CVE-2007-5237

Java Web Start in Sun JDK and JRE 6 Update 2 and earlier does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to read and modify local files via an untrusted application, aka "two vulnerabilities."...

CVE-2007-5238

Java Web Start in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, and SDK and JRE 1.4.215 and earlier does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to obtain sensitive information the Java Web...

CVE-2007-5155

IceGUI.DLL in ICEOWS 4.20b invokes a function with incorrect arguments, which allows user-assisted remote attackers to execute arbitrary code via a long filename in the header of an ACE archive, which triggers a stack-based buffer overflow...

Code injection

Mail in Apple iPhone 1.1.1 allows remote user-assisted attackers to force the iPhone user to make calls to arbitrary telephone numbers via a "tel:" link, which does not prompt the user before dialing the number...

CVE-2007-3755

Mail in Apple iPhone 1.1.1 allows remote user-assisted attackers to force the iPhone user to make calls to arbitrary telephone numbers via a "tel:" link, which does not prompt the user before dialing the number...

CVE-2007-3757

CVE-2007-3757 describes a vulnerability in Apple iPhone 1.1.1 where the embedded Safari browser mishandles tel: links, allowing a crafted link to cause the user to initiate a call to a different number than the one displayed. The issue affects the iPhone’s handling of tel: hyperlinks; exploitatio...

CVE-2007-3757

Safari in Apple iPhone 1.1.1 allows remote user-assisted attackers to trick the iPhone user into making calls to arbitrary telephone numbers via a crafted "tel:" link that causes iPhone to display a different number than the number that will be dialed...

CVE-2007-3755

The CVE-2007-3755 issue affects the Apple iPhone’s Mail client (around v1.1.1) where embedded tel: links can trigger phone calls without user confirmation. The root cause is processing tel: hyperlinks in the Mail client that allows remote user-assisted attackers to cause the device to dial arbitr...

CVE-2007-5093

The disconnect method in the Philips USB Webcam pwc driver in Linux kernel 2.6.x before 2.6.22.6 "relies on user space to close the device," which allows user-assisted local attackers to cause a denial of service USB subsystem hang and CPU consumption in khubd by not closing the device after the...

CVE-2007-4981

Cross-site scripting XSS vulnerability in the save function in Obedit 3.03 allows user-assisted remote attackers to inject arbitrary web script or HTML via unknown vectors, as demonstrated by a SCRIPT element in an unspecified context when saving a document. NOTE: because the details of the attac...

CVE-2007-4981

The vulnerability CVE-2007-4981 affects Obedit 3.03 and is a Cross-site Scripting (XSS) flaw in the save function. The issue allows user-assisted remote attackers to inject arbitrary script/HTML via unknown vectors when saving a document, demonstrated by a SCRIPT element in an unspecified context...

Code injection

Unspecified vulnerability in RemoteDocs R-Viewer before 1.6.3768 allows user-assisted remote attackers to execute arbitrary code via a crafted RDZ archive in which the first file has an executable extension...

CVE-2007-4750

Unspecified vulnerability in RemoteDocs R-Viewer before 1.6.3768 allows user-assisted remote attackers to execute arbitrary code via a crafted RDZ archive in which the first file has an executable extension...

CVE-2007-4750

Affected product: RemoteDocs R-Viewer (Windows) prior to 1.6.3768. Issue: design flaw in RDZ handling can execute code when opening a crafted RDZ archive, with the first file’s extension triggering execution; also exists potential leakage of unencrypted document copies from temporary directories....

CVE-2007-4750

Unspecified vulnerability in RemoteDocs R-Viewer before 1.6.3768 allows user-assisted remote attackers to execute arbitrary code via a crafted RDZ archive in which the first file has an executable extension...

CVE-2007-4904

RealNetworks RealPlayer 10.1.0.3114 and earlier, and Helix Player 1.0.6.778 on Fedora Core 6 FC6 and possibly other platforms, allow user-assisted remote attackers to cause a denial of service application crash via a malformed .au file that triggers a divide-by-zero error...

CVE-2007-4884

Media Player Classic MPC allows user-assisted remote attackers to cause a denial of service application crash via a malformed .au file that triggers a divide-by-zero error...

CVE-2007-4735

Buffer overflow in Next Generation Software Virtual DJ VDJ 5.0 allows user-assisted remote attackers to execute arbitrary code via a long file path in an m3u file...

CVE-2007-2931

Heap-based buffer overflow in Microsoft MSN Messenger 6.2, 7.0, and 7.5, and Live Messenger 8.0 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors involving video conversation handling in Web Cam and video chat sessions...

CVE-2007-4134

Directory traversal vulnerability in extract.c in star before 1.5a84 allows user-assisted remote attackers to overwrite arbitrary files via certain //.. slash slash dot dot sequences in directory symlinks in a TAR archive...