CVE-2007-1068

The CVE-2007-1068 entry describes a credential leakage issue where authentication credentials used by Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x/2.x, Cisco Security Agent (CSA) 5.0/5.1 (with vulnerable Trust Agent), and Meetinghouse AEGIS SecureConnect Client are stored in plaintext...

Directory traversal

Directory traversal vulnerability in the Plain Old Webserver POW add-on before 0.0.9 for Mozilla Firefox allows remote attackers to read arbitrary files via a .. dot dot in the URI...

EUVD-2007-0868

Directory traversal vulnerability in the Plain Old Webserver POW add-on before 0.0.9 for Mozilla Firefox allows remote attackers to read arbitrary files via a .. dot dot in the URI...

CVE-2007-0872: Undefined Security Weakness

Directory traversal vulnerability in the Plain Old Webserver POW add-on before 0.0.9 for Mozilla Firefox allows remote attackers to read arbitrary files via a .. dot dot in the URI...

RHEL 2.1 / 3 / 4 : fetchmail (RHSA-2007:0018)

Updated fetchmail packages that fix two security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding utility. A denial of service flaw was found when Fetchmail was run in...

Information disclosure

The wwwpurgeList method in Plain Black WebGUI before 7.3.8 does not properly check user permissions, which allows attackers to delete unauthorized assets. NOTE: some of these details are obtained from third party information...

CVE-2007-0629

The wwwpurgeList method in Plain Black WebGUI before 7.3.8 does not properly check user permissions, which allows attackers to delete unauthorized assets. NOTE: some of these details are obtained from third party information...

CVE-2007-0629

CVE-2007-0629 affects Plain Black WebGUI prior to version 7.3.8, where the www_purgeList method fails to properly enforce user permissions, enabling an attacker to delete assets they should not be able to access. The vulnerability is documented in multiple sources (NVD/NVD-derived entries) and is...

CVE-2007-0629: Undefined Security Weakness

The wwwpurgeList method in Plain Black WebGUI before 7.3.8 does not properly check user permissions, which allows attackers to delete unauthorized assets. NOTE: some of these details are obtained from third party information...

GLSA-200701-13 : Fetchmail: Denial of Service and password disclosure

The remote host is affected by the vulnerability described in GLSA-200701-13 Fetchmail: Denial of Service and password disclosure Neil Hoggarth has discovered that when delivering messages to a message delivery agent by means of the 'mda' option, Fetchmail passes a NULL pointer to the ferror and...

CVE-2007-0407: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Operation/User.pm in Plain Black WebGUI before 7.3.5 beta allows remote attackers to inject arbitrary web script or HTML via the username parameter during anonymous registration, a different vector than CVE-2007-0308. NOTE: it is possible that a separate...

Cross site scripting

Cross-site scripting XSS vulnerability in Plain Black WebGUI before 7.3.4 beta allows remote attackers to inject arbitrary web script or HTML via Wiki Page titles...

CVE-2007-0308

Cross-site scripting XSS vulnerability in Plain Black WebGUI before 7.3.4 beta allows remote attackers to inject arbitrary web script or HTML via Wiki Page titles...

CVE-2007-0308: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Plain Black WebGUI before 7.3.4 beta allows remote attackers to inject arbitrary web script or HTML via Wiki Page titles...

CVE-2007-0308

Cross-site scripting XSS vulnerability in Plain Black WebGUI before 7.3.4 beta allows remote attackers to inject arbitrary web script or HTML via Wiki Page titles...

CVE-2007-0308

Plain Black WebGUI is affected by CVE-2007-0308: an XSS in Wiki Page titles allows remote injection of script/HTML. Affected product/version: Plain Black WebGUI before 7.3.4 (beta). Root cause: improper handling of Wiki Page titles leads to script injection. Impact per sources: client-side script...

CVE-2007-0119

Multiple cross-site scripting XSS vulnerabilities in EditTag 1.2 allow remote attackers to inject arbitrary web script or HTML via the plain parameter to 1 mkpwmp.cgi, 2 mkpw.pl, or 3 mkpw.cgi...

CVE-2007-0119: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in EditTag 1.2 allow remote attackers to inject arbitrary web script or HTML via the plain parameter to 1 mkpwmp.cgi, 2 mkpw.pl, or 3 mkpw.cgi...

Microsoft Internet Explorer VML buffer overflow

Overview Microsoft Internet Explorer IE fails to properly handle Vector Markup Language tags. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft IE version 5.0 and higher supports the Vector Markup Language VML,...

FreeBSD : fetchmail -- TLS enforcement problem/MITM attack/password exposure (5238ac45-9d8c-11db-858b-0060084a00e5)

Matthias Andree reports : Fetchmail has had several longstanding password disclosure vulnerabilities. - sslcertck/sslfingerprint options should have implied 'sslproto tls1' in order to enforce TLS negotiation, but did not. - Even with 'sslproto tls1' in the config, fetches would go ahead in plain...