Yahoo! Widgets YDP YDPCTL.YDPControl.1 ActiveX (YDPCTL.dll) Buffer Overflow

The remote host contains the YDP ActiveX control, distributed as a part of Yahoo! Widgets. The version of this control installed on the remote host reportedly fails to validate input to the 'GetComponentVersion' method before storing it in a 512-byte buffer. If an attacker can trick a user on the...

Yahoo! Widgets Engine 4.0.3 YDPCTL.DLL ActiveX Control Buffer Overflow Vulnerability

Yahoo! Widgets Engine 4.0.3 YDPCTL.DLL ActiveX Control Buffer Overflow Vulnerability. CVE-2007-4034. Remote exploit for windows platform source: http://www.securityfocus.com/bid/25086/info Yahoo! Widgets Engine is prone to a buffer-overflow vulnerability because it fails to bounds-check...

CVE-2007-3261: Undefined Security Weakness

Cross-site scripting XSS vulnerability in widgets/widgetsearch.php in dKret before 2.6 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO PHPSELF...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Build it Fast bif3 0.4.1 allow remote attackers to execute arbitrary PHP code via a URL in 1 the peardir parameter to Base/Application.php, or the 2 sysdir parameter to a Footer.php, b widget.BifContainer.php, c widget.BifRoot.php, d...

CVE-2007-2762

Multiple PHP remote file inclusion vulnerabilities in Build it Fast bif3 0.4.1 allow remote attackers to execute arbitrary PHP code via a URL in 1 the peardir parameter to Base/Application.php, or the 2 sysdir parameter to a Footer.php, b widget.BifContainer.php, c widget.BifRoot.php, d...

CVE-2007-2762

Multiple PHP remote file inclusion vulnerabilities in Build it Fast bif3 0.4.1 allow remote attackers to execute arbitrary PHP code via a URL in 1 the peardir parameter to Base/Application.php, or the 2 sysdir parameter to a Footer.php, b widget.BifContainer.php, c widget.BifRoot.php, d...

Fedora Core 5 : kdebase-3.5.3-0.3.fc5 (2006-726)

Thu Jun 15 2006 Than Ngo 6:3.5.3-0.3.fc5 - fix BR - Wed Jun 14 2006 Than Ngo 6:3.5.3-0.2.fc5 - apply patch to to fix 194659, CVE-2006-2449 KDM symlink attack vulnerability thanks to KDE security team - Thu Jun 8 2006 Than Ngo 6:3.5.3-0.1.fc5 - update to 3.5.3 - Fri May 12 2006 Than Ngo...

CVE-2006-4287: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in NES Game and NES System c108122 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 phphtmllib parameter to a phphtmllib/includes.php; tagutils/ scripts including b divtagutils.php, c formutils.php, d...

CVE-2005-1727: Undefined Security Weakness

Apple Mac OS X 10.4.x up to 10.4.1 sets insecure world- and group-writable permissions for the 1 system cache folder and 2 Dashboard system widgets, which allows local users to conduct unauthorized file operations via "file race conditions."...

CVE-2005-1933

Dashboard in Apple Mac OS X Tiger 10.4 allows attackers to execute arbitrary commands by overriding the behavior of system widgets via a user widget with the same bundle identifier CFBundleIdentifier, a different vulnerability than CVE-2005-1474...

CVE-2005-1474

Dashboard in Apple Mac OS X 10.4.1 allows remote attackers to install widgets via Safari without prompting the user, a different vulnerability than CVE-2005-1933...

CVE-2005-1474

In CVE-2005-1474, Apple Mac OS X 10.4.1’s Dashboard allows remote widget installation through Safari without user prompts, enabling execution or installation of user widgets that can override system widgets. The vulnerability stems from Safari automatically handling widget installation and widget...

CVE-2005-1933

Dashboard in Apple Mac OS X Tiger 10.4 allows attackers to execute arbitrary commands by overriding the behavior of system widgets via a user widget with the same bundle identifier CFBundleIdentifier, a different vulnerability than CVE-2005-1474...

CVE-2005-1727

Apple Mac OS X 10.4.x up to 10.4.1 sets insecure world- and group-writable permissions for the 1 system cache folder and 2 Dashboard system widgets, which allows local users to conduct unauthorized file operations via "file race conditions."...

Apple Safari automatically installs Dashboard widgets

Overview Apple Safari on Mac OS X Tiger automatically installs Dashboard widgets without user intervention or notice. Description DashboardDashboard is a new feature introduced in Apple Mac OS X Tiger 10.4. Dashboard is a collection of applications called "widgets." The system-installed widgets a...

Apple Mac OSX executes arbitrary widget with same "bundle identifier" as system widget

Overview Apple Mac OS X Tiger Dashboard executes arbitrary widgets with the same "bundle identifier" as a system widget. This can allow a user-installed widget to override a system-installed one. Description DashboardDashboard is a new feature introduced in Apple Mac OS X Tiger 10.4. Dashboard is...