5662 matches found
CVE-2007-4450
The server in Toribash 2.71 and earlier does not properly handle long commands, which allows remote attackers to trigger a protocol violation in which data is sent to other clients without a required LF character, as demonstrated by a SAY command. NOTE: the security impact of this violation is no...
CVE-2007-4430
CVE-2007-4430 affects Cisco IOS 12.0–12.4, where certain regular expressions used by the command “show ip bgp regexp” can trigger a denial-of-service condition. The issue enables context-dependent attackers to cause a device restart and BGP routing-table rebuild, with unauthenticated remote acces...
[slackware-security] tcpdump
New tcpdump packages are available for Slackware 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0 to fix a security issue. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2007-3798 Here are the details from the Slackware...
Security Best Practice: Protect Yourself against DNS Cache Poisoning
DNS cache poisoning occurs when false DNS records are injected into a DNS server's cache tables. Once the cache tables have been altered, a remote attacker may inspect, capture or corrupt any information exchanged between hosts on the network. By poisoning a DNS server, a remote attacker could, f...
CVE-2007-3843
The CVE-2007-3843 issue affects the Linux kernel (pre-2.6.23-rc1) CIFS handling: the mount option sec= is checked against the wrong global variable, which could allow remote attackers to spoof CIFS network traffic intended to be signed with security signatures (e.g., lack of signing despite sec=n...
CVE-2007-3845
Mozilla Firefox before 2.0.0.6, Thunderbird before 1.5.0.13 and 2.x before 2.0.0.6, and SeaMonkey before 1.1.4 allow remote attackers to execute arbitrary commands via certain vectors associated with launching "a file handling program based on the file extension at the end of the URI," a variant ...
CVE-2007-4171
SQL injection vulnerability in komentar.php in the Forum Module for auraCMS Modul Forum Sederhana allows remote attackers to execute arbitrary SQL commands via the id parameter to the default URI. NOTE: some of these details are obtained from third party information...
CVE-2007-4174
Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid...
CVE-2007-4166
CVE-2007-4166 is described in the PRION entry as an XSS vulnerability in WordPress-related themes: index.php in the Unnamed theme 1.217 and Special Edition (SE) 1.02 (before 20070804) allows remote attackers to inject arbitrary web script via the s parameter. The root cause is unsanitized input i...
CVE-2007-4162
TIBCO Rendezvous RV 7.5.2 does not protect confidentiality or integrity of inter-daemon communication, which allows remote attackers to capture and spoof traffic...
WebDirector XSS vuln.
WebDirector XSS vuln. Vuln. discovered by : r0t Date: 1 August 2007 vendor:www.webdirector.ru orginal advisory: http://pridels-team.blogspot.com/2007/08/webdirector-xss-vuln.html affected versions:2.2 and previous WebDirector contains a flaw that allows a remote Cross-Site Scripting attacks.Input...
CVE-2007-4035
Guidance Software EnCase is affected by CVE-2007-4035 and related CVE-2007-4201 issues. The flaws involve improper handling of (1) malformed MBR partition tables with many entries that can prevent logical collection of a disk image, (2) NTFS filesystems with directory loops that can block examina...
CVE-2007-4040
Argument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in an unspecified URI, which are inserted into the command...
CVE-2007-3985
Directory traversal vulnerability in file.cgi in Secure Computing SecurityReporter aka Network Security Analyzer 4.6.3 allows remote attackers to download arbitrary files via a .. dot dot in the name parameter...
Multiple Browsers - URI Handlers Command Injection
Multiple Browsers - URI Handlers Command Injection source: https://www.securityfocus.com/bid/25053/info Multiple browsers are prone to vulnerabilities that let attackers inject commands through various protocol handlers. Exploiting these issues allows remote attackers to pass and execute arbitrar...
CVE-2007-2925
The default access control lists ACL in ISC BIND 9.4.0, 9.4.1, and 9.5.0a1 through 9.5.0a5 do not set the allow-recursion and allow-query-cache ACLs, which allows remote attackers to make recursive queries and query the cache...
CVE-2007-3930
Interpretation conflict between Microsoft Internet Explorer and DocuWiki before 2007-06-26b allows remote attackers to inject arbitrary JavaScript and conduct cross-site scripting XSS attacks when spellchecking UTF-8 encoded messages via the spellutf8test function in lib/exe/spellcheck.php, which...
CVE-2007-3930
Interpretation conflict between Microsoft Internet Explorer and DocuWiki before 2007-06-26b allows remote attackers to inject arbitrary JavaScript and conduct cross-site scripting XSS attacks when spellchecking UTF-8 encoded messages via the spellutf8test function in lib/exe/spellcheck.php, which...
CVE-2007-3609
Multiple SQL injection vulnerabilities in eMeeting Online Dating Software 5.2 allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 b.php and 2 account/gallery.php, and other unspecified vectors...
