Primary
Vendor -- Product |
Description |
|
CVSS Score |
Source & Patch Info |
2z Project -- 2z Project
|
Multiple cross-site scripting (XSS) vulnerabilities in 2z project 0.9.6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) contentshort or (2) contentfull parameter in an addnews action to the default URI; (3) the content parameter in a pm write action to 2z/admin.php; (4) the referer parameter to templates/default/usermenu.tpl, accessed through index.php; or the (5) newavatar or (6) newphoto parameter in a profile action to the default URI under 2z/. |
| 4.3 |
CVE-2007-6659
BUGTRAQ
BID
|
2z Project -- 2z Project
|
2z project 0.9.6.1 allows remote attackers to obtain sensitive information via (1) a request to index.php with an invalid template or (2) a request to the default URI with certain year and month parameters, which reveals the path in various error messages. |
| 5.0 |
CVE-2007-6660
BUGTRAQ
BID
|
2z Project -- 2z Project
|
2z project 0.9.6.1 allows attackers to change the password without supplying the old password. |
| 6.4 |
CVE-2007-6661
BUGTRAQ
BID
|
Adobe -- Flash Player Plugin
Adobe -- Flash Player
|
Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver CS3 or Adobe Acrobat Connect. NOTE: the asfunction: vector is already covered by CVE-2007-6244.1. |
| 4.3 |
CVE-2007-6637
OTHER-REF
BID
SECTRACK
|
Agares Media -- phpAutoVideo
|
PHP remote file inclusion vulnerability in admin/frontpage_right.php in Agares Media phpAutoVideo 2.21 allows remote attackers to execute arbitrary PHP code via a URL in the loadadminpage parameter, a related issue to CVE-2007-6542. |
| 6.8 |
CVE-2007-6614
MILW0RM
OTHER-REF
BID
FRSIRT
SECUNIA
|
Agares Media -- phpAutoVideo
|
Directory traversal vulnerability in includes/block.php in Agares Media phpAutoVideo 2.21 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the selected_provider parameter. |
| 6.8 |
CVE-2007-6615
MILW0RM
OTHER-REF
BID
FRSIRT
SECUNIA
|
AGENCY4NET -- WEBFTP
|
Directory traversal vulnerability in download2.php in AGENCY4NET WEBFTP 1 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the file parameter. |
| 6.4 |
CVE-2008-0091
MILW0RM
VIM
BID
|
Apple -- Safari
|
Apple Safari 2, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, which makes it easier for remote attackers to trick a user into accepting an invalid certificate for a spoofed web site. |
| 4.3 |
CVE-2007-6592
BUGTRAQ
BUGTRAQ
OTHER-REF
|
Atlassian -- JIRA
|
Cross-site scripting (XSS) vulnerability in 500page.jsp in JIRA Enterprise Edition before 3.12.1 allows remote attackers to inject arbitrary web script or HTML, which is not properly handled when generating error messages, as demonstrated by input originally sent in the URI to secure/CreateIssue. NOTE: some of these details are obtained from third party information. |
| 4.3 |
CVE-2007-6617
OTHER-REF
SECUNIA
|
Atlassian -- JIRA
|
JIRA Enterprise Edition before 3.12.1 allows remote attackers to delete another user's shared filter via a modified filter ID. |
| 5.0 |
CVE-2007-6618
OTHER-REF
SECUNIA
|
Bitflu -- Bitflu
|
Unspecified vulnerability in the StorageFarabDb module in Bitflu before 0.42 allows user-assisted remote attackers to create or append data to arbitrary files via a crafted .torrent file. |
| 5.8 |
CVE-2007-6636
OTHER-REF
BID
SECUNIA
|
Bitweaver -- R2 CMS
|
Directory traversal vulnerability in wiki/edit.php in Bitweaver R2 CMS allows remote attackers to obtain sensitive information (script source code) via a .. (dot dot) in the suck_url parameter. |
| 6.4 |
CVE-2007-6651
MILW0RM
OTHER-REF
|
CutePHP -- CuteNews
|
Directory traversal vulnerability in file.php in CuteNews 2.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, as demonstrated by reading the admin username and password hash in data/users.db.php. |
| 5.8 |
CVE-2007-6662
BUGTRAQ
|
Dovecot -- Dovecot
|
Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password. |
| 6.8 |
CVE-2007-6598
BUGTRAQ
BUGTRAQ
MLIST
MLIST
BID
FRSIRT
|
Feng -- Feng
|
LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via (1) a malformed Transport header, which triggers misparsing in parse_transport_header in RTSP_setup.c, as demonstrated by a Transport header that contains only a "RTP/AVP;unicast;client_port" sequence; or (2) a malformed Range header, which triggers misparsing in parse_play_time_range in RTSP_Play, as demonstrated by an empty Range header. |
| 5.0 |
CVE-2007-6628
BUGTRAQ
OTHER-REF
OTHER-REF
BID
|
Feng -- Feng
|
Interpretation conflict in LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a User-Agent header line that contains a carriage-return character, which is considered a line delimiter when the header is split into individual lines, but not when log_user_agent in RTSP_utils.c parses the content of the User-Agent line. |
| 5.0 |
CVE-2007-6629
BUGTRAQ
OTHER-REF
OTHER-REF
BID
|
Feng -- Feng
|
The Url_init function in utils/url.c in Netembryo 0.0.4, when used by LScube Feng, allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a malformed URI containing a "/:" sequence, as demonstrated by a "DESCRIBE /: RTSP/1.0" request. |
| 5.0 |
CVE-2007-6630
BUGTRAQ
OTHER-REF
OTHER-REF
BID
|
GNU -- libcdio
|
Stack-based buffer overflow in the print_iso9660_recurse function in iso-info (src/iso-info.c) in GNU Compact Disc Input and Control Library (libcdio) 0.79 and earlier allows context-dependent attackers to cause a denial of service (core dump) and possibly execute arbitrary code via a disk or image that contains a long joilet file name. |
| 5.0 |
CVE-2007-6613
MLIST
OTHER-REF
OTHER-REF
|
Integry Systems -- LiveCart
|
Multiple cross-site scripting (XSS) vulnerabilities in LiveCart 1.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the return parameter to user/remindPassword, (2) the q parameter to the category script, (3) the return parameter to the order script, or (4) the email parameter to user/remindComplete. |
| 4.3 |
CVE-2007-6646
BUGTRAQ
OTHER-REF
BID
XF
|
Joomla -- Joomla
|
Multiple cross-site request forgery (CSRF) vulnerabilities in Joomla! before 1.5 RC4 allow remote attackers to (1) add a Super Admin, (2) upload an extension containing arbitrary PHP code, and (3) modify the configuration as administrators via unspecified vectors. |
| 6.8 |
CVE-2007-6642
BUGTRAQ
OTHER-REF
SECTRACK
|
Joomla -- Joomla
|
Cross-site scripting (XSS) vulnerability in the com_poll component in Joomla! before 1.5 RC4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| 4.3 |
CVE-2007-6643
OTHER-REF
SECTRACK
|
Joomla -- Joomla
|
Joomla! before 1.5 RC4 allows remote authenticated administrators to promote arbitrary users to the administrator group, in violation of the intended security model. |
| 6.5 |
CVE-2007-6644
OTHER-REF
SECTRACK
|
Joovili -- Joovili
|
Directory traversal vulnerability in include/images.inc.php in Joovili 2.x allows remote attackers to read arbitrary files via a .. (dot dot) in the picture parameter. |
| 6.4 |
CVE-2007-6620
MILW0RM
|
Joovili -- Joovili
|
Directory traversal vulnerability in joovili.images.php in Joovili 3.0.0 through 3.0.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the picture parameter. |
| 6.4 |
CVE-2007-6621
MILW0RM
|
Mantis -- Mantis
|
Cross-site scripting (XSS) vulnerability in view.php in Mantis before 1.1.0 allows remote attackers to inject arbitrary web script or HTML via a filename. |
| 4.3 |
CVE-2007-6611
OTHER-REF
OTHER-REF
BID
SECUNIA
|
MaraDNS -- MaraDNS
|
MaraDNS 1.0 before 1.0.41, 1.2 before 1.2.12.08, and 1.3 before 1.3.07.04 allows remote attackers to cause a denial of service via a crafted DNS packet that prevents an authoritative name (CNAME) record from resolving, aka "improper rotation of resource records." |
| 5.0 |
CVE-2008-0061
OTHER-REF
OTHER-REF
|
Microsoft -- Internet Explorer
DivX -- DivX Player
|
A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long argument to the SetPassword method. |
| 5.0 |
CVE-2008-0090
MILW0RM
BID
|
Mihalism -- Multi Host
|
Directory traversal vulnerability in download.php in Mihalism Multi Host 2.0.7 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. |
| 5.0 |
CVE-2007-6653
MILW0RM
|
MilliScripts -- MilliScripts
|
Cross-site scripting (XSS) vulnerability in dir.php in milliscripts allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a browse action. |
| 4.3 |
CVE-2007-6641
BUGTRAQ
BID
XF
|
Mongrel -- Mongrel
|
Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences (".%252e"). |
| 6.4 |
CVE-2007-6612
MLIST
MLIST
MLIST
MLIST
OTHER-REF
|
NetBizCity -- FAQMasterFlexPlus
|
Multiple cross-site scripting (XSS) vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to inject arbitrary web script or HTML via (1) the cat_name parameter to faq.php; and unspecified parameters to the (2) add categories, (3) edit categories, (4) delete categories, (5) add faq, (6) edit faq, and (7) delete faq Admin scripts. |
| 4.3 |
CVE-2007-6633
FULLDISC
BID
SECUNIA
|
NetBizCity -- FAQMasterFlexPlus
|
Multiple SQL injection vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to execute arbitrary SQL commands via the category_id parameter to faq.php, and unspecified other vectors involving additional scripts. |
| 6.8 |
CVE-2007-6634
FULLDISC
BID
SECUNIA
|
NetBizCity -- FAQMasterFlexPlus
|
FAQMasterFlexPlus, possibly 1.5 or 1.52, stores the admin password in cleartext in a database, which might allow context-dependent attackers to obtain the password via unspecified database access. |
| 6.4 |
CVE-2007-6635
FULLDISC
|
Novell -- Novell Identity Manager
|
The Platform Service Process (asampsp) in Fan-Out Driver Platform Services for Novell Identity Manager (IDM) 3.5.1 allows remote attackers to cause a denial of service (daemon crash) via unspecified network traffic that triggers a syslog message containing invalid format string specifiers, as demonstrated by a Nessus scan. |
| 5.0 |
CVE-2007-6625
OTHER-REF
FRSIRT
SECTRACK
SECUNIA
XF
|
OpenAFS -- OpenAFS
|
Race condition in fileserver in OpenAFS 1.3.50 through 1.4.5 and 1.5.0 through 1.5.27 allows remote attackers to cause a denial of service (daemon crash) by simultaneously acquiring and giving back file callbacks, which causes the handler for the GiveUpAllCallBacks RPC to perform linked-list operations without the host_glock lock. |
| 4.3 |
CVE-2007-6599
MLIST
OTHER-REF
|
phpWebsite -- phpWebSite
|
Cross-site scripting (XSS) vulnerability in index.php in the search module in Appalachian State University phpWebSite 1.4.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter. |
| 4.3 |
CVE-2008-0092
BUGTRAQ
OTHER-REF
BID
|
PNphpBB -- PNphpBB
|
Directory traversal vulnerability in printview.php in PNphpBB2 1.2i and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phpEx parameter. |
| 6.8 |
CVE-2007-6624
MILW0RM
OTHER-REF
BID
XF
|
SanyBee Gallery -- SanyBee Gallery
|
Directory traversal vulnerability in index.php in SanyBee Gallery 0.1.0 and 0.1.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter. |
| 5.0 |
CVE-2007-6648
MILW0RM
BID
SECUNIA
|
SimpleForum -- SimpleForum
|
Cross-site scripting (XSS) vulnerability in simpleforum.cgi in SimpleForum 4.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchkey parameter in a search action. NOTE: some of these details are obtained from third party information. |
| 4.3 |
CVE-2007-6616
BUGTRAQ
BID
SECUNIA
XF
|
SourceForge -- Greasekit
SourceForge -- Creammonkey
|
Creammonkey 0.9 through 1.1 and GreaseKit 1.2 through 1.3 does not properly prevent access to dangerous functions, which allows remote attackers to read the configuration, modify the configuration, or send an HTTP request via the (1) GM_addStyle, (2) GM_log, (3) GM_openInTab, (4) GM_setValue, (5) GM_getValue, or (6) GM_xmlhttpRequest function within a web page on which a userscript is configured. |
| 6.4 |
CVE-2007-6640
OTHER-REF
SECUNIA
XF
|
xml2owl -- xml2owl
|
showCode.php in xml2owl 0.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter. |
| 6.8 |
CVE-2007-6632
MILW0RM
OTHER-REF
BID
|
ZeusCMS -- ZeusCMS
|
Absolute path traversal vulnerability in ZeusCMS 0.3 and earlier might allow remote attackers to list arbitrary directories via a full pathname in the dir parameter. |
| 5.0 |
CVE-2007-6623
MILW0RM
BID
SECUNIA
|