7055 matches found
rPSA-2007-0257-1 rsync
rPath Security Advisory: 2007-0257-1 Published: 2007-12-04 Products: rPath Linux 1 Rating: Minor Exposure Level Classification: Remote Deterministic Unauthorized Access Updated Versions: rsync=conary.rpath.com@rpl:1/2.6.8-1.2-1 rPath Issue Tracking System: https://issues.rpath.com/browse/RPL-1989...
Design/Logic Flaw
The "internal state tracking" code for the random and urandom devices in FreeBSD 5.5, 6.1 through 6.3, and 7.0 beta 4 allows local users to obtain portions of previously-accessed random values, which could be leveraged to bypass protection mechanisms that rely on secrecy of those values...
CVE-2007-6150
The "internal state tracking" code for the random and urandom devices in FreeBSD 5.5, 6.1 through 6.3, and 7.0 beta 4 allows local users to obtain portions of previously-accessed random values, which could be leveraged to bypass protection mechanisms that rely on secrecy of those values...
CVE-2007-6150
CVE-2007-6150 concerns a bug in FreeBSD where the internal state tracking for the random(4) and urandom(4) devices can be exploited to replay data distributed during subsequent reads. Affected: FreeBSD 5.5, 6.1–6.3, and 7.0 beta4. Impact: local adversaries could deduce fragments of previously rea...
FreeBSD-SA-07:09.random
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-07:09.random Security Advisory The FreeBSD Project Topic: Random value disclosure Category: core Module: sysdevrandom Announced: 2007-11-29 Credits: Robert Woolle...
CVE-2007-6044
Multiple unspecified vulnerabilities in IBM WebSphere MQ 6.0 have unknown impact and remote attack vectors involving "memory corruption." NOTE: as of 20071116, the only disclosure is a vague pre-advisory with no actionable information. However, since it is from a well-known researcher, it is bein...
CVE-2007-6030
Unspecified vulnerability in Weird Solutions BOOTPTurbo 1.2 has unknown impact and remote attack vectors. NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been...
rPSA-2007-0242-1 php5 php5-cgi php5-mysql php5-pear php5-pgsql php5-soap php5-xsl
rPath Security Advisory: 2007-0242-1 Published: 2007-11-19 Products: rPath Appliance Platform Linux Service 1 rPath Linux 1 Rating: Minor Exposure Level Classification: Remote Deterministic Denial of Service Updated Versions: php5=conary.rpath.com@rpl:1/5.2.5-1-1...
Design/Logic Flaw
Unspecified vulnerability in BitDefender allows attackers to execute arbitrary code via unspecified vectors, aka EEYEB-20071024. NOTE: as of 20071029, the only disclosure is a vague pre-advisory with no actionable information. However, since it is from a well-known researcher, it is being assigne...
SuSE Security Update: Kernel Update for SUSE Linux 10.1 (kernel-4193)
This kernel update brings the kernel to the one shipped with SLES 10 Service Pack 1 and also fixes the following security problems: - CVE-2007-2242: The IPv6 protocol allows remote attackers to cause a denial of service via crafted IPv6 type 0 route headers IPV6RTHDRTYPE0 that create network...
[Full-disclosure] CallManager and OpeSer toll fraud and authentication forward attack
MADYNES Security Advisory : SIP toll fraud and authentication forward attack Date of Discovery 5 May, 2007 Vendor1 Cisco was informed on 22 May 2007 Vendor 2 OpenSer, voice-systems was informed in 4 th October 2007 ID: KIPH11 Affected products CallManager: System version: 5.1.1.3000-5...
CVE-2002-2245
NetBSD ftpd is affected on versions 1.5 through 1.5.3 and 1.6. The issue arises because the FTP server does not properly quote a digit in the response to a STAT command for a filename containing a carriage return followed by a digit, which can cause firewalls and other intermediary devices to los...
Cross site scripting
Cross-site scripting XSS vulnerability in the subscription functionality in the Project issue tracking module before 4.7.x-1.5, 4.7.x-2.x before 4.7.x-2.5, and 5.x-1.x before 5.x-1.1 for Drupal allows remote authenticated users with project create or edit permissions to inject arbitrary web scrip...
CVE-2007-5228
Cross-site scripting XSS vulnerability in the subscription functionality in the Project issue tracking module before 4.7.x-1.5, 4.7.x-2.x before 4.7.x-2.5, and 5.x-1.x before 5.x-1.1 for Drupal allows remote authenticated users with project create or edit permissions to inject arbitrary web scrip...
CVE-2007-5228
CVE-2007-5228 is a Drupal XSS vulnerability in the subscription functionality of the Project issue tracking module. The issue enables remote authenticated users with project create or edit permissions to inject arbitrary web script or HTML via unspecified vectors in the (1) individual and (2) ove...
CVE-2007-5228
Cross-site scripting XSS vulnerability in the subscription functionality in the Project issue tracking module before 4.7.x-1.5, 4.7.x-2.x before 4.7.x-2.5, and 5.x-1.x before 5.x-1.1 for Drupal allows remote authenticated users with project create or edit permissions to inject arbitrary web scrip...
GLSA-200709-18 : Bugzilla: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-200709-18 Bugzilla: Multiple vulnerabilities Masahiro Yamada found that from the 2.17.1 version, Bugzilla does not properly sanitize the content of the 'buildid' parameter when filing bugs CVE-2007-4543. The next two vulnerabiliti...
SA-2007-021: Project issue tracking - XSS vulnerabilities in subscription forms.
The Project issue tracking module provides a subscription functionality enabling users to sign up for e-mail notification of issue updates. The subscriptions can be edited on both an individual or overview form. Users who have permissions to create or edit projects may be able to inject arbitrary...
[SECURITY] Fedora 7 Update: bugzilla-3.0.2-0.fc7
Bugzilla is a popular bug tracking system used by multiple open source projects. It requires a database engine installed - either MySQL or PostgreSQL. Without one of these database engines, Bugzilla will not work...
