U.S. Flag Official website of the Department of Homeland Security

Note: This page is part of the us-cert.gov archive.This document is part of the US-CERT website archive. These documents are no longer updated and may contain outdated information. Links may also no longer function. Please contact info@us-cert.gov if you have any questions about the US-CERT website archive.

TLP:WHITE

Bulletin (SB07-218)

Vulnerability Summary for the Week of July 30, 2007

Original release date: August 06, 2007

The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information.

The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

  • High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0

  • Medium - Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 - 6.9

  • Low - Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 - 3.9

Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.

">

High Vulnerabilities
Primary
Vendor -- Product
Description
Discovered
Published
CVSS ScoreSource & Patch Info
Adult Directory -- Adult DirectorySQL injection vulnerability in directory.php in Adult Directory allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action. NOTE: This might be related to Maan Bsat Photo Collection. NOTE: this might be a site-specific issue, so perhaps this should not be included in CVE.
unknown
2007-07-30
7.5CVE-2007-4056
MILW0RM
VIM
FRSIRT
AlstraSoft -- Affiliate Network ProMultiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to execute arbitrary SQL commands via (1) the pgmid parameter in an uploadProducts action to merchants/index.php and possibly (2) the rowid parameter to merchants/temp.php.
unknown
2007-07-30
7.5CVE-2007-4084
OTHER-REF
BID
ASP Indir -- Alisveris Sitesi ScriptMultiple SQL injection vulnerabilities in index.asp in Alisveris Sitesi Scripti allow remote attackers to execute arbitrary SQL commands via the (1) product_id or (2) cat_id parameter in a product mod action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
unknown
2007-07-30
7.5CVE-2007-4076
BID
Baidu -- Soba Search BarA certain ActiveX control in BaiduBar.dll in Baidu Soba Search Bar 5.4 allows remote attackers to execute arbitrary code via a request containing "a link to download and a file to execute," possibly involving remote file inclusion.
unknown
2007-07-31
9.3CVE-2007-4105
OTHER-REF
FRSIRT
SECUNIA
Berthanas Ziyaretci -- DefteriMultiple SQL injection vulnerabilities in yonetici.asp in Berthanas Ziyaretci Defteri 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) user and (2) Pass fields.
unknown
2007-08-01
7.5CVE-2007-4119
BUGTRAQ
BID
XF
BSM Store -- Dependent ForumsSQL injection vulnerability in BSM Store Dependent Forums 1.02 allows remote attackers to execute arbitrary SQL commands via the Username parameter to an unspecified component.
unknown
2007-07-30
7.5CVE-2007-4095
BUGTRAQ
BID
Centre for Speech Technology Research -- Gentoo LinuxThe default configuration of Centre for Speech Technology Research (CSTR) Festival 1.95 beta (aka 2.0 beta) is run locally with elevated privileges without requiring authentication, which allows context-dependent attackers to execute arbitrary commands via the local daemon on port 1314, a different vulnerability than CVE-2001-0956.
unknown
2007-07-30
7.2CVE-2007-4074
OTHER-REF
GENTOO
BID
SECUNIA
Clever Components -- Internet ActiveX SuiteAbsolute path traversal vulnerability in the clInetSuiteX6.clWebDav ActiveX control in CLINETSUITEX6.OCX in Clever Internet ActiveX Suite 6.2 allows remote attackers to create or overwrite arbitrary files via a full pathname in the second argument to the GetToFile method. NOTE: some of these details are obtained from third party information.
unknown
2007-07-30
9.3CVE-2007-4067
MILW0RM
VIM
BID
FRSIRT
SECUNIA
XF
CodeWidgets -- Online Event Registration TemplateSQL injection vulnerability in sign_in.aspx in WebEvents (Online Event Registration Template) allows remote attackers to execute arbitrary SQL commands via the Password parameter.
unknown
2007-07-31
7.5CVE-2007-4108
BUGTRAQ
BUGTRAQ
OTHER-REF
BID
SECUNIA
CodeWidgets -- Online Event Registration TemplateSQL injection vulnerability in sign_in.aspx in WebStore (Online Store Application Template) allows remote attackers to execute arbitrary SQL commands via the Password parameter.
unknown
2007-07-31
7.5CVE-2007-4109
BUGTRAQ
OTHER-REF
BID
SECUNIA
CodeWidgets -- Threaded Discussion Forum ApplicationSQL injection vulnerability in sign_in.aspx in Message Board / Threaded Discussion Forum Application Template allows remote attackers to execute arbitrary SQL commands via the Password parameter.
unknown
2007-07-31
7.5CVE-2007-4110
BUGTRAQ
OTHER-REF
BID
Digium -- Asterisk
Digium -- Asterisk Appliance Developer Kit
Digium -- AsteriskNOW pre-release
The IAX2 channel driver (chan_iax2) in Asterisk Open 1.2.x before 1.2.23, 1.4.x before 1.4.9, and Asterisk Appliance Developer Kit before 0.6.0, when configured to allow unauthenticated calls, allows remote attackers to cause a denial of service (resource exhaustion) via a flood of calls that do not complete a 3-way handshake, which causes an ast_channel to be allocated but not released.
unknown
2007-07-31
7.8CVE-2007-4103
BUGTRAQ
OTHER-REF
FRSIRT
SECTRACK
SECUNIA
E-Commerce Solutions -- Multi-Vendor E-Shop Script
E-Commerce Solutions -- Auction Script
E-Commerce Solutions -- Shopping Cart Script
Multiple SQL injection vulnerabilities in admin.aspx in E-Commerce Scripts Shopping Cart Script, Multi-Vendor E-Shop Script, and Auction Script allow remote attackers to execute arbitrary SQL commands via the (1) EmailAdd (Username) and (2) Pass (password) parameters. NOTE: some of these details are obtained from third party information.
unknown
2007-08-01
10.0CVE-2007-4121
BUGTRAQ
OTHER-REF
BID
SECUNIA
XF
Frank Yaul -- corehttpMultiple buffer overflows in the HttpSprockMake function in http.c in Frank Yaul corehttp 0.5.3alpha allow remote attackers to execute arbitrary code via a long string in the (1) method name or (2) URI in an HTTP request.
unknown
2007-07-30
9.0CVE-2007-4060
MILW0RM
BID
HP -- HP-UXUnspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport functionality in HP-UX B.11.11, B.11.23, and B.11.31 allows remote attackers to cause an unspecified denial of service via unknown vectors.
unknown
2007-08-01
7.1CVE-2007-4125
HP
SECTRACK
SECUNIA
iDevspot -- PHPHostBotPHP remote file inclusion vulnerability in library/authorize.php in IDevSpot PhpHostBot allows remote attackers to execute arbitrary PHP code via a URL in the login_form parameter, a different vector than CVE-2006-3776.
unknown
2007-07-30
7.5CVE-2007-4094
BUGTRAQ
OTHER-REF
Index Script -- Index ScriptSQL injection vulnerability in show_cat.php in IndexScript 2.8 and earlier allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
unknown
2007-07-30
7.5CVE-2007-4069
MILW0RM
BID
XF
Jelsoft -- vBulletin** DISPUTED ** Multiple PHP remote file inclusion vulnerabilities in Jelsoft vBulletin 3.6.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) classfile parameter to includes/functions.php, the (2) nextitem parameter to includes/functions_cron.php, and the (3) specialtemplates parameter to includes/functions_forumdisplay.php. NOTE: this issue is disputed by a reliable third party who states "further investigation has revealed that the application is not vulnerable to this issue." The original researcher also has a history of erroneous claims.
unknown
2007-08-01
9.3CVE-2007-4120
BUGTRAQ
BID
Jx Development -- phpvoterPHP remote file inclusion vulnerability in includes/functions.inc.php in phpVoter 0.6 allows remote attackers to execute arbitrary PHP code via a URL in the sitepath parameter.
unknown
2007-08-01
7.5CVE-2007-4118
BUGTRAQ
Minb -- Minb Is Not a BlogMinb Is Not a Blog (minb) stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing usernames and encrypted passwords via a direct request for db/users.db.
unknown
2007-07-30
7.8CVE-2007-4093
BUGTRAQ
XF
Nessus -- Vulnerability ScannerDirectory traversal vulnerability in a certain ActiveX control in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to delete arbitrary files via a .. (dot dot) in the argument to the deleteReport method.
unknown
2007-07-27
7.8CVE-2007-4031
MILW0RM
Nessus -- Vulnerability ScannerDirectory traversal vulnerability in a certain ActiveX control in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the argument to the saveNessusRC method, which writes text specified by the addsetConfig method, possibly related to the SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll. NOTE: this can be leveraged for code execution by writing to a Startup folder.
unknown
2007-07-30
9.3CVE-2007-4061
MILW0RM
OTHER-REF
SECUNIA
XF
Nessus -- Vulnerability ScannerThe SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to delete arbitrary files via unspecified vectors involving the deleteNessusRC method, probably a directory traversal vulnerability.
unknown
2007-07-30
7.8CVE-2007-4062
OTHER-REF
SECUNIA
XF
phpMyForum -- phpMyForumSQL injection vulnerability in editpost.php in phpMyForum before 4.1.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: some of these details are obtained from third party information.
unknown
2007-07-31
7.5CVE-2007-4107
OTHER-REF
OTHER-REF
BID
FRSIRT
SECUNIA
SuskunDuygular -- SuskunDuygular Uyelik SistemiMultiple SQL injection vulnerabilities in unuttum.asp in SuskunDuygular Uyelik Sistemi 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) kadi or (2) email parameter. NOTE: some of these details are obtained from third party information.
unknown
2007-07-31
7.5CVE-2007-4114
BUGTRAQ
BID
SECUNIA

Back to top

Medium Vulnerabilities
Primary
Vendor -- Product
Description
Discovered
Published
CVSS ScoreSource & Patch Info
Advanced Webhost Billing System -- Advanced Webhost Billing SystemMultiple SQL injection vulnerabilities in Advanced Webhost Billing System (AWBS) before 2.6.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be leveraged for XSS attacks that "bypass AWBS's anti-XSS input validation."
unknown
2007-07-31
6.8CVE-2007-4112
OTHER-REF
BID
SECUNIA
AlstraSoft -- Video Share EnterpriseMultiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to inject arbitrary web script or HTML via the (1) msg, (2) page, (3) viewkey, or (4) viewtype parameter to (a) view_video.php; the (5) next parameter to (b) signup.php; the (6) search_id parameter to (c) search_result.php; the (7) category or (8) page parameter to (d) video.php; the (9) receiver parameter to (e) compose.php; the (10) catgy parameter to (f) groups.php; the (11) channelname parameter to (g) siteadmin/channels.php; or the (12) uname parameter to (h) siteadmin/muser.php.
unknown
2007-07-30
4.3CVE-2007-4077
OTHER-REF
AlstraSoft -- Text Ads EnterpriseMultiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Text Ads Enterprise allow remote attackers to inject arbitrary web script or HTML via the (1) r parameter to (a) forgot_uid.php, the (2) query or (3) sk parameter to (b) search_results.php, or (4) the pageId parameter to (c) website_page.php.
unknown
2007-07-30
4.3CVE-2007-4078
OTHER-REF
BID
AlstraSoft -- SMS Text Messaging EnterpriseMultiple cross-site scripting (XSS) vulnerabilities in AlstraSoft SMS Text Messaging Enterprise allow remote attackers to inject arbitrary web script or HTML via the (1) domain or (2) q parameter to (a) admin/membersearch.php, or (3) the userid parameter to (b) admin/edituser.php.
unknown
2007-07-30
4.3CVE-2007-4079
OTHER-REF
BID
AlstraSoft -- E-FriendsCross-site scripting (XSS) vulnerability in index.php AlstraSoft E-Friends allows remote attackers to inject arbitrary web script or HTML via the p_id parameter in a people_card action. NOTE: this might overlap CVE-2006-2564.
unknown
2007-07-30
6.4CVE-2007-4080
OTHER-REF
AlstraSoft -- Affiliate Network ProMultiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to inject arbitrary web script or HTML via vectors in (a) merchants/index.php, including the (1) id or (2) msg parameter in a programedit action; the (3) pgmid parameter in an uploadProducts action; the (4) d, (5) m, or (6) y parameter in a daily action; the (7) err parameter in a ProgramReport action; the (8) i, (9) txtto, (10) txtfrom, or (11) programs parameter in a LinkReport action; or the (12) msg parameter in an add_money action; and one vector in (b) merchants/temp.php using (13) the rowid parameter. NOTE: vector 7 might overlap CVE-2005-3795.1.
unknown
2007-07-30
4.3CVE-2007-4081
OTHER-REF
BID
AlstraSoft -- Article Manager ProCross-site scripting (XSS) vulnerability in contact_author.php AlstraSoft Article Manager Pro allows remote attackers to inject arbitrary web script or HTML via the userid parameter.
unknown
2007-07-30
4.3CVE-2007-4082
OTHER-REF
AlstraSoft -- AskMe ProMultiple cross-site scripting (XSS) vulnerabilities in AlstraSoft AskMe Pro allow remote attackers to inject arbitrary web script or HTML via (1) the cat_id parameter to search.php or the (2) typ parameter to register.php.
unknown
2007-07-30
4.3CVE-2007-4083
OTHER-REF
AlstraSoft -- AskMe ProMultiple SQL injection vulnerabilities in AlstraSoft AskMe Pro allow remote attackers to execute arbitrary SQL commands via the (1) que_id parameter to forum_answer.php or (2) the cat_id parameter to search.php.
unknown
2007-07-30
6.8CVE-2007-4085
OTHER-REF
AlstraSoft -- Video Share EnterpriseMultiple SQL injection vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to execute arbitrary SQL commands via (1) the gid parameter to gmembers.php, or (2) the UID parameter to (a) uvideos.php, (b) ugroups.php, (c) uprofile.php, (d) ufavour.php, (e) ufriends.php, or (f) uplaylist.php.
unknown
2007-07-30
6.8CVE-2007-4086
OTHER-REF
AlstraSoft -- Video Share EnterpriseAlstraSoft Video Share Enterprise allows remote attackers to obtain sensitive information (the full path) via (1) a ' (quote) character in the category parameter to view_video.php, or (2) an XSS sequence in the UID parameter to (a) uprofile.php, (b) channel_detail.php, (c) uvideos.php, (d) groups_home.php, or (e) ufriends.php.
unknown
2007-07-30
4.3CVE-2007-4087
OTHER-REF
Apple -- CFNetworkCFNetwork on Apple Mac OS X 10.3.9 and 10.4.10 does not properly validate ftp: URIs, which allows remote attackers to trigger the transmission of arbitrary FTP commands to arbitrary FTP servers.
unknown
2007-08-03
6.8CVE-2007-2403
OTHER-REF
APPLE
BID
FRSIRT
SECTRACK
SECUNIA
Apple -- Mac OS X Server
Apple -- Mac OS X
CRLF injection vulnerability in CFNetwork on Apple Mac OS X 10.3.9 and 10.4.10 before 20070731 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in an unspecified context. NOTE: this can be leveraged for cross-site scripting (XSS) attacks.
unknown
2007-08-03
5.0CVE-2007-2404
OTHER-REF
APPLE
BID
FRSIRT
SECTRACK
SECUNIA
Apple -- PDFKitInteger underflow in Preview in PDFKit on Apple Mac OS X 10.4.10 allows remote attackers to execute arbitrary code via a crafted PDF file.
unknown
2007-08-03
6.8CVE-2007-2405
OTHER-REF
APPLE
BID
FRSIRT
SECUNIA
Apple -- Quartz ComposerQuartz Composer on Apple Mac OS X 10.4.10 does not initialize a certain object pointer, which might allow user-assisted remote attackers to execute arbitrary code via a crafted Quartz Composer file.
unknown
2007-08-03
6.8CVE-2007-2406
OTHER-REF
APPLE
BID
FRSIRT
SECUNIA
Apple -- WebCoreCross-domain vulnerability in WebCore on Apple Mac OS X 10.3.9 and 10.4.10 allows remote attackers to obtain sensitive information via a popup window, which is able to read the current URL of the parent window.
unknown
2007-08-03
4.3CVE-2007-2409
OTHER-REF
APPLE
BID
FRSIRT
SECTRACK
SECUNIA
Apple -- WebCoreWebCore on Apple Mac OS X 10.3.9 and 10.4.10 retains properties of certain global objects when a new URL is visited in the same window, which allows remote attackers to conduct cross-site scripting (XSS) attacks.
unknown
2007-08-03
4.3CVE-2007-2410
OTHER-REF
APPLE
BID
FRSIRT
SECTRACK
SECUNIA
Apple -- Mac OS X Server
Apple -- Mac OS X
Buffer overflow in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) implementation in mDNSResponder on Apple Mac OS X 10.4.10 before 20070731 allows network-adjacent remote attackers to execute arbitrary code via a crafted packet.
unknown
2007-08-03
5.8CVE-2007-3744
OTHER-REF
APPLE
BID
FRSIRT
SECUNIA
Apple -- CoreAudioThe Java interface to CoreAudio on Apple Mac OS X 10.3.9 and 10.4.10 contains an unsafe interface that is exposed by JDirect, which allows remote attackers to free arbitrary memory and thereby execute arbitrary code.
unknown
2007-08-03
6.8CVE-2007-3745
OTHER-REF
APPLE
BID
FRSIRT
SECTRACK
SECUNIA
Apple -- iChatThe Java interface to CoreAudio on Apple Mac OS X 10.3.9 and 10.4.10 does not properly check the bounds of heap read and write operations, which allows remote attackers to execute arbitrary code via a crafted applet.
unknown
2007-08-03
6.8CVE-2007-3746
OTHER-REF
APPLE
BID
FRSIRT
SECTRACK
SECUNIA
Apple -- iChatThe Java interface to CoreAudio on Apple Mac OS X 10.3.9 and 10.4.10 does not restrict object instantiation and manipulation to valid heap addresses, which allows remote attackers to execute arbitrary code via a crafted applet.
unknown
2007-08-03
6.8CVE-2007-3747
OTHER-REF
APPLE
BID
FRSIRT
SECTRACK
SECUNIA
Apple -- iChatBuffer overflow in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) implementation in iChat on Apple Mac OS X 10.3.9 and 10.4.10 allows network-adjacent remote attackers to execute arbitrary code via a crafted packet.
unknown
2007-08-03
5.4CVE-2007-3748
OTHER-REF
APPLE
BID
FRSIRT
SECTRACK
SECUNIA
ASP Indir -- Alisveris Sitesi ScriptCross-site scripting (XSS) vulnerability in index.asp in Alisveris Sitesi Scripti allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search mod action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
unknown
2007-07-30
4.3CVE-2007-4075
BID
CodeWidgets -- Pay Roll - Time Sheet
CodeWidgets -- Punch Card
SQL injection vulnerability in login.asp in CodeWidgets Pay Roll - Time Sheet and Punch Card Application With Web Interface allows remote attackers to execute arbitrary SQL commands via the Password parameter.
unknown
2007-07-31
6.8CVE-2007-4106
BUGTRAQ
OTHER-REF
BID
SECUNIA
CodeWidgets -- Real Estate listing website application templateSQL injection vulnerability in the login script in Real Estate listing website application template, when logging in as user or manager, allows remote attackers to execute arbitrary SQL commands via the Password parameter.
unknown
2007-07-31
6.8CVE-2007-4111
BUGTRAQ
OTHER-REF
BID
SECUNIA
Drupal -- DrupalMultiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.2 allow remote attackers to (1) delete comments, (2) delete content revisions, and (3) disable menu items as privileged users, related to improper use of HTTP GET and the Forms API.
unknown
2007-07-30
4.3CVE-2007-4063
OTHER-REF
BID
FRSIRT
SECUNIA
XF
Drupal -- DrupalMultiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, (1) allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHP_SELF; and (2) allow remote authenticated administrators to inject arbitrary web script or HTML via custom content type names.
unknown
2007-07-30
4.3CVE-2007-4064
OTHER-REF
FRSIRT
SECUNIA
XF
XF
EMC -- VMwareAbsolute path traversal vulnerability in a certain ActiveX control in vielib.dll 2.2.5.42958 in EMC VMware 6.0.0 allows remote attackers to execute arbitrary local programs via a full pathname in the first argument to the StartProcess method.
unknown
2007-07-30
4.3CVE-2007-4058
MILW0RM
BID
Firestorm Technologies -- GMapsSQL injection vulnerability in index.php in the Firestorm Technologies GMaps (com_gmaps) 1.00 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the mapId parameter in a viewmap action.
unknown
2007-08-01
6.8CVE-2007-4128
MILW0RM
BID
Global Centre -- Aplomb PollMultiple PHP remote file inclusion vulnerabilities in Madoa Poll 1.1 allow remote attackers to execute arbitrary PHP code via the Madoa parameter to (1) index.php, (2) vote.php, and (3) admin.php.
unknown
2007-07-31
6.8CVE-2007-4101
BUGTRAQ
VIM
BID
GNOME -- GPdfInteger overflow in gpdf before 2.8.2 might allow remote attackers to execute arbitrary code via a crafted PDF file.
unknown
2007-07-30
6.8CVE-2007-3387
REDHAT
Hitachi -- JP1-CM2-Hierarchical ViewerUnspecified vulnerability in Hitachi JP1/Cm2/Hierarchical Viewer (HV) 06-00 through 06-71-/B allows remote attackers to cause a denial of service (application stop and web interface outage) via certain "unexpected data."
unknown
2007-08-01
4.3CVE-2007-4122
OTHER-REF
FRSIRT
SECUNIA
Hitachi -- Groupmax Groupware ServerThe Groupmax Scheduler_Facilities management tool in Hitachi Groupmax Groupware Server 07-00-/F through 07-32-/A before 20070731 does not properly manage schedule server configuration data, which might allow attackers to obtain sensitive information via unspecified vectors.
unknown
2007-08-01
5.0CVE-2007-4123
OTHER-REF
FRSIRT
Hitachi -- uCosminexus Service Platform
Hitachi -- uCosminexus ERP Integrator
Hitachi -- uCosminexus Application Server
Hitachi -- Electronic Form Workflow
Hitachi -- uCosminexus OpenTP1 Web Front-end Set
Hitachi -- uCosminexus Collaboration Portal
Hitachi -- uCosminexus Developer
Hitachi -- Cosminexus OpenTP1 Web Front-end Set
Hitachi -- uCosminexus Service Architect
Hitachi -- Groupmax Collaboration Portal
Hitachi -- Cosminexus Developer
Hitachi -- Cosminexus Collaboration Portal
Hitachi -- Cosminexus ERP Integrator
Hitachi -- Cosminexus Application Server
The session failover function in Cosminexus Component Container in Cosminexus 6, 6.7, and 7 before 20070731, as used in multiple Hitachi products, can use session data for the wrong user under unspecified conditions, which might allow remote authenticated users to obtain sensitive information, corrupt another user's session data, and possibly gain privileges.
unknown
2007-08-01
4.9CVE-2007-4124
OTHER-REF
FRSIRT
SECUNIA
iFoto -- iFotoDirectory traversal vulnerability in index.php in iFoto 1.0.1 and earlier allows remote attackers to list arbitrary directories, and possibly download arbitrary photos, via a .. (dot dot) in the dir parameter.
unknown
2007-07-30
5.0CVE-2007-4092
OTHER-REF
BID
SECUNIA
ITCMS -- ITCMSMultiple cross-site scripting (XSS) vulnerabilities in IT!CMS (itcms) 0.2 allow remote attackers to inject arbitrary web script or HTML via the wndtitle parameter to (1) lang-en.php, (2) menu-ed.php, or (3) titletext-ed.php.
unknown
2007-07-31
4.3CVE-2007-4115
BUGTRAQ
Le Ralf -- Ralf Image Gallery** DISPUTED ** PHP remote file inclusion vulnerability in check_entry.php in Ralf Image Gallery (RIG), aka Raphael Moll RIG Image Gallery, 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the dir_abs_src parameter. NOTE: this issue is disputed by multiple third parties, who report that the product exits if register_globals is enabled, thereby blocking exploitation. NOTE: CVE-2006-3210.a covers this issue in versions before 1.0.
unknown
2007-08-01
6.8CVE-2007-4127
BUGTRAQ
VIM
VIM
VIM
VIM
LFS -- Live for speed S2Buffer overflow in Live for Speed (LFS) S2 ALPHA PATCH 0.5x allows user-assisted remote attackers to execute arbitrary code via a .mpr file (replay file) that contains a long car name.
unknown
2007-08-03
6.8CVE-2007-4140
MILW0RM
XF
Metyus -- Forum PortalSQL injection vulnerability in philboard_forum.asp in Metyus Forum Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the forumid parameter. NOTE: this might be related to CVE-2007-0920 or CVE-2007-3884.
unknown
2007-07-31
6.8CVE-2007-4116
BUGTRAQ
BID
SECUNIA
Mldonkey -- MldonkeyMLDonkey before 2.9.0 does not load certain code from $MLDONKEY/web_infos/ before the network modules become active, which allows remote attackers to bypass the IP blocklist.
unknown
2007-07-31
5.0CVE-2007-4100
OTHER-REF
BID
SECUNIA
XF
Neocrome -- SeditioUnrestricted file upload vulnerability in pfs.php in Neocrome Seditio 121 and earlier allows remote authenticated users to upload arbitrary PHP code via a filename ending with (1) .php.gif, (2) .php.jpg, or (3) .php.png.
unknown
2007-07-30
6.5CVE-2007-4057
MILW0RM
OpenRat -- OpenRat CMSOpenRat CMS 0.8-beta1 and earlier allows remote attackers to obtain sensitive information via a request containing an XSS sequence in the action parameter to index.php, which reveals the path in an error message.
unknown
2007-08-03
4.3CVE-2007-4141
OTHER-REF
Platon -- phpwebfilemanager** DISPUTED ** PHP remote file inclusion vulnerability in index.php in phpWebFileManager 0.5 allows remote attackers to execute arbitrary PHP code via a URL in the PN_PathPrefix parameter. NOTE: this issue is disputed by a reliable third party, who demonstrates that PN_PathPrefix is defined before use.
unknown
2007-08-01
6.8CVE-2007-4117
BUGTRAQ
VIM
Samba -- Samba ServerThe Samba server on Apple Mac OS X 10.3.9 and 10.4.10, when Windows file sharing is enabled, does not enforce disk quotas after dropping privileges, which allows remote authenticated users to use disk space in excess of quota.
unknown
2007-08-03
4.0CVE-2007-2407
OTHER-REF
APPLE
BID
FRSIRT
SECUNIA
sBLOG -- sBLOGCross-site scripting (XSS) vulnerability in search.php for sBlog 0.7.3 Beta allows remote attackers to inject arbitrary HTML and web script via a leading '"/> sequence in the search string.
unknown
2007-07-31
4.3CVE-2007-4102
BUGTRAQ
BID
XF
Sun -- SolarisUnspecified vulnerability in Low Bandwidth X proxy (lbxproxy) on Sun Solaris 8 through 10 before 20070725 allows local users to read arbitrary files with root group ownership via unknown vectors.
unknown
2007-07-30
4.9CVE-2007-4070
SUNALERT
BID
FRSIRT
SECUNIA
tincan -- Webbler CMSMultiple cross-site scripting (XSS) vulnerabilities in uploader/index.php in Webbler CMS before 3.1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) login parameter.
unknown
2007-07-30
4.3CVE-2007-4071
BUGTRAQ
BUGTRAQ
OTHER-REF
OTHER-REF
tincan -- Webbler CMSWebbler CMS before 3.1.6 provides the full installation path within HTML comments in certain documents, which allows remote attackers to obtain sensitive information by viewing the HTML source, as demonstrated by viewing the source generated from index.php.
unknown
2007-07-30
5.0CVE-2007-4072
BUGTRAQ
OTHER-REF
OTHER-REF
tincan -- Webbler CMSWebbler CMS before 3.1.6 does not properly restrict use of "mail a friend" forms, which allows remote attackers to send arbitrary amounts of forged e-mail. NOTE: this could be leveraged for spam or phishing attacks.
unknown
2007-07-30
5.0CVE-2007-4073
BUGTRAQ
OTHER-REF
OTHER-REF
Tor -- TorBuffer overflow in Tor before 0.1.2.15, when using BSD natd support, allows remote attackers to cause a denial of service via unspecified vectors.
unknown
2007-07-30
5.8CVE-2007-4096
MLIST
BID
FRSIRT
SECUNIA
Tor -- TorTor before 0.1.2.15 sends "destroy cells" containing the reason for tearing down a circuit, which allows remote attackers to obtain sensitive information, contrary to specifications.
unknown
2007-07-30
6.4CVE-2007-4097
MLIST
BID
FRSIRT
SECUNIA
Tor -- TorTor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might allow remote attackers with control over Tor routers to inject cells into arbitrary streams.
unknown
2007-07-30
5.8CVE-2007-4098
MLIST
BID
FRSIRT
SECUNIA
Tor -- TorTor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.
unknown
2007-07-30
5.8CVE-2007-4099
MLIST
BID
FRSIRT
SECUNIA
Vikingboard -- VikingboardMultiple cross-site scripting (XSS) vulnerabilities in Vikingboard 0.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) id, (2) f, (3) quote, and (4) act parameters to cp.php; the (5) u parameter to user.php; the (6) f parameter to post.php; the (7) s parameter to topic.php; the (8) quote, (9) t, (10) poll, and (11) p parameters to post.php; the (12) Message Title field of a private message (PM) in mode 6 of cp.php; the (13) title field of a private message (PM) in mode 7 of cp.php; and (14) allow user-assisted remote attackers to inject arbitrary web script or HTML via a dosearch action to search.php, which reflects the first lines of all posts by a user. NOTE: the act parameter to help.php and the p parameter to report.php are already covered by CVE-2006-4708. NOTE: vectors 12 and 13 might overlap CVE-2006-6283.1. NOTE: vector 14 might overlap CVE-2006-4708.b.
unknown
2007-07-30
4.3CVE-2007-4088
OTHER-REF
OTHER-REF
BID
SECUNIA
XF
Vikingboard -- VikingboardVikingboard 0.1.2 allows remote attackers to obtain sensitive information via the debug parameter to (1) forum.php, (2) cp.php, and possibly other unspecified components.
unknown
2007-07-30
4.3CVE-2007-4089
OTHER-REF
OTHER-REF
OTHER-REF
SECUNIA
XF
Vikingboard -- VikingboardMultiple cross-site scripting (XSS) vulnerabilities in Vikingboard 0.1.2 allow remote attackers to inject arbitrary web script or HTML via (1) the URI to inc/lib/screen.php or (2) the title parameter to post.php. NOTE: vector 2 might overlap CVE-2006-6283. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
unknown
2007-07-30
4.3CVE-2007-4090
OTHER-REF
SECUNIA
VIM Development Group -- VIMFormat string vulnerability in the helptags_one function in src/ex_cmds.c in Vim 6.4 and earlier, and 7.x up to 7.1, allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a help-tags tag in a help file, related to the helptags command.
unknown
2007-07-31
6.8CVE-2007-2953
OTHER-REF
OTHER-REF
BID
FRSIRT
SECUNIA
XF
VMWare -- VMWare WorkstationAbsolute path traversal vulnerability in a certain ActiveX control in IntraProcessLogging.dll 5.5.3.42958 in EMC VMware allows remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the SetLogFileName method.
unknown
2007-07-30
5.8CVE-2007-4059
MILW0RM
BID
Webyapar -- WebyaparMultiple SQL injection vulnerabilities in Webyapar 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the kat_id parameter to the default URI in a download action or (2) the id parameter to the default URI in a duyurular_detay action.
unknown
2007-07-30
5.8CVE-2007-4068
MILW0RM
BID
WordPress -- WordPressCross-site scripting (XSS) vulnerability in the Temporary Uploads editing functionality (wp-admin/includes/upload.php) in WordPress 2.2.1, allows remote attackers to inject arbitrary web script or HTML via the style parameter to wp-admin/upload.php.
unknown
2007-08-03
4.3CVE-2007-4139
OTHER-REF
OTHER-REF
OTHER-REF
FRSIRT
SECUNIA
XF
WP-FeedStats -- WordPress pluginMultiple cross-site scripting (XSS) vulnerabilities in the WP-FeedStats before 2.4 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, one of which involves an rss2 feed with an invalid or missing blog with an XSS sequence in the query string.
unknown
2007-07-31
4.3CVE-2007-4104
FULLDISC
OTHER-REF
OTHER-REF
OTHER-REF
BID
SECUNIA
XF

Back to top

Low Vulnerabilities
Primary
Vendor -- Product
Description
Discovered
Published
CVSS ScoreSource & Patch Info
Advanced Webhost Billing System -- Advanced Webhost Billing SystemUnspecified vulnerability in Advanced Webhost Billing System (AWBS) before 2.6.0 allows remote authenticated users to obtain configuration data about other dedicated servers via unspecified vectors.
unknown
2007-07-31
3.5CVE-2007-4113
OTHER-REF
BID
SECUNIA
Sun -- SolarisUnspecified vulnerability in the dynamic tracing framework (DTrace) on Sun Solaris 10 before 20070730 allows local users with PRIV_DTRACE_USER privileges to cause a denial of service (panic or hang) via unspecified use of certain DTrace programs.
unknown
2007-08-01
1.5CVE-2007-4126
SUNALERT
SECTRACK
SECUNIA

Back to top

">

High Vulnerabilities
Primary
Vendor -- Product
Description
Discovered
Published
CVSS ScoreSource & Patch Info
Adult Directory -- Adult DirectorySQL injection vulnerability in directory.php in Adult Directory allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action. NOTE: This might be related to Maan Bsat Photo Collection. NOTE: this might be a site-specific issue, so perhaps this should not be included in CVE.
unknown
2007-07-30
7.5CVE-2007-4056
MILW0RM
VIM
FRSIRT
AlstraSoft -- Affiliate Network ProMultiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to execute arbitrary SQL commands via (1) the pgmid parameter in an uploadProducts action to merchants/index.php and possibly (2) the rowid parameter to merchants/temp.php.
unknown
2007-07-30
7.5CVE-2007-4084
OTHER-REF
BID
ASP Indir -- Alisveris Sitesi ScriptMultiple SQL injection vulnerabilities in index.asp in Alisveris Sitesi Scripti allow remote attackers to execute arbitrary SQL commands via the (1) product_id or (2) cat_id parameter in a product mod action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
unknown
2007-07-30
7.5CVE-2007-4076
BID
Baidu -- Soba Search BarA certain ActiveX control in BaiduBar.dll in Baidu Soba Search Bar 5.4 allows remote attackers to execute arbitrary code via a request containing "a link to download and a file to execute," possibly involving remote file inclusion.
unknown
2007-07-31
9.3CVE-2007-4105
OTHER-REF
FRSIRT
SECUNIA
Berthanas Ziyaretci -- DefteriMultiple SQL injection vulnerabilities in yonetici.asp in Berthanas Ziyaretci Defteri 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) user and (2) Pass fields.
unknown
2007-08-01
7.5CVE-2007-4119
BUGTRAQ
BID
XF
BSM Store -- Dependent ForumsSQL injection vulnerability in BSM Store Dependent Forums 1.02 allows remote attackers to execute arbitrary SQL commands via the Username parameter to an unspecified component.
unknown
2007-07-30
7.5CVE-2007-4095
BUGTRAQ
BID
Centre for Speech Technology Research -- Gentoo LinuxThe default configuration of Centre for Speech Technology Research (CSTR) Festival 1.95 beta (aka 2.0 beta) is run locally with elevated privileges without requiring authentication, which allows context-dependent attackers to execute arbitrary commands via the local daemon on port 1314, a different vulnerability than CVE-2001-0956.
unknown
2007-07-30
7.2CVE-2007-4074
OTHER-REF
GENTOO
BID
SECUNIA
Clever Components -- Internet ActiveX SuiteAbsolute path traversal vulnerability in the clInetSuiteX6.clWebDav ActiveX control in CLINETSUITEX6.OCX in Clever Internet ActiveX Suite 6.2 allows remote attackers to create or overwrite arbitrary files via a full pathname in the second argument to the GetToFile method. NOTE: some of these details are obtained from third party information.
unknown
2007-07-30
9.3CVE-2007-4067
MILW0RM
VIM
BID
FRSIRT
SECUNIA
XF
CodeWidgets -- Online Event Registration TemplateSQL injection vulnerability in sign_in.aspx in WebEvents (Online Event Registration Template) allows remote attackers to execute arbitrary SQL commands via the Password parameter.
unknown
2007-07-31
7.5CVE-2007-4108
BUGTRAQ
BUGTRAQ
OTHER-REF
BID
SECUNIA
CodeWidgets -- Online Event Registration TemplateSQL injection vulnerability in sign_in.aspx in WebStore (Online Store Application Template) allows remote attackers to execute arbitrary SQL commands via the Password parameter.
unknown
2007-07-31
7.5CVE-2007-4109
BUGTRAQ
OTHER-REF
BID
SECUNIA
CodeWidgets -- Threaded Discussion Forum ApplicationSQL injection vulnerability in sign_in.aspx in Message Board / Threaded Discussion Forum Application Template allows remote attackers to execute arbitrary SQL commands via the Password parameter.
unknown
2007-07-31
7.5CVE-2007-4110
BUGTRAQ
OTHER-REF
BID
Digium -- Asterisk
Digium -- Asterisk Appliance Developer Kit
Digium -- AsteriskNOW pre-release
The IAX2 channel driver (chan_iax2) in Asterisk Open 1.2.x before 1.2.23, 1.4.x before 1.4.9, and Asterisk Appliance Developer Kit before 0.6.0, when configured to allow unauthenticated calls, allows remote attackers to cause a denial of service (resource exhaustion) via a flood of calls that do not complete a 3-way handshake, which causes an ast_channel to be allocated but not released.
unknown
2007-07-31
7.8CVE-2007-4103
BUGTRAQ
OTHER-REF
FRSIRT
SECTRACK
SECUNIA
E-Commerce Solutions -- Multi-Vendor E-Shop Script
E-Commerce Solutions -- Auction Script
E-Commerce Solutions -- Shopping Cart Script
Multiple SQL injection vulnerabilities in admin.aspx in E-Commerce Scripts Shopping Cart Script, Multi-Vendor E-Shop Script, and Auction Script allow remote attackers to execute arbitrary SQL commands via the (1) EmailAdd (Username) and (2) Pass (password) parameters. NOTE: some of these details are obtained from third party information.
unknown
2007-08-01
10.0CVE-2007-4121
BUGTRAQ
OTHER-REF
BID
SECUNIA
XF
Frank Yaul -- corehttpMultiple buffer overflows in the HttpSprockMake function in http.c in Frank Yaul corehttp 0.5.3alpha allow remote attackers to execute arbitrary code via a long string in the (1) method name or (2) URI in an HTTP request.
unknown
2007-07-30
9.0CVE-2007-4060
MILW0RM
BID
HP -- HP-UXUnspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport functionality in HP-UX B.11.11, B.11.23, and B.11.31 allows remote attackers to cause an unspecified denial of service via unknown vectors.
unknown
2007-08-01
7.1CVE-2007-4125
HP
SECTRACK
SECUNIA
iDevspot -- PHPHostBotPHP remote file inclusion vulnerability in library/authorize.php in IDevSpot PhpHostBot allows remote attackers to execute arbitrary PHP code via a URL in the login_form parameter, a different vector than CVE-2006-3776.
unknown
2007-07-30
7.5CVE-2007-4094
BUGTRAQ
OTHER-REF
Index Script -- Index ScriptSQL injection vulnerability in show_cat.php in IndexScript 2.8 and earlier allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
unknown
2007-07-30
7.5CVE-2007-4069
MILW0RM
BID
XF
Jelsoft -- vBulletin** DISPUTED ** Multiple PHP remote file inclusion vulnerabilities in Jelsoft vBulletin 3.6.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) classfile parameter to includes/functions.php, the (2) nextitem parameter to includes/functions_cron.php, and the (3) specialtemplates parameter to includes/functions_forumdisplay.php. NOTE: this issue is disputed by a reliable third party who states "further investigation has revealed that the application is not vulnerable to this issue." The original researcher also has a history of erroneous claims.
unknown
2007-08-01
9.3CVE-2007-4120
BUGTRAQ
BID
Jx Development -- phpvoterPHP remote file inclusion vulnerability in includes/functions.inc.php in phpVoter 0.6 allows remote attackers to execute arbitrary PHP code via a URL in the sitepath parameter.
unknown
2007-08-01
7.5CVE-2007-4118
BUGTRAQ
Minb -- Minb Is Not a BlogMinb Is Not a Blog (minb) stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing usernames and encrypted passwords via a direct request for db/users.db.
unknown
2007-07-30
7.8CVE-2007-4093
BUGTRAQ
XF
Nessus -- Vulnerability ScannerDirectory traversal vulnerability in a certain ActiveX control in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to delete arbitrary files via a .. (dot dot) in the argument to the deleteReport method.
unknown
2007-07-27
7.8CVE-2007-4031
MILW0RM
Nessus -- Vulnerability ScannerDirectory traversal vulnerability in a certain ActiveX control in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the argument to the saveNessusRC method, which writes text specified by the addsetConfig method, possibly related to the SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll. NOTE: this can be leveraged for code execution by writing to a Startup folder.
unknown
2007-07-30
9.3CVE-2007-4061
MILW0RM
OTHER-REF
SECUNIA
XF
Nessus -- Vulnerability ScannerThe SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to delete arbitrary files via unspecified vectors involving the deleteNessusRC method, probably a directory traversal vulnerability.
unknown
2007-07-30
7.8CVE-2007-4062
OTHER-REF
SECUNIA
XF
phpMyForum -- phpMyForumSQL injection vulnerability in editpost.php in phpMyForum before 4.1.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: some of these details are obtained from third party information.
unknown
2007-07-31
7.5CVE-2007-4107
OTHER-REF
OTHER-REF
BID
FRSIRT
SECUNIA
SuskunDuygular -- SuskunDuygular Uyelik SistemiMultiple SQL injection vulnerabilities in unuttum.asp in SuskunDuygular Uyelik Sistemi 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) kadi or (2) email parameter. NOTE: some of these details are obtained from third party information.
unknown
2007-07-31
7.5CVE-2007-4114
BUGTRAQ
BID
SECUNIA

Back to top

Medium Vulnerabilities
Primary
Vendor -- Product
Description
Discovered
Published
CVSS ScoreSource & Patch Info
Advanced Webhost Billing System -- Advanced Webhost Billing SystemMultiple SQL injection vulnerabilities in Advanced Webhost Billing System (AWBS) before 2.6.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be leveraged for XSS attacks that "bypass AWBS's anti-XSS input validation."
unknown
2007-07-31
6.8CVE-2007-4112
OTHER-REF
BID
SECUNIA
AlstraSoft -- Video Share EnterpriseMultiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to inject arbitrary web script or HTML via the (1) msg, (2) page, (3) viewkey, or (4) viewtype parameter to (a) view_video.php; the (5) next parameter to (b) signup.php; the (6) search_id parameter to (c) search_result.php; the (7) category or (8) page parameter to (d) video.php; the (9) receiver parameter to (e) compose.php; the (10) catgy parameter to (f) groups.php; the (11) channelname parameter to (g) siteadmin/channels.php; or the (12) uname parameter to (h) siteadmin/muser.php.
unknown
2007-07-30
4.3CVE-2007-4077
OTHER-REF
AlstraSoft -- Text Ads EnterpriseMultiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Text Ads Enterprise allow remote attackers to inject arbitrary web script or HTML via the (1) r parameter to (a) forgot_uid.php, the (2) query or (3) sk parameter to (b) search_results.php, or (4) the pageId parameter to (c) website_page.php.
unknown
2007-07-30
4.3CVE-2007-4078
OTHER-REF
BID
AlstraSoft -- SMS Text Messaging EnterpriseMultiple cross-site scripting (XSS) vulnerabilities in AlstraSoft SMS Text Messaging Enterprise allow remote attackers to inject arbitrary web script or HTML via the (1) domain or (2) q parameter to (a) admin/membersearch.php, or (3) the userid parameter to (b) admin/edituser.php.
unknown
2007-07-30
4.3CVE-2007-4079
OTHER-REF
BID
AlstraSoft -- E-FriendsCross-site scripting (XSS) vulnerability in index.php AlstraSoft E-Friends allows remote attackers to inject arbitrary web script or HTML via the p_id parameter in a people_card action. NOTE: this might overlap CVE-2006-2564.
unknown
2007-07-30
6.4CVE-2007-4080
OTHER-REF
AlstraSoft -- Affiliate Network ProMultiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to inject arbitrary web script or HTML via vectors in (a) merchants/index.php, including the (1) id or (2) msg parameter in a programedit action; the (3) pgmid parameter in an uploadProducts action; the (4) d, (5) m, or (6) y parameter in a daily action; the (7) err parameter in a ProgramReport action; the (8) i, (9) txtto, (10) txtfrom, or (11) programs parameter in a LinkReport action; or the (12) msg parameter in an add_money action; and one vector in (b) merchants/temp.php using (13) the rowid parameter. NOTE: vector 7 might overlap CVE-2005-3795.1.
unknown
2007-07-30
4.3CVE-2007-4081
OTHER-REF
BID
AlstraSoft -- Article Manager ProCross-site scripting (XSS) vulnerability in contact_author.php AlstraSoft Article Manager Pro allows remote attackers to inject arbitrary web script or HTML via the userid parameter.
unknown
2007-07-30
4.3CVE-2007-4082
OTHER-REF
AlstraSoft -- AskMe ProMultiple cross-site scripting (XSS) vulnerabilities in AlstraSoft AskMe Pro allow remote attackers to inject arbitrary web script or HTML via (1) the cat_id parameter to search.php or the (2) typ parameter to register.php.
unknown
2007-07-30
4.3CVE-2007-4083
OTHER-REF
AlstraSoft -- AskMe ProMultiple SQL injection vulnerabilities in AlstraSoft AskMe Pro allow remote attackers to execute arbitrary SQL commands via the (1) que_id parameter to forum_answer.php or (2) the cat_id parameter to search.php.
unknown
2007-07-30
6.8CVE-2007-4085
OTHER-REF
AlstraSoft -- Video Share EnterpriseMultiple SQL injection vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to execute arbitrary SQL commands via (1) the gid parameter to gmembers.php, or (2) the UID parameter to (a) uvideos.php, (b) ugroups.php, (c) uprofile.php, (d) ufavour.php, (e) ufriends.php, or (f) uplaylist.php.
unknown
2007-07-30
6.8CVE-2007-4086
OTHER-REF
AlstraSoft -- Video Share EnterpriseAlstraSoft Video Share Enterprise allows remote attackers to obtain sensitive information (the full path) via (1) a ' (quote) character in the category parameter to view_video.php, or (2) an XSS sequence in the UID parameter to (a) uprofile.php, (b) channel_detail.php, (c) uvideos.php, (d) groups_home.php, or (e) ufriends.php.
unknown
2007-07-30
4.3CVE-2007-4087
OTHER-REF
Apple -- CFNetworkCFNetwork on Apple Mac OS X 10.3.9 and 10.4.10 does not properly validate ftp: URIs, which allows remote attackers to trigger the transmission of arbitrary FTP commands to arbitrary FTP servers.
unknown
2007-08-03
6.8CVE-2007-2403
OTHER-REF
APPLE
BID
FRSIRT
SECTRACK
SECUNIA
Apple -- Mac OS X Server
Apple -- Mac OS X
CRLF injection vulnerability in CFNetwork on Apple Mac OS X 10.3.9 and 10.4.10 before 20070731 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in an unspecified context. NOTE: this can be leveraged for cross-site scripting (XSS) attacks.
unknown
2007-08-03
5.0CVE-2007-2404
OTHER-REF
APPLE
BID
FRSIRT
SECTRACK
SECUNIA
Apple -- PDFKitInteger underflow in Preview in PDFKit on Apple Mac OS X 10.4.10 allows remote attackers to execute arbitrary code via a crafted PDF file.
unknown
2007-08-03
6.8CVE-2007-2405
OTHER-REF
APPLE
BID
FRSIRT
SECUNIA
Apple -- Quartz ComposerQuartz Composer on Apple Mac OS X 10.4.10 does not initialize a certain object pointer, which might allow user-assisted remote attackers to execute arbitrary code via a crafted Quartz Composer file.
unknown
2007-08-03
6.8CVE-2007-2406
OTHER-REF
APPLE
BID
FRSIRT
SECUNIA
Apple -- WebCoreCross-domain vulnerability in WebCore on Apple Mac OS X 10.3.9 and 10.4.10 allows remote attackers to obtain sensitive information via a popup window, which is able to read the current URL of the parent window.
unknown
2007-08-03
4.3CVE-2007-2409
OTHER-REF
APPLE
BID
FRSIRT
SECTRACK
SECUNIA
Apple -- WebCoreWebCore on Apple Mac OS X 10.3.9 and 10.4.10 retains properties of certain global objects when a new URL is visited in the same window, which allows remote attackers to conduct cross-site scripting (XSS) attacks.
unknown
2007-08-03
4.3CVE-2007-2410
OTHER-REF
APPLE
BID
FRSIRT
SECTRACK
SECUNIA
Apple -- Mac OS X Server
Apple -- Mac OS X
Buffer overflow in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) implementation in mDNSResponder on Apple Mac OS X 10.4.10 before 20070731 allows network-adjacent remote attackers to execute arbitrary code via a crafted packet.
unknown
2007-08-03
5.8CVE-2007-3744
OTHER-REF
APPLE
BID
FRSIRT
SECUNIA
Apple -- CoreAudioThe Java interface to CoreAudio on Apple Mac OS X 10.3.9 and 10.4.10 contains an unsafe interface that is exposed by JDirect, which allows remote attackers to free arbitrary memory and thereby execute arbitrary code.
unknown
2007-08-03
6.8CVE-2007-3745
OTHER-REF
APPLE
BID
FRSIRT
SECTRACK
SECUNIA
Apple -- iChatThe Java interface to CoreAudio on Apple Mac OS X 10.3.9 and 10.4.10 does not properly check the bounds of heap read and write operations, which allows remote attackers to execute arbitrary code via a crafted applet.
unknown
2007-08-03
6.8CVE-2007-3746
OTHER-REF
APPLE
BID
FRSIRT
SECTRACK
SECUNIA
Apple -- iChatThe Java interface to CoreAudio on Apple Mac OS X 10.3.9 and 10.4.10 does not restrict object instantiation and manipulation to valid heap addresses, which allows remote attackers to execute arbitrary code via a crafted applet.
unknown
2007-08-03
6.8CVE-2007-3747
OTHER-REF
APPLE
BID
FRSIRT
SECTRACK
SECUNIA
Apple -- iChatBuffer overflow in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) implementation in iChat on Apple Mac OS X 10.3.9 and 10.4.10 allows network-adjacent remote attackers to execute arbitrary code via a crafted packet.
unknown
2007-08-03
5.4CVE-2007-3748
OTHER-REF
APPLE
BID
FRSIRT
SECTRACK
SECUNIA
ASP Indir -- Alisveris Sitesi ScriptCross-site scripting (XSS) vulnerability in index.asp in Alisveris Sitesi Scripti allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search mod action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
unknown
2007-07-30
4.3CVE-2007-4075
BID
CodeWidgets -- Pay Roll - Time Sheet
CodeWidgets -- Punch Card
SQL injection vulnerability in login.asp in CodeWidgets Pay Roll - Time Sheet and Punch Card Application With Web Interface allows remote attackers to execute arbitrary SQL commands via the Password parameter.
unknown
2007-07-31
6.8CVE-2007-4106
BUGTRAQ
OTHER-REF
BID
SECUNIA
CodeWidgets -- Real Estate listing website application templateSQL injection vulnerability in the login script in Real Estate listing website application template, when logging in as user or manager, allows remote attackers to execute arbitrary SQL commands via the Password parameter.
unknown
2007-07-31
6.8CVE-2007-4111
BUGTRAQ
OTHER-REF
BID
SECUNIA
Drupal -- DrupalMultiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.2 allow remote attackers to (1) delete comments, (2) delete content revisions, and (3) disable menu items as privileged users, related to improper use of HTTP GET and the Forms API.
unknown
2007-07-30
4.3CVE-2007-4063
OTHER-REF
BID
FRSIRT
SECUNIA
XF
Drupal -- DrupalMultiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, (1) allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHP_SELF; and (2) allow remote authenticated administrators to inject arbitrary web script or HTML via custom content type names.
unknown
2007-07-30
4.3CVE-2007-4064
OTHER-REF
FRSIRT
SECUNIA
XF
XF
EMC -- VMwareAbsolute path traversal vulnerability in a certain ActiveX control in vielib.dll 2.2.5.42958 in EMC VMware 6.0.0 allows remote attackers to execute arbitrary local programs via a full pathname in the first argument to the StartProcess method.
unknown
2007-07-30
4.3CVE-2007-4058
MILW0RM
BID
Firestorm Technologies -- GMapsSQL injection vulnerability in index.php in the Firestorm Technologies GMaps (com_gmaps) 1.00 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the mapId parameter in a viewmap action.
unknown
2007-08-01
6.8CVE-2007-4128
MILW0RM
BID
Global Centre -- Aplomb PollMultiple PHP remote file inclusion vulnerabilities in Madoa Poll 1.1 allow remote attackers to execute arbitrary PHP code via the Madoa parameter to (1) index.php, (2) vote.php, and (3) admin.php.
unknown
2007-07-31
6.8CVE-2007-4101
BUGTRAQ
VIM
BID
GNOME -- GPdfInteger overflow in gpdf before 2.8.2 might allow remote attackers to execute arbitrary code via a crafted PDF file.
unknown
2007-07-30
6.8CVE-2007-3387
REDHAT
Hitachi -- JP1-CM2-Hierarchical ViewerUnspecified vulnerability in Hitachi JP1/Cm2/Hierarchical Viewer (HV) 06-00 through 06-71-/B allows remote attackers to cause a denial of service (application stop and web interface outage) via certain "unexpected data."
unknown
2007-08-01
4.3CVE-2007-4122
OTHER-REF
FRSIRT
SECUNIA
Hitachi -- Groupmax Groupware ServerThe Groupmax Scheduler_Facilities management tool in Hitachi Groupmax Groupware Server 07-00-/F through 07-32-/A before 20070731 does not properly manage schedule server configuration data, which might allow attackers to obtain sensitive information via unspecified vectors.
unknown
2007-08-01
5.0CVE-2007-4123
OTHER-REF
FRSIRT
Hitachi -- uCosminexus Service Platform
Hitachi -- uCosminexus ERP Integrator
Hitachi -- uCosminexus Application Server
Hitachi -- Electronic Form Workflow
Hitachi -- uCosminexus OpenTP1 Web Front-end Set
Hitachi -- uCosminexus Collaboration Portal
Hitachi -- uCosminexus Developer
Hitachi -- Cosminexus OpenTP1 Web Front-end Set
Hitachi -- uCosminexus Service Architect
Hitachi -- Groupmax Collaboration Portal
Hitachi -- Cosminexus Developer
Hitachi -- Cosminexus Collaboration Portal
Hitachi -- Cosminexus ERP Integrator
Hitachi -- Cosminexus Application Server
The session failover function in Cosminexus Component Container in Cosminexus 6, 6.7, and 7 before 20070731, as used in multiple Hitachi products, can use session data for the wrong user under unspecified conditions, which might allow remote authenticated users to obtain sensitive information, corrupt another user's session data, and possibly gain privileges.
unknown
2007-08-01
4.9CVE-2007-4124
OTHER-REF
FRSIRT
SECUNIA
iFoto -- iFotoDirectory traversal vulnerability in index.php in iFoto 1.0.1 and earlier allows remote attackers to list arbitrary directories, and possibly download arbitrary photos, via a .. (dot dot) in the dir parameter.
unknown
2007-07-30
5.0CVE-2007-4092
OTHER-REF
BID
SECUNIA
ITCMS -- ITCMSMultiple cross-site scripting (XSS) vulnerabilities in IT!CMS (itcms) 0.2 allow remote attackers to inject arbitrary web script or HTML via the wndtitle parameter to (1) lang-en.php, (2) menu-ed.php, or (3) titletext-ed.php.
unknown
2007-07-31
4.3CVE-2007-4115
BUGTRAQ
Le Ralf -- Ralf Image Gallery** DISPUTED ** PHP remote file inclusion vulnerability in check_entry.php in Ralf Image Gallery (RIG), aka Raphael Moll RIG Image Gallery, 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the dir_abs_src parameter. NOTE: this issue is disputed by multiple third parties, who report that the product exits if register_globals is enabled, thereby blocking exploitation. NOTE: CVE-2006-3210.a covers this issue in versions before 1.0.
unknown
2007-08-01
6.8CVE-2007-4127
BUGTRAQ
VIM
VIM
VIM
VIM
LFS -- Live for speed S2Buffer overflow in Live for Speed (LFS) S2 ALPHA PATCH 0.5x allows user-assisted remote attackers to execute arbitrary code via a .mpr file (replay file) that contains a long car name.
unknown
2007-08-03
6.8CVE-2007-4140
MILW0RM
XF
Metyus -- Forum PortalSQL injection vulnerability in philboard_forum.asp in Metyus Forum Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the forumid parameter. NOTE: this might be related to CVE-2007-0920 or CVE-2007-3884.
unknown
2007-07-31
6.8CVE-2007-4116
BUGTRAQ
BID
SECUNIA
Mldonkey -- MldonkeyMLDonkey before 2.9.0 does not load certain code from $MLDONKEY/web_infos/ before the network modules become active, which allows remote attackers to bypass the IP blocklist.
unknown
2007-07-31
5.0CVE-2007-4100
OTHER-REF
BID
SECUNIA
XF
Neocrome -- SeditioUnrestricted file upload vulnerability in pfs.php in Neocrome Seditio 121 and earlier allows remote authenticated users to upload arbitrary PHP code via a filename ending with (1) .php.gif, (2) .php.jpg, or (3) .php.png.
unknown
2007-07-30
6.5CVE-2007-4057
MILW0RM
OpenRat -- OpenRat CMSOpenRat CMS 0.8-beta1 and earlier allows remote attackers to obtain sensitive information via a request containing an XSS sequence in the action parameter to index.php, which reveals the path in an error message.
unknown
2007-08-03
4.3CVE-2007-4141
OTHER-REF
Platon -- phpwebfilemanager** DISPUTED ** PHP remote file inclusion vulnerability in index.php in phpWebFileManager 0.5 allows remote attackers to execute arbitrary PHP code via a URL in the PN_PathPrefix parameter. NOTE: this issue is disputed by a reliable third party, who demonstrates that PN_PathPrefix is defined before use.
unknown
2007-08-01
6.8CVE-2007-4117
BUGTRAQ
VIM
Samba -- Samba ServerThe Samba server on Apple Mac OS X 10.3.9 and 10.4.10, when Windows file sharing is enabled, does not enforce disk quotas after dropping privileges, which allows remote authenticated users to use disk space in excess of quota.
unknown
2007-08-03
4.0CVE-2007-2407
OTHER-REF
APPLE
BID
FRSIRT
SECUNIA
sBLOG -- sBLOGCross-site scripting (XSS) vulnerability in search.php for sBlog 0.7.3 Beta allows remote attackers to inject arbitrary HTML and web script via a leading '"/> sequence in the search string.
unknown
2007-07-31
4.3CVE-2007-4102
BUGTRAQ
BID
XF
Sun -- SolarisUnspecified vulnerability in Low Bandwidth X proxy (lbxproxy) on Sun Solaris 8 through 10 before 20070725 allows local users to read arbitrary files with root group ownership via unknown vectors.
unknown
2007-07-30
4.9CVE-2007-4070
SUNALERT
BID
FRSIRT
SECUNIA
tincan -- Webbler CMSMultiple cross-site scripting (XSS) vulnerabilities in uploader/index.php in Webbler CMS before 3.1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) login parameter.
unknown
2007-07-30
4.3CVE-2007-4071
BUGTRAQ
BUGTRAQ
OTHER-REF
OTHER-REF
tincan -- Webbler CMSWebbler CMS before 3.1.6 provides the full installation path within HTML comments in certain documents, which allows remote attackers to obtain sensitive information by viewing the HTML source, as demonstrated by viewing the source generated from index.php.
unknown
2007-07-30
5.0CVE-2007-4072
BUGTRAQ
OTHER-REF
OTHER-REF
tincan -- Webbler CMSWebbler CMS before 3.1.6 does not properly restrict use of "mail a friend" forms, which allows remote attackers to send arbitrary amounts of forged e-mail. NOTE: this could be leveraged for spam or phishing attacks.
unknown
2007-07-30
5.0CVE-2007-4073
BUGTRAQ
OTHER-REF
OTHER-REF
Tor -- TorBuffer overflow in Tor before 0.1.2.15, when using BSD natd support, allows remote attackers to cause a denial of service via unspecified vectors.
unknown
2007-07-30
5.8CVE-2007-4096
MLIST
BID
FRSIRT
SECUNIA
Tor -- TorTor before 0.1.2.15 sends "destroy cells" containing the reason for tearing down a circuit, which allows remote attackers to obtain sensitive information, contrary to specifications.
unknown
2007-07-30
6.4CVE-2007-4097
MLIST
BID
FRSIRT
SECUNIA
Tor -- TorTor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might allow remote attackers with control over Tor routers to inject cells into arbitrary streams.
unknown
2007-07-30
5.8CVE-2007-4098
MLIST
BID
FRSIRT
SECUNIA
Tor -- TorTor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.
unknown
2007-07-30
5.8CVE-2007-4099
MLIST
BID
FRSIRT
SECUNIA
Vikingboard -- VikingboardMultiple cross-site scripting (XSS) vulnerabilities in Vikingboard 0.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) id, (2) f, (3) quote, and (4) act parameters to cp.php; the (5) u parameter to user.php; the (6) f parameter to post.php; the (7) s parameter to topic.php; the (8) quote, (9) t, (10) poll, and (11) p parameters to post.php; the (12) Message Title field of a private message (PM) in mode 6 of cp.php; the (13) title field of a private message (PM) in mode 7 of cp.php; and (14) allow user-assisted remote attackers to inject arbitrary web script or HTML via a dosearch action to search.php, which reflects the first lines of all posts by a user. NOTE: the act parameter to help.php and the p parameter to report.php are already covered by CVE-2006-4708. NOTE: vectors 12 and 13 might overlap CVE-2006-6283.1. NOTE: vector 14 might overlap CVE-2006-4708.b.
unknown
2007-07-30
4.3CVE-2007-4088
OTHER-REF
OTHER-REF
BID
SECUNIA
XF
Vikingboard -- VikingboardVikingboard 0.1.2 allows remote attackers to obtain sensitive information via the debug parameter to (1) forum.php, (2) cp.php, and possibly other unspecified components.
unknown
2007-07-30
4.3CVE-2007-4089
OTHER-REF
OTHER-REF
OTHER-REF
SECUNIA
XF
Vikingboard -- VikingboardMultiple cross-site scripting (XSS) vulnerabilities in Vikingboard 0.1.2 allow remote attackers to inject arbitrary web script or HTML via (1) the URI to inc/lib/screen.php or (2) the title parameter to post.php. NOTE: vector 2 might overlap CVE-2006-6283. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
unknown
2007-07-30
4.3CVE-2007-4090
OTHER-REF
SECUNIA
VIM Development Group -- VIMFormat string vulnerability in the helptags_one function in src/ex_cmds.c in Vim 6.4 and earlier, and 7.x up to 7.1, allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a help-tags tag in a help file, related to the helptags command.
unknown
2007-07-31
6.8CVE-2007-2953
OTHER-REF
OTHER-REF
BID
FRSIRT
SECUNIA
XF
VMWare -- VMWare WorkstationAbsolute path traversal vulnerability in a certain ActiveX control in IntraProcessLogging.dll 5.5.3.42958 in EMC VMware allows remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the SetLogFileName method.
unknown
2007-07-30
5.8CVE-2007-4059
MILW0RM
BID
Webyapar -- WebyaparMultiple SQL injection vulnerabilities in Webyapar 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the kat_id parameter to the default URI in a download action or (2) the id parameter to the default URI in a duyurular_detay action.
unknown
2007-07-30
5.8CVE-2007-4068
MILW0RM
BID
WordPress -- WordPressCross-site scripting (XSS) vulnerability in the Temporary Uploads editing functionality (wp-admin/includes/upload.php) in WordPress 2.2.1, allows remote attackers to inject arbitrary web script or HTML via the style parameter to wp-admin/upload.php.
unknown
2007-08-03
4.3CVE-2007-4139
OTHER-REF
OTHER-REF
OTHER-REF
FRSIRT
SECUNIA
XF
WP-FeedStats -- WordPress pluginMultiple cross-site scripting (XSS) vulnerabilities in the WP-FeedStats before 2.4 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, one of which involves an rss2 feed with an invalid or missing blog with an XSS sequence in the query string.
unknown
2007-07-31
4.3CVE-2007-4104
FULLDISC
OTHER-REF
OTHER-REF
OTHER-REF
BID
SECUNIA
XF

Back to top

Low Vulnerabilities
Primary
Vendor -- Product
Description
Discovered
Published
CVSS ScoreSource & Patch Info
Advanced Webhost Billing System -- Advanced Webhost Billing SystemUnspecified vulnerability in Advanced Webhost Billing System (AWBS) before 2.6.0 allows remote authenticated users to obtain configuration data about other dedicated servers via unspecified vectors.
unknown
2007-07-31
3.5CVE-2007-4113
OTHER-REF
BID
SECUNIA
Sun -- SolarisUnspecified vulnerability in the dynamic tracing framework (DTrace) on Sun Solaris 10 before 20070730 allows local users with PRIV_DTRACE_USER privileges to cause a denial of service (panic or hang) via unspecified use of certain DTrace programs.
unknown
2007-08-01
1.5CVE-2007-4126
SUNALERT
SECTRACK
SECUNIA

Back to top

Was this document helpful?  Yes  |  Somewhat  |  No

Back to Top