JVN#91305178 InfoBarrier4 self-decrypted file vulnerability

Impact The third party could view the contents of self-decrypted files or obtain the passwords used for self-decryption. Solution Products Affected InfoBarrier4 Standard Plus: V4.0L10, V4.0L20...

Windows Vista输入法状态判断错误绕过认证漏洞

Microsoft Windows Vista是一款微软公司新开发的操作系统。 Microsoft Windows Vista提供的输入法机制存在设计问题，远程攻击者可以利用漏洞未授权访问应用系统。 一个输入法被安装到Vista系统，默认会出现在登录界面或锁屏状态中，操作系统默认应该根据自身运行状态提供不同的功能。不过Windows Vista没有正确检查当前系统登录状态，会不正确的把特权功能提供给未登录进系统的用户。在恶意用户可以接触物理终端或者通过终端服务会话访问有此漏洞系统，通过执行输入法提供的某些帮助功能可绕过访问机制，获得对系统的控制。...

CVE-2007-2021

CVE-2007-2021: Multiple PHP remote file inclusion flaws in Pineapple Technologies Lore 1 permit remote code execution via crafted URLs in the lang_path parameter of third_party/phpmailer/class.phpmailer.php or the get_plugin_file_path parameter of third_party/smarty/libs/plugins/function.html_che...

More information on ZERT patch for ANI 0day

Hi, more information about the patch released April 1st can be found here: http://zert.isotf.org/ Including: 1. Technical information. 2. Why this patch was released when eeye already released a third party patch. The newly discovered zero-day vulnerability in the parsing of animated cursors is...

CVE-2007-1775

Unrestricted file upload vulnerability in upload.php3 in JBrowser 2.4 and earlier allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

[Full-disclosure] ANI Zeroday, Third Party Patch

A new vulnerability was recently discovered, in the wild, that affects the .ANI file format. This flaw affects all versions of Microsoft Windows and can be delivered through multiple attack vectors, specifically any user who visits a malicious website. This flaw remains as of yet unpatched by...

CVE-2007-1569

Stack-based buffer overflow in NewsBin Pro 4.32 allows remote attackers to cause a denial of service or execute arbitrary code via a yEnc yEncode encoded article with a long filename, as demonstrated using a .nzb file. NOTE: some of these details are obtained from third party information...

Code injection

Direct static code injection vulnerability in admin/configuration.php in Guestbara 1.2 and earlier allows remote authenticated users to inject arbitrary PHP code into config.php via the 1 adminmail, 2 emotpatch, 3 login, 4 pass, and unspecified other parameters. NOTE: the provenance of this...

JVN#19795972: FENCE-Pro and Systemwalker Desktop Encryption self-decoding file vulnerability

Impact The third party could view the contents of self-decoding files and obtain the passwords used for the encryption of the files. Solution Products Affected All version levels of FENCE-Pro excluding V5 V5L01 Systemwalker Desktop Encryption: V12.0L10, V12.0L10A, V12.0L10B, V12.0L20, V13.0.0 For...

CVE-2007-1435

Buffer overflow in D-Link TFTP Server 1.0 allows remote attackers to cause a denial of service crash via a long 1 GET or 2 PUT request, which triggers memory corruption. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-1394

Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via the Chat Name field, which is inserted into online.txt and included by users.php. NOTE: some of these details are obtained from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in popprofile.asp in Snitz Forums 2000 3.4.06 allows remote attackers to inject arbitrary web script or HTML via the MSN parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-1300

DOURAN Software Technologies ISPUtil 3.32.84.1, and possibly earlier versions, stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and reseller data via a direct request for scripts/activesessions.ini. NOTE: the provenance...

CVE-2006-7113

Unrestricted file upload vulnerability in P-News 2.0 allows remote attackers to upload and execute arbitrary files via an avatar file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-7134

Unrestricted file upload vulnerability in mainuser.php in Upload Tool for PHP 1.0 allows remote attackers to upload and execute arbitrary files with executable extensions such as .php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party informatio...

Cross site scripting

Cross-site scripting XSS vulnerability in setup.php in Audins Audiens 3.3 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-1240

Multiple cross-site scripting XSS vulnerabilities in Docebo CMS 3.0.3 through 3.0.5 allow remote attackers to inject arbitrary web script or HTML via 1 the searchkey parameter to index.php, or the 2 sn or 3 ri parameter to modules/htmlframechat/index.php. NOTE: the provenance of this information ...

WordPress source code compromised to enable remote code execution

While assessing the security of WordPress, a popular blog creation software, I have discovered that it's source code has recently been compromised by a third party in order to enable remote command execution on the machines running affected versions. The compromised files are wp-includes/feed.php...

CVE-2007-1190

Unspecified vulnerability in the EmbeddedWB Web Browser ActiveX control allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in modules/out.php in Pyrophobia 2.1.3.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...