Mozilla Foundation Security Advisory 2007-27

Mozilla Foundation Security Advisory 2007-27 Title: Unescaped URIs passed to external programs Impact: Critical Announced: July 30, 2007 Reporter: Jesper Johansson Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 2.0.0.6 Thunderbird 2.0.0.6 Thunderbird 1.5.0.13 SeaMonkey 1.1.4...

Unfixed XSS vulnerability at www.hiphop4.us

Security researcher St@rExT, has submitted on 19/07/2007 a cross-site-scripting XSS vulnerability affecting www.hiphop4.us, which at the time of submission ranked 7309568 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 03/08/2007. It is current...

US-CERT Technical Cyber Security Alert TA07-199A -- Mozilla Updates for Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA07-199A Mozilla Updates for Multiple Vulnerabilities Original release date: July 18, 2007 Last revised: -- Source: US-CERT Systems Affected Mozilla Firefox Mozilla Thunderbird Other products...

US-CERT Technical Cyber Security Alert TA07-151A -- Mozilla Updates for Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA07-151A Mozilla Updates for Multiple Vulnerabilities Original release date: May 31, 2007 Last revised: -- Source: US-CERT Systems Affected Mozilla Firefox Mozilla Thunderbird Mozilla SeaMonk...

US-CERT Technical Cyber Security Alert TA07-093A -- Microsoft Update for Windows Animated Cursor Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA07-093A Microsoft Update for Windows Animated Cursor Vulnerability Original release date: April 3, 2007 Last revised: -- Source: US-CERT Systems Affected Microsoft Windows 2000, XP, Server...

[NB07-22] Multiple vulnerabilities in NETxEIB OPC server

Multiple vulnerabilities in NETxEIB OPC server ============================================== OPC servers provide a standard way to interoperate automation and control systems, bridging data from several industrial protocols such as DNP3, MODBUS, etc. to a more standard data access interface. The...

CVE-2007-1132

Multiple cross-site scripting XSS vulnerabilities in the "Contact Us" functionality in MTCMS 2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 message and 2 title fields...

CVE-2007-1132

Multiple cross-site scripting XSS vulnerabilities in the "Contact Us" functionality in MTCMS 2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 message and 2 title fields...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the "Contact Us" functionality in MTCMS 2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 message and 2 title fields...

CVE-2007-1132

CVE-2007-1132 pertains to multiple XSS vulnerabilities in the MTCMS 2.2 "Contact Us" feature, affecting the (1) message and (2) title fields. The root cause is not explicitly detailed in the provided documents beyond the XSS existence; no payloads, environment constraints, or affected subversions...

CVE-2007-1132

Multiple cross-site scripting XSS vulnerabilities in the "Contact Us" functionality in MTCMS 2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 message and 2 title fields...

MTCMS multiple upload vulnerabilities

avatar upload vulnerability: upload any kind of file in: site.com/MTCMS-V2.2/?a=gallery&b=adddown and approuved or not it will be here : /uploads/pictures/ same thing for : add link /index.php?a=links&b=addlink xss permanent on Contact Us : message & title fields are vulnerable to an xss attack...

CVE-2007-1132: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the "Contact Us" functionality in MTCMS 2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 message and 2 title fields...

InstallShield InstallFromTheWeb ActiveX Control Multiple Overflows

InstallFromTheWeb IFTW, a web-enabled software installation product from InstallShield, is installed on the remote host. The version of InstallFromTheWeb on the remote host includes an ActiveX control that is reportedly affected by multiple and, as yet, unspecified buffer overflow vulnerabilities...

NCTAudioFile2 v2.x ActiveX Control SetFormatLikeSample() Buffer Overflow

This module exploits a stack buffer overflow in the NCTAudioFile2.Audio ActiveX Control provided by various audio applications. By sending an overly long string to the "SetFormatLikeSample" method, an attacker may be able to execute arbitrary code. Module Options msf use...

US-CERT Technical Cyber Security Alert TA07-022A

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA07-022A Sun Updates for Multiple Vulnerabilities in Java Original release date: January 22, 2007 Last revised: -- Source: US-CERT Systems Affected Sun Java Runtime Environment versions JDK a...

CVE-2007-0350: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in a index.php and b dl.php in SmE FileMailer 1.21 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 ps, 2 us, 3 f, or 4 code parameter. NOTE: the us vector in index.php is already covered by CVE-2007-0346...

CVE-2007-0346: Undefined Security Weakness

SQL injection vulnerability in index.php in SmE FileMailer 1.21 allows remote attackers to execute arbitrary SQL commands via the us parameter...

Unfixed XSS vulnerability at www.niit.com

Security researcher RubberDuck, has submitted on 01/04/2007 a cross-site-scripting XSS vulnerability affecting www.niit.com, which at the time of submission ranked 95279 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 01/04/2007. It is currentl...

DodosMail <= 2.0.1 (dodosmail.php) Remote File Include Vulnerability

No description provided by source. --------------------------------------|| Viva Palestine ||----------------------------------------- --------------------------------------|| Free Saddam Hussien ||----------------------------------------- DodosMail = 2.0.1dodosmail.php Remote File Include...