Debian Security Advisory DSA 1362-1 (lighttpd)

The remote host is missing an update to lighttpd announced via advisory DSA 1362-1. OpenVAS Vulnerability Test $Id: deb13621.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1362-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 1372-2 (ktorrent)

The remote host is missing an update to ktorrent announced via advisory DSA 1372-2. OpenVAS Vulnerability Test $Id: deb13722.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1372-2 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Code injection

Unspecified vulnerability in the Fileshare module for Drupal allows remote authenticated users with node-creation privileges to execute arbitrary code via unspecified vectors...

CVE-2007-5401

Unrestricted file upload vulnerability in uploadrequest.asp in Layton HelpBox 3.7.1 allows remote authenticated users to upload and execute arbitrary ASP files, related to not properly checking file extensions...

CVE-2007-6422

The balancerhandler function in modproxybalancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to cause a denial of service child process crash via an invalid bb variable...

Unrestricted file upload

Unrestricted file upload vulnerability in the "My productions" component for main/auth/profile.php aka the "My profile" page in Dokeos 1.8.4 allows remote authenticated users to upload and execute arbitrary PHP files via a filename with a double extension, which can then be accessed through a URI...

Code injection

Unspecified vulnerability in IIS/iibind.asp in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to change the headers of arbitrary hosts via an unspecified parameter...

CVE-2007-6503

Multiple unspecified vulnerabilities in Hosting Controller 6.1 Hot fix 3.3 and earlier allow remote authenticated users to 1 import an arbitrary plan via a request to hosting/importhostingplans.asp; or 2 change an arbitrary plan via a request to hosting/AutoSignUpPlans.asp with the a save, b 30,...

CVE-2007-6393

SQL injection vulnerability in albums.php in Ace Image Hosting Script allows remote authenticated users to execute arbitrary SQL commands via the id parameter in editalbum mode...

Cross site scripting

Cross-site scripting XSS vulnerability in the Shoutbox module for Drupal 5.x before Shoutbox 5.x-1.1 allows remote authenticated users to inject arbitrary web script or HTML via Shoutbox block messages...

Directory traversal

Directory traversal vulnerability in OpenBase 10.0.5 and earlier allows remote authenticated users to create files with arbitrary contents via a .. dot dot in the first argument to the GlobalLog stored procedure. NOTE: this can be leveraged to execute arbitrary code using CVE-2007-5926...

CVE-2007-5928

OpenBase 10.0.5 and earlier allows remote authenticated users to trigger a free of an arbitrary memory location via long strings in a SELECT statement. NOTE: this might be a buffer overflow, but it is not clear...

CVE-2007-5897

Buffer overflow in MDSYS.SDOCS in Oracle Database Server 8iR3, 9iR1, 9iR2 up to 9.2.0.6, and 10gR1 up to 10.1.0.4 allows remote authenticated users to cause a denial of service crash and execute arbitrary code via the TRANSFORM function. NOTE: this issue might already be covered by CVE-2007-5515,...

DSA-1373-2 ktorrent - directory traversal

Bulletin has no description...

CVE-2007-5539

Unspecified vulnerability in Cisco Unified Intelligent Contact Management Enterprise ICME, Unified ICM Hosted ICMH, Unified Contact Center Enterprise UCCE, Unified Contact Center Hosted UCCH, and System Unified Contact Center Enterprise SUCCE 7.15 allows remote authenticated users to gain...

CVE-2007-5492

Static code injection vulnerability in the translation module translator.php in SiteBar 3.3.8 allows remote authenticated users to execute arbitrary PHP code via the value parameter...

CVE-2007-5492

Static code injection vulnerability in the translation module translator.php in SiteBar 3.3.8 allows remote authenticated users to execute arbitrary PHP code via the value parameter...

openSUSE 10 Security Update : asterisk (asterisk-1676)

A security problem was fixed in the IAX2 channel driver of Asterisk that could be used by remote users to execute code or at least crash Asterisk. This issue is tracked by the Mitre CVE ID CVE-2006-2898. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks ...

Stack overflow

Stack-based buffer overflow in Live for Speed 0.5X10 and earlier allows remote authenticated users to cause a denial of service client crash and possibly execute arbitrary code via a long skin name...

CVE-2007-5441

CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by 1 adding a user via a direct request to admin/adduser.php and 2 reading the admin log via an...