The file watch implementation in the audit subsystem (auditctl -w) in the Red Hat Enterprise Linux (RHEL) 4 kernel 2.6.9 allows local users to cause a denial of service (kernel panic) by replacing a watched file, which does not cause the watch on the old inode to be dropped.Successful exploitation requires that the attacker previously created a watch for a file.RHSA-2007:0085http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=22312910177052273724300oval:org.mitre.oval:def:956033031Multiple heap-based buffer overflows in WordPerfect Document importer/exporter (libwpd) before 0.8.9 allow user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted WordPerfect file in which values to loop counters are not properly handled in the (1) WP3TablesGroup::_readContents and (2) WP5DefinitionGroup_DefineTablesSubGroup::WP5DefinitionGroup_DefineTablesSubGroup functions. NOTE: the integer overflow has been split into CVE-2007-1466.This vulnerability has been addressed by the vendor through a product update: http://sourceforge.net/projects/libwpd/ ADV-2007-1339ADV-2007-1032ADV-2007-0976USN-437-110177892300620070316 rPSA-2007-0057-1 libwpdRHSA-2007:0055MDKSA-2007:064MDKSA-2007:063GLSA-200704-12DSA-1270DSA-1268102863http://sourceforge.net/project/shownotes.php?release_id=494122SSA-2007-085-02GLSA-200704-072490624856247942461324593245912458824581245802457324572245572450724465oval:org.mitre.oval:def:11535SUSE-SA:2007:02320070316 Multiple Vendor libwpd Multiple Buffer Overflow VulnerabilitiesFEDORA-2007-350pam_unix.so in Linux-PAM 0.99.7.0 allows context-dependent attackers to log into accounts whose password hash, as stored in /etc/passwd or /etc/shadow, has only two characters.[pam-list] 20070123 Linux-PAM 0.99.7.1 releasedADV-2007-0323[fedora-devel-list] 20070122 Re: rawhide report: 20070120 changes[fedora-devel-list] 20070122 Re: rawhide report: 20070120 changes32017linuxpam-pamunix-security-bypass(31739)22204SUSE-SR:2007:00323858The NFS client implementation in the kernel in Red Hat Enterprise Linux (RHEL) 3, when a filesystem is mounted with the noacl option, checks permissions for the open system call via vfs_permission (mode bits) data rather than an NFS ACCESS call to the server, which allows local client processes to obtain a false success status from open calls that the server would deny, and possibly obtain sensitive information about file permissions on the server, as demonstrated in a root_squash environment. NOTE: it is uncertain whether any scenarios involving this issue cross privilege boundaries.https://bugzilla.redhat.com/show_bug.cgi?id=199715Multiple buffer overflows in the (1) read and (2) write handlers in the Omnikey CardMan 4040 driver in the Linux kernel before 2.6.21-rc3 allow local users to gain privileges.http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.21-rc3https://issues.rpath.com/browse/RPL-1035kernel-cardman4040drivers-bo(32880)ADV-2007-0872USN-489-1USN-486-12287020070309 Buffer Overflow in Linux Drivers for Omnikey CardMan 4040 (CVE-2007-0005)20070615 rPSA-2007-0124-1 kernel xenRHSA-2007:009933023MDKSA-2007:078DSA-12862613926133256912507824901247772451824436oval:org.mitre.oval:def:11238FEDORA-2007-336FEDORA-2007-335The key serial number collision avoidance code in the key_alloc_serial function in Linux kernel 2.6.9 up to 2.6.20 allows local users to cause a denial of service (crash) via vectors that trigger a null dereference, as originally reported as "spinlock CPU recursion."The scheme for selecting serial numbers was changed from incrementing a counter to random number selection, increasing the likelihood of a serial number collision.https://issues.rpath.com/browse/RPL-1097https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=227495USN-451-12253920070615 rPSA-2007-0124-1 kernel xenRHSA-2007:0099RHSA-2007:0085SUSE-SA:2007:021MDKSA-2007:060MDKSA-2007:0472569124752245472448224429243002425924109oval:org.mitre.oval:def:9829http://bugzilla.kernel.org/show_bug.cgi?id=7727gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) gnucash.trace, (2) qof.trace, and (3) qof.trace.[PID] temporary files.24225https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=223233ADV-2007-0653gnucash-symlink(32558)22610MDKSA-2007:046http://sourceforge.net/project/shownotes.php?group_id=192&release_id=4874462431724226FEDORA-2007-256Integer underflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, SeaMonkey before 1.0.8, Thunderbird before 1.5.0.10, and certain Sun Java System server products before 20070611, allows remote attackers to execute arbitrary code via a crafted SSLv2 server message containing a public key that is too short to encrypt the "Master Secret", which results in a heap-based overflow.VU#377812http://www.mozilla.org/security/announce/2007/mfsa2007-06.htmlhttps://issues.rpath.com/browse/RPL-1103https://issues.rpath.com/browse/RPL-1081https://bugzilla.mozilla.org/show_bug.cgi?id=364319nss-mastersecret-bo(32666)ADV-2007-2141ADV-2007-1165ADV-2007-0719ADV-2007-0718USN-431-1USN-428-110176962269420070303 rPSA-2007-0040-3 firefox thunderbird20070226 rPSA-2007-0040-1 firefoxRHSA-2007:0108RHSA-2007:0097RHSA-2007:0079RHSA-2007:007832105MDKSA-2007:052GLSA-200703-22DSA-1336102856GLSA-200703-182470324650245622452224410243952438924384243432433324328243202429324290242872427724253242522423824205RHSA-2007:0077oval:org.mitre.oval:def:10502SUSE-SA:2007:01920070223 Mozilla Network Security Services SSLv2 Client Integer Underflow VulnerabilityHPSBUX02153FEDORA-2007-293FEDORA-2007-281FEDORA-2007-279FEDORA-2007-27820070301-01-PSUSE-SA:2007:022MDKSA-2007:050102945SSA:2007-066-03SSA:2007-066-04SSA:2007-066-0525597255882445724456244552440624342HPSBUX02153FEDORA-2007-309FEDORA-2007-30820070202-01-PStack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, SeaMonkey before 1.0.8, and certain Sun Java System server products before 20070611, allows remote attackers to execute arbitrary code via invalid "Client Master Key" length values.VU#592796https://issues.rpath.com/browse/RPL-1103https://issues.rpath.com/browse/RPL-1081https://bugzilla.mozilla.org/show_bug.cgi?id=364323nss-clientmasterkey-bo(32663)ADV-2007-2141ADV-2007-1165ADV-2007-0719ADV-2007-0718USN-431-1USN-428-1101769620070303 rPSA-2007-0040-3 firefox thunderbird20070226 rPSA-2007-0040-1 firefoxRHSA-2007:0108RHSA-2007:0097RHSA-2007:0079RHSA-2007:007832106http://www.mozilla.org/security/announce/2007/mfsa2007-06.htmlMDKSA-2007:052MDKSA-2007:050GLSA-200703-22DSA-1336102945102856SSA:2007-066-03SSA:2007-066-04SSA:2007-066-05GLSA-200703-18247032465024562245222441024395243892438424343243332429324290242872427724253RHSA-2007:0077oval:org.mitre.oval:def:10174SUSE-SA:2007:01920070223 Mozilla Network Security Services SSLv2 Server Stack Overflow VulnerabilityHPSBUX02153FEDORA-2007-309FEDORA-2007-308FEDORA-2007-279FEDORA-2007-27820070301-01-P20070202-01-PSUSE-SA:2007:02225597255882445724456244552440624342HPSBUX02153The GdkPixbufLoader function in GIMP ToolKit (GTK+) in GTK 2 (gtk2) before 2.4.13 allows context-dependent attackers to cause a denial of service (crash) via a malformed image file.https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218932ADV-2007-0331RHSA-2007:0019oval:org.mitre.oval:def:1032531621https://issues.rpath.com/browse/RPL-984USN-415-122209SUSE-SR:2007:002MDKSA-2007:039101755224095240102400623984239352393323884DSA-1256The web portal interface in Citrix Access Gateway (aka Citrix Advanced Access Control) before Advanced Edition 4.5 HF1 places a session ID in the URL, which allows context-dependent attackers to hijack sessions by reading "residual information", including the a referer log, browser history, or browser cache.2497526143citrix-access-unspeci-information-disclosure(35510)ADV-2007-258320071022 Corsaire Security Advisory - Citrix Access Gateway session ID disclosure issuehttp://support.citrix.com/article/CTX113814http://support.citrix.com/article/CTX112803101843545288Sun JRE 5.0 before update 14 allows remote attackers to cause a denial of service (Internet Explorer crash) via an object tag with an encoded applet and an undefined name attribute, which triggers a NULL pointer dereference in jpiexp32.dll when the applet is decoded and passed to the JVM.sun-java-jpiexp32-dos(39549)2718520080108 Corsaire Security Advisory: Sun J2RE DoS issue3527ChainKey Java Code Protection allows attackers to decompile Java class files via a Java class loader with a modified defineClass method that saves the bytecode to a file before it is passed to the JVM.20070112 Re: Corsaire Security Advisory: ChainKey Java Code Protection Bypass issue20070112 Corsaire Security Advisory: ChainKey Java Code Protection Bypass issue33473Buffer overflow in Apple QuickTime 7.1.3 allows remote attackers to execute arbitrary code via a long rtsp:// URI.VU#442497TA07-005Aquicktime-rtsp-url-bo(31203)23540ADV-2007-0001218291017461http://projects.info-pull.com/moab/MOAB-01-01-2007.htmlhttp://landonf.bikemonkey.org/code/macosx/MOAB_Day_1.20070102060815.15950.zadder.local.html31023http://secunia.com/blog/7/3064APPLE-SA-2007-01-23http://isc.sans.org/diary.html?storyid=2094http://docs.info.apple.com/article.html?artnum=304989Stack-based buffer overflow in MoviePlay 4.76 allows remote attackers to execute arbitrary code via a long filename in a LST file.2184040512295932547Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an invalid URI, as demonstrated by a udp://-- URI in an M3U file.http://www.videolan.org/patches/vlc-0.8.6-MOAB-02-01-2007.patchvlcmediaplayer-udp-format-string(31226)ADV-2007-0026http://www.videolan.org/sa0701.html[vlc-devel] 20070102 Security hole in VLC media player for Mac...21852SUSE-SA:2007:013DSA-1252http://trac.videolan.org/vlc/changeset/184811017464GLSA-200701-2423971239102382923592http://projects.info-pull.com/moab/MOAB-02-01-2007.htmloval:org.mitre.oval:def:1431331163http://landonf.bikemonkey.org/code/macosx/MOAB_Day_2.20070103045559.6753.timor.htmlhttp://applefun.blogspot.com/2007/01/moab-02-01-2007-vlc-media-player-udp.htmlStack-based buffer overflow in the NCTAudioFile2.AudioFile ActiveX control (NCTAudioFile2.dll), as used by multiple products, allows remote attackers to execute arbitrary code via a long argument to the SetFormatLikeSample function. NOTE: the products include (1) NCTsoft NCTAudioStudio, NCTAudioEditor, and NCTDialogicVoice; (2) Magic Audio Recorder, Music Editor, and Audio Converter; (3) Aurora Media Workshop; DB Audio Mixer And Editor; (4) J. Hepple Products including Fx Audio Editor and others; (5) EXPStudio Audio Editor; (6) iMesh; (7) Quikscribe; (8) RMBSoft AudioConvert and SoundEdit Pro 2.1; (9) CDBurnerXP; (10) Code-it Software Wave MP3 Editor and aBasic Editor; (11) Movavi VideoMessage, DVD to iPod, and others; (12) SoftDiv Software Dexster, iVideoMAX, and others; (13) Sienzo Digital Music Mentor (DMM); (14) MP3 Normalizer; (15) Roemer Software FREE and Easy Hi-Q Recorder, and Easy Hi-Q Converter; (16) Audio Edit Magic; (17) Joshua Video and Audio Converter; (18) Virtual CD; (19) Cheetah CD and DVD Burner; (20) Mystik Media AudioEdit Deluxe, Blaze Media, and others; (21) Power Audio Editor; (22) DanDans Digital Media Full Audio Converter, Music Editing Master, and others; (23) Xrlly Software Text to Speech Makerand Arial Sound Recorder / Audio Converter; (24) Absolute Sound Recorder, Video to Audio Converter, and MP3 Splitter; (25) Easy Ringtone Maker; (26) RecordNRip; (27) McFunSoft iPod Audio Studio, Audio Recorder for Free, and others; (28) MP3 WAV Converter; (29) BearShare 6.0.2.26789; and (30) Oracle Siebel SimBuilder and CRM 7.x.VU#292713ADV-2007-0310http://secunia.com/secunia_research/2007-9/advisory/http://secunia.com/secunia_research/2007-8/advisory/http://secunia.com/secunia_research/2007-7/advisory/http://secunia.com/secunia_research/2007-6/advisory/http://secunia.com/secunia_research/2007-5/advisory/http://secunia.com/secunia_research/2007-4/advisory/http://secunia.com/secunia_research/2007-34/advisory/http://secunia.com/secunia_research/2007-33/advisory/http://secunia.com/secunia_research/2007-32/advisory/http://secunia.com/secunia_research/2007-31/advisory/http://secunia.com/secunia_research/2007-30/advisory/http://secunia.com/secunia_research/2007-3/advisory/http://secunia.com/secunia_research/2007-29/advisory/http://secunia.com/secunia_research/2007-28/advisory/http://secunia.com/secunia_research/2007-27/advisory/http://secunia.com/secunia_research/2007-26/advisory/http://secunia.com/secunia_research/2007-25/advisory/http://secunia.com/secunia_research/2007-24/advisory/http://secunia.com/secunia_research/2007-23/advisory/http://secunia.com/secunia_research/2007-22/advisory/http://secunia.com/secunia_research/2007-21/advisory/http://secunia.com/secunia_research/2007-20/advisory/http://secunia.com/secunia_research/2007-2/advisory/http://secunia.com/secunia_research/2007-19/advisory/http://secunia.com/secunia_research/2007-18/advisory/http://secunia.com/secunia_research/2007-17/advisory/http://secunia.com/secunia_research/2007-16/advisory/http://secunia.com/secunia_research/2007-15/advisory/http://secunia.com/secunia_research/2007-14/advisory/http://secunia.com/secunia_research/2007-13/advisory/http://secunia.com/secunia_research/2007-12/advisory/http://secunia.com/secunia_research/2007-11/advisory/http://secunia.com/secunia_research/2007-10/advisory/http://secunia.com/blog/6/30459304503044730446304393042430406235682355723553235522355123543235342353223530235162351123495234932348523475nctaudiofile2-multiple-bo(31707)238922219620070124 Re: Secunia Research: NCTsoft Products NCTAudioFile2 ActiveXControl Buffer Overflow20070124 Secunia Research: Sienzo Digital Music Mentor NCTAudioFile2ActiveX Control Buffer Overflow20070124 Secunia Research: NCTsoft Products NCTAudioFile2 ActiveX ControlBuffer Overflowhttp://secunia.com/secunia_research/2007-50/advisory/2840726101261002604625993237952375323745235652356223561235602355823554235502354823546235442354223541235362353522922Multiple heap-based buffer overflows in rumpusd in Rumpus 5.1 and earlier (1) allow remote authenticated users to execute arbitrary code via a long LIST command and other unspecified requests to the FTP service, and (2) allow remote attackers to execute arbitrary code via unspecified requests to the HTTP service.rumpus-ftp-http-bo(31594)http://projects.info-pull.com/moab/MOAB-18-01-2007.html3269232689rumpus-ftp-service-bo(31594)23842Heap-based buffer overflow in the SFTP protocol handler for Panic Transmit (Transmit.app) up to 3.5.5 allows remote attackers to execute arbitrary code via a long ftps:// URL.ADV-2007-02732214523861http://projects.info-pull.com/moab/MOAB-19-01-2007.html32694transmit-url-handler-bo(31673)3160Format string vulnerability in Apple iChat 3.1.6 allows remote attackers to cause a denial of service (null pointer dereference and application crash) and possibly execute arbitrary code via format string specifiers in an aim:// URI.TA07-047AVU#794752ADV-2007-0274http://projects.info-pull.com/moab/MOAB-20-01-2007.html32715ichat-aim-format-string(31679)10176612214624198APPLE-SA-2007-02-15http://docs.info.apple.com/article.html?artnum=305102Untrusted search path vulnerability in writeconfig in Apple Mac OS X 10.4.8 allows local users to gain privileges via a modified PATH that points to a malicious launchctl program.TA07-109Amacos-writeconfig-privilege-escalation(31677)ADV-2007-1470ADV-2007-0074101794122148316052496623793http://projects.info-pull.com/moab/MOAB-21-01-2007.htmlAPPLE-SA-2007-04-19http://docs.info.apple.com/article.html?artnum=305391The CFUserNotificationSendRequest function in UserNotificationCenter.app in Apple Mac OS X 10.4.8, when used in combination with diskutil, allows local users to gain privileges via a malicious InputManager in Library/InputManagers in a user's home directory, which is executed when Cocoa applications attempt to notify the user.TA07-047AVU#315856ADV-2007-0074http://projects.info-pull.com/moab/MOAB-22-01-2007.htmlmacos-inputmanager-privilege-escalation(31676)221883269510175422419823846APPLE-SA-2007-02-15http://docs.info.apple.com/article.html?artnum=305102Integer overflow in the Vector Markup Language (VML) implementation (vgx.dll) in Microsoft Internet Explorer 5.01, 6, and 7 on Windows 2000 SP4, XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted web page that contains unspecified integer properties that cause insufficient memory allocation and trigger a buffer overflow, aka the "VML Buffer Overrun Vulnerability."VU#122084TA07-009Aie-vml-record-bo(31287)2193031250MS07-00492996910174892367720070109 Microsoft Windows VML Element Integer Overflow VulnerabilityADV-2007-0129ADV-2007-0105SSRT071296SSRT07129620070117 Re: MS07-004 VML Integer Overflow Exploit20070116 MS07-004 VML Integer Overflow Exploithttp://support.avaya.com/elmodocs2/security/ASA-2007-009.htmoval:org.mitre.oval:def:1058The MFC component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 and Visual Studio .NET 2000, 2002 SP1, 2003, and 2003 SP1 allows user-assisted remote attackers to execute arbitrary code via an RTF file with a malformed OLE object that triggers memory corruption. NOTE: this might be due to a stack-based buffer overflow in the AfxOleSetEditMenu function in MFC42u.dll.TA07-044AVU#932041MS07-012ADV-2007-05811017638224763188724150oval:org.mitre.oval:def:157The OLE Dialog component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 allows user-assisted remote attackers to execute arbitrary code via an RTF file with a malformed OLE object that triggers memory corruption.TA07-044AVU#497756MS07-011ADV-2007-05801017637224833188524147oval:org.mitre.oval:def:540Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows remote attackers to execute arbitrary code via malformed IMDATA records that trigger memory corruption.TA07-009AVU#74996421856MS07-0021017487ADV-2007-0103HPSBST02184HPSBST0218431255oval:org.mitre.oval:def:119Microsoft Excel 2000, 2002, 2003, Viewer 2003, Office 2004 for Mac, and Office v.X for Mac does not properly handle certain opcodes, which allows user-assisted remote attackers to execute arbitrary code via a crafted XLS file, which results in an "Improper Memory Access Vulnerability." NOTE: an early disclosure of this issue used CVE-2006-3432, but only CVE-2007-0028 should be used.VU#493185TA07-009AMS07-002ADV-2007-010321952HPSBST02184SSRT07129631249http://www.fortinet.com/FortiGuardCenter/advisory/FGA-2007-01.htmlhttp://www.fortinet.com/FortiGuardCenter/advisory/FG-2006-30.html101748523676oval:org.mitre.oval:def:768Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via a malformed string, aka "Excel Malformed String Vulnerability."TA07-009AMS07-002ADV-2007-010321877HPSBST02184HPSBST02184312561017487oval:org.mitre.oval:def:1102Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via an Excel file with an out-of-range Column field in certain BIFF8 record types, which references arbitrary memory.TA07-009AVU#302836MS07-00220070109 Microsoft Excel Invalid Column Heap Corruption VulnerabilityADV-2007-010321925HPSBST02184HPSBST02184312571017487oval:org.mitre.oval:def:323Heap-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via a BIFF8 spreadsheet with a PALETTE record that contains a large number of entries.TA07-009AVU#625532MS07-00220070109 Microsoft Excel Long Palette Heap Overflow VulnerabilityADV-2007-010321922SSRT071296HPSBST02184312581017487oval:org.mitre.oval:def:753Microsoft Outlook 2002 and 2003 allows user-assisted remote attackers to execute arbitrary code via a malformed VEVENT record in an .iCal meeting request or ICS file.TA07-009AVU#476900MS07-003ADV-2007-010421931HPSBST02184HPSBST0218431252101748823674oval:org.mitre.oval:def:516Buffer overflow in the Advanced Search (Finder.exe) feature of Microsoft Outlook 2000, 2002, and 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted Outlook Saved Searches (OSS) file that triggers memory corruption, aka "Microsoft Outlook Advanced Find Vulnerability."TA07-009AVU#271860MS07-003ADV-2007-010421936HPSBST02184HPSBST0218420070111 Computer Terrorism (UK) :: Incident Response Centre - Microsoft Outlook Vulnerability31254http://www.computerterrorism.com/research/ct09-01-2007.htm101748823674oval:org.mitre.oval:def:153Word (or Word Viewer) in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, 2004 for Mac, and Works Suite 2004, 2005, and 2006 does not properly handle data in a certain array, which allows user-assisted remote attackers to execute arbitrary code, aka the "Word Array Overflow Vulnerability."TA07-128AVU#260777MS07-024ADV-2007-1709101801323804HPSBST02214SSRT07142234387oval:org.mitre.oval:def:1737Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a large length value in the second (or later) anih block of a RIFF .ANI, cur, or .ico file, which results in memory corruption when processing cursors, animated cursors, and icons, a variant of CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this might be a duplicate of CVE-2007-1765; if so, then CVE-2007-0038 should be preferred.TA07-100ATA07-093ATA07-089AVU#191609windows-ani-code-execution(33301)windows-ani-code-execution(33301)ADV-2007-1215SSRT071354SSRT07135420070402 MS announces out-of-band patch for ANI 0day20070402 More information on ZERT patch for ANI 0day20070331 RE: [Full-disclosure] 0-day ANI vulnerability in Microsoft Windows(CVE-2007-0038)20070331 Re: 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038)20070330 Re: 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038)20070330 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038)33629MS07-017http://www.determina.com/security_center/security_advisories/securityadvisory_0day_032907.asp254224659363420070330 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038)oval:org.mitre.oval:def:1854The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 allows remote attackers to cause a denial of service (crash) via an Internet Calendar (iCal) file containing multiple X-MICROSOFT-CDO-MODPROPS (MODPROPS) properties in which the second MODPROPS is longer than the first, which triggers a NULL pointer dereference and an unhandled exception.TA07-128AMS07-026exchange-ical-dos(33888)ADV-2007-1711101801523808HPSBST02214HPSBST0221420070508 Exchange Calendar MODPROPS Denial of Service (CVE-2007-0039)34390http://www.determina.com/security.research/vulnerabilities/exchange-ical-modprops.html2518320070509 Exchange Calendar MODPROPS Denial of Service (CVE-2007-0039)oval:org.mitre.oval:def:1593The LDAP service in Windows Active Directory in Microsoft Windows 2000 Server SP4, Server 2003 SP1 and SP2, Server 2003 x64 Edition and SP2, and Server 2003 for Itanium-based Systems SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted LDAP request with an unspecified number of "convertible attributes."TA07-191AVU#487905MS07-039ADV-2007-24813596010183552480020070710 Microsoft Windows Active Directory Remote Code Execution26002SSRT071446oval:org.mitre.oval:def:2012The PE Loader service in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to execute arbitrary code via unspecified vectors involving an "unchecked buffer" and unvalidated message lengths, probably a buffer overflow.TA07-191AMS07-040ms-dotnet-pe-loader-bo(34637)ADV-2007-24821018356247782600335954SSRT071446oval:org.mitre.oval:def:2093Interpretation conflict in ASP.NET in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to access configuration files and obtain sensitive information, and possibly bypass security mechanisms that try to constrain the final substring of a string, via %00 characters, related to use of %00 as a string terminator within POSIX functions but a data character within .NET strings, aka "Null Byte Termination Vulnerability."TA07-191AADV-2007-24821018356MS07-040http://security-assessment.com/files/advisories/2007-07-11_Multiple_.NET_Null_Byte_Injection_Vulnerabilities.pdf26003SSRT071446oval:org.mitre.oval:def:2070The Just In Time (JIT) Compiler service in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows user-assisted remote attackers to execute arbitrary code via unspecified vectors involving an "unchecked buffer," probably a buffer overflow, aka ".NET JIT Compiler Vulnerability".TA07-191AMS07-040ms-dotnet-jit-bo(34639)ADV-2007-24821018356248112600335956SSRT071446oval:org.mitre.oval:def:1873Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the (1) FDF, (2) xml, and (3) xfdf AJAX request parameters, following the # (hash) character, aka "Universal CSRF and session riding."http://www.wisec.it/vulns.php?page=9adobe-acrobat-pdf-csrf(31266)ADV-2007-00322185820070103 Adobe Acrobat Reader Plugin - Multiple VulnerabilitiesRHSA-2008:014410174692090GLSA-200701-16290652388223812oval:org.mitre.oval:def:10042SUSE-SA:2007:011http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdfMultiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, for Mozilla Firefox, Microsoft Internet Explorer 6 SP1, Google Chrome, Opera 8.5.4 build 770, and Opera 9.10.8679 on Windows allow remote attackers to inject arbitrary JavaScript and conduct other attacks via a .pdf URL with a javascript: or res: URI with (1) FDF, (2) XML, and (3) XFDF AJAX parameters, or (4) an arbitrarily named name=URI anchor identifier, aka "Universal XSS (UXSS)."TA09-286BVU#815960http://www.wisec.it/vulns.php?page=9RHSA-2007:0017adobe-acrobat-pdf-xss(31271)ADV-2009-2898ADV-2007-0957ADV-2007-00322185820070104 Universal PDF XSS After Party20070103 Adobe Acrobat Reader Plugin - Multiple Vulnerabilities20070103 RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous20070103 Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous20070103 Re: Universal XSS with PDF files: highly dangerous20070103 Universal XSS with PDF files: highly dangerousRHSA-2007:0021http://www.mozilla.org/security/announce/2007/mfsa2007-02.htmlhttp://www.gnucitizen.org/blog/universal-pdf-xss-after-partyhttp://www.gnucitizen.org/blog/danger-danger-danger/http://www.disenchant.ch/blog/hacking-with-browser-plugins/34http://www.adobe.com/support/security/bulletins/apsb09-15.htmlhttp://www.adobe.com/support/security/bulletins/apsb07-01.htmlhttp://www.adobe.com/support/security/advisories/apsa07-02.htmlhttp://www.adobe.com/support/security/advisories/apsa07-01.html102847SSA:2007-066-05102300710174692090GLSA-200701-163375424533244572388223877238122369123483oval:org.mitre.oval:def:9693oval:org.mitre.oval:def:6487SUSE-SA:2007:011HPSBUX02153HPSBUX02153http://googlechromereleases.blogspot.com/2009/01/stable-beta-update-yahoo-mail-and.htmlDouble free vulnerability in the Adobe Acrobat Reader Plugin before 8.0.0, as used in Mozilla Firefox 1.5.0.7, allows remote attackers to execute arbitrary code by causing an error via a javascript: URI call to document.write in the (1) FDF, (2) XML, or (3) XFDF AJAX request parameters.http://www.wisec.it/vulns.php?page=9ADV-2007-0957ADV-2007-003220070103 Adobe Acrobat Reader Plugin - Multiple Vulnerabilitiesoval:org.mitre.oval:def:9684http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdfRHSA-2007:0017adobe-acrobat-msvcrt-code-execution(31272)RHSA-2007:0021http://www.adobe.com/support/security/bulletins/apsb07-01.html10284710174692090GLSA-200701-162453323882238772381223691SUSE-SA:2007:011CRLF injection vulnerability in Adobe Acrobat Reader Plugin before 8.0.0, when used with the Microsoft.XMLHTTP ActiveX object in Internet Explorer, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the javascript: URI in the (1) FDF, (2) XML, or (3) XFDF AJAX request parameters.adobe-acrobat-xmlhttp-response-splitting(31291)ADV-2007-0032101746923882SUSE-SA:2007:011http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdfAdobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, when used with Internet Explorer, Google Chrome, or Opera, allows remote attackers to cause a denial of service (memory consumption) via a long sequence of # (hash) characters appended to a PDF URL, related to a "cross-site scripting issue."TA09-286Bhttp://www.wisec.it/vulns.php?page=9adobe-acrobat-character-dos(31273)ADV-2009-2898ADV-2007-003220070103 Adobe Acrobat Reader Plugin - Multiple Vulnerabilitieshttp://www.adobe.com/support/security/bulletins/apsb09-15.htmlhttp://www.adobe.com/support/security/bulletins/apsb07-01.html10230071017469GLSA-200701-16337542388223812oval:org.mitre.oval:def:634831596SUSE-SA:2007:011http://googlechromereleases.blogspot.com/2009/01/stable-beta-update-yahoo-mail-and.htmlhttp://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf2090Geckovich TaskTracker Pro 1.5 and earlier allows remote attackers to add administrative or other accounts via an Add action with a modified GroupID in a direct request to Customize.asp.tasktrackerpro-customize-auth-bypass(31235)2184723564316823068** DISPUTED ** PHP remote file inclusion vulnerability in index.php in OpenPinboard 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the language parameter. NOTE: this issue has been disputed by the developer and a third party, since the variable is set before use. CVE analysis suggests that there is a small time window of risk before the installation is complete.20070103 OpenPinboard <= Remote File Include20070103 Re: OpenPinboard <= Remote File Include3337520070106 Re: OpenPinboard <= Remote File IncludeFormat string vulnerability in Apple iPhoto 6.0.5 (316), and other versions before 6.0.6, allows remote user-assisted attackers to execute arbitrary code via a crafted photocast with format string specifiers in the title of an RSS iPhoto feed.iphoto-xmltitle-format-string(31281)ADV-2007-00572187120070104 DMA[2007-0104a] - 'iLife iPhoto Photocasing Format String Vulnerability'http://www.digitalmunition.com/DMA[2007-0104a].txt23615http://projects.info-pull.com/moab/MOAB-04-01-2007.html311653080APPLE-SA-2007-03-13http://docs.info.apple.com/article.html?artnum=30521520070104 DMA[2007-0104a] - 'iLife iPhoto Photocasing Format String Vulnerability'SQL injection vulnerability in haberdetay.asp in Vizayn Haber allows remote attackers to execute arbitrary SQL commands via the id parameter.ADV-2007-00152183623576315183061vicayn-haberdetay-sql-injection(31213)SQL injection vulnerability in detail.asp in ASP SiteWare autoDealer 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the iPro parameter.ADV-2007-00162183323572325393062autodealer-detail-sql-injection(31219)Cross-site scripting (XSS) vulnerability in gbrowse.php in Belchior Foundry vCard PRO allows remote attackers to inject arbitrary web script or HTML via the sortby parameter.2184420070101 vBulletin vCard PRO XSS33359vcard-gbrowse-xss(31182)Directory traversal vulnerability in formbankcgi.exe/AbfrageForm in Formbankserver 1.9 allows remote attackers to read arbitrary files via directory traversal sequences in the Name parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.ADV-2007-00122353932545formbankserver-name-directory-traversal(31214)3063Multiple cross-site scripting (XSS) vulnerabilities in AShop Deluxe 4.5 and AShop Administration Panel allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to (a) ashop/catalogue.php and (b) ashop/basket.php, the (2) exp parameter to ashop/catalogue.php, the (3) searchstring parameter to (c) ashop/search.php, the (4) checkout and (5) action parameters to (d) ashop/shipping.php, the cat parameter to (f) cart-path/admin/editcatalogue.php, and the (7) resultpage parameter to (g) cart-path/admin/salesadmin.php.ADV-2007-00282184520070101 AShop Shopping Cart Multiple XSS Vulnerabilities325583255732556325553255432553ashop-multiple-scripts-xss(31178)209123547Cisco Clean Access (CCA) 3.6.x through 3.6.4.2 and 4.0.x through 4.0.3.2 does not properly configure or allow modification of a shared secret authentication key, which causes all devices to have the same shared sercet and allows remote attackers to gain unauthorized access.20070103 Multiple Vulnerabilities in Cisco Clean AccessADV-2007-003032578101746523617Cisco Clean Access (CCA) 3.5.x through 3.5.9 and 3.6.x through 3.6.1.1 on the Clean Access Manager (CAM) allows remote attackers to bypass authentication and download arbitrary manual database backups by guessing the snapshot filename using brute force, then making a direct request for the file.ADV-2007-003020070103 Multiple Vulnerabilities in Cisco Clean Access10174652355632579Cross-zone scripting vulnerability in Apple Quicktime 3 to 7.1.3 allows remote user-assisted attackers to execute arbitrary code and list filesystem contents via a QuickTime movie (.MOV) with an HREF Track (HREFTrack) that contains an automatic action tag with a local URI, which is executed in a local zone during preview, as exploited by a MySpace worm.VU#304064http://www.gnucitizen.org/blog/backdooring-quicktime-movies/http://projects.info-pull.com/moab/MOAB-03-01-2007.html31164APPLE-SA-2007-03-05http://docs.info.apple.com/article.html?artnum=305149Stack-based buffer overflow in the Message Queuing Server (Cam.exe) in CA (formerly Computer Associates) Message Queuing (CAM / CAFT) software before 1.11 Build 54_4 on Windows and NetWare, as used in CA Advantage Data Transport, eTrust Admin, certain BrightStor products, certain CleverPath products, and certain Unicenter products, allows remote attackers to execute arbitrary code via a crafted message to TCP port 3104.systems-management-bo(32234)ADV-2007-26382505120070724 CA Message Queuing Server (Cam.exe) Overflowhttp://supportconnectw.ca.com/public/dto_transportit/infodocs/camsgquevul-secnot.asp26190101844920070725 [CAID 35527]: CA Message Queuing (CAM / CAFT) Buffer Overflow Vulnerabilityhttp://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=149809The DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528 allows remote attackers to execute arbitrary code via a malformed packet that triggers "corrupt stack memory."dhcp-malformed-packet-bo(33101)http://www.vmware.com/support/ws6/doc/releasenotes_ws6.htmlhttp://www.vmware.com/support/ws55/doc/releasenotes_ws55.htmlhttp://www.vmware.com/support/server/doc/releasenotes_server.htmlhttp://www.vmware.com/support/player2/doc/releasenotes_player2.htmlhttp://www.vmware.com/support/player/doc/releasenotes_player.htmlhttp://www.vmware.com/support/ace2/doc/releasenotes_ace2.htmlhttp://www.vmware.com/support/ace/doc/releasenotes_ace.htmlADV-2007-32292572920070919 VMWare DHCP Server Remote Code Execution VulnerabilitiesUSN-543-11018717GLSA-200711-2327706276942689020070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware PlayerInteger overflow in the ISC dhcpd 3.0.x before 3.0.7 and 3.1.x before 3.1.1; and the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528; allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code via a malformed DHCP packet with a large dhcp-max-message-size that triggers a stack-based buffer overflow, related to servers configured to send many DHCP options to clients.dhcp-param-overflow(33102)http://www.vmware.com/support/ws6/doc/releasenotes_ws6.htmlhttp://www.vmware.com/support/ws55/doc/releasenotes_ws55.htmlhttp://www.vmware.com/support/server/doc/releasenotes_server.htmlhttp://www.vmware.com/support/player2/doc/releasenotes_player2.htmlhttp://www.vmware.com/support/player/doc/releasenotes_player.htmlhttp://www.vmware.com/support/ace2/doc/releasenotes_ace2.htmlhttp://www.vmware.com/support/ace/doc/releasenotes_ace.html2572920070919 VMWare DHCP Server Remote Code Execution Vulnerabilitieshttps://bugzilla.redhat.com/show_bug.cgi?id=339561ADV-2007-3229USN-543-1101871720090312 rPSA-2009-0041-1 dhclient dhcp libdhcp4clientMDVSA-2009:153http://wiki.rpath.com/Advisories:rPSA-2009-0041GLSA-200808-05GLSA-200711-233426331396277062769426890SUSE-SR:2009:00520070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Playerhttp://bugs.gentoo.org/show_bug.cgi?id=227135Integer underflow in the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528 allows remote attackers to execute arbitrary code via a malformed DHCP packet that triggers a stack-based buffer overflow.dhcp-param-underflow(33103)http://www.vmware.com/support/ws6/doc/releasenotes_ws6.htmlhttp://www.vmware.com/support/ws55/doc/releasenotes_ws55.htmlhttp://www.vmware.com/support/server/doc/releasenotes_server.htmlhttp://www.vmware.com/support/player2/doc/releasenotes_player2.htmlhttp://www.vmware.com/support/player/doc/releasenotes_player.htmlhttp://www.vmware.com/support/ace2/doc/releasenotes_ace2.htmlhttp://www.vmware.com/support/ace/doc/releasenotes_ace.html2572920070919 VMWare DHCP Server Remote Code Execution VulnerabilitiesADV-2007-3229USN-543-11018717GLSA-200711-2327706276942689020070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware PlayerHeap-based buffer overflow in Windows Media Format Runtime 7.1, 9, 9.5, 9.5 x64 Edition, 11, and Windows Media Services 9.1 for Microsoft Windows 2000, XP, Server 2003, and Vista allows user-assisted remote attackers to execute arbitrary code via a crafted Advanced Systems Format (ASF) file.TA07-345AVU#319385MS07-068ADV-2007-4183101907426776SSRT071506SSRT07150628034oval:org.mitre.oval:def:3622Heap-based buffer overflow in Object Linking and Embedding (OLE) Automation in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, Office 2004 for Mac, and Visual basic 6.0 SP6 allows remote attackers to execute arbitrary code via a crafted script request.TA08-043CMS08-008ADV-2008-0510SSRT08001610193732766128902SSRT080016oval:org.mitre.oval:def:5388The kernel in Microsoft Windows 2000 SP4, XP SP2, and Server 2003, when ICMP Router Discovery Protocol (RDP) is enabled, allows remote attackers to cause a denial of service via fragmented router advertisement ICMP packets that trigger an out-of-bounds read, aka "Windows Kernel TCP/IP/ICMP Vulnerability."TA08-008AMS08-00128297win-tcpip-icmp-dos(39254)ADV-2008-006927139SSRT080003HPSBST0230420070108 Multiple (3) Microsoft Windows TCP/IP Remote Code Execution and DoS Vulnerabilities1019166http://blogs.technet.com/swi/archive/2008/01/08/ms08-001-part-2-the-case-of-the-moderate-icmp-mitigations.aspxoval:org.mitre.oval:def:5271Unspecified vulnerability in the Lotus Domino Web Server 6.0, 6.5.x before 6.5.6, and 7.0.x before 7.0.3 allows remote attackers to cause a denial of service (daemon crash) via requests for URLs that reference certain files.24307http://www-1.ibm.com/support/docview.wss?uid=swg2125725125542domino-unspecified-dos(34689)ADV-2007-2046357661018189IBM Lotus Domino 7.0.x before 7.0.3 does not revalidate the signature on a signed scheduled agent after the agent is modified, which allows remote authenticated users to gain privileges via a modified agent in a server database.ADV-2007-206324322http://www-1.ibm.com/support/docview.wss?uid=swg212587842552035765domino-signature-privilege-escalation(34718)Unspecified vulnerability in the kernel in Microsoft Windows XP SP2, Server 2003, and Vista allows remote attackers to cause a denial of service (CPU consumption) and possibly execute arbitrary code via crafted (1) IGMPv3 and (2) MLDv2 packets that trigger memory corruption, aka "Windows Kernel TCP/IP/IGMPv3 and MLDv2 Vulnerability."TA08-008AVU#115083MS08-00128297win-ssm-mld-bo(39453)win-ssm-igmp-bo(39452)ADV-2008-006927100HPSBST02304HPSBST0230420070108 Multiple (3) Microsoft Windows TCP/IP Remote Code Execution and DoS Vulnerabilities1019166http://blogs.technet.com/swi/archive/2008/01/08/ms08-001-part-3-the-case-of-the-igmp-network-critical.aspxoval:org.mitre.oval:def:5370Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file with a negative Scene Count value, which passes a signed comparison, is used as an offset of a NULL pointer, and triggers a buffer overflow.TA08-150ATA08-149ATA08-100AVU#395473VU#159523multimedia-file-integer-overflow(37277)http://www.zerodayinitiative.com/advisories/ZDI-08-032/ADV-2008-1724ADV-2008-1697ADV-2008-166210198112938628695RHSA-2008:022144282http://www.matasano.com/log/1032/this-new-vulnerability-dowds-inhuman-flash-exploit/20080408 Adobe Flash Player Invalid Pointer VulnerabilityGLSA-200804-21http://www.adobe.com/support/security/bulletins/apsb08-11.html2383053050730430304042986529763oval:org.mitre.oval:def:10379SUSE-SA:2008:022APPLE-SA-2008-05-28http://isc.sans.org/diary.html?storyid=4465http://documents.iss.net/whitepapers/IBM_X-Force_WP_final.pdfhttp://blogs.adobe.com/psirt/2008/05/potential_flash_player_issue.htmlHeap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a read operation over RPC.VU#768681application-rpc-read-bo(38760)ADV-2008-31273226120081111 Trend Micro ServerProtect [PROCEDURE NAME REDACTED] Heap Overflows (3)32618http://blogs.iss.net/archive/trend.htmlHeap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a file read operation over RPC.VU#768681application-rpc-file-read-bo(39050)ADV-2008-31273226120081111 Trend Micro ServerProtect [PROCEDURE NAME REDACTED] Heap Overflows (3)32618http://blogs.iss.net/archive/trend.htmlHeap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a folder read operation over RPC.VU#768681application-rpc-folder-read-bo(39051)ADV-2008-31273226120081111 Trend Micro ServerProtect [PROCEDURE NAME REDACTED] Heap Overflows (3)32618http://blogs.iss.net/archive/trend.htmlAspBB stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user passwords via a direct request for db/aspbb.mdb.aspbb-aspbb-info-disclosure(31230)20070102 AspBB Remote Password Disclosurehttp://www.aria-security.com/forum/showthread.php?t=82333642100Openforum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user passwords via a direct request for openforum.mdb.openforum-openforum-password-disclosure(31209)20070102 Openforum Remote password Disclosurehttp://www.aria-security.com/forum/showthread.php?t=80333662099lblog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for a certain file in admin/db/newFolder/.lblog-newfolder-information-disclosure(31229)20070102 lblog Remote Password Disclosurehttp://www.aria-security.com/forum/showthread.php?t=791017462333672098BattleBlog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/blankmaster.mdb.battleblog-blankmaster-info-disclosure(31224)20070101 BattleBlog Database Download Vulnerabilityhttp://www.aria-security.com/forum/showthread.php?t=76333602097rblog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) data/admin.mdb or (2) data/rblog.mdb.rblog-database-info-disclosure(31200)20070101 rblog Database Download Vulnerabilityhttp://www.aria-security.com/forum/showthread.php?t=7723538325722102** DISPUTED ** Buffer overflow in the SMB_Connect_Server function in FreeRadius 1.1.3 and earlier allows attackers to execute arbitrary code related to the server desthost field of an SMB_Handle_Type instance. NOTE: the impact of this issue has been disputed by a reliable third party and the vendor, who states that exploitation is limited "only to local administrators who have write access to the server configuration files." CVE concurs with the dispute.A buffer overflow in the SMB_Connect_Server function in FreeRADIUS 1.1.4 and earlier allows attackers to execute arbitrary code related to the server desthost field of an SMB_Handle_Type instance. This issue can not be exploited remotely, and can only be exploited by administrators who have write access to the server configuration files.-- Official Vendor Statement from the FreeRADIUS Server project
This issue is not a security vulnerability. The exploit is available only to local administrators who have write access to the server configuration files. As such, this issue has no security impact on any system running FreeRADIUS.
-- Official Vendor Statement from the FreeRADIUS Server project
freeradius-smbconnectserver-bo(31248)20070102 FreeRadius 1.1.3 SMB_Handle_Type SMB_Connect_Server arbitrary code execution20070103 Re: FreeRadius 1.1.3 SMB_Handle_Type SMB_Connect_Server arbitrary code executionhttp://www.freeradius.org/security.html20070211 FreeRADIUS dispute of CVE-2007-0080101746332082Sunbelt Kerio Personal Firewall (SKPF) 4.3.268 and 4.3.246, and possibly other versions allows local users to provide a Trojan horse iphlpapi.dll to SKPF by placing it in the installation directory.kerio-directory-code-execution(31232)2182820070101 Kerio Fake 'iphlpapi' DLL injection Vulnerabilityhttp://www.matousec.com/info/advisories/Kerio-Fake-iphlpapi-DLL-injection.php333562095users_adm/start1.php in IMGallery 2.5 and earlier does not properly handle files with multiple extensions, which allows remote authenticated users to upload and execute arbitrary PHP scripts.imgallery-start1-file-upload(31237)ADV-2007-0010218273049Cross-site scripting (XSS) vulnerability in Nuked Klan 1.7 and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in a getURL statement in a .swf file, as demonstrated by "Remote Cookie Disclosure." NOTE: it could be argued that this is an issue in Shockwave instead of Nuked Klan.2185020070102 Nuked Klan <= 1.7 Remote Cookie Disclosure Exploit333682101** DISPUTED ** Buffer overflow in the Windows NT Message Compiler (MC) 1.00.5239 on Microsoft Windows XP allows local users to gain privileges via a long MC-filename. NOTE: this issue has been disputed by a reliable third party who states that the compiler is not a privileged program, so privilege boundaries cannot be crossed.20070102 Windows NT Message Compiler 1.00.5239 arbitrary code execution20070103 Re: Windows NT Message Compiler 1.00.5239 arbitrary code execution37817Unspecified vulnerability in sys/dev/pci/vga_pci.c in the VGA graphics driver for wscons in OpenBSD 3.9 and 4.0, when the kernel is compiled with the PCIAGP option and a non-AGP device is being used, allows local users to gain privileges via unspecified vectors, possibly related to agp_ioctl NULL pointer reference.[3.9] 017: SECURITY FIX: January 3, 2007[4.0] 007: SECURITY FIX: January 3, 2007101746823608openbsd-vga-privilege-escalation(31276)ADV-2007-0043[openbsd-cvs] 20070103 CVS: cvs.openbsd.org: www[openbsd-cvs] 20070103 Re: CVS: cvs.openbsd.org: srchttp://ilja.netric.org/files/Unusual%20bugs%2023c3.pdf32574** DISPUTED ** The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal.20070103 a cheesy Apache / IIS DoS vuln (+a question)20070104 Re: a cheesy Apache / IIS DoS vuln (+a question)20070104 Re: a cheesy Apache / IIS DoS vuln (+a question)20070104 Re: a cheesy Apache / IIS DoS vuln (+a question)33456** DISPUTED ** Microsoft Internet Information Services (IIS), when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal.20070103 a cheesy Apache / IIS DoS vuln (+a question)20070104 Re: a cheesy Apache / IIS DoS vuln (+a question)20070104 Re: a cheesy Apache / IIS DoS vuln (+a question)20070104 Re: a cheesy Apache / IIS DoS vuln (+a question)33457Multiple directory traversal vulnerabilities in openmedia allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) src parameter to page.php or the (2) format parameter to search_form.php.openmedia-page-directory-traversal(31258)20070102 openmedia local read file33371333702103jgbbs stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db/bbs.mdb.20070103 jgbbs33376http://aria-security.com/forum/showthread.php?t=87jgbbs-bbs-information-disclosure(31274)WineGlass stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db/data.mdb.ADV-2007-003720070103 WineGlass "data.mdb" Remote Password Disclosure32575http://aria-security.com/forum/showthread.php?p=11223594newsCMSlite stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for newsCMS.mdb.newscmslite-newscms-info-disclosure(31222)375483066SQL injection vulnerability in productdetail.asp in E-SMARTCART 1.0 allows remote attackers to execute arbitrary SQL commands via the product_id parameter.ADV-2007-00362361031679esmartcart-productdetail-sql-injection(31243)3074SQL injection vulnerability in page.php in Simple Web Content Management System allows remote attackers to execute arbitrary SQL commands via the id parameter.swcms-page-sql-injection(31261)ADV-2007-004020070103 Simple Web Content Management System SQL Injection Exploit23590316573076http://acid-root.new.fr/poc/18070102.txt2106Sven Moderow GuestBook 0.3a stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for (1) gbook97.mdb or (2) gbook.mdb in ~db/.20070103 GuestBook v0.3a Remote Password Disclosure33363http://aria-security.com/forum/showthread.php?p=114guestbook-gbook-information-disclosure(31245)2105phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via a direct request for themes/darkblue_orange/layout.inc.php, which reveals the path in an error message.phpmyadmin-darkblueorange-path-disclosure(31223)3325720070102 Inforamtion Discloser Vulnerabilities in phpMyAdmin20070102 Inforamtion Discloser Vulnerabilities in "phpMyAdmin"MDKSA-2007:1992104CarbonCommunities stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for DataBase/Carbon2.4d.mdb.carboncommunities-carbon2-info-disclosure(31253)ADV-2007-003837549http://aria-security.com/forum/showthread.php?t=85Multiple stack-based buffer overflows in the (1) LoadTree and (2) ReadHeader functions in PAISO.DLL 1.7.3.0 (1.7.3 beta) in ConeXware PowerArchiver 2006 9.64.02 allow user-assisted attackers to execute arbitrary code via a crafted ISO file containing a file within several nested directories.http://vuln.sg/powarc964-en.html23559ADV-2007-00413257620070104 [vuln.sg] PowerArchiver PAISO.DLL Buffer Overflowpowerarchiver-loadtree-readheader-bo(31263)20070104 [vuln.sg] PowerArchiver PAISO.DLL Buffer Overflow VulnerabilityDirectory traversal vulnerability in language.php in VerliAdmin 0.3 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by language.php.ADV-2007-003532352verliadmin-language-file-include(31241)3075Race condition in the msxml3 module in Microsoft XML Core Services 3.0, as used in Internet Explorer 6 and other applications, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via many nested tags in an XML document in an IFRAME, when synchronous document rendering is frequently disrupted with asynchronous events, as demonstrated using a JavaScript timer, which can trigger NULL pointer dereferences or memory corruption, aka "MSXML Memory Corruption Vulnerability."TA08-316A21872MS08-069ADV-2008-311120070104 Re: RE: [Full-disclosure] Concurrency strikes MSIE (potentially exploitablemsxml3 flaws)20070104 RE: [Full-disclosure] Concurrency strikes MSIE (potentially exploitablemsxml3 flaws)20070104 Concurrency strikes MSIE (potentially exploitable msxml3 flaws)10211642365520070104 Concurrency strikes MSIE (potentially exploitable msxml3 flaws)oval:org.mitre.oval:def:579332627SSRT080164HPSBST02386http://isc.sans.org/diary.php?storyid=200420070104 Re: Concurrency strikes MSIE (potentially exploitablemsxml3 flaws)The Perforce client does not restrict the set of files that it overwrites upon receiving a request from the server, which allows remote attackers to overwrite arbitrary files by modifying the client config file on the server, or by operating a malicious server.20070104 Perforce client: security hole by design33369Cross-site request forgery (CSRF) vulnerability in SPINE allows remote attackers to perform unauthorized actions as administrators via unspecified vectors. NOTE: some of these details are obtained from third party information.http://spine.sourceforge.net/changelog.htmlspine-unspecified-csrf(31283)ADV-2007-00422353732577The Adobe PDF specification 1.3, as implemented by Apple Mac OS X Preview, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.TA07-072A21910multiple-vendor-pdf-code-execution(31364)ADV-2007-0930101774924479http://projects.info-pull.com/moab/MOAB-06-01-2007.html31221http://docs.info.apple.com/article.html?artnum=305214The Adobe PDF specification 1.3, as implemented by Adobe Acrobat before 8.0.0, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.TA07-072Amultiple-vendor-pdf-code-execution(31364)ADV-2007-093010177492191024479http://projects.info-pull.com/moab/MOAB-06-01-2007.htmlhttp://docs.info.apple.com/article.html?artnum=305214The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.TA07-072Ahttps://issues.rpath.com/browse/RPL-964multiple-vendor-pdf-code-execution(31364)ADV-2007-0930ADV-2007-0244ADV-2007-0212ADV-2007-0203USN-410-2USN-410-110177492191020070116 [KDE Security Advisory] kpdf/kword/xpdf denial of service vulnerabilitySUSE-SR:2007:003MDKSA-2007:024MDKSA-2007:022MDKSA-2007:021MDKSA-2007:020MDKSA-2007:019MDKSA-2007:018http://www.kde.org/info/security/advisory-20070115-1.txthttp://support.novell.com/techcenter/psdb/44d7cb9b669d58e0ce5aa5d7ab2c7c53.html101751424479242042387623844238392381523813238082379923791http://projects.info-pull.com/moab/MOAB-06-01-2007.htmlhttp://docs.info.apple.com/article.html?artnum=305214Stack-based buffer overflow in the CSAdmin service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engine before 4.1 allows remote attackers to execute arbitrary code via a crafted HTTP GET request.VU#74424923629cisco-acs-csadmin-bo(31323)ADV-2007-00682190020070105 Multiple Vulnerabilities in Cisco Secure Access Control Server101747532642Cross-site scripting (XSS) vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack with an invalid token and quote characters or HTML tags in URL variable names, which are not properly handled when WordPress generates a new link to verify the request.21893http://wordpress.org/development/2007/01/wordpress-206/ADV-2007-006120070105 Advisory 01/2007: WordPress CSRF Protection XSS Vulnerabilityhttp://www.hardened-php.net/advisory_012007.140.html23595333972114WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.Successful exploitation requires that the "mbstring" extension be enabled.
This vulnerability is addressed in the following product release:
WordPress, WordPress, 2.0.6wordpress-mbstring-security-bypass(31297)2190720070105 Advisory 02/2007: WordPress Trackback Charset Decoding SQL Injection VulnerabilityOpenPKG-SA-2007.005http://www.hardened-php.net/advisory_022007.141.htmlhttp://wordpress.org/development/2007/01/wordpress-206/23595ADV-2007-0061315792112GLSA-200701-1023741nwgina.dll in Novell Client 4.91 SP3 for Windows 2000/XP/2003 does not delete user profiles during a Terminal Service or Citrix session, which allows remote authenticated users to invoke alternate user profiles.novell-profile-security-bypass(31343)ADV-2007-006421886http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974970.htm10174712361931358wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks.wordpress-account-enumeration(31262)ADV-2007-006220070103 Wordpress <= 2.x dictionnary & Bruteforce attack23621315772113GLSA-200701-1023741Cross-site scripting (XSS) vulnerability in nidp/idff/sso in Novell Access Manager Identity Server before 3.0.0-1013 allows remote attackers to inject arbitrary web script or HTML via the IssueInstant parameter, which is not properly handled in the resulting error message.https://secure-support.novell.com/KanisaPlatform/Publishing/143/3615264_f.SAL_Public.htmlADV-2007-00732192123654313591017483Buffer overflow in Resco Photo Viewer for PocketPC 4.11 and 6.01, as used in mobile devices running Windows Mobile 5.0, 2003, and 2003SE, allows remote attackers to execute arbitrary code via a crafted PNG image.ADV-2007-0072http://www.trendmicro.com/vinfo/secadvisories/default6.asp?VName=Vulnerability+in+Resco+Photo+Viewer+6%2E01+Enabling+Code+Injection+and+Arbitrary+Code+Execution219202365832644http://blog.trendmicro.com/flaw-in-3rd-party-app-weakens-windows-mobile/SQL injection vulnerability in cats.asp in createauction allows remote attackers to execute arbitrary SQL commands via the catid parameter.createauction-cats-sql-injection(31356)2192920070107 createauction (cats.asp) Remote SQL Injection Vulnerability334062111Buffer overflow in Packeteer PacketShaper PacketWise 8.x allows remote authenticated users to cause a denial of service (reset or reboot) via (1) a long traffic class argument to the "class show" command or (2) a long POLICY parameter value in clastree.htm.packetshaper-argument-dos(31357)ADV-2007-00982193320070108 Packeteer PacketWise CLI overflow DoS23685316562110Sun Java System Content Delivery Server 5.0 and 5.0 PU1 allows remote attackers to obtain sensitive information regarding "content details" via unspecified vectors.10276423630sun-java-cds-info-disclosure(31345)ADV-2007-00762190832645Static code injection vulnerability in Coppermine Photo Gallery 1.4.10 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the Username to login.php, which is injected into an error message in security.log.php, which can then be accessed using viewlog.php.20070105 Coppermine Photo Gallery <= 1.4.10 SQL Injection Exploit20070108 Source verify - Coppermine Photo Gallery <= 1.4.10 code injection33383http://acid-root.new.fr/poc/19070104.txt2107Digger Solutions Intranet Open Source (IOS) stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for data/intranet.mdb.20070105 Intranet Open Source Remote Password Disclosure "intranet.mdb"33379intranet-intranet-info-disclosure(31308)2109DiskManagementTool in the DiskManagement.framework 92.29 on Mac OS X 10.4.8 does not properly validate Bill of Materials (BOM) files, which allows attackers to gain privileges via a BOM file under /Library/Receipts/, which triggers arbitrary file permission changes upon execution of a diskutil permission repair operation.ADV-2007-007421899http://projects.info-pull.com/moab/MOAB-05-01-2007.html3116723653Multiple absolute path traversal vulnerabilities in EditTag 1.2 allow remote attackers to read arbitrary files via an absolute pathname in the file parameter to (1) edittag.cgi, (2) edittag.pl, (3) edittag_mp.cgi, or (4) edittag_mp.pl.2189020070105 Multiple bugs in EditTag333963339533394333937950Multiple cross-site scripting (XSS) vulnerabilities in EditTag 1.2 allow remote attackers to inject arbitrary web script or HTML via the plain parameter to (1) mkpw_mp.cgi, (2) mkpw.pl, or (3) mkpw.cgi.2189120070105 Multiple bugs in EditTag3339233391333907950Acunetix Web Vulnerability Scanner (WVS) 4.0 Build 20060717 and earlier allows remote attackers to cause a denial of service (application crash) via multiple HTTP requests containing invalid Content-Length values.acunetix-content-length-dos(31279)21898375803078Cross-site scripting (XSS) vulnerability in search.asp in RI Blog 1.3 allows remote attackers to inject arbitrary web script or HTML via the q parameter.ADV-2007-00832188020070105 RI Blog 1.3 XSS Vuln.31637riblog-search-xss(31317)210823657Multiple SQL injection vulnerabilities in Coppermine Photo Gallery 1.4.10 and earlier allow remote authenticated administrators to execute arbitrary SQL commands via (1) the cat parameter to albmgr.php, and possibly (2) the gid parameter to usermgr.php; (3) the start parameter to db_ecard.php; and the albumid parameter to unspecified files, related to the (4) filename_to_title and (5) del_titles functions.2189420070105 Coppermine Photo Gallery <= 1.4.10 SQL Injection Exploit3585635855358543585335852http://acid-root.new.fr/poc/19070104.txt2123258463085Unrestricted file upload vulnerability in Uber Uploader 4.2 allows remote attackers to upload and execute arbitrary PHP scripts by naming them with a .phtml extension, which bypasses the .php extension check but is still executable on some server configurations.20070105 Uber Uploader 4.2 Arbitrary File Upload Vulnerabilityuber-uploader-phtml-file-upload(31303)2116Unspecified vulnerability in Drupal before 4.6.11, and 4.7 before 4.7.5, when MySQL is used, allows remote authenticated users to cause a denial of service by poisoning the page cache via unspecified vectors, which triggers erroneous 404 HTTP errors for pages that exist.2189520070105 [DRUPAL-SA-2007-002] Drupal 4.6.11 / 4.7.5 fixes DoS issue23586http://drupal.org/node/104238ADV-2007-0051321312115Kaspersky Labs Antivirus Engine 6.0 for Windows and 5.5-10 for Linux before 20070102 enter an infinite loop upon encountering an invalid NumberOfRvaAndSizes value in the Optional Windows Header of a portable executable (PE) file, which allows remote attackers to cause a denial of service (CPU consumption) by scanning a crafted PE file.kaspersky-antivirus-pe-dos(31315)ADV-2007-0067219011017476235753258820070105 Kaspersky Antivirus Scan Engine PE File Denial of Service VulnerabilityHeap-based buffer overflow in Opera 9.02 allows remote attackers to execute arbitrary code via a JPEG file with an invalid number of index bytes in the Define Huffman Table (DHT) marker.http://www.opera.com/support/search/supsearch.dml?index=852opera-jpeg-dht-bo(31305)ADV-2007-0060GLSA-200701-08101747323771237392361331574SUSE-SA:2007:00920070105 Opera Software Opera Web Browser JPG Image DHT Marker Heap Corruption VulnerabilityThe Javascript SVG support in Opera before 9.10 does not properly validate object types in a createSVGTransformFromMatrix request, which allows remote attackers to execute arbitrary code via JavaScript code that uses an invalid object in this request that causes a controlled pointer to be referenced during the virtual function call.2361320070105 Opera Software Opera Web Browser createSVGTransformFromMatrix Object Typecasting VulnerabilityADV-2007-0060http://www.opera.com/support/search/supsearch.dml?index=851GLSA-200701-081017473237712373931575SUSE-SA:2007:009SQL injection vulnerability in info_book.asp in Digirez 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the book_id parameter.ADV-2007-005323606316773081SQL injection vulnerability in main.asp in LocazoList 2.01a beta5 and earlier allows remote attackers to execute arbitrary SQL commands via the subcatID parameter.locazolist-main-sql-injection(31242)ADV-2007-0052358133073SQL injection vulnerability in user.php in iGeneric iG Calendar 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.ADV-2007-0055218732360231678igcalendar-user-sql-injection(31300)20070105 IG Calendar SQL Injection3082JAMWiki before 0.5.0 does not properly check permissions during moves of "read-only or admin-only topics," which allows remote attackers to make unauthorized changes to the wiki.http://sourceforge.net/project/shownotes.php?group_id=171441&release_id=4756632363432581jamwiki-permission-security-bypass(31296)21879SQL injection vulnerability in compare_product.php in iGeneric iG Shop 1.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.ADV-2007-005623604http://packetstormsecurity.nl/0701-exploits/igshop10-multiple.txt33385igshop-compareproduct-sql-injection(31299)2187420070105 IG Shop remote code execution3083Multiple SQL injection vulnerabilities in display_review.php in iGeneric iG Shop 1.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) user_login_cookie parameter.ADV-2007-005633386Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the action parameter, which is supplied to an eval function call in (1) cart.php and (2) page.php. NOTE: a later report and CVE analysis indicate that the vulnerability is present in 1.4.igshop-cartpage-code-execution(31301)ADV-2007-00562187520070619 iG Shop 1.4 eval Inclusion Vulnerability20070105 IG Shop remote code execution20070618 Dup: iG Shop 1.4 (page.php) Remote Code Execution Exploit23604http://packetstormsecurity.nl/0701-exploits/igshop10-multiple.txt33388333873083PHP remote file inclusion vulnerability in inc/init.inc.php in Aratix 0.2.2 beta 11 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the current_path parameter.ADV-2007-005420070108 Source verify of Aratix RFIhttp://securityreason.com/exploitalert/169833405aratix-init-file-include(31282)3079Multiple cross-site scripting (XSS) vulnerabilities in Drupal before 4.6.11, and 4.7 before 4.7.5, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in the (1) filter and (2) system modules. NOTE: some of these details are obtained from third party information.http://drupal.org/node/104233ADV-2007-0050321403213920070105 [DRUPAL-SA-2007-001] Drupal 4.6.11 / 4.7.5 fixesdrupal-core-unspecified-xss(31311)20070105 [DRUPAL-SA-2007-001] Drupal 4.6.11 / 4.7.5 fixes XSS issuehttp://drupal.org/files/sa-2007-001/advisory.txtCross-site scripting (XSS) vulnerability in SimpleBoxes/SerendipityNZ Serene Bach 2.05R and earlier, and 2.08D and earlier in the 2.08 series; and (2) sb 1.13D and earlier, and 1.18R and earlier in the 1.18 series; allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.23623ADV-2007-0065http://serenebach.net/log/sb209R.htmlhttp://serenebach.net/log/sb119R.html32580JVN#65500885serene-bach-unspecified-xss(31302)218841017470formbankcgi.exe in Fersch Formbankserver 1.9, when the PATH_INFO begins with (1) AbfrageForm or (2) EingabeForm, allows remote attackers to cause a denial of service (daemon crash) via multiple requests containing many /../ sequences in the Name parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.formbankserver-formbank-dos(31216)2353932546Unspecified vulnerability in the DECnet-Plus 7.3-2 feature in DECnet/OSI 7.3-2 for OpenVMS ALPHA, and the DECnet-Plus 7.3 feature in DECnet/OSI 7.3 for OpenVMS VAX, allows attackers to obtain "unintended privileged access to data and system resources" via unspecified vectors, related to (1) [SYSEXE]CTF$UI.EXE, (2) [SYSMSG]CTF$MESSAGES.EXE, (3) [SYSHLP]CTF$HELP.HLB, and (4) [SYSMGR]CTF$STARTUP.COM.23636ftp://ftp.itrc.hp.com/openvms_patches/vax/V7.3/VAX_DNVOSIMUP01-V0703.txtftp://ftp.itrc.hp.com/openvms_patches/alpha/V7.3-2/AXP_DNVOSIMUP01-V0703-2.txtADV-2007-006332586325853258432583SQL injection vulnerability in down.asp in Kolayindir Download (Yenionline) allows remote attackers to execute arbitrary SQL commands via the id parameter.ADV-2007-00792188920070105 Kolayindir Download (Yenionline) (tr) SqL Injection Vuln.2364531625kolayindirdownload-down-sql-injection(31320)2122Cross-site scripting (XSS) vulnerability in yald.php in Yet Another Link Directory 1.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter.ADV-2007-00822190420070106 Yet Another Link Directory v1.02364631626yald-yald-xss(31322)2121SQL injection vulnerability in orange.asp in ShopStoreNow E-commerce Shopping Cart allows remote attackers to execute arbitrary SQL commands via the CatID parameter.ADV-2007-00802190520070106 shopstorenow (orange.asp) sql injection2364231665shopstorenow-orange-sql-injection(31313)2120Multiple PHP remote file inclusion vulnerabilities in NUNE News Script 2.0pre2 allow remote attackers to execute arbitrary PHP code via a URL in the custom_admin_path parameter to (1) index.php or (2) archives.php.ADV-2007-00782363531209312083090nune-index-archives-file-include(31312)20070107 NUNE News Script (custom_admin_path) Remote File Include VulnerablityCross-site scripting (XSS) vulnerability in search.asp in Digitizing Quote And Ordering System 1.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the ordernum parameter.2365231690qos-search-xss(31321)3089PHP remote file inclusion vulnerability in bn_smrep1.php in BinGoPHP News (BP News) 3.01 allows remote attackers to execute arbitrary PHP code via a URL in the bnrep parameter, a different vector than CVE-2006-4648 and CVE-2006-4649.101747735898bingo-bnsmrep1-file-include(31328)Multiple cross-site scripting (XSS) vulnerabilities in Fix and Chips CMS 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter in (a) delete-announce.php; the (2) Announcement form field in (b) staff.php; the (3) Client Name, (4) Business Name, (5) Street, (6) Address 2, (7) Town/City, (8) Postcode, (9) Phone Number, (10) Email Address and (11) Website Address form fields in (c) new_customer.php; and unspecified fields in (d) search.php and (e) client-results.php.ADV-2007-008120070106 Fix & Chips CMS v1.023625fixandchips-multiple-scripts-xss(31319)32650326493264832647326462119Cuyahoga before 1.0.1 installs the FCKEditor component with an incorrect deny statement in a Web.config file, which allows remote attackers to upload files when these privileges were intended only for the Administrator and Editor roles.http://www.cuyahoga-project.org/10/section.aspx/6123662http://cuyahoga.svn.sourceforge.net/viewvc/cuyahoga?view=rev&revision=5513264321927Format string vulnerability in OmniGroup OmniWeb 5.5.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via format string specifiers in the Javascript alert function.http://www.omnigroup.com/applications/omniweb/releasenotes/23624ADV-2007-0075http://projects.info-pull.com/moab/MOAB-07-01-2007.html31222omniweb-alert-format-string(31324)2191120070111 DMA[2007-0107a] OmniWeb Javascript Alert Format String Vulnerabiity and DMA[2007-0109a] Apple Finder Disk Image Volume Label Overflow / DoShttp://www.digitalmunition.com/DMA%5B2007-0107a%5D.txt3098http://blog.omnigroup.com/2007/01/07/omniweb-552-now-available-and-more-secure/EMembersPro 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for users.mdb.20070107 EMembersPro 1.0 Remote Password Disclosure Vulnerability33403ememberspro-users-info-disclosure(31329)2118Multiple PHP remote file inclusion vulnerabilities in index.php in Dayfox Blog allow remote attackers to execute arbitrary PHP code via a URL in the (1) page, (2) subject, and (3) q parameters.ADV-2007-009920070107 Dayfox Blog Remote File Include Vuln.31259dayfoxblog-index-file-include(31336)211723661MitiSoft stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for access_MS/MitiSoft.mdb.20070107 MitiSoft Remote Password Disclosure Vulnerability33409mitisoft-mitisoft-info-disclosure(31341)OhhASP stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db/OhhASP.mdb.20070106 ohhASP Remote Password Disclosure33381http://64.38.62.221/ariasecucom/forum/showthread.php?t=89ohhasp-ohhasp-info-disclosure(31342)AJLogin 3.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for ajlogin.mdb.20070107 AJLogin v3.5 Remote Password Disclosure Vulnerability33404ajlogin-ajlogin-info-disclosure(31331)2127Webulas stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db/db.mdb.20070107 Webulas Remote Password Disclosure Vulnerability33401webulas-db-info-disclosure(31338)2126HarikaOnline 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for harikaonline.mdb.20070107 HarikaOnline v2.0 Remote Password Disclosure Vulnerability33410harikaonline-harikaonline-info-disclosure(31339)2125M-Core stores the database under the web document root, which allows remote attackers to obtain sensitive information via a direct request to db/uyelik.mdb.20070107 M-Core Remote Password Disclosure Vulnerability33402mcore-uyelik-info-disclosure(31340)2124Array index error in the uri_lookup function in the URI parser for neon 0.26.0 to 0.26.2, possibly only on 64-bit platforms, allows remote malicious servers to cause a denial of service (crash) via a URI with non-ASCII characters, which triggers a buffer under-read due to a type conversion error that generates a negative index.ADV-2007-0362ADV-2007-017239247[neon] 20070107 invalid chars cause sigserv in neonhttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=404723http://bugs.debian.org/cgi-bin/bugreport.cgi/neon26_0.26.2-3_to_mdx1.diff?bug=404723;msg=5;att=2http://www.webdav.org/cadaver/22035SUSE-SR:2007:002MDKSA-2007:013239842376323751[cadaver] 20070123 release 0.22.5Directory traversal vulnerability in the GeoIP_update_database_general function in libGeoIP/GeoIPUpdate.c in GeoIP 1.4.0 allows remote malicious update servers (possibly only update.maxmind.com) to overwrite arbitrary files via a .. (dot dot) in the database filename, which is returned by a request to app/update_getfilename.http://arctic.org/~dean/patches/GeoIP-1.4.0-update-vulnerability.patchADV-2007-0118ADV-2007-011731618geoip-geoipupdate-directory-traversal(31383)USN-412-121959MDKSA-2007:0042390623880Stack-based buffer overflow in the LiveJournal support (hooks/ljhook.cc) in CenterICQ 4.9.11 through 4.21.0, when using unofficial LiveJournal servers, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by adding the victim as a friend and using long (1) username and (2) real name strings.Failed exploitation attempts will likely result in a denial-of-service condition.centericq-username-bo(31330)ADV-2007-03062193220070107 TK53 Advisory #1: CenterICQ remote DoS buffer overflow in LiveJournal handlingGLSA-200701-201017545212933408The PML Driver HPZ12 (HPZipm12.exe) in the HP all-in-one drivers, as used by multiple HP products, uses insecure SERVICE_CHANGE_CONFIG DACL permissions, which allows local users to gain privileges and execute arbitrary programs, as demonstrated by modifying the binpath argument, a related issue to CVE-2006-0023.ADV-2007-00942193520070108 HP Multiple Products PML Driver Local Privilege Escalationhttp://secway.org/advisory/AD20070108.txt2366332654pml-driver-config-privilege-escalation(31361)2128Unsanity Application Enhancer (APE) 2.0.2 installs with insecure permissions for the (1) ApplicationEnhancer binary and the (2) /Library/Frameworks/ApplicationEnhancer.framework directory, which allows local users to gain privileges by modifying or replacing the binary or library files.http://projects.info-pull.com/moab/MOAB-08-01-2007.html32661http://landonf.bikemonkey.org/code/macosx/MOAB_Day_8.20070109002959.18582.timor.htmlape-appenhancer-privilege-escalation(31349)2195123649SecureKit Steganography 1.7.1 and 1.8 embeds password information in the carrier file, which allows remote attackers to bypass authentication requirements and decrypt embedded steganography by replacing the last 20 bytes of the JPEG image with alternate password information.20070106 Cracking Steganography Application in less than ONE minute2363931244http://homepage.mac.com/adonismac/Advisory/steg/steganography.htmlsteganography-password-security-bypass(31378)20070107 A Major design Bug in Steganography 1.7.x, 1.8 (latest) (Updated Version)Camouflage 1.2.1 embeds password information in the carrier file, which allows remote attackers to bypass authentication requirements and decrypt embedded steganography by replacing certain bytes of the JPEG image with alternate password information.219392357832651http://homepage.mac.com/adonismac/Advisory/steg/camouflage.htmlcamouflage-password-security-bypass(31375)20070107 A Major design Bug in Camouflage 1.2.1 (latest)Unspecified vulnerability in libnsl in Sun Solaris 8 and 9 allows remote attackers to cause a denial of service (crash) via malformed RPC requests that trigger a crash in rpcbind.102713ADV-2007-0110oval:org.mitre.oval:def:592031576solaris-rpcbind-dos(31366)21964http://support.avaya.com/elmodocs2/security/ASA-2007-036.htm10174922405623700oval:org.mitre.oval:def:2210The jail rc.d script in FreeBSD 5.3 up to 6.2 does not verify pathnames when writing to /var/log/console.log during a jail start-up, or when file systems are mounted or unmounted, which allows local root users to overwrite arbitrary files, or mount/unmount files, outside of the jail via a symlink attack.FreeBSD-SA-07:013272622011101750523730Multiple PHP file inclusion vulnerabilities in WGS-PPC (aka PPC Search Engine), as distributed with other aliases, allow remote attackers to execute arbitrary PHP code via a URL in the INC parameter in (1) config_admin.php, (2) config_main.php, (3) config_member.php, and (4) mysql_config.php in config/; (5) admin.php and (6) index.php in admini/; (7) paypalipn/ipnprocess.php; (8) index.php and (9) registration.php in members/; and (10) ppcbannerclick.php and (11) ppcclick.php in main/.2196120070109 ppc engine Multiple file inclusion20070109 "ppc engine" is WGS-PPCdemoppc-inc-file-include(31355)334543345333452334513345033449334483344733446334453344421343104The Tape Engine service in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Business Protection Suite r2 allows remote attackers to execute arbitrary code via certain data in opnum 0xBF in an RPC request, which is directly executed.VU#662400http://supportconnectw.ca.com/public/storage/infodocs/babimpsec-notice.asphttp://www.zerodayinitiative.com/advisories/ZDI-07-002.htmlADV-2007-015431327brightstor-tapeengine-code-execution(31442)2201020070111 ZDI-07-002: CA BrightStor ARCserve Backup Tape Engine Code Execution Vulnerability20070111 [CAID 34955, 34956, 34957, 34958, 34959, 34817]: CA BrightStor ARCserve Backup Multiple Overflow Vulnerabilities20070111 LS-20061002 - Computer Associates BrightStor ARCserve Backup Remote Code Execution Vulnerabilityhttp://www.lssec.com/advisories/LS-20061002.pdf101750623648http://livesploit.com/advisories/LS-20061002.pdfMultiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Business Protection Suite r2 allow remote attackers to execute arbitrary code via RPC requests with crafted data for opnums (1) 0x2F and (2) 0x75 in the (a) Message Engine RPC service, or opnum (3) 0xCF in the Tape Engine service.VU#180336VU#151032http://supportconnectw.ca.com/public/storage/infodocs/babimpsec-notice.aspbrightstor-messageengine-rpc-bo(31443)brightstor-tapeengine-rpc-bo(31433)http://www.zerodayinitiative.com/advisories/ZDI-07-004.htmlhttp://www.zerodayinitiative.com/advisories/ZDI-07-003.htmlADV-2007-0154220062200520070111 ZDI-07-003: CA BrightStor ARCserve Backup Message Engine Buffer Overflow Vulnerability20070111 ZDI-07-004: CA BrightStor ARCserve Backup Tape Engine Buffer Overflow Vulnerability20070111 [CAID 34955, 34956, 34957, 34958, 34959, 34817]: CA BrightStor ARCserve Backup Multiple Overflow Vulnerabilities1017506236483132720070111 Computer Associates BrightStor ARCserve Backup RPC Engine PFC Request Buffer Overflow VulnerabilityPHP remote file inclusion vulnerability in index.php in AllMyVisitors 0.4.0 allows remote attackers to execute arbitrary PHP code via a URL in the AMV_serverpath parameter.allmyvisitors-index-file-include(31316)21917359043097PHP remote file inclusion vulnerability in index.php in AllMyLinks 0.5.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the AML_opensite parameter.allmylinks-index-file-include(31314)21916359093096Multiple PHP remote file inclusion vulnerabilities in AllMyGuests 0.3.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the AMG_serverpath parameter to (1) comments.php and (2) signin.php; and possibly via a URL in unspecified parameters to (3) include/submit.inc.php, (4) admin/index.php, (5) include/cm_submit.inc.php, and (6) index.php.allmyguests-multiple-file-include(31310)219183592335921359193591735916359153093Directory traversal vulnerability in index.php in L2J Statistik Script 0.09 and earlier, when register_globals is enabled and magic_quotes is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.l2j-statistik-index-file-include(31309)ADV-2007-009721914359143091Multiple stack-based multiple buffer overflows in the BRWOSSRE2UC.dll ActiveX Control in Sina UC2006 and earlier allow remote attackers to execute arbitrary code via a long string in the (1) astrVerion parameter to the SendChatRoomOpt function or (2) the astrDownDir parameter to the SendDownLoadFile function.ADV-2007-0093http://secway.org/advisory/ad20070109EN.txt236383265920070109 Sina UC ActiveX Multiple Remote Stack Overflowsinauc-senddownloadfile-bo(31350)sinauc-sendchatroomopt-bo(31348)2195820070109 Sina UC ActiveX Multiple Remote Stack OverflowCross-site scripting (XSS) vulnerability in htsrv/login.php in b2evolution 1.8.6 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes in the redirect_to parameter.b2evolution-login-xss(31368)21953DSA-1568300932365632027http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=410568Cross-site scripting (XSS) vulnerability in search/advanced_search.php in GForge 4.5.11 allows remote attackers to inject arbitrary web script or HTML via the words parameter.2194620070108 GForge Cross Site Scripting vulnerabilityhttp://www.eazel.es/advisory006-gforge-cross-site-scripting-vulnerability.html10174822367531248gforge-words-xss(31346)DSA-1475213328598Cross-site scripting (XSS) vulnerability in the AJAX module in MediaWiki before 1.6.9, 1.7 before 1.7.2, 1.8 before 1.8.3, and 1.9 before 1.9.0rc2, when wgUseAjax is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.21956http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_9_0RC2/phase3/RELEASE-NOTEShttp://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_8_3/phase3/RELEASE-NOTEShttp://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_7_2/phase3/RELEASE-NOTEShttp://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_6_9/phase3/RELEASE-NOTEShttp://sourceforge.net/forum/forum.php?forum_id=652721ADV-2007-00962364731525mediawiki-ajax-unspecified-xss(31359)SUSE-SR:2007:00624889PHP remote file inclusion vulnerability in info.php in Easy Banner Pro 2.8 allows remote attackers to execute arbitrary PHP code via a URL in the s[phppath] parameter.20070108 Easy Banner Pro Version 2.8 <= Remote File Inclusion33455easybannerpro-info-file-include(31374)219672132SQL injection vulnerability in comment.php in PHPKIT 1.6.1 R2 allows remote attackers to execute arbitrary SQL commands via the subid parameter.2196220070109 Re: PHPKit 1.6.1 RC2 (faq/faq.php) Remote SQL Injection Exploit312662131Stack-based buffer overflow in EF Commander 5.75 allows user-assisted attackers to execute arbitrary code via a crafted ISO file containing a file within several nested directories, which produces a large filename that triggers the overflow.http://vuln.sg/efcommander575-en.html2365932660efcommander-iso-pathname-bo(31365)21969PHP remote file inclusion vulnerability in include/common_function.php in magic photo storage website allows remote attackers to execute arbitrary PHP code via a URL in the _config[site_path] parameter.ADV-2007-013620070108 magic photo storage website Remote File Inclusionmagicphotostorage-config-file-include(31347)21965236873100Multiple PHP remote file inclusion vulnerabilities in magic photo storage website allow remote attackers to execute arbitrary PHP code via a URL in the _config[site_path] parameter to (1) admin_password.php, (2) add_welcome_text.php, (3) admin_email.php, (4) add_templates.php, (5) admin_paypal_email.php, (6) approve_member.php, (7) delete_member.php, (8) index.php, (9) list_members.php, (10) membership_pricing.php, or (11) send_email.php in admin/; (12) config.php or (13) db_config.php in include/; or (14) add_category.php, (15) add_news.php, (16) change_catalog_template.php, (17) couple_milestone.php, (18) couple_profile.php, (19) delete_category.php, (20) index.php, (21) login.php, (22) logout.php, (23) register.php, (24) upload_photo.php, (25) user_catelog_password.php, (26) user_email.php, (27) user_extend.php, or (28) user_membership_password.php in user/. NOTE: the include/common_function.php vector is already covered by another candidate from the same date.20070108 magic photo storage website Multiple Remote File Inclusion2196533439334383343733436334353343433433334323343133430334293342833427334263342533423334223342133420334193341833417334163341533414334133341233411326682136Cross-site scripting (XSS) vulnerability in /search in iPlanet Web Server 4.x allows remote attackers to inject arbitrary web script or HTML via the NS-max-records parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.219772360532662Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to obtain unauthorized access to public methods via a crafted request that bypasses the include/exclude checks.ADV-2007-0095219552364132657SUSE-SR:2009:004http://getahead.ltd.uk/dwr/changelogdwr-include-exclude-security-bypass(31377)Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to cause a denial of service (memory exhaustion and servlet outage) via unknown vectors related to a large number of calls in a batch.23641ADV-2007-00952195532658SUSE-SR:2009:004http://getahead.ltd.uk/dwr/changelogdwr-servlet-engine-dos(31382)Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via (1) the xcho parameter to my.logon.php3; the (2) topblue, (3) midblue, (4) wtopblue, and certain other Custom color parameters in a per action to vdesk/admincon/index.php; the (5) h321, (6) h311, (7) h312, and certain other Front Door custom text color parameters in a per action to vdesk/admincon/index.php; the (8) ua parameter in a bro action to vdesk/admincon/index.php; the (9) app_param and (10) app_name parameters to webyfiers.php; (11) double eval functions; (12) JavaScript contained in an <FP_DO_NOT_TOUCH> element; and (13) the vhost parameter to my.activation.php. NOTE: it is possible that this candidate overlaps CVE-2006-3550.https://tech.f5.com/home/solutions/sol6920.htmlhttps://tech.f5.com/home/solutions/sol6919.html21957http://www.mnin.org/advisories/2007_firepass.pdf236432362720070106 NNL-Labs & MNIN - F5 FirePass Security Advisory32743327423274132740327393273832737F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via (1) a trailing null byte, (2) multiple leading slashes, (3) Unicode encoding, (4) URL-encoded directory traversal or same-directory characters, or (5) upper case letters in the domain name.https://tech.f5.com/home/solutions/sol6924.html21957http://www.mnin.org/advisories/2007_firepass.pdf3916720070105 NNL-Labs & MNIN - F5 FirePass Security Advisoryhttps://tech.f5.com/home/solutions/sol6916.html236402362620070106 NNL-Labs & MNIN - F5 FirePass Security AdvisoryF5 FirePass 5.4 through 5.5.1 does not properly enforce host access restrictions when a client uses a single integer (dword) representation of an IP address ("dotless IP address"), which allows remote authenticated users to connect to the FirePass administrator console and certain other network resources.https://tech.f5.com/home/solutions/sol6922.html21957http://www.mnin.org/advisories/2007_firepass.pdf327342364020070106 NNL-Labs & MNIN - F5 FirePass Security Advisory** DISPUTED ** PHP remote file inclusion vulnerability in index.php in GeoBB Georgian Bulletin Board allows remote attackers to execute arbitrary PHP code via a URL in the action parameter. NOTE: CVE disputes this issue, since GeoBB 1.0 sets $action to a whitelisted value.geobb-index-file-include(31335)20070107 GeoBB Georgian Bulletin Board Remote File Include Vuln.20070110 Dispute of GeoBB RFI334402141PHP remote file inclusion vulnerability in edit_address.php in edit-x ecommerce allows remote attackers to execute arbitrary PHP code via a URL in the include_dir parameter.ADV-2007-015820070109 edit-x ecommerce (include_dir) Remote File includeeditx-editaddress-file-include(31384)219742139Cross-site scripting (XSS) vulnerability in admin.php in MKPortal allows remote attackers to inject arbitrary web script or HTML via two certain fields in a contents_new operation in the ad_contents section.mkportal-admin-xss(31304)20070105 MkPortal Admin XSS333992138Cross-site request forgery (CSRF) vulnerability in the save_main operation in the ad_perms section in admin.php in MKPortal allows remote attackers to modify privilege settings, as demonstrated using a getURL of admin.php within a .swf file contained in an IFRAME element, aka the "All Guests are Admin" attack.20070104 MkPortal "All Guests are Admin" Exploit334002137FON La Fonera routers do not properly limit DNS service access by unauthenticated clients, which allows remote attackers to tunnel traffic via DNS requests for hosts that should not be accessible before authentication.20070107 Re: FON Router allows anonymous web access20070106 FON Router allows anonymous web access33441admin.php in MKPortal M1.1 RC1 allows remote attackers to obtain sensitive information via a direct request with an MK_PATH=1 query string, which reveals the path in an error message.20070108 MKPortal Full Path Disclosure33407mkportal-admin-path-disclosure(31333)my.activation.php3 in F5 FirePass 5.4 through 5.5.1 and 6.0 displays different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to confirm the validity of an LDAP account.https://tech.f5.com/home/solutions/sol6923.html21957http://www.mnin.org/advisories/2007_firepass.pdf327362362720070106 NNL-Labs & MNIN - F5 FirePass Security AdvisorySQL injection vulnerability in admin_check_user.asp in Motionborg Web Real Estate 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the username field (txtUserName parameter) and possibly other parameters. NOTE: some details were obtained from third party information.motionborg-admincheckuser-sql-injection(31360)ADV-2007-01432196323531327183105Finder 10.4.6 on Apple Mac OS X 10.4.8 allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a long volume name in a DMG disk image, which results in memory corruption.TA07-047AVU#240880macos-finder-dos(31410)ADV-2007-014010176622198020070111 DMA[2007-0107a] OmniWeb Javascript Alert Format String Vulnerabiity and DMA[2007-0109a] Apple Finder Disk Image Volume Label Overflow / DoS32714http://www.digitalmunition.com/DMA%5B2007-0109a%5D.txt24198http://projects.info-pull.com/moab/MOAB-09-01-2007.htmlAPPLE-SA-2007-02-15http://docs.info.apple.com/article.html?artnum=305102The JTapi Gateway process in Cisco Unified Contact Center Enterprise, Unified Contact Center Hosted, IP Contact Center Enterprise, and Cisco IP Contact Center Hosted 5.0 through 7.1 allows remote attackers to cause a denial of service (repeated process restart) via a certain TCP session on the JTapi server port.20070110 Cisco Unified Contact Center and IP Contact Center JTapi Gateway VulnerabilityADV-2007-01382198832682101749923710The Data-link Switching (DLSw) feature in Cisco IOS 11.0 through 12.4 allows remote attackers to cause a denial of service (device reload) via "an invalid value in a DLSw message... during the capabilities exchange."20070110 DLSw VulnerabilityADV-2007-0139oval:org.mitre.oval:def:57143268321990101749823697PHP remote file inclusion vulnerability in template.php in Geoffrey Golliher Axiom Photo/News Gallery (axiompng) 0.8.6 allows remote attackers to execute arbitrary PHP code via a URL in the baseAxiomPath parameter.ADV-2007-010720070110 source verify - Axiom RFI32716axiom-template-file-include(31372)21972237153108Buffer overflow in the cmd_usr function in ftp-gw in TIS Internet Firewall Toolkit (FWTK) allows remote attackers to execute arbitrary code via a long destination hostname (dest).tisfwtk-ftpgw-bo(31363)21960http://www.ranum.com/security/computer_security/editorials/codetools/101748135967SQL injection vulnerability in index.php in @lex Guestbook 4.0.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the lang parameter.@lexguestbook-index-sql-injection(31393)ADV-2007-01372192620070107 @lex Guestbook <= 4.0.2 Remote Command Execution Exploit2363731707http://acid-root.new.fr/poc/20070107.txt21353103Multiple unspecified vulnerabilities in phpMyAdmin before 2.9.2-rc1 have unknown impact and attack vectors.http://www.phpmyadmin.net/home_page/downloads.php?relnotes=023702ADV-2007-01253266621987MDKSA-2007:199Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.9.2-rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information.23702ADV-2007-0125http://www.phpmyadmin.net/home_page/downloads.php?relnotes=032667phpmyadmin-unspecified-xss(31387)21987MDKSA-2007:199Directory traversal vulnerability in admin/skins.php for @lex Guestbook 4.0.2 and earlier allows remote attackers to create files in arbitrary directories via ".." sequences in the (1) aj_skin and (2) skin_edit parameters. NOTE: this can be leveraged for file inclusion by creating a skin file in the lang directory, then referencing that file via the lang parameter to index.php, which passes a sanity check in livre_include.php.@lexguestbook-livreinclude-file-include(31397)2192620070107 @lex Guestbook <= 4.0.2 Remote Command Execution Exploit213531709317083103http://acid-root.new.fr/poc/20070107.txtUnspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 6.20, 6.4x, 7.01, and 7.50 allows remote attackers to read arbitrary files via unknown vectors.ADV-2007-015322009SSRT061174HPSBMA021753272910175032140Microsoft Word in Office 2000 SP3, XP SP3, Office 2003 SP2, Works Suite 2004 to 2006, and Office 2004 for Mac does not correctly check the properties of certain documents and warn the user of macro content, which allows user-assisted remote attackers to execute arbitrary code.TA07-044AMS07-014ADV-2007-058310176392247734385oval:org.mitre.oval:def:700Microsoft Word in Office 2000 SP3, XP SP3, Office 2003 SP2, Works Suite 2004 to 2006, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a Word file with a malformed drawing object, which leads to memory corruption.TA07-044AADV-2007-0583101763922482MS07-01434386oval:org.mitre.oval:def:187The Window Image Acquisition (WIA) Service in Microsoft Windows XP SP2 allows local users to gain privileges via unspecified vectors involving an "unchecked buffer," probably a buffer overflow.TA07-044AMS07-007ADV-2007-05761017634224993188924132oval:org.mitre.oval:def:186The hardware detection functionality in the Windows Shell in Microsoft Windows XP SP2 and Professional, and Server 2003 SP1 allows local users to gain privileges via an unvalidated parameter to a function related to the "detection and registration of new hardware."TA07-044AVU#240796MS07-006ADV-2007-05751017633224813189024126oval:org.mitre.oval:def:224Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 does not properly decode certain MIME encoded e-mails, which allows remote attackers to execute arbitrary code via a crafted base64-encoded MIME e-mail message.TA07-128AVU#343145MS07-026ADV-2007-1711SSRT071422exchange-mime-base64-code-execution(33889)101801523809HPSBST022143439125183oval:org.mitre.oval:def:1890The HTML Help ActiveX control (Hhctrl.ocx) in Microsoft Windows 2000 SP3, XP SP2 and Professional, 2003 SP1 allows remote attackers to execute arbitrary code via unspecified functions, related to uninitialized parameters.VU#563756TA07-044AMS07-008ADV-2007-05771017635224783188424136oval:org.mitre.oval:def:125Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, and 2003 Viewer allows user-assisted remote attackers to execute arbitrary code via a .XLS BIFF file with a malformed Named Graph record, which results in memory corruption.TA07-128Ahttp://www.zerodayinitiative.com/advisories/ZDI-07-026.htmlMS07-023ADV-2007-1708SSRT071422excel-biff-file-bo(33913)101801223760SSRT07142220070508 ZDI-07-026: Microsoft Excel BIFF File Format Named Graph Record Parsing Stack Overflow Vulnerability3439325150oval:org.mitre.oval:def:1971wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary code via a .wps file with crafted section length headers, aka "Microsoft Works File Converter Input Validation Vulnerability."TA08-043CMS08-011ADV-2008-051310193862765728904SSRT080016HPSBST0231420080208 Microsoft Office Works Converter Heap Overflow Vulnerabilityoval:org.mitre.oval:def:5309The wininet.dll FTP client code in Microsoft Internet Explorer 5.01 and 6 might allow remote attackers to execute arbitrary code via an FTP server response of a specific length that causes a terminating null byte to be written outside of a buffer, which causes heap corruption.VU#613564TA07-044AMS07-016ADV-2007-0584101764222489318922415620070213 Microsoft 'wininet.dll' FTP Reply Null Termination Heap Corruption Vulnerability20070309 MS07-016 FTP Response DOS PoCoval:org.mitre.oval:def:1141Microsoft Internet Explorer 5.01 and 6 allows remote attackers to execute arbitrary code by instantiating certain COM objects from Urlmon.dll, which triggers memory corruption during a call to the IObjectSafety function.TA07-163AMS07-033webbrowser-object-code-execution(32106)ADV-2007-215324372HPSBST02231HPSBST022311018235256273534820070612 Microsoft License Manager and urlmon.dll COM Object Interaction Invalid Memory Access Vulnerabilityoval:org.mitre.oval:def:1084Microsoft Internet Explorer 5.01, 6, and 7 uses certain COM objects from (1) Msb1fren.dll, (2) Htmlmm.ocx, and (3) Blnmgrps.dll as ActiveX controls, which allows remote attackers to execute arbitrary code via unspecified vectors, a different issue than CVE-2006-4697.VU#771788TA07-044AMS07-016ie-com-activex-code-execution(32427)ADV-2007-058410176432250431895318943189324156oval:org.mitre.oval:def:257Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an "incorrectly handled UTF character set label".TA07-128AVU#124113MS07-026ADV-2007-1711SSRT071422exchange-utf-xss(33887)101801523806HPSBST022143438925183oval:org.mitre.oval:def:1371Integer overflow in the IMAP (IMAP4) support in Microsoft Exchange Server 2000 SP3 allows remote attackers to cause a denial of service (service hang) via crafted literals in an IMAP command, aka the "IMAP Literal Processing Vulnerability."TA07-128A1018015MS07-0262518320070508 Microsoft Exchange Server 2000 IMAP Literal Processing DoS Vulnerabilityexchange-imap-command-dos(33890)ADV-2007-171123810HPSBST02214SSRT07142234392oval:org.mitre.oval:def:2054Directory traversal vulnerability in the EmChartBean server side component for Oracle Application Server 10g allows remote attackers to read arbitrary files via unknown vectors, probably "\.." sequences in the beanId parameter. NOTE: this is likely a duplicate of another CVE that Oracle addressed in CPU Jan 2007, but due to lack of details by Oracle, it is unclear which BugID this issue is associated with, so the other CVE cannot be determined. Possibilities include EM02 (CVE-2007-0292) or EM05 (CVE-2007-0293).2202720070115 SYMSA-2007-001: Oracle Application Server 10g - Directory Traversal2379420070131 Oracle 10g R2 Enterprise Manager Directory Traversalhttp://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html101752222083SQL injection vulnerability in shared/code/cp_functions_downloads.php in Nicola Asuni All In One Control Panel (AIOCP) before 1.3.009 allows remote attackers to execute arbitrary SQL commands via the download_category parameter.http://sourceforge.net/project/shownotes.php?release_id=47784523726aiocp-cpfunctionsdownloads-sql-injection(31591)2201931641SQL injection vulnerability in shopgiftregsearch.asp in VP-ASP Shopping Cart 6.09 and earlier allows remote attackers to execute arbitrary SQL commands via the LoginLastname parameter.2369932732vpasp-shopgift-sql-injection(31447)3115Cross-site scripting (XSS) vulnerability in shopcustadmin.asp in VP-ASP Shopping Cart 6.09 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter.2369932733vpasp-shopcustadmin-xss(31449)3115SQL injection vulnerability in wbsearch.aspx in uniForum 4 and earlier allows remote attackers to execute arbitrary SQL commands via the "by User" field (aka the TXbyuser parameter).uniforum-wbsearch-sql-injection(31362)219663292720070125 uniForum <= v4 (wbsearch.aspx) Remote SQL Injection Vulnerability238273106slocate 3.1 does not properly manage database entries that specify names of files in protected directories, which allows local users to obtain the names of private files. NOTE: another researcher reports that the issue is not present in slocate 2.7.2198920070329 FLEA-2007-0005-1: slocate20070110 Re: slocate leaks filenames of protected directories20070110 slocate leaks filenames of protected directories20070111 Re: slocate leaks filenames of protected directories33465USN-425-120070112 Re: slocate leaks filenames of protected directoriesThe DataCollector service in EIQ Networks Network Security Analyzer allows remote attackers to cause a denial of service (service crash) via a (1) &CONNECTSERVER& (2) &ADDENTRY& (3) &FIN& (4) &START& (5) &LOGPATH& (6) &FWADELTA& (7) &FWALOG& (8) &SETSYNCHRONOUS& (9) &SETPRGFILE&, or (10) &SETREPLYPORT& string to TCP port 10618, which triggers a NULL pointer dereference.ADV-2007-0147219943272520070110 EIQ Networks Network Security Analyzer DoS Vulnerabilityeiq-datacollector-dos(31428)23693Integer overflow in the ffs_mountfs function in Mac OS X 10.4.8 and FreeBSD 6.1 allows local users to cause a denial of service (panic) and possibly gain privileges via a crafted DMG image that causes "allocation of a negative size buffer" leading to a heap-based buffer overflow, a related issue to CVE-2006-5679. NOTE: a third party states that this issue does not cross privilege boundaries in FreeBSD because only root may mount a filesystem.TA07-072Amacos-ffsmountfs-bo(31409)ADV-2007-0930ADV-2007-0141101775121993326842447923703http://projects.info-pull.com/moab/MOAB-10-01-2007.html[freebsd-security] 20070114 MOAB advisoriesAPPLE-SA-2007-03-13http://docs.info.apple.com/article.html?artnum=305214http://applefun.blogspot.com/2007/01/moab-10-01-2007-apple-dmg-ufs.html** DISPUTED ** PHP remote file inclusion vulnerability in install.php in CS-Cart 1.3.3 allows remote attackers to execute arbitrary PHP code via a URL in the install_dir parameter. NOTE: CVE and third parties dispute this vulnerability because install_dir is defined before use.cscart-install-file-include(31408)20070109 CS-Cart 1.3.3 (install.php) Remote File Include Vulnerability20070110 [bogus] [ahmed_labib_hilmy at yahoo.com: CS-Cart 1.3.3 (install.php) Remote File Include Vulnerability] (fwd)31277Cross-site scripting (XSS) vulnerability in Movable Type (MT) 3.33, when nofollow is disabled and unmoderated comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Comments field.http://www.zackvision.com/weblog/2007/01/movabletype-security-bug.htmlADV-2007-01422366932717http://golem.ph.utexas.edu/~distler/blog/archives/001102.htmlPHP remote file inclusion vulnerability in routines/fieldValidation.php in Jshop Server 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the jssShopFileSystem parameter.2199533459jshop-fieldvalidation-file-include(31425)20070110 Jshop Server 1.321463113wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary SQL commands via the tb_id parameter. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in WordPress.2198336860wordpress-tbid-sql-injection(31385)3109** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2007-0243. Reason: This candidate is a duplicate of CVE-2007-0243. Notes: All CVE users should reference CVE-2007-0243 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.Stack-based buffer overflow in the glibtop_get_proc_map_s function in libgtop before 2.14.6 (libgtop2) allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a process with a long filename that is mapped in its address space, which triggers the overflow in gnome-system-monitor.https://launchpad.net/bugs/79206https://issues.rpath.com/browse/RPL-972libgtop2-glibtopbo(31522)ADV-2007-0187ADV-2007-0185USN-407-122054MDKSA-2007:023DSA-1255GLSA-200701-17240152387223840238142377723736oval:org.mitre.oval:def:1072032815http://ftp.gnome.org/pub/gnome/sources/libgtop/2.14/libgtop-2.14.6.newshttp://bugzilla.gnome.org/show_bug.cgi?id=3964771018526RHSA-2007:076526367Double free vulnerability in the _ATPsndrsp function in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to cause a denial of service (kernel panic) and possibly execute arbitrary code via a crafted AppleTalk request that triggers a heap-based buffer overflow.TA07-072AADV-2007-0930ADV-2007-019110177512204132687313010175132447923708http://projects.info-pull.com/moab/MOAB-14-01-2007.htmlAPPLE-SA-2007-03-13http://docs.info.apple.com/article.html?artnum=305214The ndeb-binary feature in Lookup (lookup-el) allows local users to overwrite arbitrary files via a symlink attack on temporary files.DSA-1269245902437734263lookup-ndebbinary-symlink(33052)101779223026GLSA-200712-0728023http://bugs.gentoo.org/show_bug.cgi?id=197306Stack-based buffer overflow in filter\starcalc\scflt.cxx in the StarCalc parser in OpenOffice.org (OOo) Office Suite before 2.2, and 1.x before 1.1.5 Patch, allows user-assisted remote attackers to execute arbitrary code via a document with a long Note.https://issues.rpath.com/browse/RPL-1118https://issues.foresightlinux.org/browse/FL-211openoffice-starcalc-bo(33112)ADV-2007-1117ADV-2007-1032USN-444-110177992306720070404 High Risk Vulnerability in OpenOfficeRHSA-2007:0069RHSA-2007:0033http://www.openoffice.org/security/CVE-2007-0238http://www.ngssoftware.com/advisories/high-risk-vulnerabilities-in-the-openoffice-suite/MDKSA-2007:073GLSA-200704-12DSA-1270102794249062481024676246472464624613245882455024465oval:org.mitre.oval:def:8968SUSE-SA:2007:023OpenOffice.org (OOo) Office Suite allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a prepared link in a crafted document.ADV-2007-1117ADV-2007-10321017799DSA-1270oval:org.mitre.oval:def:11422https://issues.rpath.com/browse/RPL-1118https://issues.foresightlinux.org/browse/FL-211openoffice-shell-command-execution(33113)USN-444-122812RHSA-2007:0069RHSA-2007:0033MDKSA-2007:073GLSA-200704-12102807249062481024676246472464624613245882455024465SUSE-SA:2007:023Cross-site scripting (XSS) vulnerability in Zope 2.10.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a HTTP GET request.http://www.zope.org/Products/Zope/Hotfix-2007-03-20/announcement/viewADV-2007-1041zope-unspecifiedget-xss(33187)23084DSA-1275252392471324017SUSE-SR:2007:011The UTF-8 decoder in codecs/qutfcodec.cpp in Qt 3.3.8 and 4.2.3 does not reject long UTF-8 sequences as required by the standard, which allows remote attackers to conduct cross-site scripting (XSS) and directory traversal attacks via long sequences that decode to dangerous metacharacters.http://www.trolltech.com/company/newsroom/announcements/press.2007-03-30.9172215350ADV-2007-1212http://www.nabble.com/Bug-417390:-CVE-2007-0242,--Qt-UTF-8-overlong-sequence-decoding-vulnerability-t3506065.html46117RHSA-2011:1324oval:org.mitre.oval:def:11510https://issues.rpath.com/browse/RPL-1202qt-utf8-xss(33397)USN-452-123269RHSA-2007:0909RHSA-2007:0883SUSE-SR:2007:006MDKSA-2007:076MDKSA-2007:075MDKSA-2007:074DSA-1292http://support.novell.com/techcenter/psdb/fc79b7f48d739f9c803a24ddad933384.htmlhttp://support.novell.com/techcenter/psdb/39ea4b325a7da742cb8b6995fa585b14.htmlhttp://support.avaya.com/elmodocs2/security/ASA-2007-424.htmSSA:2007-093-0327275271082685726804252632488924847247972475924727247262470524699FEDORA-2007-70320070901-01-PBuffer overflow in Sun JDK and Java Runtime Environment (JRE) 5.0 Update 9 and earlier, SDK and JRE 1.4.2_12 and earlier, and SDK and JRE 1.3.1_18 and earlier allows applets to gain privileges via a GIF image with a block with a 0 width field, which triggers memory corruption.TA07-022AVU#388289http://www.zerodayinitiative.com/advisories/ZDI-07-005.html102760jre-gif-bo(31537)ADV-2007-4224ADV-2007-1814ADV-2007-0936ADV-2007-02112208520070121 Sun Microsystems Java GIF File Parsing Memory Corruption Vulnerability Prove Of Concept Exploit20070117 ZDI-07-005: Sun Microsystems Java GIF File Parsing Memory Corruption VulnerabilityRHSA-2007:0956RHSA-2007:0167RHSA-2007:0166SUSE-SA:2007:045GLSA-200702-07http://support.novell.com/techcenter/psdb/d2f549cc040cd81ae4a268bb5edfe918.htmlhttp://support.novell.com/techcenter/psdb/4f850d1e2b871db609de64ec70f0089c.html10175202158GLSA-200702-082811527203266452611926049252832499324468242022418923757oval:org.mitre.oval:def:1107332834APPLE-SA-2007-12-14HPSBUX02196HPSBUX02196http://docs.info.apple.com/article.html?artnum=307177BEA07-172.00RHSA-2008:0261pptpgre.c in PoPToP Point to Point Tunneling Server (pptpd) before 1.3.4 allows remote attackers to cause a denial of service (PPTP connection tear-down) via (1) GRE packets with out-of-order sequence numbers or (2) certain GRE packets that are processed using a wrong pointer and improperly dequeued.DSA-1288ADV-2007-174323886http://sourceforge.net/project/shownotes.php?release_id=501476&group_id=44827USN-459-2USN-459-12007-00171018064SUSE-SR:2007:019SUSE-SR:2007:010GLSA-200705-18269872525525220Heap-based buffer overflow in OpenOffice.org (OOo) 2.2.1 and earlier allows remote attackers to execute arbitrary code via a RTF file with a crafted prtdata tag with a length parameter inconsistency, which causes vtable entries to be overwritten.DSA-1307https://issues.rpath.com/browse/RPL-1570openoffice-rtf-bo(34843)ADV-2007-2229ADV-2007-2166USN-482-110182392445020070613 High risk vulnerability in OpenOffice RTF parserRHSA-2007:0406SUSE-SA:2007:037MDKSA-2007:144GLSA-200707-02http://sw.openoffice.org/source/browse/sw/sw/source/filter/rtf/swparrtf.cxx?rev=1.6710291726476260222601025905258942586225705256732565025648oval:org.mitre.oval:def:100023537820070602-01-Pplugins/scmcvs/www/cvsweb.php in the CVSWeb CGI in GForge 4.5.16 before 20070524, aka gforge-plugin-scmcvs, allows remote attackers to execute arbitrary commands via shell metacharacters in the PATH_INFO.2541625395gforge-cvsweb-command-execution(34510)ADV-2007-194224141DSA-129736526http://gforge.org/scm/viewvc.php/branches/Branch_4_5/gforge/plugins/scmcvs/www/cvsweb.php?root=gforge&r1=5849&r2=6038&pathrev=6038gforge-cvsweb-code-execution(34510)squid/src/ftp.c in Squid before 2.6.STABLE7 allows remote FTP servers to cause a denial of service (core dump) via crafted FTP directory listing responses, possibly related to the (1) ftpListingFinish and (2) ftpHtmlifyListEntry functions.squid-multiple-dos(31523)ADV-2007-0199USN-414-1http://www.squid-cache.org/Versions/v2/2.6/squid-2.6.STABLE7-RELEASENOTES.html#s12http://www.squid-cache.org/bugs/show_bug.cgi?id=185722079SUSE-SA:2007:012MDKSA-2007:026GLSA-200701-222394623921238892383723810238052376739839The aclMatchExternal function in Squid before 2.6.STABLE7 allows remote attackers to cause a denial of service (crash) by causing an external_acl queue overload, which triggers an infinite loop.23767ADV-2007-0199http://www.squid-cache.org/Versions/v2/2.6/squid-2.6.STABLE7-RELEASENOTES.html#s12http://www.squid-cache.org/bugs/show_bug.cgi?id=1848squid-externalacl-dos(31525)USN-414-122203SUSE-SA:2007:012MDKSA-2007:026GLSA-200701-2223946239212388923805Cross-site scripting (XSS) vulnerability in index.php in Nwom topsites 3.0 allows remote attackers to inject arbitrary web script or HTML via the o parameter.2201220070111 Nwom topsites v3.0334612149index.php in Nwom topsites 3.0 allows remote attackers to obtain potentially sensitive information via a ' (quote) character in the o parameter, which forces a SQL error.2201220070111 Nwom topsites v3.0334622149Integer underflow in the DecodeGRE function in src/decode.c in Snort 2.6.1.2 allows remote attackers to trigger dereferencing of certain memory locations via crafted GRE packets, which may cause corruption of log files or writing of sensitive information into log files.ADV-2007-0152http://www.snort.org/got_source/source.html2200420070111 Calyptix Security Advisory CX-2007-001 - Snort 2.6.1.2 Integer Underflow Vulnerability3346432095http://labs.calyptix.com/advisories/CX-2007-01.txt10175072165Unspecified vulnerability in easy-content filemanager allows remote attackers to upload or modify arbitrary files via unspecified vectors.20070111 easy-content filemanager33463** DISPUTED ** Unspecified vulnerability in the grsecurity patch has unspecified impact and remote attack vectors, a different vulnerability than the expand_stack vulnerability from the Digital Armaments 20070110 pre-advisory. NOTE: the grsecurity developer has disputed this issue, stating that "the function they claim the vulnerability to be in is a trivial function, which can, and has been, easily checked for any supposed vulnerabilities." The developer also cites a past disclosure that was not proven.http://www.digitalarmaments.com/news_news.shtmlhttp://grsecurity.net/news.php#digitalfudhttp://forums.grsecurity.net/viewtopic.php?t=1646Format string vulnerability in the errors_create_window function in errors.c in xine-ui allows attackers to execute arbitrary code via unknown vectors.2200220070111 Xine-ui format string Vulnerabilties.31594xineui-errorscreatewindow-format-string(31505)MDKSA-2007:154MDKSA-2007:027GLSA-200701-18239312389123709XINE 0.99.4 allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a certain M3U file that contains a long #EXTINF line and contains format string specifiers in an invalid udp:// URI, possibly a variant of CVE-2007-0017.20070110 VLC Format String Vulnerability also in XINE3166622252MDKSA-2007:154MDKSA-2007:02723931VideoLAN VLC 0.8.6a allows remote attackers to cause a denial of service (application crash) via a crafted .wmv file.22003http://wiki.videolan.org/Changelog/0.8.6boval:org.mitre.oval:def:1469839022http://downloads.securityfocus.com/vulnerabilities/exploits/22003.pyvlcmediaplayer-wmv-dos(31515)** DISPUTED ** Unspecified vulnerability in the expand_stack function in grsecurity PaX allows local users to gain privileges via unspecified vectors. NOTE: the grsecurity developer has disputed this issue, stating that "the function they claim the vulnerability to be in is a trivial function, which can, and has been, easily checked for any supposed vulnerabilities." The developer also cites a past disclosure that was not proven. As of 20070120, the original researcher has released demonstration code.ADV-2007-01552201420070309 Re: Digital Armaments Security Advisory 20.01.2007: Grsecurity Kernel PaX Vulnerability20070120 Digital Armaments Security Advisory 20.01.2007: Grsecurity Kernel PaX Vulnerability20070112 Lies? [Was: Re: Digital Armaments Security Pre-Advisory11.01.2007: Grsecurity Kernel PaX - Local root vulnerability]20070111 Digital Armaments Security Pre-Advisory 11.01.2007: Grsecurity Kernel PaX - Local root vulnerabilityhttp://www.digitalarmaments.com/pre2007-00018659.htmlhttp://www.digitalarmaments.com/news_news.shtml10175092371332727http://grsecurity.net/news.php#digitalfudhttp://forums.grsecurity.net/viewtopic.php?t=1646Cross-site scripting (XSS) vulnerability in index.php in (1) Fastilo 2.0 and (2) Open Solution Quick.Cart 2.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: some of these details are obtained from third party information.ADV-2007-0157ADV-2007-01562200723738237333273132730http://14house.blogspot.com/2007/01/fastilo-open-source-shopping-cart-vuln.htmlquickcart-p-xss(31475)21971Ezboxx Portal System Beta 0.7.6 and earlier allows remote attackers to obtain sensitive information via a invalid cat parameter to boxx/knowledgebase.asp, which reveals the path in an error message.ADV-2007-020820070111 Ezboxx multiple vulnerabilities.3347032829http://www.bugsec.com/articles.php?Security=20** DISPUTED ** PHP remote file inclusion vulnerability in index.php in Naig 0.5.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the this_path parameter. NOTE: a reliable third party disputes this vulnerability because this_path is defined before use.20070112 Naig <= 0.5.2 (this_path) Remote File Include Vulnerability20070112 Fwd: Naig <= 0.5.2 (this_path) Remote File Include Vulnerability3347220070113 Re: Naig <= 0.5.2 (this_path) Remote File Include Vulnerability2145snews.php in sNews 1.5.30 and earlier does not properly exit when authentication fails, which allows remote attackers to perform unauthorized administrative actions, as demonstrated by changing an administrative password via the changeup task, and by uploading PHP code via the imagefile parameter.2202532817snews-image-file-upload(31535)237463116WordPress 2.0.6, and 2.1Alpha 3 (SVN:4662), does not properly verify that the m parameter value has the string data type, which allows remote attackers to obtain sensitive information via an invalid m[] parameter, as demonstrated by obtaining the path, and obtaining certain SQL information such as the table prefix.20070112 Wordpress disclosure of Table Prefix Weakness33458Unspecified vulnerability in Total Commander before 6.5.6 allows user-assisted remote attackers to delete arbitrary files and corrupt a filesystem via a crafted RAR file. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.22033http://www.ghisler.com/whatsnew.htm39837Buffer overflow in Winzip32.exe in WinZip 9.0 allows local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long command line argument. NOTE: this issue may cross privilege boundaries if an application automatically invokes Winzip32.exe for untrusted input filenames, as in the case of a file upload application. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.This vulnerability is addressed in the following product release:
WinZip, WinZip, 9.0 SR12202039800Multiple cross-site scripting (XSS) vulnerabilities in Ezboxx Portal System Beta 0.7.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the pic parameter to custom/piczoom.asp, (2) the nocatname parameter to boxx/user-upload.asp, or (3) the iid parameter to indexes/newscomments.asp.ADV-2007-020820070111 Ezboxx multiple vulnerabilities.334693346833467328283282732826http://www.bugsec.com/articles.php?Security=2023759SQL injection vulnerability in boxx/ShowAppendix.asp in Ezboxx Portal System Beta 0.7.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the iid parameter.ADV-2007-020820070111 Ezboxx multiple vulnerabilities.3346632825http://www.bugsec.com/articles.php?Security=2023759The ufs_lookup function in the Mac OS X 10.4.8 and FreeBSD 6.1 kernels allows local users to cause a denial of service (kernel panic) and possibly corrupt other filesystems by mounting a crafted UNIX File System (UFS) DMG image that contains a corrupted directory entry (struct direct), related to the ufs_dirbad function. NOTE: a third party states that the FreeBSD issue does not cross privilege boundaries.TA07-072AADV-2007-0930ADV-2007-0171101775122036326862447923721http://projects.info-pull.com/moab/MOAB-12-01-2007.html[freebsd-security] 20070114 MOAB advisoriesAPPLE-SA-2007-03-13http://docs.info.apple.com/article.html?artnum=305214Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5, 9.2.0.7, and 10.1.0.5 have unknown impact and attack vectors related to (1) the Advanced Queuing component and sys.dbms_aqsys.dbms_aq privileges (DB01), (2) Advanced Replication and sys.dbms_repcat_untrusted (DB07), and (3) Oracle Text and ctxload (DB15). NOTE: Oracle has not publicly claims by reliable researchers that DB01 is for SQL injection in the SYS.DBMS_AQ_INV package, and DB07 is for a buffer overflow in the UNREGISTER_SNAPSHOT procedure in the DBMS_REPCAT_UNTRUSTED package.TA07-017AVU#2217882208323794oracle-cpu-jan2007(31541)20070129 Re: Re: Oracle Buffer Overflows in DBMS_CAPTURE_ADM_INTERNAL20070124 Oracle Buffer Overflow in DBMS_REPCAT_UNTRUSTED.UNREGISTER_SNAPSHOThttp://www.red-database-security.com/advisory/oracle_sql_injection_dbms_aq_inv.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html1017522329213291332907Unspecified vulnerability in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.3 has unknown impact and attack vectors related to the Change Data Capture and sys.dbms_cdc_subscribe privileges, aka DB02.TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html32908oracle-cpu-jan2007(31541)220831017522Buffer overflow in SYS.DBMS_DRS in Oracle Database 9.2.0.7 and 10.1.0.4 allows remote authenticated users to cause a denial of service (crash) or execute arbitrary code via the GET_PROPERTY function in SYS.DBMS_DRS, aka DB03.TA07-017A23794oracle-cpu-jan2007(31541)2208320070718 Oracle Database Buffer overflow vulnerabilities in procedure DBMS_DRS.GET_PROPERTY (DB03)20070124 Oracle Buffer Overflow in DBMS_DRS.GET_PROPERTYhttp://www.oracle.com/technetwork/topics/security/cpujan2007-101493.htmlhttp://www.appsecinc.com/resources/alerts/oracle/2007-04.shtml101752232909Unspecified vulnerability in Oracle Database 9.0.1.5 and 9.2.0.7 has unknown impact and attack vectors related to the Log Miner component and sys.dbms_log_mnr privileges, aka DB04. NOTE: Oracle has not disputed a reliable researcher claim that this is a buffer overflow in the ADD_LOGFILE procedure for the SYS.DBMS_LOGMNR package that allows code execution.TA07-017A23794oracle-cpu-jan2007(31541)2208320070129 Re: Re: Oracle Buffer Overflows in DBMS_CAPTURE_ADM_INTERNAL20070124 Oracle Buffer Overflow in DBMS_LOGMNR.ADD_LOGFILEhttp://www.oracle.com/technetwork/topics/security/cpujan2007-101493.htmlhttp://www.appsecinc.com/resources/alerts/oracle/2007-01.shtml101752232910Multiple buffer overflows in MDSYS.MD in Oracle Database 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4 allows remote authenticated users to cause a denial of service (crash) or execute arbitrary code via unspecified vectors involving certain public procedures, aka DB05.TA07-017A23794oracle-cpu-jan2007(31541)2208320070718 Oracle Database Buffer overflows and Denial of service vulnerabilities in public procedures of MDSYS.MD (DB12)20070124 Oracle Multiple Buffer Overflows and DoS attacks in public procedures of MDSYS.MDhttp://www.oracle.com/technetwork/topics/security/cpujan2007-101493.htmlhttp://www.appsecinc.com/resources/alerts/oracle/2007-05.shtml101752232911Unspecified vulnerability in Oracle Database 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.3 has unknown impact and attack vectors related to XMLDB, aka DB06. NOTE: as of 20070123, Oracle has not disputed claims by a reliable researcher that DB06 is for multiple cross-site scripting (XSS) vulnerabilities.TA07-017A23794oracle-cpu-jan2007(31541)22083http://www.red-database-security.com/advisory/oracle_xmldb_css2.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html101752232912Multiple unspecified vulnerabilities in Oracle Database 9.2.0.7 and 10.1.0.5 have unknown impact and attack vectors related to (1) Export and sys.dbms_logrep_util (DB08), and (2) Oracle Streams and sys.dbms_capture_adm_internal privileges (DB09). NOTE: Oracle has not disputed reliable researcher claims that DB08 is for a buffer overflow in the GET_OBJECT_NAME procedure in the DBMS_LOGREP_UTIL package, and DB09 is for buffer overflows in the CREATE_CAPTURE, ALTER_CAPTURE, and ABORT_TABLE_INSTANTIATION procedures in SYS.DBMS_CAPTURE_ADM_INTERNAL.TA07-017A2208323794oracle-cpu-jan2007(31541)20070129 Re: Re: Oracle Buffer Overflows in DBMS_CAPTURE_ADM_INTERNAL20070125 Re: Oracle Buffer Overflow in DBMS_LOGREP_UTIL.GET_OBJECT_NAME20070125 Re: Oracle Buffer Overflows in DBMS_CAPTURE_ADM_INTERNAL20070124 Oracle Buffer Overflows in DBMS_CAPTURE_ADM_INTERNAL20070124 Oracle Buffer Overflow in DBMS_LOGREP_UTIL.GET_OBJECT_NAMEhttp://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html10175223291532914Cross-site scripting (XSS) vulnerability in Oracle Reports Web Cartridge (RWCGI60) in the Workflow Cartridge component, as used in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.3; Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2; Collaboration Suite 10.1.2; and Oracle E-Business Suite and Applications 11.5.10CU2; allows remote authenticated users to inject arbitrary HTML or web script via the genuser parameter to rwcgi60, aka OWF01.TA07-017A23794oracle-cpu-jan2007(31541)2208320070117 [ISecAuditors Security Advisories] Oracle Reports Web Cartridge (RWCGI60) vulnerable to XSShttp://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html101752232906Multiple unspecified vulnerabilities in Oracle Database 8.1.7.4 and 9.0.1.5 have unknown impact and attack vectors related to (1) Advanced Security Option and oklist or okdstry (DB10), (2) Oracle Net Services (DB13), and (3) Recovery Manager and oklist (DB16).TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html329223291932916oracle-cpu-jan2007(31541)220831017522Unspecified vulnerability in Oracle Database client-only 10.1.0.4 has unknown impact and attack vectors related to the Export component and expdp or impdp, aka DB11.TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html32917oracle-cpu-jan2007(31541)220831017522Multiple unspecified vulnerabilities in Oracle Database 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.5 have unknown impact and attack vectors related to (1) NLS Runtime and lmsgen (DB12), and (2) Oracle Text and ctxkbtc (DB14).TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html3292032918oracle-cpu-jan2007(31541)220831017522Multiple unspecified vulnerabilities in Oracle HTTP Server 9.2.0.8 and Oracle E-Business Suite and Applications 11.5.10CU2 have unknown impact and attack vectors, aka (1) OHS01, (2) OHS02, (3) OHS05, (4) OHS06, and (5) OHS07.TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html3288732886328853288232881oracle-cpu-jan2007(31541)220831017522Unspecified vulnerability in Oracle HTTP Server 9.0.1.5, Application Server 9.0.4.3, 10.1.2.0.0, 10.1.2.0.2, and 10.1.2.2; and Collaboration Suite 9.0.4.2 and 10.1.2; has unknown impact and attack vectors related to the Oracle Process Mgmt & Notification component, aka OPMN01. NOTE: as of 20070123, Oracle has not disputed claims by a reliable researcher that OPMN01 is for a buffer overflow in Oracle Notification Service (ONS).TA07-017A23794oracle-cpu-jan2007(31541)22083http://www.red-database-security.com/advisory/oracle_buffer_overflow_ons.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html101752232905Multiple unspecified vulnerabilities in Oracle HTTP Server 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.3; Application Server 9.0.4.3, 10.1.2.0.0, 10.1.2.0.1, 10.1.2.0.2, 10.1.2.1, and 10.1.3.0; and Collaboration Suite 9.0.4.2 and 10.1.2; have unknown impact and attack vectors related to the Oracle HTTP Server, aka (1) OHS03 and (2) OHS04.TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html3288432883oracle-cpu-jan2007(31541)220831017522Unspecified vulnerability in Oracle HTTP Server 9.0.1.5, Application Server 9.0.4.2 and 10.1.2.0.0, and Collaboration Suite 9.0.4.2 has unknown impact and attack vectors related to the Oracle Process Mgmt & Notification component, aka OPMN02.TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.htmloracle-cpu-jan2007(31541)220831017522Unspecified vulnerability in Oracle Application Server 9.0.4.3 and Collaboration Suite 9.0.4.2 has unknown impact and attack vectors related to Oracle Containers for J2EE, aka OC4J02.TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html32896oracle-cpu-jan2007(31541)220831017522Multiple unspecified vulnerabilities in Oracle Application Server 9.0.4.3 and 10.1.2.0.0, and Collaboration Suite 9.0.4.2, have unknown impact and attack vectors related to Oracle Containers for J2EE, aka (1) OC4J03 and (2) OC4J04.TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html3289832897oracle-cpu-jan2007(31541)220831017522Unspecified vulnerability in Oracle Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2; Collaboration Suite 9.0.4.2 and 10.1.2; and E-Business Suite and Applications 11.5.10CU2 has unknown impact and attack vectors related to Oracle Reports Developer, aka REP01.TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html32894oracle-cpu-jan2007(31541)220831017522Unspecified vulnerability in Oracle Application Server 10.1.2.0.2 and 10.1.3.0, and Collaboration Suite 10.1.2, has unknown impact and attack vectors related to Containers for J2EE, aka OC4J07.TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html32901oracle-cpu-jan2007(31541)220831017522Unspecified vulnerability in Oracle Application Server 9.0.4.3, 10.1.2.0.0, and 10.1.2.0.2; and Collaboration Suite 9.0.4.2 and 10.1.2; has unknown impact and attack vectors related to Containers for J2EE, aka OC4J08.TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html32902oracle-cpu-jan2007(31541)220831017522Unspecified vulnerability in Oracle Application Server 10.1.4.0 has unknown impact and attack vectors related to Oracle Internet Directory, aka OID01.TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html32903oracle-cpu-jan2007(31541)220831017522Multiple unspecified vulnerabilities in Oracle Collaboration Suite 9.0.4.2 have unknown impact and attack vectors related to Oracle Containers for J2EE, aka (1) OC4J01, (2) OC4J05, and (3) OC4J06.TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html329003289932895oracle-cpu-jan2007(31541)220831017522Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.10CU2 have unknown impact and attack vectors related to (1) Application Object Library (APPS01), (2) Human Resources (APPS03), (3) Payables (APPS04), (4) Trading Community Architecture (APPS05), and (5) Web Applications Desktop Integrator (APPS06).TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html3289332892328913289032888oracle-cpu-jan2007(31541)220831017522Unspecified vulnerability in Oracle E-Business Suite and Applications 6.2.3 has unknown impact and attack vectors related to Oracle Exchange, aka APPS02.TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html32889oracle-cpu-jan2007(31541)220831017522Multiple unspecified vulnerabilities in Oracle Enterprise Manager 10.1.0.5 have unknown impact and attack vectors related to Oracle Agent, aka (1) EM01 and (2) EM02. NOTE: EM05 might be related to CVE-2007-0222.TA07-017A2208323794oracle-cpu-jan2007(31541)http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html10175223287632875Multiple unspecified vulnerabilities in Oracle Enterprise Manager 10.1.0.5 and 10.2.0.1 have unknown impact and attack vectors related to (1) Oracle Agent (EM03) and (2) EM04 and (3) EM05 in Enterprise Manager Console. NOTE: EM05 might be related to CVE-2007-0222.TA07-017A23794oracle-cpu-jan2007(31541)22083http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html1017522328793287832877Unspecified vulnerability in Oracle Enterprise Manager 10.2.0.1 has unknown impact and attack vectors related to Database Cloning & Data Guard Management, aka EM06.TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html32880oracle-cpu-jan2007(31541)220831017522Unspecified vulnerability in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.22.13 and 8.47.11 has unknown impact and attack vectors in PeopleTools, aka PSE01.TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.htmloracle-cpu-jan2007(31541)220831017522Unspecified vulnerability in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.22.13, 8.47.11, and 8.48.06 has unknown impact and attack vectors in PeopleTools, aka PSE02.TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.htmloracle-cpu-jan2007(31541)220831017522Unspecified vulnerability in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.47.11 and 8.48.06 has unknown impact and attack vectors in PeopleTools, aka PSE03.TA07-017A23794http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.htmloracle-cpu-jan2007(31541)220831017522PHP remote file inclusion vulnerability in show.php in LunarPoll, when register_globals is enabled, allows remote attackers execute arbitrary PHP code via a URL in the PollDir parameter.ADV-2007-01772202420070112 LunarPoll (PollDir) Remote File Include Vulnerabilities3163920070112 Source Verify of LunarPoll PollDir RFIlunarpoll-show-file-include(31472)10175102152237603117Integer overflow in the byte_swap_sbin function in bsd/ufs/ufs/ufs_byte_order.c in Mac OS X 10.4.8 allows user-assisted remote attackers to cause a denial of service (kernel panic) by mounting a crafted Unix File System (UFS) DMG image, which triggers an invalid pointer dereference.VU#515792TA07-072AADV-2007-09301017751316532447923725http://projects.info-pull.com/moab/MOAB-11-01-2007.htmlhttp://docs.info.apple.com/article.html?artnum=305214APPLE-SA-2007-03-13PHP remote file inclusion vulnerability in i-accueil.php in TLM CMS 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter.Successful exploitation requires that "register_globals" is enabled.ADV-2007-0176220212372232814311820070112 [Bogus - partly] V TLM CMS <= 1.1 (i-accueil.php chemin) Remote File Include Vulnerability (fwd)PHP remote file inclusion vulnerability in _admin/admin_menu.php in FdWeB Espace Membre 2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.Successful exploitation requires that "register_globals" is enabled.ADV-2007-01782204023743328243123Multiple cross-site scripting (XSS) vulnerabilities in InstantASP 4.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) SessionID parameter to (a) Logon.aspx, and the (2) Username and (3) Update parameters to (b) Members1.aspx.ADV-2007-02272205220070115 InstantForum.NET Multiple Cross-Site Scripting Vulnerability3285332852instantforum-multiple-scripts-xss(31521)216423787Multiple unspecified vulnerabilities in Zina 1.0rc1 and earlier have unknown impact and attack vectors related to "Potential security bugs."ADV-2007-018122049http://www.pancake.org/zina-changelog-12SQL injection vulnerability in duyuru.asp in MiNT Haber Sistemi 2.7 allows remote attackers to execute arbitrary SQL commands via the id parameter.ADV-2007-017523756328203120SQL injection vulnerability in etkinlikbak.asp in Okul Web Otomasyon Sistemi 4.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.ADV-2007-02062206020070115 Okul Web Otomasyon Sistemi (etkinlikbak.asp) SQL Injection Vulnerability237553281921513135SQL injection vulnerability in visu_user.asp in Digiappz DigiAffiliate 1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.ADV-2007-01792203923744328183122PHP remote file inclusion vulnerability in include/common.php in Poplar Gedcom Viewer 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the env[rootPath] parameter.ADV-2007-01742203823761328073121Cross-site scripting (XSS) vulnerability in Plain Black WebGUI before 7.3.4 (beta) allows remote attackers to inject arbitrary web script or HTML via Wiki Page titles.22051http://www.plainblack.com/getwebgui/advisories/webgui-7_3_4-beta-released#BUeIjcWiQasypsJxD-YwgQ2371832813SQL injection vulnerability in blocks/block-Old_Articles.php in Francisco Burzi PHP-Nuke 7.9 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cat parameter.2203720070113 PHP-Nuke <= 7.9 Old-Articles Block "cat" SQL Injection vulnerabilityhttp://www.neosecurityteam.net/advisories/PHP-Nuke--7.9-Old-Articles-Block-cat-SQL-Injection-vulnerability-31.html101751132863phpnuke-blockoldarticles-sql-injection(31482)215323748BMC Remedy Action Request System 5.01.02 Patch 1267 generates different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to determine valid account names.ADV-2007-02042206620070115 Remedy Action Request System 5.01.02 - User Enumerationhttp://www.alighieri.org/advisories/advisory-remedy50102.txt2377531658rars-login-information-disclosure(31527)20070116 Re: Remedy Action Request System 5.01.02 - User Enumeration10175152162Texas Imperial Software WFTPD and WFTPD Pro Server 3.25 and earlier allow remote attackers to cause a denial of service (application crash) via a long SITE ADMIN command.wftpd-admn-dos(31517)220463126wcSimple Poll stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain password hashes via a direct request for password.txt.20070114 wcSimple Poll (password.txt) Remote Password Disclosure Vulnerablity335392157Unspecified vulnerability in GONICUS System Administration (GOsa) before 2.5.8 allows remote authenticated users to modify certain settings, including the admin password, via crafted POST requests.[gosa] 20070115 GOsa 2.5.8 released (security fixes!)ADV-2007-02072374932821gosa-unspecified-data-manipulation(31516)Multiple PHP remote file inclusion vulnerabilities in Article System 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the INCLUDE_DIR parameter to (1) forms.php, (2) issue_edit.php, (3) client.php, and (4) classes.php.article-system-includedir-file-include(31446)220173114Multiple buffer overflows in FileZilla before 2.2.30a allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors related to (1) Options.cpp when storing settings in the registry, and (2) the transfer queue (QueueCtrl.cpp). NOTE: some of these details are obtained from third party information.Failed exploit attempts may result in a application level denial-of-service condition.filezilla-options-queuectrl-bo(31500)22057http://sourceforge.net/project/shownotes.php?release_id=475423&group_id=21558ADV-2007-0183Multiple SQL injection vulnerabilities in All In One Control Panel (AIOCP) 1.3.010 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) xuser_name parameter to shared/code/cp_authorization.php, and the (2) did parameter to public/code/cp_downloads.php, different vectors than CVE-2007-0223.aiocp-cpdownloads-sql-injection(31485)ADV-2007-01902203220070112 AIOCP Login Bypass Vulnerability20070112 AIOCP SQL Injection Vulnerability2374032810328092166Format string vulnerability in the LogMessage function in FileZilla before 3.0.0-beta5 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted arguments. NOTE: some of these details are obtained from third party information.filezilla-logmessage-format-string(31497)22063http://sourceforge.net/project/shownotes.php?release_id=477793&group_id=21558ADV-2007-0182The do_hfs_truncate function in Mac OS X 10.4.8 allows context-dependent attackers to cause a denial of service (kernel panic) via a crafted HFS+ filesystem in a DMG image, which causes an access of an invalid vnode structure during file removal.TA07-072AADV-2007-0930ADV-2007-01712374210177593268524479http://projects.info-pull.com/moab/MOAB-13-01-2007.htmlAPPLE-SA-2007-03-13http://docs.info.apple.com/article.html?artnum=305214Multiple stack-based buffer overflows in the Motive ActiveEmailTest.EmailData (ActiveUtils EmailData) ActiveX control in ActiveUtils.dll in Motive Service Activation Manager 5.1 and Self Service Manager 5.1 and earlier allow remote attackers to execute arbitrary code via unspecified vectors.VU#747233activeutils-emaildata-bo(36034)ADV-2007-288125312http://www.motive.com/securitybulletin_08122007.aspMS07-04537710101857126481Multiple buffer overflows in (a) an ActiveX control (iftw.dll) and (b) Netscape plug-in (npiftw32.dll) for Macrovision (formerly InstallShield) InstallFromTheWeb allow remote attackers to execute arbitrary code via crafted HTML documents.VU#181041macrovision-installfromtheweb-activex-bo(32645)macrovision-installfromtheweb-activex-bo(32645)ADV-2007-070522672http://www.kb.cert.org/vuls/id/MAPG-6UQUDP242853353133530Buffer overflow in the Update Service Agent ActiveX Control in isusweb.dll for Macrovision FLEXnet Connect (formerly InstallShield Update Service) allows remote attackers to execute arbitrary code via the Download method.VU#847993macrovision-updateservice-activex-bo(32678)ADV-2007-0706http://www.kb.cert.org/vuls/id/MAPG-6UERNRhttp://support.installshield.com/kb/view.asp?articleid=Q1130202427033532Multiple stack-based buffer overflows in the Intuit QuickBooks Online Edition ActiveX control before 10 allow remote attackers to execute arbitrary code via unspecified vectors.VU#907481quickbooks-activex-bo(36462)2554426659Buffer overflow in the SetLanguage function in Research In Motion (RIM) TeamOn Import Object ActiveX control (TOImport.dll) allows remote attackers to execute arbitrary code via unspecified vectors.VU#869641TA07-128AMS07-027ADV-2007-1716HPSBST0221435873rim-toimport-activex-bo(34182)23331HPSBST02214http://www.blackberry.com/btsc/articles/74/KB13142_f.SAL_Public.html25218Multiple buffer overflows in the LizardTech DjVu Browser Plug-in before 6.1.1 allow remote attackers to execute arbitrary code via unspecified vectors.VU#5223932256920070215 Lizardtech DjVu Browser Plug-in - Multiple Vulnerabilities24149ADV-2007-0618http://www.lizardtech.com/products/doc/djvupluginrelease.php33199djvu-browser-multiple-bo(32510)2259Multiple buffer overflows in the Trend Micro OfficeScan Web-Deployment SetupINICtrl ActiveX control in OfficeScanSetupINI.dll, as used in OfficeScan 7.0 before Build 1344, OfficeScan 7.3 before Build 1241, and Client / Server / Messaging Security 3.0 before Build 1197, allow remote attackers to execute arbitrary code via a crafted HTML document.Successful exploitation requires that OfficeScan client was installed using web deployment.The vendor has issued a fix (7.0 Security Patch - Build 1344; 7.3 Security Patch - Build 1241).
VU#78436924193ADV-2007-0638http://www.trendmicro.com/ftp/documentation/readme/osce_70_win_en_securitypatch_1344_readme.txt10176642258533040http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1034288Multiple stack-based buffer overflows in the PhotoChannel Networks PNI Digital Media Photo Upload Plugin ActiveX control before 2.0.0.10, as used by multiple retailers, allow remote attackers to execute arbitrary code via unspecified vectors.This vulnerability is addressed in the following product release:
PhotoChannel, PNI Digital Media Photo Upload Plugin ActiveX control, 2.0.0.10VU#854769ADV-2007-318137958photochannel-photo-upload-bo(36643)10187012568526830The DWUpdateService ActiveX control in the agent (agent.exe) in Macrovision FLEXnet Connect 6.0 and Update Service 3.x to 5.x allows remote attackers to execute arbitrary commands via (1) the Execute method, and obtain the exit status using (2) the GetExitCode method.VU#524681http://support.installshield.com/kb/view.asp?articleid=Q113020macrovision-dwupdate-command-execution(34660)ADV-2008-3278ADV-2007-2017http://www.blackberry.com/btsc/articles/749/KB16469_f.SAL_Public.html328422550136896download.php in Joonas Viljanen JV2 Folder Gallery allows remote attackers to read sensitive files via a relative pathname in the file parameter, as demonstrated by config/gallerysetup.php. NOTE: this issue might be resultant from a directory traversal vulnerability.ADV-2007-018023724328113125Buffer overflow in wsbho2k0.dll, as used by wsftpurl.exe, in Ipswitch WS_FTP 2007 Professional allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long ftp:// URL in an HTML document, and possibly other vectors.2206220070116 Re: Ipswitch WS_FTP 2007 Professional "wsftpurl" access violation vulnerability20070114 Re: Ipswitch WS_FTP 2007 Professional "wsftpurl" access violation vulnerability20070112 Ipswitch WS_FTP 2007 Professional "wsftpurl" access violation vulnerability334762160Cross-site scripting (XSS) vulnerability in liens.php3 in liens_dynamiques 2.1 allows remote attackers to inject arbitrary web script or HTML by using the ajouter=1 query string and the add menu.2207020070114 liens_dynamiques xss and admin authentification33540liensdynamiques-liens-xss(31528)(1) admin/adminlien.php3 and (2) admin/modif.php3 in liens_dynamiques 2.1 do not require authentication, which allows remote attackers to perform unauthorized administrative actions using a direct request.2206820070114 liens_dynamiques xss and admin authentification3354233541Agnitum Outpost Firewall PRO 4.0 allows local users to bypass access restrictions and insert Trojan horse drivers into the product's installation directory by creating links using FileLinkInformation requests with the ZwSetInformationFile function, as demonstrated by modifying SandBox.sys.2206920070115 Outpost Bypassing Self-Protection using file links Vulnerabilityhttp://www.matousec.com/info/advisories/Outpost-Bypassing-Self-Protection-using-file-links.php33480outpostfirewall-zwset-privilege-escalation(31529)2163Unspecified vulnerability in the SIP module in InGate Firewall and SIParator before 4.5.1 allows remote attackers to conduct replay attacks on the authentication mechanism via unknown vectors.23737ADV-2007-020922080http://www.ingate.com/relnote-451.php32831ingate-sip-security-bypass(31546)Multiple directory traversal vulnerabilities in Jax Petition Book 1.0.3.06 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the languagepack parameter to (1) jax_petitionbook.php or (2) smileys.php.ADV-2007-02202207220070116 Re: Jax Petition Book (languagepack) Remote File Include Vulnerabilities20070115 Re: Jax Petition Book (languagepack) Remote File Include Vulnerabilities20070114 Jax Petition Book (languagepack) Remote File Include Vulnerabilities3283632835petitionbook-language-file-include(31543)216123784Undercover.app/Contents/Resources/uc in Rixstep Undercover allows local users to overwrite arbitrary files, probably related to a race condition.2207120070115 Rixstep aren't as leet as they thought they wereDirectory traversal vulnerability in sesskglogadmin.php in KGB 1.9 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skinnn parameter, as demonstrated by invoking kg.php with a postek parameter containing PHP code, which is injected into a file in the kg directory, and then included by sesskglogadmin.php.ADV-2007-02282206531585kgb-sesskglogadmin-file-include(31508)237683134Heap-based buffer overflow in Dream FTP Server allows remote attackers to execute arbitrary code via a USER command with a large number of format string specifiers, which triggers the overflow during processing of the Server Log.23731328163128SQL injection vulnerability in index.php (aka the login form) in Scriptme SMe FileMailer 1.21 allows remote attackers to execute arbitrary SQL commands via the Password field (ps parameter). NOTE: some of these details are obtained from third party information.20070116 [x0n3-h4ck] SmE FileMailer 1.21 Remote Sql Injextion Exploit20070117 Source VERIFY of SMe FileMailer 1.21 SQL injection23766328322154SQL injection vulnerability in inc/header.inc.php in ThWboard 3.0b2.84-php5 and earlier allows remote attackers to execute arbitrary SQL commands via the board[styleid] parameter to index.php.23735328373124Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.1 and earlier, when Microsoft Internet Explorer 6 is used, allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in a CSS style in the convcharset parameter to the top-level URI, a different vulnerability than CVE-2005-0992.http://www.virtuax.be/advisories/Advisory1-12012007.txt20070112 Re: xss in phpmyadmin <= 2.8.120070112 xss in phpmyadmin <= 2.8.1WebCore in Apple WebKit build 18794 allows remote attackers to cause a denial of service (null dereference and application crash) via a TD element with a large number in the ROWSPAN attribute, as demonstrated by a crash of OmniWeb 5.5.3 on Mac OS X 10.4.8, a different vulnerability than CVE-2006-2019.22059http://security-protocols.com/sp-x41-advisory.phpOpenBSD before 20070116 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via certain IPv6 ICMP (aka ICMP6) echo request packets.22087[3.9] 018: RELIABILITY FIX: January 16, 2007[4.0] 008: RELIABILITY FIX: January 16, 200710175183293523830Multiple format string vulnerabilities in (1) _invitedToRoom: and (2) _invitedToDirectChat: in Colloquy 2.1 and earlier allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in the channel name of an INVITE request, related to the implementation of AlertSheet and AlertPanel in Apple AppKit.2208623801ADV-2007-023832688http://projects.info-pull.com/moab/MOAB-16-01-2007.html3139The (1) Activity Monitor.app/Contents/Resources/pmTool, (2) Keychain Access.app/Contents/Resources/kcproxy, and (3) ODBC Administrator.app/Contents/Resources/iodbcadmintool programs in /Applications/Utilities/ in Mac OS X 10.4.8 have weak permissions (writable by admin group), which allows local admin users to gain root privileges by modifying a program and then performing permissions repair via diskutil.http://projects.info-pull.com/moab/MOAB-15-01-2007.htmlmacosx-applications-privilege-escalation(31530)3270232701327003136SQL injection vulnerability in index.php in SmE FileMailer 1.21 allows remote attackers to execute arbitrary SQL commands via the us parameter.ADV-2007-022120070117 Source VERIFY of SMe FileMailer 1.21 SQL injection32832smefilemailer-login-sql-injection(31533)The is_eow function in format.c in CVSTrac before 2.0.1 does not properly check for the "'" (quote) character, which allows remote authenticated users to execute limited SQL injection attacks and cause a denial of service (database error) via a ' character in certain messages, tickets, or Wiki entries.The DoS vulnerability exists because the is_eow() function in "format.c" does NOT just check the FIRST character of the supplied string for an End-Of-Word terminating character, but instead iterates over string and this way can skip a single embedded quotation mark. The is_repository_file() function then in turn assumes that the filename string can never contain a single quotation mark and traps into a SQL escaping problem.An SQL injection via this technique is somewhat limited as is_eow() bails on whitespace. So while one _can_ do an SQL injection, one is limited to SQL queries containing only characters which get past the function isspace(3). This effectively limits attacks to SQL commands like "VACUUM".Successful remote unauthenticated exploit requires that CVSTrac is explicitly configured to allow anonymous users to add tickets (it is not by default).20070129 CVSTrac 2.0.0 Denial of Service (DoS) vulnerabilityhttp://www.cvstrac.org/cvstrac/tktview?tn=683http://www.cvstrac.org/cvstrac/chngview?cn=85020070129 CVSTrac 2.0.0 Denial of Service (DoS) vulnerabilityADV-2007-0398OpenPKG-SA-2007.0083193522296219223940Stack-based buffer overflow in the IASystemInfo.dll ActiveX control in (1) InterActual Player 2.60.12.0717, (2) Roxio CinePlayer 3.2, (3) WinDVD 7.0.27.172, and possibly other products, allows remote attackers to execute arbitrary code via a long ApplicationType property.VU#922969interactual-iasysteminfo-bo(33186)ADV-2007-1043ADV-2007-10422307120070321 Secunia Research: InterActual Player / CinePlayer IASystemInfo.dllActiveX Control Buffer Overflowhttp://secunia.com/secunia_research/2007-37/advisory/2455623075230323431534314Directory traversal vulnerability in upgrade.php in nicecoder.com INDEXU 5.x allows remote attackers to include arbitrary local files via a .. (dot dot) in the gateway parameter.20070116 vulnerability script indexu all versions45533indexu-upgrade-file-include(31539)Multiple SQL injection vulnerabilities in (a) index.php and (b) dl.php in SmE FileMailer 1.21 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ps, (2) us, (3) f, or (4) code parameter. NOTE: the us vector in index.php is already covered by CVE-2007-0346.smefilemailer-login-sql-injection(31533)ADV-2007-02213283320070117 Source VERIFY of SMe FileMailer 1.21 SQL injection20070116 [x0n3-h4ck] SmE FileMailer 1.21 Remote Sql Injextion ExploitMicrosoft Windows XP and Windows Server 2003 do not properly handle user logoff, which might allow local users to gain the privileges of a previous system user, possibly related to user profile unload failure. NOTE: it is not clear whether this is an issue in Windows itself, or an interaction with another product. The issue might involve ZoneAlarm not being able to terminate processes when it cannot prompt the user.20070211 Windows logoff bug solution possibly.20070123 Re: Windows logoff bug possible security vulnerability and exploit.20070118 Re: Windows logoff bug possible security vulnerability and exploit.20070117 Re: Windows logoff bug possible security vulnerability and exploit.20070117 Windows logoff bug possible security vulnerability and exploit.Stack-based buffer overflow in Microsoft Help Workshop 4.03.0002 allows user-assisted remote attackers to execute arbitrary code via a crafted .cnt file composed of lines that begin with an integer followed by a space and a long string.20070117 Microsoft Help Workshop .CNT contents files buffer overflow vulnerabilityhttp://www.anspi.pl/~porkythepig/visualization/cnt-expl1.cpp31898ms-help-workshop-cnt-bo(31555)2210010175302156238623149Cross-site scripting (XSS) vulnerability in (1) index.php and (2) login.php in myBloggie 2.1.5 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO string.2209720070117 [x0n3-h4ck] myBloggie 2.1.5 XSS exploit3293032929http://mywebland.com/forums/showtopic.php?t=122420070117 [x0n3-h4ck] myBloggie 2.1.5 XSS exploitmybloggie-indexlogin-xss(31554)10175312155SQL injection vulnerability in email.php in MGB OpenSource Guestbook 0.5.4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.ADV-2007-0232http://www.tv-kritik.net/mgb/index.php2209420070118 vendor ACK for MGB Guestbook issue31612mgb-email-sql-injection(31551)238253141Buffer overflow in the Apple Minimal SLP v2 Service Agent (slpd) in Mac OS X 10.4.11 and earlier, including 10.4.8, allows local users, and possibly remote attackers, to gain privileges and possibly execute arbitrary code via a registration request with an invalid attr-list field.TA08-043Bmacos-slpd-bo(31562)ADV-2007-02392210132693101753323796http://projects.info-pull.com/moab/MOAB-17-01-2007.html3151APPLE-SA-2008-02-111019359http://docs.info.apple.com/article.html?artnum=307430The Common Controls Replacement Project (CCRP) FolderTreeview (FTV) ActiveX control (ccrpftv6.ocx) allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long CCRP.RootFolder property value.22092ie-ccrp-dos(31549)3142Directory traversal vulnerability in the AVM IGD CTRL Service in Fritz!DSL 02.02.29 allows remote attackers to read arbitrary files via ..%5C (URL-encoded dot dot backslash) sequences in a URI requested from the AR7 webserver.ADV-2007-0236220933286620070117 Flaw in AVM UPNP service for windowsfritz-avm-directory-traversal(31556)215923774Unspecified vulnerability in the FTP server implementation in HP Jetdirect firmware x.20.nn through x.24.nn allows remote attackers to cause a denial of service via unknown vectors.23802ADV-2007-023332867HPSBPI02185HPSBPI02185hp-jetdirect-unspecified-dos(31589)221051017532PHP remote file inclusion vulnerability in frontpage.php in Uberghey CMS 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the setup_folder parameter.ADV-2007-023020070118 source verify: Uberghey CMS 0.3.1 RFIuberghey-frontpage-file-include(31553)220983147PHP remote file inclusion vulnerability in lang/index.php in Oreon 1.2.3 RC4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the file parameter.ADV-2007-022933711oreon-index-file-include(31568)2210720070211 Oreon1.2.x Series Exploit Coded3150PHP remote file inclusion vulnerability in mep/frame.php in PHPMyphorum 1.5a allows remote attackers to execute arbitrary PHP code via a URL in the chem parameter.ADV-2007-0231phpmyphorum-frame-file-include(31552)220993145Cross-site scripting (XSS) vulnerability in the RSS feed component in FreshReader before 1.0.07010600 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to tag attributes.ADV-2007-02412380632923http://manual.freshreader.com/archives/2007/01/20070118_javasc.htmlJVN#95249468freshreader-rssfeed-xss(31566)22106Cross-site scripting (XSS) vulnerability in admin-search.php in (1) Openads for PostgreSQL (aka phpPgAds) before 2.0.10 and (2) Openads (aka phpAdsNew) before 2.0.10 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.http://sourceforge.net/project/shownotes.php?group_id=36679&release_id=479426http://sourceforge.net/project/shownotes.php?group_id=11386&release_id=47942423720ADV-2007-0240openads-unspecified-xss(31570)22124Multiple cross-site scripting (XSS) vulnerabilities in nicecoder.com INDEXU 5.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) error_msg parameter to (a) suggest_category.php; the (2) u parameter to (b) user_detail.php; the (3) friend_name, (4) friend_email, (5) error_msg, (6) my_name, (7) my_email, and (8) id parameters to (c) tell_friend.php; the (9) error_msg, (10) email, (11) name, and (12) subject parameters to (d) sendmail.php; the (13) email, (14) error_msg, and (15) username parameters to (e) send_pwd.php; the (16) keyword parameter to (f) search.php; the (17) error_msg, (18) username, (19) password, (20) password2, and (21) email parameters to (g) register.php; the (22) url, (23) contact_name, and (24) email parameters to (h) power_search.php; the (25) path and (26) total parameters to (i) new.php; the (27) query parameter to (j) modify.php; the (28) error_msg parameter to (k) login.php; the (29) error_msg and (30) email parameters to (l) mailing_list.php; the (31) gateway parameter to (m) upgrade.php; and another unspecified vector.indexu-multiple-scripts-xss(31538)ADV-2007-02222208420070116 vulnerability script indexu all versions328513285032849328483284732846328453284432843328423284132840328382376432839Multiple cross-site scripting (XSS) vulnerabilities in All In One Control Panel (AIOCP) 1.3.009 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this is probably a different vulnerability than CVE-2006-5830.aiocp-unspecified-xss(31486)http://sourceforge.net/project/shownotes.php?release_id=47837023732ADV-2007-018932808Untrusted search path vulnerability in Rumpus 5.1 and earlier allows local users to gain privileges via a modified PATH that points to a malicious ipfw program.rumpus-path-privilege-escalation(31597)http://projects.info-pull.com/moab/MOAB-18-01-2007.html32690rumpus-path-privilege-escalation(31597)23842Rumpus 5.1 and earlier has weak permissions for certain files and directories under /usr/local/Rumpus, including the configuration file, which allows local users to have an unknown impact by creating, modifying, or deleting files.http://projects.info-pull.com/moab/MOAB-18-01-2007.html3269123842Stack-based buffer overflow in mbse-bbs 0.70 and earlier allows local users to execute arbitrary code via a long string in the MBSE_ROOT environment variable.22112http://www.mbse.eu/mbse/mbsebbs/index.htmlmbsebbs-mbuseradd-bo(31639)315420070118 mbsebbs 0.70.0 & below local root exploitSQL injection vulnerability in phpBP RC3 (2.204) and earlier allows remote attackers to execute arbitrary SQL commands via the comment forum.34763phpbp-comment-sql-injection(31622)3153Unrestricted file upload vulnerability in index.php in phpBP RC3 (2.204) and earlier allows remote administrators to inject arbitrary PHP code into an upload/banners/ file via a banners add operation that uploads the PHP code through an image_form parameter specifying a multiple-extension filename such as .jpg.vil.gif.php, which is stored in upload/banners/ under a different name, and executable via a direct request. NOTE: a separate SQL injection issue could be leveraged to make this vulnerability reachable by remote unauthenticated attackers.34762phpbp-banner-file-upload(31619)3153A certain ActiveX control in the Common Controls Replacement Project (CCRP) CCRP BrowseDialog Server (ccrpbds6.dll) allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long CCRP_BDc.SelectedFolder property value.22110346473155Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 7.9 allow remote attackers to execute arbitrary SQL commands via (1) the active parameter in admin/modules/modules.php; the (2) ad_class, (3) imageurl, (4) clickurl, (5) ad_code, or (6) position parameter in modules/Advertising/admin/index.php; or unspecified vectors in the (7) advertising, (8) weblinks, or (9) reviews section.22116http://www.hackers.ir/advisories/festival.txt337023370133700336993369820070118 The vulnerabilities festival !20070204 Sql injection bugs in PHP-NukeMultiple SQL injection vulnerabilities in Joomla! 1.5.0 Beta allow remote attackers to execute arbitrary SQL commands via (1) the searchword parameter in certain files; the where parameter in (2) plugins/search/content.php or (3) plugins/search/weblinks.php; the text parameter in (4) plugins/search/contacts.php, (5) plugins/search/categories.php, or (6) plugins/search/sections.php; or (7) the email parameter in database/table/user.php, which is not properly handled by the check function.22122http://www.hackers.ir/advisories/festival.txt3253332532325313253032529325283252720070118 The vulnerabilities festival !20070204 Sql injection bugs in Joomla and MamboSQL injection vulnerability in (1) Joomla! 1.0.11 and 1.5 Beta, and (2) Mambo 4.6.1, allows remote attackers to execute arbitrary SQL commands via the id parameter when cancelling content editing.20070118 The vulnerabilities festival !19734http://www.hackers.ir/advisories/festival.txt3252020070204 Sql injection bugs in Joomla and MamboJoomla! 1.5.0 Beta allows remote attackers to obtain sensitive information via a direct request for (1) plugins/user/example.php; (2) gmail.php, (3) example.php, or (4) ldap.php in plugins/authentication/; (5) modules/mod_mainmenu/menu.php; or other unspecified PHP scripts, which reveals the path in various error messages, related to a jimport function call at the beginning of each script.http://www.hackers.ir/advisories/festival.txt325263252532524325233252220070118 The vulnerabilities festival !20070204 Sql injection bugs in Joomla and MamboCross-site scripting (XSS) vulnerability in Virtuemart 1.0.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.22123http://www.hackers.ir/advisories/festival.txthttp://virtuemart.svn.sourceforge.net/viewvc/*checkout*/virtuemart/branches/virtuemart-1_0_0/virtuemart/CHANGELOG.php?revision=60720070118 The vulnerabilities festival !20070204 Sql injection bugs in Virtuemart and Letterman24058Multiple SQL injection vulnerabilities in Xoops 2.0.16 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in kernel/group.php in core, (2) the lid parameter in class/table_broken.php in the Weblinks module, and other unspecified vectors.http://www.hackers.ir/advisories/festival.txt336853368420070118 The vulnerabilities festival !2239920070204 Sql injection bugs in Xoops 2.0.16 + Weblinks moduleMultiple SQL injection vulnerabilities in DocMan 1.3 RC2 allow attackers to execute arbitrary SQL commands via unspecified vectors.http://www.hackers.ir/advisories/festival.txt3465020070118 The vulnerabilities festival !Cross-site scripting (XSS) vulnerability in DocMan 1.3 RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.http://www.hackers.ir/advisories/festival.txt3465120070118 The vulnerabilities festival !DocMan 1.3 RC2 allows remote attackers to obtain sensitive information (the full path) via unspecified vectors.http://www.hackers.ir/advisories/festival.txt3465220070118 The vulnerabilities festival !Multiple SQL injection vulnerabilities in ATutor 1.5.3.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters. NOTE: CVE analysis suggests that the vendor fixed these issues.http://www.atutor.ca/atutor/mantis/changelog_page.phphttp://www.hackers.ir/advisories/festival.txt3466020070118 The vulnerabilities festival !Multiple SQL injection vulnerabilities in letterman.class.php in the Letterman 1.2.3 (com_letterman) component for Joomla! before 1.0.12 allow remote attackers to execute arbitrary SQL commands via the id parameter, related to the (1) lm_sendMail, (2) saveNewsletter, and (3) cancelNewsletter functions.22117http://www.hackers.ir/advisories/festival.txt3368820070118 The vulnerabilities festival !20070204 Sql injection bugs in Virtuemart and Letterman** DISPUTED ** WDaemon 9.5.4 allows remote attackers to access the /WorldClient.dll URI on TCP port 3000, which has unknown impact. NOTE: The researcher reports that the vendor response was "this is not a security bug."http://www.hackers.ir/advisories/festival.txt3466120070118 The vulnerabilities festival !Cross-site scripting (XSS) vulnerability in preview in the reviews section in PostNuke 0.764 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.22119http://www.hackers.ir/advisories/festival.txt35473http://noc.postnuke.com/plugins/scmsvn/viewcvs.php/trunk/Historic/PostNuke7x/html/modules/?root=postnuke20070118 The vulnerabilities festival !The faq section in PostNuke 0.764 allows remote attackers to obtain sensitive information (the full path) via "unvalidated output" in FAQ/index.php, possibly involving an undefined id_cat variable.http://www.hackers.ir/advisories/festival.txt35472http://noc.postnuke.com/plugins/scmsvn/viewcvs.php/trunk/Historic/PostNuke7x/html/modules/FAQ/index.php?root=postnuke&r1=20350&r2=20911http://noc.postnuke.com/plugins/scmsvn/viewcvs.php/trunk/Historic/PostNuke7x/html/modules/?root=postnuke20070118 The vulnerabilities festival !Unspecified vulnerability in the rating section in PostNuke 0.764 has unknown impact and attack vectors, related to "an interesting bug."http://www.hackers.ir/advisories/festival.txt3547120070118 The vulnerabilities festival !SQL injection vulnerability in models/category.php in the Weblinks component for Joomla! SVN 20070118 (com_weblinks) allows remote attackers to execute arbitrary SQL commands via the catid parameter.http://www.hackers.ir/advisories/festival.txt3479220070118 The vulnerabilities festival !20070204 Sql injection bugs in Joomla and MamboSQL injection vulnerability in search.php in Woltlab Burning Board (wBB) 1.0.2 and earlier, and 2.3.6 and earlier in the 2.x series, allows remote attackers to execute arbitrary SQL commands via the boardids[1] and other boardids[] parameters.wbb-search-sql-injection(31550)3387231443143Directory traversal vulnerability in ArsDigita Community System (ACS) 3.4.10 and earlier, and ArsDigita Community Education Solution (ACES) 1.1, allows remote attackers to read arbitrary files via .%252e/ (double-encoded dot dot slash) sequences in the URI.ADV-2007-02862212120070118 Directory Traversal in ArsDigita Community System33552acs-url-directory-traversal(31613)Cross-site scripting (XSS) vulnerability in index.php in sabros.us 1.7 allows remote attackers to inject arbitrary web script or HTML via the tag parameter.2211520070118 [x0n3-h4ck] sabros.us 1.7 XSS Exploit3160220070118 [x0n3-h4ck] sabros.us 1.7 XSS Exploitsabros-index-xss(31600)21702382420070118 [x0ne-h4ck] sabros.us 1.7 XSS ExploitFormat string vulnerability in the log creation functionality of BitDefender Client Professional Plus 8.02 allows attackers to execute arbitrary code via certain scan job settings.ADV-2007-0253http://www.bitdefender.com/KB325-en--Format-string-vulnerability.html20070119 Layered Defense Research Advisory: BitDefender Client 8.02 Format String Vulnerabilitybitdefender-scanjob-format-string(31608)2212820070119 Layered Defense Research Advisory: BitDefender Client 8.02 Format String VulnerabilityIBM AIX 5.3 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by closing file descriptor 0, 1, or 2 and then invoking a setuid program, a variant of CVE-2002-0572.20070118 Re: Multiple OS kernel insecure handling of stdio file descriptor20070118 Multiple OS kernel insecure handling of stdio file descriptorSun Solaris 9 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by closing file descriptor 0, 1, or 2 and then invoking a setuid program, a variant of CVE-2002-0572.20070118 Re: Multiple OS kernel insecure handling of stdio file descriptor20070118 Multiple OS kernel insecure handling of stdio file descriptorHP HP-UX B11.11 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by closing file descriptor 0, 1, or 2 and then invoking a setuid program, a variant of CVE-2002-0572.20070118 Re: Multiple OS kernel insecure handling of stdio file descriptor20070118 Multiple OS kernel insecure handling of stdio file descriptorPHP remote file inclusion vulnerability in libraries/grab_globals.lib.php in ComVironment 4.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter.ADV-2007-02662210834621comvironment-grabglobals-file-include(31564)3152Unspecified vulnerability in HP-UX B.11.23, when running IPFilter in combination with PHNE_34474, allows remote attackers to cause a denial of service (system crash) via unspecified vectors.ADV-2007-023422103101752723800oval:org.mitre.oval:def:610432869HPSBUX02181HPSBUX02181hp-ipfilter-dos(31565)The Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.3 and Adaptive Security Device Manager (ASDM) before 5.2(2.54) do not validate the SSL/TLS certificates or SSH public keys when connecting to devices, which allows remote attackers to spoof those devices to obtain sensitive information or generate incorrect information.20070118 SSL/TLS Certificate and SSH Public Key Validation VulnerabilityADV-2007-024532720cisco-csmars-asdm-device-spoofing(31567)221111017536101753523836Multiple cross-site scripting (XSS) vulnerabilities in forum.php3 in Arnaud Guyonne (aka Arnotic) a-forum allow remote attackers to inject arbitrary web script or HTML via the (1) Sujet or (2) Pseudo field.aforum-unspecified-xss(31610)20070119 a-forum xss20070122 a-forum xss - who? what? where?Multiple cross-site scripting (XSS) vulnerabilities in index.php in Simple Machines Forum (SMF) 1.1 RC3 allow remote authenticated users to inject arbitrary web script or HTML via the (1) recipient or (2) BCC field when selecting send in a pm action.20070120 SMF "index.php?action=pm" Cross Site-Scripting32606http://aria-security.com/forum/showthread.php?p=128smf-pm-xss(31612)2214320070202 Re: SMF "index.php?action=pm" Cross Site-Scripting20070126 Re: Re: Re: Re: SMF "index.php?action=pm" Cross Site-Scripting20070122 Re: Re: Re: SMF "index.php?action=pm" Cross Site-Scripting20070121 Re: SMF "index.php?action=pm" Cross Site-Scripting2169Cross-site scripting (XSS) vulnerability in admin/memberlist.php in Easebay Resources Login Manager 3.0 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.20070120 Login Manager Multiple HTML Injectionsloginmanager-memberlist-xss(31614)2167SQL injection vulnerability in admin/memberlist.php in Easebay Resources Login Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the init_row parameter.20070120 Login Manager Multiple HTML Injections2167Cross-site scripting (XSS) vulnerability in admin/edit_member.php in Easebay Resources Paypal Subscription Manager allows remote attackers to inject arbitrary web script or HTML via the username parameter.20070120 Paypal Subscription Manager Multiple HTML Injections33559psm-editmember-xss(31618)2168SQL injection vulnerability in admin/memberlist.php in Easebay Resources Paypal Subscription Manager allows remote attackers to execute arbitrary SQL commands via the keyword parameter.20070120 Paypal Subscription Manager Multiple HTML Injections3610333560psm-memberlist-sql-injection(31616)2168bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a (1) .po or (2) .mo file.23826http://code.djangoproject.com/changeset/3592django-po-code-execution(31627)22134The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user.23826django-request-session-hijacking(31628)22138http://code.djangoproject.com/changeset/3754Multiple buffer overflows in the (1) main function in (a) client.c, and the (2) server_setup and (3) server_client_connect functions in (b) server.c in gxine 0.5.9 and earlier allow local users to cause a denial of service (daemon crash) or gain privileges via a long HOME environment variable. NOTE: some of these details are obtained from third party information.http://xinehq.de/index.php/news?show_category_id=1ADV-2007-0259http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=4768913832138320gxine-serversetup-serverclient-bo(31604)Cross-site scripting (XSS) vulnerability in Operation/User.pm in Plain Black WebGUI before 7.3.5 (beta) allows remote attackers to inject arbitrary web script or HTML via the username parameter during anonymous registration, a different vector than CVE-2007-0308. NOTE: it is possible that a separate "WikiPage titles" issue was also fixed.webgui-username-xss(31573)ADV-2007-024222114http://www.plainblack.com/downloads/builds/7.3.5-beta/WebGUI/docs/changelog/7.x.x.txthttp://www.plainblack.com/bugs/tracker/security-update-cross-site-scripting-vulnerability2375432928BEA Weblogic Server 8.1 through 8.1 SP4 does not properly validate client certificates when reusing cached connections, which allows remote attackers to obtain access via an untrusted X.509 certificate.BEA07-135.00ADV-2007-02131017519237503850022082BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the JDBCDataSourceFactory MBean Properties, which allows local administrative users to read the cleartext password.BEA07-136.00ADV-2007-02131017525237503850122082Unspecified vulnerability in the thread management in BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1, when T3 authentication is used, allows remote attackers to cause a denial of service (thread and system hang) via unspecified "sequences of events."BEA07-137.00ADV-2007-02131017525237503850222082BEA WebLogic Server 8.1 through 8.1 SP5, 9.0, 9.1, and 9.2 Gold, when WS-Security is used, does not properly validate certificates, which allows remote attackers to conduct a man-in-the-middle (MITM) attack.BEA07-138.00ADV-2007-02131017525237503850322082BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP7, and 8.1 through 8.1 SP5 allows remote attackers to read arbitrary files inside the class-path property via .ear or exploded .ear files that use the manifest class-path property to point to utility jar files.BEA07-139.00ADV-2007-02131017525237503850522082BEA WebLogic Server 8.1 through 8.1 SP5 stores cleartext data in a backup of config.xml after offline editing, which allows local users to obtain sensitive information by reading this backup file.BEA07-140.00ADV-2007-02132208210175252375038504BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, and 9.0 allows remote attackers to cause a denial of service (server hang) via certain requests that cause muxer threads to block when processing error pages.BEA07-141.00ADV-2007-02131017525237503850622082BEA WebLogic Server 8.1 through 8.1 SP5 does not properly enforce access control after a dynamic update and dynamic redeployment of an application that is implemented through exploded jars, which allows attackers to bypass intended access restrictions.BEA07-142.00ADV-2007-02131017525237503850922082The WSEE runtime (WS-Security runtime) in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when decrypting client messages, which allows remote attackers to bypass application security.BEA07-143.00ADV-2007-02131017525237503851022082BEA WebLogic Server 7.0 through 7.0 SP7, 8.1 through 8.1 SP5, 9.0, and 9.1, when using the WebLogic Server 6.1 compatibility realm, allows attackers to execute certain EJB container persistence operations with an administrative identity.BEA07-144.00ADV-2007-02131017525237503851122082BEA WebLogic Server 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1 does not enforce a security policy that declares permissions for EJB methods that have array parameters, which allows remote attackers to obtain unauthorized access to these methods.BEA07-145.00ADV-2007-02131017525237503851222082The BEA WebLogic Server proxy plug-in before June 2006 for the Apache HTTP Server does not properly handle protocol errors, which allows remote attackers to cause a denial of service (server outage).BEA07-146.00ADV-2007-02131017525237503851322082BEA WebLogic Server 9.0, 9.1, and 9.2 Gold allows remote attackers to obtain sensitive information via malformed HTTP requests, which reveal data from previous requests.BEA07-147.00ADV-2007-02131017525237503851422082BEA WebLogic Server 6.1 through 6.1 SP7, and 7.0 through 7.0 SP7 allows remote attackers to cause a denial of service (disk consumption) via requests containing malformed headers, which cause a large amount of data to be written to the server log.BEA07-148.00ADV-2007-02131017525237503285922082BEA WebLogic Server 9.0, 9.1, and 9.2 Gold, when running on Solaris 9, allows remote attackers to cause a denial of service (server inaccessibility) via manipulated socket connections.BEA07-150.00ADV-2007-02131017525237503285822082BEA WebLogic Portal 9.2 does not properly handle when an administrator deletes entitlements for a role, which causes other role entitlements to be "inadvertently affected," which has an unknown impact.BEA07-151.00ADV-2007-02132375032857220821017521Unspecified vulnerability in the BEA WebLogic Server proxy plug-in for Netscape Enterprise Server before September 2006 for Netscape Enterprise Server allow remote attackers to cause a denial of service via certain requests that trigger errors that lead to a server being marked as unavailable, hosting web server failure, or CPU consumption.BEA07-152.00ADV-2007-02131017525237503285622082Unspecified vulnerability in BEA WebLogic Platform and Server 8.1 through 8.1 SP5, and JRockit 1.4.2 R4.5 and earlier, allows attackers to gain privileges via unspecified vectors, related to an "overflow condition," probably a buffer overflow.ADV-2007-021310175252375038515BEA07-155.00BEA WebLogic Portal 9.2, when running in a WebLogic Server clustered environment using WebLogic Portal entitlements, does not properly propagate entitlement policy changes if the changes are made on a managed server while the Administrative Server is unavailable, which might allow attackers to bypass intended restrictions.BEA07-156.00ADV-2007-0213237503851632854220821017521Stack-based buffer overflow in Microsoft Help Workshop 4.03.0002 allows user-assisted remote attackers to execute arbitrary code via a help project (.HPJ) file with a long HLP field in the OPTIONS section.2213520070119 Help project files (.HPJ) buffer overflow vulnerability in Microsoft Help Workshophttp://www.anspi.pl/~porkythepig/visualization/hpj-x01.cpp31899217723862Unspecified vulnerability in the chtbl_lookup function in hash.c for WzdFTPD 8.0 and earlier allows remote attackers to cause a denial of service via a crafted FTP command, probably due to a NULL pointer dereference.wzdftpd-ftp-dos(31599)ADV-2007-027720070119 WzdFTPD < 8.1 Denial of servicehttp://www.s21sec.com/avisos/s21sec-033-en.txt10175373294120070119 WzdFTPD < 8.1 Denial of service217123852DivXBrowserPlugin (aka DivX Web Player) npdivx32.dll, as distributed with DivX Player 6.4.1, allows remote attackers to cause a denial of service (Internet Explorer 7 crash) by invoking the GoWindowed method for a certain instance of the ActiveX object.divx-divxbrowserplugin-dos(31601)22133376933157The shared_region_map_file_np function in Apple Mac OS X 10.4.8 and earlier kernel allows local users to cause a denial of service (memory corruption) via a large mappingCount value.ADV-2007-027520070119 [RISE-2007001] Apple Mac OS X 10.4.x kernel shared_region_map_file_np() memory corruption vulnerabilitymacos-sharedregionmapfilenp-dos(31645)329421017538217823823http://risesecurity.org/advisory.php?id=RISE-2007001.txtAVM Fritz!Box 7050, and possibly other product models, allows remote attackers to cause a denial of service (VoIP application crash) via a zero-length UDP packet to the SIP port (port 5060).ADV-2007-02722213020070119 DoS against AVM Fritz!Box 7050 (and others)32940http://mazzoo.de/blog/2007/01/18#FritzBox_DoS20070119 DoS against AVM Fritz!Box 7050 (and others)fritzbox-udp-packet-dos(31633)20070123 Re: DoS against AVM Fritz!Box 7050 (and others)23868ftp://ftp.avm.de/fritz.box/fritzbox.fon_wlan_7050/firmware/info.txtBEA AquaLogic Service Bus 2.0, 2.1, and 2.5 does not properly reject malformed request messages to a proxy service, which might allow remote attackers to bypass authorization policies and route requests to back-end services or conduct other unauthorized activities.10175232378632862BEA07-157.0022082Unspecified vulnerability in BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2, when using Active Directory LDAP for authentication, allows remote authenticated users to access the server even after the account has been disabled.10175242378632861BEA07-154.0022082BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2 does not properly set the severity level of audit events when the system load is high, which might make it easier for attackers to avoid detection.2378632860BEA07-153.0022082T-Com Speedport 500V routers with firmware 1.31 allow remote attackers to bypass authentication and reconfigure the device via a LOGINKEY=TECOM cookie value.20070119 Virginity Security Advisory 2007-001 : T-Com Speedport 500V Login bypass32995tcom-login-authentication-bypass(31621)2216020070216 Re: Virginity Security Advisory 2007-001 : T-Com Speedport 500V Login bypass20070122 Re: Virginity Security Advisory 2007-001 : T-Com Speedport 500V Login bypass20070121 Re: Virginity Security Advisory 2007-001 : T-Com Speedport 500V Login bypass23853Barron McCann X-Kryptor Driver BMS1446HRR (Xgntr BMS1351 Install BMS1472) in X-Kryptor Secure Client does not drop privileges when launching an Explorer window in response to a help command, which allows local users to gain LocalSystem privileges via interactive use of Explorer.ADV-2007-049622424http://www.cpni.gov.uk/Products/vulnerabilitydisclosures/default.aspx?id=va-20070129-0107.xmlhttp://www.cpni.gov.uk/Products/advisories/default.aspx?id=al-20070129-0107.xmlhttp://www.bemacpromotions.com/files/xkpatch462660.ziphttp://www.barronmccann.com/ISec/s2pressrelease.asp?PRID=141&S2ID=142404533110http://jvn.jp/niscc/NISCC-462660/index.htmlMultiple cross-site scripting (XSS) vulnerabilities in the sample Cache' Server Page (CSP) scripts in InterSystems Cache' allow remote attackers to inject arbitrary web script or HTML via (1) the TO parameter to loop.csp, (2) the VALUE parameter to cookie.csp, and (3) the PAGE parameter to showsource.csp in csp/samples/; and allow remote authenticated users to inject arbitrary web script or HTML via (4) the ERROR parameter to csp/samples/xmlclasseserror.csp, and unspecified vectors in (5) object.csp and (6) lotteryhistory.csp in csp/samples/.http://www.mwrinfosecurity.com/news/1658.htmlhttp://www.mwrinfosecurity.com/advisories/mwri_cache-sample-files-xss-advisory_2007-04-04.pdfhttp://www.cpni.gov.uk/Products/alerts/2928.aspxUnspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 6.20, 6.4x, 7.01, and 7.50 allows remote attackers to execute arbitrary commands via unknown vectors.SSRT05103ADV-2007-0153SSRT05103101750432728Unspecified vulnerability in IBM OS/400 R530 and R535 has unknown impact and remote attack vectors, related to an "Integrity Problem" involving LIC-TCPIP and TCP reset. NOTE: it is possible that this issue is related to CVE-2004-0230, but this is not certain.MA33860MA338612376532812Multiple buffer overflows in the CDDBControl ActiveX control in Gracenote CDDB before 20070418 allow remote attackers to execute arbitrary code via long values for certain Proxy configuration parameters.The vendor has address this issue with the following information: http://www.gracenote.com/corporate/FAQs.html/faqset=update/page=0http://www.zerodayinitiative.com/advisories/ZDI-07-021.html2356722924ADV-2007-14751017937http://www.gracenote.com/corporate/FAQs.html/faqset=update/page=034327cddbcontrol-activex-bo(33773)20070420 ZDI-07-021: GraceNote CDDBControl ActiveX Buffer Overflow VulnerabilityStack-based buffer overflow in the print provider library (cpprov.dll) in Citrix Presentation Server 4.0, MetaFrame Presentation Server 3.0, and MetaFrame XP 1.0 allows local users and remote attackers to execute arbitrary code via long arguments to the (1) EnumPrintersW and (2) OpenPrinter functions.http://www.zerodayinitiative.com/advisories/ZDI-07-006.htmlADV-2007-0328http://www.securityfocus.com/data/vulnerabilities/exploits/testlpc.c2221720070124 ZDI-07-006: Citrix Metaframe Presentation Server Print Provider Buffer Overflow Vulnerabilityhttp://support.citrix.com/article/CTX11168610175532386932958Heap-based buffer overflow in the arj.ppl module in the OnDemand Scanner in Kaspersky Anti-Virus, Anti-Virus for Workstations, and Anti-Virus for File Servers 6.0, and Internet Security 6.0 before Maintenance Pack 2 build 6.0.2.614 allows remote attackers to execute arbitrary code via crafted ARJ archives.http://www.kaspersky.com/technews?id=203038694http://www.kaspersky.com/technews?id=20303869324778http://www.zerodayinitiative.com/advisories/ZDI-07-013.htmlADV-2007-1268kaspersky-arj-bo(33489)101788310178822334620070405 ZDI-07-013: Kaspersky AntiVirus Engine ARJ Archive Parsing Heap Overflow VulnerabilityStack-based buffer overflow in magentproc.exe for Hewlett-Packard Mercury LoadRunner Agent 8.0 and 8.1, Performance Center Agent 8.0 and 8.1, and Monitor over Firewall 8.1 allows remote attackers to execute arbitrary code via a packet with a long server_ip_name field to TCP port 54345, which triggers the overflow in mchan.dll.VU#303012SSRT061280http://www.zerodayinitiative.com/advisories/ZDI-07-007.htmlADV-2007-053533132SSRT061280mercury-multiple-agent-bo(32390)2248720070208 ZDI-07-007: HP Mercury LoadRunner Agent Stack Overflow VulnerabilityR-12310176131017612101761124112Heap-based buffer overflow in the Decomposer component in multiple Symantec products allows remote attackers to execute arbitrary code via multiple crafted CAB archives.http://securityresponse.symantec.com/avcenter/security/Content/2007.07.11f.htmlhttp://www.zerodayinitiative.com/advisories/ZDI-07-040.htmlADV-2007-2508242822605336118The fopen function in PHP 5.2.0 does not properly handle invalid URI handlers, which allows context-dependent attackers to bypass safe_mode restrictions and read arbitrary files via a file path specified with an invalid URI, as demonstrated via the srpath URI.2226120070125 PHP 5.2.0 safe_mode bypass (by Writing Mode)2175Multiple buffer overflows in LGSERVER.EXE in CA BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.1 SP1, Mobile Backup r4.0, Desktop and Business Protection Suite r2, and Desktop Management Suite (DMS) r11.0 and r11.1 allow remote attackers to execute arbitrary code via crafted packets to TCP port (1) 1900 or (2) 2200.VU#611276VU#357308http://supportconnectw.ca.com/public/sams/lifeguard/infodocs/babldimpsec-notice.asp23897http://www3.ca.com/securityadvisor/vulninfo/Vuln.aspx?ID=34993http://www3.ca.com/securityadvisor/newsinfo/collateral.aspx?cid=97696ADV-2007-031422342223402219920070131 Remote Unauthenticated Code Execution II CA BrightStor ARCserve Backup for Laptops & Desktops20070131 Remote Unauthenticated Code Execution CA BrightStor ARCserve Backup20070124 [CAID 34993]: CA BrightStor ARCserve Backup for Laptops and Desktops Multiple Overflow Vulnerabilities315931017548Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.20070314 SEC Consult SA-20070314-0 :: Apache HTTP Server / Tomcat directory traversaltomcat-proxy-directory-traversal(32988)ADV-2009-0233ADV-2008-1979ADV-2008-0065ADV-2007-3386ADV-2007-3087ADV-2007-2732ADV-2007-09752296020090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilitieshttp://www.sec-consult.com/fileadmin/Advisories/20070314-0-apache_tomcat_directory_traversal.txthttp://www.sec-consult.com/287.htmlRHSA-2007:0327SUSE-SR:2007:005http://tomcat.apache.org/security-6.htmlhttp://tomcat.apache.org/security-5.htmlhttp://tomcat.apache.org/security-4.htmlhttp://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540GLSA-200705-0333668252802510624732oval:org.mitre.oval:def:10643SSRT071447http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx2515920080108 VMSA-2008-0002 Low severity security update for VirtualCenter and ESX Server 3.0.2, and ESX 3.0.1RHSA-2008:0261RHSA-2007:0360SUSE-SR:2007:015MDKSA-2007:241http://www.fujitsu.com/global/support/software/security/products-f/interstage-200702e.htmlhttp://support.avaya.com/elmodocs2/security/ASA-2007-206.htm2393122446309083089928365270372666026235[Security-announce] 20080107 VMSA-2008-0002 Low severity security update for VirtualCenter and ESX Server 3.0.2, and ESX 3.0.1APPLE-SA-2007-07-31HPSBUX02262http://docs.info.apple.com/article.html?artnum=306172Apache SpamAssassin before 3.1.8 allows remote attackers to cause a denial of service via long URLs in malformed HTML, which triggers "massive memory usage."Upgrade to SpamAssassin version 3.1.822584https://issues.rpath.com/browse/RPL-1073spamassassin-url-dos(32536)ADV-2007-06281017666RHSA-2007:0075SUSE-SR:2007:006MDKSA-2007:049http://svn.apache.org/repos/asf/spamassassin/branches/3.1/build/announcements/3.1.8.txthttp://spamassassin.apache.org/advisories/cve-2007-0451.txtGLSA-200703-0224889243072426524256242502420024197RHSA-2007:0074oval:org.mitre.oval:def:1001833207smbd in Samba 3.0.6 through 3.0.23d allows remote authenticated users to cause a denial of service (memory and CPU exhaustion) by renaming a file in a way that prevents a request from being removed from the deferred open queue, which triggers an infinite loop.20070205 [SAMBA-SECURITY] CVE-2007-0452: Potential DoS against smbd in Samba 3.0.6 - 3.0.23dADV-2007-1278ADV-2007-0483oval:org.mitre.oval:def:975833100HPSBUX02204HPSBUX02204https://issues.rpath.com/browse/RPL-1005samba-smbd-filerename-dos(32301)USN-419-12007-00072239520070207 rPSA-2007-0026-1 samba samba-swatRHSA-2007:0061RHSA-2007:0060MDKSA-2007:034GLSA-200702-01DSA-1257http://us1.samba.org/samba/security/CVE-2007-0452.html200588SSA:2007-038-011017587221924792242842418824151241452414024101240762406724060240462403024021SUSE-SA:2007:016FEDORA-2007-220FEDORA-2007-21920070201-01-PBuffer overflow in the nss_winbind.so.1 library in Samba 3.0.21 through 3.0.23d, as used in the winbindd daemon on Solaris, allows attackers to execute arbitrary code via the (1) gethostbyname and (2) getipnodebyname functions.20070205 [SAMBA-SECURITY] CVE-2007-0453: Buffer overrun in nss_winbind.so.1 on SolarisADV-2007-048333098https://issues.rpath.com/browse/RPL-1005samba-winbind-bo(32231)2007-00072241020070207 rPSA-2007-0026-1 samba samba-swatOpenPKG-SA-2007.012http://us1.samba.org/samba/security/CVE-2007-0453.htmlSSA:2007-038-011017589241512410124043Format string vulnerability in the afsacl.so VFS module in Samba 3.0.6 through 3.0.23d allows context-dependent attackers to execute arbitrary code via format string specifiers in a filename on an AFS file system, which is not properly handled during Windows ACL mapping.VU#64973222403https://issues.rpath.com/browse/RPL-1005samba-afsacl-format-string(32304)ADV-2007-0483USN-419-12007-000720070207 rPSA-2007-0026-1 samba samba-swat20070205 [SAMBA-SECURITY] CVE-2007-0454: Format string bug in afsacl.so VFS pluginOpenPKG-SA-2007.012MDKSA-2007:034GLSA-200702-01DSA-1257http://us1.samba.org/samba/security/CVE-2007-0454.htmlSSA:2007-038-0110175882415124145241012406724060240462402133101Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font.https://issues.rpath.com/browse/RPL-1268https://issues.rpath.com/browse/RPL-1030ADV-2011-0022ADV-2007-04002007-00072228920070418 rPSA-2007-0073-1 php php-mysql php-pgsqlRHSA-2007:0162RHSA-2007:0153MDKSA-2007:038MDKSA-2007:036MDKSA-2007:0354281324965249452492424151241432410724053240522402223916RHSA-2007:0155oval:org.mitre.oval:def:11303[security-announce] 20070208 rPSA-2007-0028-1 gdFEDORA-2010-19022FEDORA-2010-19033FEDORA-2007-150http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=224607USN-473-1RHSA-2008:0146MDKSA-2007:1092915725575Unspecified vulnerability in the LLT dissector in Wireshark (formerly Ethereal) 0.99.3 and 0.99.4 allows remote attackers to cause a denial of service (application crash) via unspecified vectors.http://www.wireshark.org/security/wnpa-sec-2007-01.html2235224016https://issues.rpath.com/browse/RPL-985wireshark-lltdissector-dos(32056)ADV-2007-0443RHSA-2007:0066MDKSA-2007:033http://support.avaya.com/elmodocs2/security/ASA-2007-166.htm1017581249702465024515240842402524011oval:org.mitre.oval:def:14867oval:org.mitre.oval:def:1134233073FEDORA-2007-20720070301-01-PUnspecified vulnerability in the IEEE 802.11 dissector in Wireshark (formerly Ethereal) 0.10.14 through 0.99.4 allows remote attackers to cause a denial of service (application crash) via unspecified vectors.http://www.wireshark.org/security/wnpa-sec-2007-01.html2235224016https://issues.rpath.com/browse/RPL-985wireshark-ieeedissector-dos(32055)ADV-2007-0443RHSA-2007:0066MDKSA-2007:033http://support.avaya.com/elmodocs2/security/ASA-2007-166.htm1017581249702465024515240842402524011oval:org.mitre.oval:def:1100333074FEDORA-2007-20720070301-01-PUnspecified vulnerability in the HTTP dissector in Wireshark (formerly Ethereal) 0.99.3 and 0.99.4 allows remote attackers to cause a denial of service (application crash) via unspecified vectors, a different issue than CVE-2006-5468.http://www.wireshark.org/security/wnpa-sec-2007-01.html22352https://issues.rpath.com/browse/RPL-985wireshark-httpdissector-dos(32054)ADV-2007-0443RHSA-2007:0066MDKSA-2007:033http://support.avaya.com/elmodocs2/security/ASA-2007-166.htm101758124970246502451524084240252401624011oval:org.mitre.oval:def:14836oval:org.mitre.oval:def:1096633075FEDORA-2007-20720070301-01-Ppacket-tcp.c in the TCP dissector in Wireshark (formerly Ethereal) 0.99.2 through 0.99.4 allows remote attackers to cause a denial of service (application crash or hang) via fragmented HTTP packets.http://www.wireshark.org/security/wnpa-sec-2007-01.html2235224016https://issues.rpath.com/browse/RPL-985wireshark-tcpdissector-dos(32053)ADV-2007-0443RHSA-2007:0066MDKSA-2007:033http://support.avaya.com/elmodocs2/security/ASA-2007-166.htm1017581249702465024515240842402524011oval:org.mitre.oval:def:14875oval:org.mitre.oval:def:10465FEDORA-2007-207http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=120020070301-01-PMultiple buffer overflows in ulogd for SUSE Linux 9.3 up to 10.1, and possibly other distributions, have unknown impact and attack vectors related to "improper string length calculations."22139SUSE-SR:2007:001MDKSA-2007:028GLSA-200703-17245242386332939Multiple memory leaks in the Dazuko anti-virus helper module before 2.3.2 allow attackers to cause a denial of service (memory consumption) via unknown vectors.SUSE-SR:2007:00138322The _GetSrcBits32ARGB function in Apple QuickDraw, as used by Quicktime 7.1.3 and other applications on Mac OS X 10.4.8 and earlier, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PICT image with a malformed Alpha RGB (ARGB) record, which triggers memory corruption.ADV-2007-0337http://projects.info-pull.com/moab/MOAB-23-01-2007.htmlmacos-argb-dos(31698)222073269623859Format string vulnerability in Apple Software Update 2.0.5 on Mac OS X 10.4.8 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via format string specifiers in (1) SWUTMP or (2) SUCATALOG filenames, or using the (3) application/x-apple.sucatalog+xml MIME type.TA07-072AADV-2007-0930ADV-2007-0337http://projects.info-pull.com/moab/MOAB-24-01-2007.html1017755222223270324479APPLE-SA-2007-03-13http://docs.info.apple.com/article.html?artnum=305214The _CFNetConnectionWillEnqueueRequests function in CFNetwork 129.19 on Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to cause a denial of service (application crash) via a crafted HTTP 301 response, which results in a NULL pointer dereference.TA07-319Amacos-cfnetwork-dos(31837)ADV-2007-3868264442224932704320027643http://projects.info-pull.com/moab/MOAB-25-01-2007.htmlAPPLE-SA-2007-11-14http://docs.info.apple.com/article.html?artnum=307041Format string vulnerability in Apple Installer 2.1.5 on Mac OS X 10.4.8 allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a (1) PKG, (2) DISTZ, or (3) MPKG package filename.TA07-109AADV-2007-147022272http://projects.info-pull.com/moab/MOAB-26-01-2007.htmlmacos-installer-format-string(31883)10179403270524966APPLE-SA-2007-04-19http://docs.info.apple.com/article.html?artnum=305391Telestream Flip4Mac Windows Media Components for Quicktime 2.1.0.33 allows remote attackers to execute arbitrary code via a crafted ASF_File_Properties_Object size field in a WMV file, which triggers memory corruption.ADV-2007-03892228623958http://projects.info-pull.com/moab/MOAB-27-01-2007.html32697crashdump in Apple Mac OS X 10.4.8 allows local users in the admin group to modify arbitrary files or gain privileges via a symlink attack on application logs in /Library/Logs/CrashReporter/.Successful exploitation requires that the attacker is already a part of the administrator group.TA07-072AVU#363112macos-crashreporterd-privilege-escalation(31888)ADV-2007-0930101775124479http://projects.info-pull.com/moab/MOAB-28-01-2007.htmlhttp://docs.info.apple.com/article.html?artnum=30521432706APPLE-SA-2007-03-13Stack-based buffer overflow in rcdll.dll in msdev.exe in Visual C++ (MSVC) in Microsoft Visual Studio 6.0 SP6 allows user-assisted remote attackers to execute arbitrary code via a long file path in the "1 TYPELIB MOVEABLE PURE" option in an RC file.ADV-2007-029620070122 Microsoft Visual C++ (.RC) resource files buffer overflow vulnerabilityhttp://www.anspi.pl/~porkythepig/visualization/rc-kupiekrowe.cpp2385631607visualstudio-rc-bo(31665)2172The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages.http://rubyforge.org/frs/shownotes.php?release_id=9074ADV-2007-0295rubygems-extractfiles-file-overwrite(31688)20070121 RubyGems 0.9.0 and earlier installation exploitSUSE-SR:2007:00420070121 RubyGems 0.9.0 and earlier installation exploitMultiple unspecified vulnerabilities in tip in Sun Solaris 8, 9, and 10 allow local users to gain uucp account privileges via unspecified vectors.102773ADV-2007-031731616solaris-tip-privilege-escalation(31669)22190101754623821oval:org.mitre.oval:def:2038sre/params.php in the Integrity Clientless Security (ICS) component in Check Point Connectra NGX R62 3.x and earlier before Security Hotfix 5, and possibly VPN-1 NGX R62, allows remote attackers to bypass security requirements via a crafted Report parameter, which returns a valid ICSCookie authentication token.checkpoint-params-security-bypass(31646)ADV-2007-027620070122 Check Point Connectra End Point security bypass20070122 Re: [Full-disclosure] Check Point Connectra End Point security bypasshttp://www.checkpoint.com/downloads/latest/hfa/vpn1_security/vpn1_R62_Windows.htmlhttp://www.checkpoint.com/downloads/latest/hfa/connectra/security_r62.htmlhttp://updates.checkpoint.com/fileserver/ID/7126/FILE/VPN-1_Hotfix1.pdf101756010175592179238473165520070122 Check Point Connectra End Point security bypassMultiple race conditions in Smb4K before 0.8.0 allow local users to (1) modify arbitrary files via unspecified manipulations of Smb4K's lock file, which is not properly handled by the remove_lock_file function in core/smb4kfileio.cpp, and (2) add lines to the sudoers file via a symlink attack on temporary files, which isn't properly handled by the writeFile function in core/smb4kfileio.cpp.[smb4k-announce] 20061221 Smb4K 0.8.0 and security fixes released23937ADV-2007-0393http://developer.berlios.de/project/shownotes.php?release_id=9777http://developer.berlios.de/project/shownotes.php?release_id=11902http://developer.berlios.de/project/shownotes.php?release_id=11706http://developer.berlios.de/bugs/?func=detailbug&bug_id=9630&group_id=76922299MDKSA-2007:042GLSA-200703-09244692411123984SUSE-SR:2007:002The writeFile function in core/smb4kfileio.cpp in Smb4K before 0.8.0 does not preserve /etc/sudoers permissions across modifications, which allows local users to obtain sensitive information (/etc/sudoers contents) by reading this file.[smb4k-announce] 20061221 Smb4K 0.8.0 and security fixes released23937ADV-2007-0393http://developer.berlios.de/project/shownotes.php?release_id=9777http://developer.berlios.de/project/shownotes.php?release_id=11902http://developer.berlios.de/project/shownotes.php?release_id=11706http://developer.berlios.de/bugs/?func=detailbug&bug_id=9630&group_id=76922299MDKSA-2007:042GLSA-200703-09244692411123984SUSE-SR:2007:002Smb4K before 0.8.0 allow local users, when present on the Smb4K sudoers list, to kill arbitrary processes, related to a "design issue with smb4k_kill."[smb4k-announce] 20061221 Smb4K 0.8.0 and security fixes released23937ADV-2007-0393http://developer.berlios.de/project/shownotes.php?release_id=9777http://developer.berlios.de/project/shownotes.php?release_id=11902http://developer.berlios.de/project/shownotes.php?release_id=11706http://developer.berlios.de/bugs/?func=detailbug&bug_id=9631&group_id=76922299MDKSA-2007:042GLSA-200703-09244692411123984SUSE-SR:2007:002Multiple stack-based buffer overflows in utilities/smb4k_*.cpp in Smb4K before 0.8.0 allow local users, when present on the Smb4K sudoers list, to gain privileges via unspecified vectors related to the args variable and unspecified other variables, in conjunction with the sudo configuration.[smb4k-announce] 20061221 Smb4K 0.8.0 and security fixes released23937ADV-2007-0393http://developer.berlios.de/project/shownotes.php?release_id=9777http://developer.berlios.de/project/shownotes.php?release_id=11902http://developer.berlios.de/project/shownotes.php?release_id=11706http://developer.berlios.de/bugs/?func=detailbug&bug_id=9631&group_id=76922299MDKSA-2007:042GLSA-200703-09244692411123984SUSE-SR:2007:002The gencert.sh script, when installing OpenLDAP before 2.1.30-r10, 2.2.x before 2.2.28-r7, and 2.3.x before 2.3.30-r2 as an ebuild in Gentoo Linux, does not create temporary directories in /tmp securely during emerge, which allows local users to overwrite arbitrary files via a symlink attack.ADV-2007-0305GLSA-200701-19238813161722195Cross-site scripting (XSS) vulnerability in Openads 2.0.x before 2.0.10, 2.3 before 2.3.31 (aka Max Media Manager before 0.3.31-alpha-pr2), and phpAdsNew/phpPgAds before 2.0.9-pr1 allows remote attackers to inject arbitrary web script or HTML via (1) the keyword parameter in admin-search.php and (2) affiliate-search.php. NOTE: this issue may overlap CVE-2007-0363.https://developer.openads.org/browser/branches/max/trunk/CHANGELOG.txt?format=rawADV-2007-031520070127 Re: [OPENADS-SA-2007-002] Max Media Manager v0.1.29 and v0.3.30 vulnerability fixed20070126 [OPENADS-SA-2007-002] Max Media Manager v0.1.29 and v0.3.30 vulnerability fixed20070124 [OPENADS-SA-2007-001] phpAdsNew and phpPgAds 2.0.9-pr1 vulnerability fixed32926JVN#07274813http://forum.openads.org/index.php?showtopic=503412651WebCore on Apple Mac OS X 10.3.9 and 10.4.10, as used in Safari, does not properly parse HTML comments in TITLE elements, which allows remote attackers to conduct cross-site scripting (XSS) attacks and bypass some XSS protection schemes by embedding certain HTML tags within an HTML comment.safari-html-xss(31846)safari-html-xss(31846)ADV-2007-27322515920070123 Safari Improperly Parses HTML Documents & BlogSpot XSS vulnerabilityhttp://www.beanfuzz.com/wordpress/?p=991018494262352389332712APPLE-SA-2007-07-31http://docs.info.apple.com/article.html?artnum=306172Memory leak in the TCP listener in Cisco IOS 9.x, 10.x, 11.x, and 12.x allows remote attackers to cause a denial of service by sending crafted TCP traffic to an IPv4 address on the IOS device.VU#217912TA07-024Acisco-tcp-ipv4-dos(31716)ADV-2007-03292220820070124 Crafted TCP Packet Can Cause Denial of Service101755123867oval:org.mitre.oval:def:508032093Cisco IOS 9.x, 10.x, 11.x, and 12.x and IOS XR 2.0.x, 3.0.x, and 3.2.x allows remote attackers to cause a denial of service or execute arbitrary code via a crafted IP option in the IP header in a (1) ICMP, (2) PIMv2, (3) PGM, or (4) URD packet.VU#341288TA07-024Acisco-ip-option-code-execution(31725)ADV-2007-032920070124 Crafted IP Option Vulnerability101755523867oval:org.mitre.oval:def:56663209222211Cisco IOS allows remote attackers to cause a denial of service (crash) via a crafted IPv6 Type 0 Routing header.VU#274760TA07-024Acisco-ios-ipv6-type0-dos(31715)ADV-2007-032920070124 IPv6 Routing Header Vulnerability101755023867oval:org.mitre.oval:def:58573209122210cgi-bin/main in Sun Ray Server Software 2.0 and 3.0 before 20070123 allows local users to obtain the utadmin password by reading a web server's log file, or by conducting a different, unspecified local attack.ADV-2007-031610277931671sunray-utadmin-information-disclosure(31700)22192101754723900Multiple cross-site scripting (XSS) vulnerabilities in Enthusiast 3.1 allow remote attackers to inject arbitrary web script or HTML via the URI for (1) show_owned.php or (2) show_joined.php. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.2386531608enthusiast-show-xss(31667)22180Multiple SQL injection vulnerabilities in Enthusiast 3.1 allow remote attackers to execute arbitrary SQL commands via the cat parameter to (1) show_owned.php, (2) show_joined.php, and possibly other files. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.238653161031609enthusiast-show-sql-injection(31666)22180PHP remote file inclusion vulnerability in defines.php in WebChat 0.77 allows remote attackers to execute arbitrary PHP code via a URL in the WEBCHATPATH parameter.webchat-definesphp-file-include(31624)1006193700020030303 WebChat (PHP)82063169** DISPUTED ** Multiple PHP remote file inclusion vulnerabilities in Openads (aka phpAdsNew) 2.0.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) phpAds_geoPlugin parameter to libraries/lib-remotehost.inc, the (2) filename parameter to admin/report-index, or the (3) phpAds_config[my_footer] parameter to admin/lib-gui.inc. NOTE: the vendor has disputed this issue, stating that the relevant variables are used within function definitions.2217220070124 Re: phpAdsNew 2.0.7 Remote File Include20070122 Re: phpAdsNew 2.0.7 Remote File Include20070120 phpAdsNew 2.0.7 Remote File Include217433573** DISPUTED ** PHP remote file inclusion vulnerability in index.php in FreeForum 0.9.0 allows remote attackers to execute arbitrary PHP code via a URL in the fpath parameter. NOTE: this issue has been disputed by third party researchers, stating that fpath variable is initialized before being used.20070124 Re: FreeForum 0.9.0 <=- (index.php fpath) Remote File Include Vulnerability20070121 FreeForum 0.9.0 <=- (index.php fpath) Remote File Include VulnerabilityThe Huawei Versatile Routing Platform 1.43 2500E-003 firmware on the Quidway R1600 Router, and possibly other models, allows remote attackers to cause a denial of service (device crash) via a long show arp command.quidway-arp-dos(31641)4035520070118 The Quidway Router local DOS2176PHP remote file inclusion vulnerability in includes/functions.visohotlink.php in VisoHotlink 1.01 and possibly earlier allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.visohotlink-functions-file-include(31654)ADV-2007-02852387831611317522171index.php in Open-Realty 2.3.4 allows remote attackers to obtain sensitive information (the full path) via an invalid listingID parameter in a listingview action.20070121 Full Path Disclosure in Open-Realty ( v2.3.4 )openrealty-index-path-disclosure(31657)PHP remote file inclusion vulnerability in up.php in Sky GUNNING MySpeach 3.0.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the my_ms[root] parameter, a different vector than CVE-2006-4630. NOTE: Some of these details are obtained from third party information.ADV-2007-026923850Multiple SQL injection vulnerabilities in gallery.php in webSPELL 4.01.02 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) galleryID parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.ADV-2007-0270webspell-gallery-sql-injection(31632)Use-after-free vulnerability in ISC BIND 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum only) allows remote attackers to cause a denial of service (named daemon crash) via unspecified vectors that cause named to "dereference a freed fetch context."http://www.isc.org/index.pl?/sw/bind/view/?release=9.3.4http://www.isc.org/index.pl?/sw/bind/view/?release=9.2.8SSRT061239SSRT071304SSRT061213ADV-2007-2315ADV-2007-2163ADV-2007-1939ADV-2007-1401ADV-2007-034923904oval:org.mitre.oval:def:9614[bind-announce] 20070125 Internet Systems Consortium Security Advisory.20070125 BIND remote exploit (low severity) [Fwd: Internet Systems Consortium Security Advisory.]SSRT061273SSRT061213https://issues.rpath.com/browse/RPL-989USN-418-12007-00052222920070125 BIND remote exploit (low severity) [Fwd: Internet Systems Consortium Security Advisory.]RHSA-2007:0057OpenPKG-SA-2007.007MDKSA-2007:030http://www.isc.org/index.pl?/sw/bind/bind-security.phpSSA:2007-026-011017561GLSA-200702-06FreeBSD-SA-07:022564925402249502493024203241292405424048240142397723974239722394323924SUSE-SA:2007:014APPLE-SA-2007-05-24HPSBUX02219NetBSD-SA2007-003FEDORA-2007-164FEDORA-2007-147http://docs.info.apple.com/article.html?artnum=305530ISC BIND 9.0.x, 9.1.x, 9.2.0 up to 9.2.7, 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum only) allows remote attackers to cause a denial of service (exit) via a type * (ANY) DNS query response that contains multiple RRsets, which triggers an assertion error, aka the "DNSSEC Validation" vulnerability.Syccessful exploitation requires that the victim has enabled dnssec validation in named.conf by specifying trusted-keys.http://www.isc.org/index.pl?/sw/bind/view/?release=9.3.4http://www.isc.org/index.pl?/sw/bind/view/?release=9.2.823904[bind-announce] 20070125 Internet Systems Consortium Security Advisory.SSRT071304SSRT061239SSRT071304SSRT061213https://issues.rpath.com/browse/RPL-989ADV-2007-3229ADV-2007-2315ADV-2007-2245ADV-2007-2163ADV-2007-2002ADV-2007-1939ADV-2007-1401USN-418-12007-000522231RHSA-2007:0057RHSA-2007:0044OpenPKG-SA-2007.007MDKSA-2007:030http://www.isc.org/index.pl?/sw/bind/bind-security.phpDSA-1254IY96324IY96144IY95619IY95618http://support.avaya.com/elmodocs2/security/ASA-2007-125.htm102969SSA:2007-026-011017573GLSA-200702-06FreeBSD-SA-07:0225402249502493024648242032412924083240542404824014239772397423972239442394323924oval:org.mitre.oval:def:11523SUSE-SA:2007:01420070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware PlayerAPPLE-SA-2007-05-24SSRT061273SSRT061273NetBSD-SA2007-003FEDORA-2007-164FEDORA-2007-147http://docs.info.apple.com/article.html?artnum=30553020070201-01-Pbind-rrsets-dos(31838)277062690925715256492548224284PHP remote file inclusion vulnerability in include/config.inc.php in PhpSherpa allows remote attackers to execute arbitrary PHP code via a URL in the racine parameter.ADV-2007-026323817315993161PHP remote file inclusion vulnerability in lib/nl/nl.php in Neon Labs Website (nlws) 3.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the g_strRootDir parameter.ADV-2007-0268367973163PHP remote file inclusion vulnerability in upload/top.php in Upload-Service 1.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the maindir parameter.ADV-2007-02652384532938http://echo.or.id/adv/adv62-y3dips-2007.txtuploadservice-top-file-include(31634)2218920070123 [ECHO_ADV_62$2007] Upload Service 1.0 remote file inclusionPHP remote file inclusion vulnerability in up.php in MySpeach 2.1 beta and possibly earlier allows remote attackers to execute arbitrary PHP code via a URL in the my[root] parameter.316033165PHP remote file inclusion vulnerability in config.php in Sangwan Kim phpIndexPage 1.0.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the env[inc_path] parameter.ADV-2007-02672216123992330143164PHP remote file inclusion vulnerability in include/includes.php in Bradabra 2.0.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.ADV-2007-026423851316043162PHP remote file inclusion vulnerability in index.php in Mafia Scum Tools 2.0.0 in Matthew Wardrop Advanced Random Generators (adv-random-gen) allows remote attackers to execute arbitrary PHP code via a URL in the gen parameter.mafiascum-index-file-include(31637)ADV-2007-027122151368103171SQL injection vulnerability in gallery.php in webSPELL 4.01.02 allows remote attackers to execute arbitrary SQL commands via the picID parameter, a different vector than CVE-2007-0492.ADV-2007-027036798webspell-gallery-sql-injection(31632)221493172Unspecified vulnerability in kcms_calibrate in Sun Solaris 8 and 9 before 20071122 allows local users to execute arbitrary commands via unknown vectors.102728solaris-kcmscalibrate-privilege-escalation(31668)ADV-2007-02871017541238853159822175http://support.avaya.com/elmodocs2/security/ASA-2007-040.htmoval:org.mitre.oval:def:1495Eval injection vulnerability in poll_frame.php in Vote! Pro 4.0, and possibly other scripts, allows remote attackers to execute arbitrary code via the poll_id parameter, which is supplied to an eval function call, a different vulnerability type than CVE-2005-4632.