: Undefined Security Weakness

Untrusted search path vulnerability in the wrapper scripts for the 1 rug, 2 zen-updater, 3 zen-installer, and 4 zen-remover programs on SUSE Linux 10.1 and Enterprise 10 allows local users to gain privileges via modified a LDLIBRARYPATH and b MONOGACPREFIX environment variables...

Yahoo! Installer Plugin for Widgets ActiveX control stack buffer overflow

Overview The Yahoo! Installer Plugin for Widgets ActiveX control contains a stack buffer overflow, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Yahoo! Widgets is a program for Windows that allows the user to run applications call...

CVE-2007-4034

Stack-based buffer overflow in the YDPCTL.YDPControl.1 aka Yahoo! Installer Plugin for Widgets ActiveX control before 2007.7.13.3 20070620 in YDPCTL.dll in Yahoo! Widgets before 4.0.5 allows remote attackers to execute arbitrary code via a long argument to the GetComponentVersion method. NOTE: so...

Stack overflow

Stack-based buffer overflow in the YDPCTL.YDPControl.1 aka Yahoo! Installer Plugin for Widgets ActiveX control before 2007.7.13.3 20070620 in YDPCTL.dll in Yahoo! Widgets before 4.0.5 allows remote attackers to execute arbitrary code via a long argument to the GetComponentVersion method. NOTE: so...

CVE-2007-4034

The vulnerability CVE-2007-4034 affects Yahoo! Widgets’ ActiveX control YDPCTL.dll (YDPCTL.YDPControl.1) in Yahoo! Widgets before 4.0.5. A stack-based buffer overflow is triggered by a long argument to GetComponentVersion(), allowing remote execution of arbitrary code. Supported details in the co...

Mandrake Linux Security Advisory : php-pear (MDKSA-2007:110)

A security hole was discovered in all versions of the PEAR Installer http://pear.php.net/PEAR. The security hole is the most serious hole found to date in the PEAR Installer, and would allow a malicious package to install files anywhere in the filesystem. The vulnerability only affects users who...

Directory traversal

Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a .. dot dot sequence in the 1 install-as attribute in the file element in package.xml 1.0 or the 2 as attribute in the install element in package.xm...

CVE-2007-2519

Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a .. dot dot sequence in the 1 install-as attribute in the file element in package.xml 1.0 or the 2 as attribute in the install element in package.xm...

CVE-2007-2519

Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a .. dot dot sequence in the 1 install-as attribute in the file element in package.xml 1.0 or the 2 as attribute in the install element in package.xm...

CVE-2007-2682

The installer for Adobe Version Cue CS3 Server on Apple Mac OS X, as used in Adobe Creative Suite 3 CS3, does not re-enable the personal firewall after completing the product installation, which allows remote attackers to bypass intended firewall rules...

CVE-2007-2682

The CVE-2007-2682 issue affects Adobe Version Cue CS3 Server on Mac OS X (CS3). The installer fails to re-enable the personal firewall after installation, which can allow remote attackers to bypass firewall rules intended to restrict access. The vulnerability is demonstrated by the product’s inst...

CVE-2007-1279

Unspecified vulnerability in the installer for Adobe Bridge 1.0.3 update for Apple OS X, when patching with desktop management tools, allows local users to gain privileges via unspecified vectors during installation of the update by a different user who has administrative privileges...

CVE-2007-1279

CVE-2007-1279 affects the installer for Adobe Bridge 1.0.3 update on macOS. The vulnerability is described as a local privilege escalation during the installation process when patching with desktop management tools, enabling a local user to gain privileges via unspecified vectors during installat...

CVE-2007-1279

Unspecified vulnerability in the installer for Adobe Bridge 1.0.3 update for Apple OS X, when patching with desktop management tools, allows local users to gain privileges via unspecified vectors during installation of the update by a different user who has administrative privileges...

CVE-2007-1279: Undefined Security Weakness

Unspecified vulnerability in the installer for Adobe Bridge 1.0.3 update for Apple OS X, when patching with desktop management tools, allows local users to gain privileges via unspecified vectors during installation of the update by a different user who has administrative privileges...

JBoss Application Server may not properly restrict access to the administrative interface

Overview The JBoss Application Server may allow unauthenticated, remote access to the administrative console. Description JBoss is an open source application server implemented in Java. Because it is Java-based, JBoss can be used on any operating system that supports Java. JBoss servers can be...

CVE-2007-0465

Format string vulnerability in Apple Installer 2.1.5 on Mac OS X 10.4.8 allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a 1 PKG, 2 DISTZ, or 3 MPKG package filename...

Format string

Format string vulnerability in Apple Installer 2.1.5 on Mac OS X 10.4.8 allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a 1 PKG, 2 DISTZ, or 3 MPKG package filename...

CVE-2007-0465

CVE-2007-0465 describes a format-string vulnerability in Apple’s Installer (Mac OS X 10.4.8, Apple Installer 2.1.5). The flaw arises during parsing of package filenames that can contain format specifiers in (PKG, DISTZ, MPKG) files, enabling a user-assisted remote attacker to execute arbitrary co...