CVE-2007-4988

Sign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted width value in an image file, which triggers an integer overflow and a heap-based buffer overflow...

CVE-2007-4988

Sign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted width value in an image file, which triggers an integer overflow and a heap-based buffer overflow...

CVE-2007-4988

Sign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted width value in an image file, which triggers an integer overflow and a heap-based buffer overflow...

Unfixed XSS vulnerability at cokisimizvar.com

Security researcher Security-TR, has submitted on 17/09/2007 a cross-site-scripting XSS vulnerability affecting cokisimizvar.com, which at the time of submission ranked 451349 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 20/09/2007. It is...

[SECURITY] Fedora 7 Update: pam_ssh-1.92-2.fc7

This PAM module provides single sign-on behavior for UNIX using SSH keys. Users are authenticated by decrypting their SSH private keys with the password provided. In the first PAM login session phase, an ssh-agent process is started and keys are added. The same agent is used for the following PAM...

Unfixed XSS vulnerability at host.dataislem.com

Security researcher Thefucker, has submitted on 08/04/2007 a cross-site-scripting XSS vulnerability affecting host.dataislem.com, which at the time of submission ranked 996699 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/04/2007. It is...

Sql injection

SQL injection vulnerability in signin.aspx in WebStore Online Store Application Template allows remote attackers to execute arbitrary SQL commands via the Password parameter...

CVE-2007-4109

SQL injection vulnerability in signin.aspx in WebStore Online Store Application Template allows remote attackers to execute arbitrary SQL commands via the Password parameter...

CVE-2007-4108

SQL injection vulnerability in signin.aspx in WebEvents Online Event Registration Template allows remote attackers to execute arbitrary SQL commands via the Password parameter...

webstore-sql.txt

A R I A - S E C U R I T Y WebStore - Online Store Application Template SQL INJECTION Vendor: http://www.codewidgets.com http://target.com/PATH/signin.aspx Username: admin Password: anything' OR 'x'='x Credits: Aria-Security Team http://aria-security.net http://outlaw.aria-security.info...

Design/Logic Flaw

Multiple unspecified vulnerabilities in Oracle Collaboration Suite 10.1.2 have unknown impact and remote attack vectors via 1 Instant Messaging/Presence OCS01 and 2 Oracle Single Sign On AS02...

Design/Logic Flaw

Unspecified vulnerability in Oracle Application Server 9.0.4.3 and 10.1.2.0.2 allows remote attackers to have an unknown impact via Oracle Single Sign On, aka AS01...

CVE-2007-3862

Unspecified vulnerability in Oracle Application Server 9.0.4.3 and 10.1.2.0.2 allows remote attackers to have an unknown impact via Oracle Single Sign On, aka AS01...

CVE-2007-3864

Multiple unspecified vulnerabilities in Oracle Collaboration Suite 10.1.2 have unknown impact and remote attack vectors via 1 Instant Messaging/Presence OCS01 and 2 Oracle Single Sign On AS02...

CVE-2007-3864

CVE-2007-3864 relates to multiple unspecified vulnerabilities in Oracle Collaboration Suite 10.1.2 with remote attack vectors via Instant Messaging/Presence (OCS01) and Oracle Single Sign On (AS02). The connected sources consistently identify the affected product as Oracle Collaboration Suite 10....

CVE-2007-3864

Multiple unspecified vulnerabilities in Oracle Collaboration Suite 10.1.2 have unknown impact and remote attack vectors via 1 Instant Messaging/Presence OCS01 and 2 Oracle Single Sign On AS02...

CVE-2007-3862

Unspecified vulnerability in Oracle Application Server 9.0.4.3 and 10.1.2.0.2 allows remote attackers to have an unknown impact via Oracle Single Sign On, aka AS01...

Information disclosure

Unspecified vulnerability in the G/PGP GPG Plugin 2.0 for Squirrelmail 1.4.10a allows remote authenticated users to execute arbitrary commands via unspecified vectors, possibly related to the passphrase variable in the gpgsignattachment function, aka ZD-00000004. this information is based upon a...

CVE-2007-2265

Cross-site scripting XSS vulnerability in YA Book 0.98-alpha allows remote attackers to inject arbitrary web script or HTML via the City field in a sign action in index.php...

[Full-disclosure] Cosign SSO Authentication Bypass

Author: Jon Oberheide [email protected] Date: Wed, April 11th, 2007 Summary ======= Application: Cosign Single Sign-On Affected Versions: 2.0.1 and previous Vendor Website: http://weblogin.org Type of Vulnerability: Authentication Bypass - Remote Background ========== cosign is a web single-sign-...