U.S. Flag Official website of the Department of Homeland Security

Note: This page is part of the us-cert.gov archive.This document is part of the US-CERT website archive. These documents are no longer updated and may contain outdated information. Links may also no longer function. Please contact info@us-cert.gov if you have any questions about the US-CERT website archive.

TLP:WHITE

Bulletin (SB08-007)

Vulnerability Summary for the Week of December 31, 2007

Original release date: January 07, 2008

The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information.

The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

  • High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0

  • Medium - Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 - 6.9

  • Low - Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 - 3.9

Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.

">

High Vulnerabilities
Primary
Vendor -- Product
Description
Discovered
Published
CVSS ScoreSource & Patch Info
Atlassian -- JIRAThe Setup Wizard in Atlassian JIRA Enterprise Edition before 3.12.1 does not properly restrict setup attempts after setup is complete, which allows remote attackers to change the default language.
unknown
2008-01-03
7.5CVE-2007-6619
OTHER-REF
SECUNIA
Bitweaver -- R2 CMSUnrestricted file upload vulnerability in fisheye/upload.php in Bitweaver R2 CMS allows remote attackers to upload arbitrary files by using the image/gif content type, and possibly other image and PDF content types, as demonstrated by uploading a .htaccess file.
unknown
2008-01-04
7.5CVE-2007-6650
MILW0RM
OTHER-REF
CCMS -- CCMSSQL injection vulnerability in admin.php/vars.php in CCMS 3.1 Demo allows remote attackers to execute arbitrary SQL commands via the p parameter in the Console page.
unknown
2008-01-04
7.5CVE-2007-6658
BUGTRAQ
MILW0RM
Clip-Share -- ClipShareSQL injection vulnerability in uprofile.php in ClipShare allows remote attackers to execute arbitrary SQL commands via the UID parameter.
unknown
2008-01-03
7.5CVE-2008-0089
MILW0RM
BID
CMS Made Simple -- CMS Made SimpleSQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.
unknown
2008-01-04
7.5CVE-2007-6656
MILW0RM
Debian -- Unpunp 1.0.12 does not properly escape file names, which might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument. NOTE: this might only be a vulnerability when unp is invoked by a third party product.
unknown
2008-01-03
10.0CVE-2007-6610
OTHER-REF
Feng -- FengMultiple buffer overflows in the RTSP_valid_response_msg function in RTSP_state_machine.c in LScube Feng 0.1.15 and earlier allow remote attackers to execute arbitrary code via (1) a long first line of a response, as demonstrated by a long VER line; or (2) a long second line of a response, as demonstrated by a message that follows a RETURN line.
unknown
2008-01-03
7.5CVE-2007-6626
BUGTRAQ
OTHER-REF
OTHER-REF
BID
Feng -- FengInteger overflow in the RTSP_remove_msg function in RTSP_lowlevel.c in LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an RTP packet with a size value of 0xffff.
unknown
2008-01-03
7.5CVE-2007-6627
BUGTRAQ
OTHER-REF
OTHER-REF
BID
IPTBB Team -- IPTBBSQL injection vulnerability in index.php in IPTBB 0.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewdir action.
unknown
2008-01-03
7.5CVE-2007-6639
MILW0RM
BID
Joomla -- JoomlaUnspecified vulnerability in Joomla! before 1.5 RC4 allows remote authenticated users to gain privileges via unspecified vectors, aka "registered user privilege escalation vulnerability."
unknown
2008-01-03
7.5CVE-2007-6645
OTHER-REF
SECTRACK
LScube -- libnemesiMultiple buffer overflows in LScube libnemesi 0.6.4-rc1 and earlier allow remote attackers to execute arbitrary code via (1) a reply that begins with a long version string, which triggers an overflow in handle_rtsp_pkt in rtsp_handlers.c; long headers that trigger overflows in (2) send_pause_request, (3) send_play_request, (4) send_setup_request, or (5) send_teardown_request in rtsp_send.c, as demonstrated by the Content-Base header; or a long Transport header, which triggers an overflow in (6) get_transport_str_sctp, (7) get_transport_str_tcp, or (8) get_transport_str_udp in rtsp_transport.c.
unknown
2008-01-03
7.5CVE-2007-6631
BUGTRAQ
OTHER-REF
OTHER-REF
BID
Macrovision -- Update ServiceBuffer overflow in a certain ActiveX control in Macrovision InstallShield Update Service Web Agent 5.1.100.47363 allows remote attackers to execute arbitrary code via a long string in the ProductCode argument (second argument) to the DownloadAndExecute method, a different vulnerability than CVE-2007-0321, CVE-2007-2419, and CVE-2007-5660.
unknown
2008-01-04
10.0CVE-2007-6654
FULLDISC
MILW0RM
XF
March Networks -- 3204 DVRMarch Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames, passwords, device names, and IP addresses via a direct request for scripts/logfiles.tar.gz.
unknown
2008-01-03
10.0CVE-2007-6638
MILW0RM
OTHER-REF
OTHER-REF
OTHER-REF
BID
SECUNIA
MatPo Bilder Galerie -- MatPo Bilder GaleriePHP remote file inclusion vulnerability in includes/tumbnail.php in MatPo Bilder Galerie 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter.
unknown
2008-01-04
7.5CVE-2007-6649
MILW0RM
MatPo Bilder Galerie -- Kontakt FormularPHP remote file inclusion vulnerability in includes/function.php in Kontakt Formular 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.
unknown
2008-01-04
7.5CVE-2007-6655
MILW0RM
Mihalism -- Multi HostPHP remote file inclusion vulnerability in source/includes/load_forum.php in Mihalism Multi Forum Host 3.0.x and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mfh_root_path parameter.
unknown
2008-01-04
7.5CVE-2007-6657
MILW0RM
MyPHP Forum -- MyPHP ForumSQL injection vulnerability in faq.php in MyPHP Forum 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the member.php vector is already covered by CVE-2005-0413.
unknown
2008-01-04
7.5CVE-2007-6667
MILW0RM
BID
Netchemia -- oneSCHOOLSQL injection vulnerability in admin/login.asp in Netchemia oneSCHOOL allows remote attackers to execute arbitrary SQL commands via the txtLoginID parameter.
unknown
2008-01-04
7.5CVE-2007-6665
MILW0RM
BID
Pragmatic Utopia -- PU ArcadeSQL injection vulnerability in index.php in the Pragmatic Utopia PU Arcade (com_puarcade) 2.0.3 and 2.1.3 Beta component for Joomla! allows remote attackers to execute arbitrary SQL commands via the fid parameter.
unknown
2008-01-04
7.5CVE-2007-6663
MILW0RM
BID
W-Agora -- W-AgoraSQL injection vulnerability in index.php in w-Agora 4.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cat parameter.
unknown
2008-01-04
7.5CVE-2007-6647
MILW0RM
WebPortal -- WebPortal CMSSQL injection vulnerability in index.php in WebPortal CMS 0.6.0 and earlier allows remote attackers to execute arbitrary SQL commands via the m parameter.
unknown
2008-01-04
7.5CVE-2007-6664
MILW0RM
BID
xcms -- xcmscpie.php in XCMS 1.83 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct direct static code injection attacks and execute arbitrary code via the testo_0 parameter in a cpie admin action to index.php, which writes to dati/generali/footer.dtb (aka the XCMS footer).
unknown
2008-01-04
7.5CVE-2007-6652
MILW0RM
Zenphoto -- zenphotoSQL injection vulnerability in rss.php in Zenphoto 1.1 through 1.1.3 allows remote attackers to execute arbitrary SQL commands via the albumnr parameter.
unknown
2008-01-04
7.5CVE-2007-6666
MILW0RM
BID
ZeusCMS -- ZeusCMSSQL injection vulnerability in security.php in ZeusCMS 0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header.
unknown
2008-01-03
7.5CVE-2007-6622
MILW0RM
BID
SECUNIA

Back to top

Medium Vulnerabilities
Primary
Vendor -- Product
Description
Discovered
Published
CVSS ScoreSource & Patch Info
2z Project -- 2z ProjectMultiple cross-site scripting (XSS) vulnerabilities in 2z project 0.9.6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) contentshort or (2) contentfull parameter in an addnews action to the default URI; (3) the content parameter in a pm write action to 2z/admin.php; (4) the referer parameter to templates/default/usermenu.tpl, accessed through index.php; or the (5) newavatar or (6) newphoto parameter in a profile action to the default URI under 2z/.
unknown
2008-01-04
4.3CVE-2007-6659
BUGTRAQ
BID
2z Project -- 2z Project2z project 0.9.6.1 allows remote attackers to obtain sensitive information via (1) a request to index.php with an invalid template or (2) a request to the default URI with certain year and month parameters, which reveals the path in various error messages.
unknown
2008-01-04
5.0CVE-2007-6660
BUGTRAQ
BID
2z Project -- 2z Project2z project 0.9.6.1 allows attackers to change the password without supplying the old password.
unknown
2008-01-04
6.4CVE-2007-6661
BUGTRAQ
BID
Adobe -- Flash Player Plugin
Adobe -- Flash Player
Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver CS3 or Adobe Acrobat Connect. NOTE: the asfunction: vector is already covered by CVE-2007-6244.1.
unknown
2008-01-03
4.3CVE-2007-6637
OTHER-REF
BID
SECTRACK
Agares Media -- phpAutoVideoPHP remote file inclusion vulnerability in admin/frontpage_right.php in Agares Media phpAutoVideo 2.21 allows remote attackers to execute arbitrary PHP code via a URL in the loadadminpage parameter, a related issue to CVE-2007-6542.
unknown
2008-01-03
6.8CVE-2007-6614
MILW0RM
OTHER-REF
BID
FRSIRT
SECUNIA
Agares Media -- phpAutoVideoDirectory traversal vulnerability in includes/block.php in Agares Media phpAutoVideo 2.21 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the selected_provider parameter.
unknown
2008-01-03
6.8CVE-2007-6615
MILW0RM
OTHER-REF
BID
FRSIRT
SECUNIA
AGENCY4NET -- WEBFTPDirectory traversal vulnerability in download2.php in AGENCY4NET WEBFTP 1 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the file parameter.
unknown
2008-01-03
6.4CVE-2008-0091
MILW0RM
VIM
BID
Apple -- SafariApple Safari 2, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, which makes it easier for remote attackers to trick a user into accepting an invalid certificate for a spoofed web site.
unknown
2007-12-28
4.3CVE-2007-6592
BUGTRAQ
BUGTRAQ
OTHER-REF
Atlassian -- JIRACross-site scripting (XSS) vulnerability in 500page.jsp in JIRA Enterprise Edition before 3.12.1 allows remote attackers to inject arbitrary web script or HTML, which is not properly handled when generating error messages, as demonstrated by input originally sent in the URI to secure/CreateIssue. NOTE: some of these details are obtained from third party information.
unknown
2008-01-03
4.3CVE-2007-6617
OTHER-REF
SECUNIA
Atlassian -- JIRAJIRA Enterprise Edition before 3.12.1 allows remote attackers to delete another user's shared filter via a modified filter ID.
unknown
2008-01-03
5.0CVE-2007-6618
OTHER-REF
SECUNIA
Bitflu -- BitfluUnspecified vulnerability in the StorageFarabDb module in Bitflu before 0.42 allows user-assisted remote attackers to create or append data to arbitrary files via a crafted .torrent file.
unknown
2008-01-03
5.8CVE-2007-6636
OTHER-REF
BID
SECUNIA
Bitweaver -- R2 CMSDirectory traversal vulnerability in wiki/edit.php in Bitweaver R2 CMS allows remote attackers to obtain sensitive information (script source code) via a .. (dot dot) in the suck_url parameter.
unknown
2008-01-04
6.4CVE-2007-6651
MILW0RM
OTHER-REF
CutePHP -- CuteNewsDirectory traversal vulnerability in file.php in CuteNews 2.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, as demonstrated by reading the admin username and password hash in data/users.db.php.
unknown
2008-01-04
5.8CVE-2007-6662
BUGTRAQ
Dovecot -- DovecotDovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.
unknown
2008-01-03
6.8CVE-2007-6598
BUGTRAQ
BUGTRAQ
MLIST
MLIST
BID
FRSIRT
Feng -- FengLScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via (1) a malformed Transport header, which triggers misparsing in parse_transport_header in RTSP_setup.c, as demonstrated by a Transport header that contains only a "RTP/AVP;unicast;client_port" sequence; or (2) a malformed Range header, which triggers misparsing in parse_play_time_range in RTSP_Play, as demonstrated by an empty Range header.
unknown
2008-01-03
5.0CVE-2007-6628
BUGTRAQ
OTHER-REF
OTHER-REF
BID
Feng -- FengInterpretation conflict in LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a User-Agent header line that contains a carriage-return character, which is considered a line delimiter when the header is split into individual lines, but not when log_user_agent in RTSP_utils.c parses the content of the User-Agent line.
unknown
2008-01-03
5.0CVE-2007-6629
BUGTRAQ
OTHER-REF
OTHER-REF
BID
Feng -- FengThe Url_init function in utils/url.c in Netembryo 0.0.4, when used by LScube Feng, allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a malformed URI containing a "/:" sequence, as demonstrated by a "DESCRIBE /: RTSP/1.0" request.
unknown
2008-01-03
5.0CVE-2007-6630
BUGTRAQ
OTHER-REF
OTHER-REF
BID
GNU -- libcdioStack-based buffer overflow in the print_iso9660_recurse function in iso-info (src/iso-info.c) in GNU Compact Disc Input and Control Library (libcdio) 0.79 and earlier allows context-dependent attackers to cause a denial of service (core dump) and possibly execute arbitrary code via a disk or image that contains a long joilet file name.
unknown
2008-01-03
5.0CVE-2007-6613
MLIST
OTHER-REF
OTHER-REF
Integry Systems -- LiveCartMultiple cross-site scripting (XSS) vulnerabilities in LiveCart 1.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the return parameter to user/remindPassword, (2) the q parameter to the category script, (3) the return parameter to the order script, or (4) the email parameter to user/remindComplete.
unknown
2008-01-03
4.3CVE-2007-6646
BUGTRAQ
OTHER-REF
BID
XF
Joomla -- JoomlaMultiple cross-site request forgery (CSRF) vulnerabilities in Joomla! before 1.5 RC4 allow remote attackers to (1) add a Super Admin, (2) upload an extension containing arbitrary PHP code, and (3) modify the configuration as administrators via unspecified vectors.
unknown
2008-01-03
6.8CVE-2007-6642
BUGTRAQ
OTHER-REF
SECTRACK
Joomla -- JoomlaCross-site scripting (XSS) vulnerability in the com_poll component in Joomla! before 1.5 RC4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
unknown
2008-01-03
4.3CVE-2007-6643
OTHER-REF
SECTRACK
Joomla -- JoomlaJoomla! before 1.5 RC4 allows remote authenticated administrators to promote arbitrary users to the administrator group, in violation of the intended security model.
unknown
2008-01-03
6.5CVE-2007-6644
OTHER-REF
SECTRACK
Joovili -- JooviliDirectory traversal vulnerability in include/images.inc.php in Joovili 2.x allows remote attackers to read arbitrary files via a .. (dot dot) in the picture parameter.
unknown
2008-01-03
6.4CVE-2007-6620
MILW0RM
Joovili -- JooviliDirectory traversal vulnerability in joovili.images.php in Joovili 3.0.0 through 3.0.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the picture parameter.
unknown
2008-01-03
6.4CVE-2007-6621
MILW0RM
Mantis -- MantisCross-site scripting (XSS) vulnerability in view.php in Mantis before 1.1.0 allows remote attackers to inject arbitrary web script or HTML via a filename.
unknown
2008-01-03
4.3CVE-2007-6611
OTHER-REF
OTHER-REF
BID
SECUNIA
MaraDNS -- MaraDNSMaraDNS 1.0 before 1.0.41, 1.2 before 1.2.12.08, and 1.3 before 1.3.07.04 allows remote attackers to cause a denial of service via a crafted DNS packet that prevents an authoritative name (CNAME) record from resolving, aka "improper rotation of resource records."
unknown
2008-01-03
5.0CVE-2008-0061
OTHER-REF
OTHER-REF
Microsoft -- Internet Explorer
DivX -- DivX Player
A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long argument to the SetPassword method.
unknown
2008-01-03
5.0CVE-2008-0090
MILW0RM
BID
Mihalism -- Multi HostDirectory traversal vulnerability in download.php in Mihalism Multi Host 2.0.7 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
unknown
2008-01-04
5.0CVE-2007-6653
MILW0RM
MilliScripts -- MilliScriptsCross-site scripting (XSS) vulnerability in dir.php in milliscripts allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a browse action.
unknown
2008-01-03
4.3CVE-2007-6641
BUGTRAQ
BID
XF
Mongrel -- MongrelDirectory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences (".%252e").
unknown
2008-01-03
6.4CVE-2007-6612
MLIST
MLIST
MLIST
MLIST
OTHER-REF
NetBizCity -- FAQMasterFlexPlusMultiple cross-site scripting (XSS) vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to inject arbitrary web script or HTML via (1) the cat_name parameter to faq.php; and unspecified parameters to the (2) add categories, (3) edit categories, (4) delete categories, (5) add faq, (6) edit faq, and (7) delete faq Admin scripts.
unknown
2008-01-03
4.3CVE-2007-6633
FULLDISC
BID
SECUNIA
NetBizCity -- FAQMasterFlexPlusMultiple SQL injection vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to execute arbitrary SQL commands via the category_id parameter to faq.php, and unspecified other vectors involving additional scripts.
unknown
2008-01-03
6.8CVE-2007-6634
FULLDISC
BID
SECUNIA
NetBizCity -- FAQMasterFlexPlusFAQMasterFlexPlus, possibly 1.5 or 1.52, stores the admin password in cleartext in a database, which might allow context-dependent attackers to obtain the password via unspecified database access.
unknown
2008-01-03
6.4CVE-2007-6635
FULLDISC
Novell -- Novell Identity ManagerThe Platform Service Process (asampsp) in Fan-Out Driver Platform Services for Novell Identity Manager (IDM) 3.5.1 allows remote attackers to cause a denial of service (daemon crash) via unspecified network traffic that triggers a syslog message containing invalid format string specifiers, as demonstrated by a Nessus scan.
unknown
2008-01-03
5.0CVE-2007-6625
OTHER-REF
FRSIRT
SECTRACK
SECUNIA
XF
OpenAFS -- OpenAFSRace condition in fileserver in OpenAFS 1.3.50 through 1.4.5 and 1.5.0 through 1.5.27 allows remote attackers to cause a denial of service (daemon crash) by simultaneously acquiring and giving back file callbacks, which causes the handler for the GiveUpAllCallBacks RPC to perform linked-list operations without the host_glock lock.
unknown
2008-01-03
4.3CVE-2007-6599
MLIST
OTHER-REF
phpWebsite -- phpWebSiteCross-site scripting (XSS) vulnerability in index.php in the search module in Appalachian State University phpWebSite 1.4.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
unknown
2008-01-03
4.3CVE-2008-0092
BUGTRAQ
OTHER-REF
BID
PNphpBB -- PNphpBBDirectory traversal vulnerability in printview.php in PNphpBB2 1.2i and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phpEx parameter.
unknown
2008-01-03
6.8CVE-2007-6624
MILW0RM
OTHER-REF
BID
XF
SanyBee Gallery -- SanyBee GalleryDirectory traversal vulnerability in index.php in SanyBee Gallery 0.1.0 and 0.1.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter.
unknown
2008-01-04
5.0CVE-2007-6648
MILW0RM
BID
SECUNIA
SimpleForum -- SimpleForumCross-site scripting (XSS) vulnerability in simpleforum.cgi in SimpleForum 4.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchkey parameter in a search action. NOTE: some of these details are obtained from third party information.
unknown
2008-01-03
4.3CVE-2007-6616
BUGTRAQ
BID
SECUNIA
XF
SourceForge -- Greasekit
SourceForge -- Creammonkey
Creammonkey 0.9 through 1.1 and GreaseKit 1.2 through 1.3 does not properly prevent access to dangerous functions, which allows remote attackers to read the configuration, modify the configuration, or send an HTTP request via the (1) GM_addStyle, (2) GM_log, (3) GM_openInTab, (4) GM_setValue, (5) GM_getValue, or (6) GM_xmlhttpRequest function within a web page on which a userscript is configured.
unknown
2008-01-03
6.4CVE-2007-6640
OTHER-REF
SECUNIA
XF
xml2owl -- xml2owlshowCode.php in xml2owl 0.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter.
unknown
2008-01-03
6.8CVE-2007-6632
MILW0RM
OTHER-REF
BID
ZeusCMS -- ZeusCMSAbsolute path traversal vulnerability in ZeusCMS 0.3 and earlier might allow remote attackers to list arbitrary directories via a full pathname in the dir parameter.
unknown
2008-01-03
5.0CVE-2007-6623
MILW0RM
BID
SECUNIA

Back to top

Low Vulnerabilities
Primary
Vendor -- Product
Description
Discovered
Published
CVSS Score
Source & Patch Info
- There were no low vulnerabilities for this week-

Back to top


 

">

High Vulnerabilities
Primary
Vendor -- Product
Description
Discovered
Published
CVSS ScoreSource & Patch Info
Atlassian -- JIRAThe Setup Wizard in Atlassian JIRA Enterprise Edition before 3.12.1 does not properly restrict setup attempts after setup is complete, which allows remote attackers to change the default language.
unknown
2008-01-03
7.5CVE-2007-6619
OTHER-REF
SECUNIA
Bitweaver -- R2 CMSUnrestricted file upload vulnerability in fisheye/upload.php in Bitweaver R2 CMS allows remote attackers to upload arbitrary files by using the image/gif content type, and possibly other image and PDF content types, as demonstrated by uploading a .htaccess file.
unknown
2008-01-04
7.5CVE-2007-6650
MILW0RM
OTHER-REF
CCMS -- CCMSSQL injection vulnerability in admin.php/vars.php in CCMS 3.1 Demo allows remote attackers to execute arbitrary SQL commands via the p parameter in the Console page.
unknown
2008-01-04
7.5CVE-2007-6658
BUGTRAQ
MILW0RM
Clip-Share -- ClipShareSQL injection vulnerability in uprofile.php in ClipShare allows remote attackers to execute arbitrary SQL commands via the UID parameter.
unknown
2008-01-03
7.5CVE-2008-0089
MILW0RM
BID
CMS Made Simple -- CMS Made SimpleSQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.
unknown
2008-01-04
7.5CVE-2007-6656
MILW0RM
Debian -- Unpunp 1.0.12 does not properly escape file names, which might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument. NOTE: this might only be a vulnerability when unp is invoked by a third party product.
unknown
2008-01-03
10.0CVE-2007-6610
OTHER-REF
Feng -- FengMultiple buffer overflows in the RTSP_valid_response_msg function in RTSP_state_machine.c in LScube Feng 0.1.15 and earlier allow remote attackers to execute arbitrary code via (1) a long first line of a response, as demonstrated by a long VER line; or (2) a long second line of a response, as demonstrated by a message that follows a RETURN line.
unknown
2008-01-03
7.5CVE-2007-6626
BUGTRAQ
OTHER-REF
OTHER-REF
BID
Feng -- FengInteger overflow in the RTSP_remove_msg function in RTSP_lowlevel.c in LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an RTP packet with a size value of 0xffff.
unknown
2008-01-03
7.5CVE-2007-6627
BUGTRAQ
OTHER-REF
OTHER-REF
BID
IPTBB Team -- IPTBBSQL injection vulnerability in index.php in IPTBB 0.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewdir action.
unknown
2008-01-03
7.5CVE-2007-6639
MILW0RM
BID
Joomla -- JoomlaUnspecified vulnerability in Joomla! before 1.5 RC4 allows remote authenticated users to gain privileges via unspecified vectors, aka "registered user privilege escalation vulnerability."
unknown
2008-01-03
7.5CVE-2007-6645
OTHER-REF
SECTRACK
LScube -- libnemesiMultiple buffer overflows in LScube libnemesi 0.6.4-rc1 and earlier allow remote attackers to execute arbitrary code via (1) a reply that begins with a long version string, which triggers an overflow in handle_rtsp_pkt in rtsp_handlers.c; long headers that trigger overflows in (2) send_pause_request, (3) send_play_request, (4) send_setup_request, or (5) send_teardown_request in rtsp_send.c, as demonstrated by the Content-Base header; or a long Transport header, which triggers an overflow in (6) get_transport_str_sctp, (7) get_transport_str_tcp, or (8) get_transport_str_udp in rtsp_transport.c.
unknown
2008-01-03
7.5CVE-2007-6631
BUGTRAQ
OTHER-REF
OTHER-REF
BID
Macrovision -- Update ServiceBuffer overflow in a certain ActiveX control in Macrovision InstallShield Update Service Web Agent 5.1.100.47363 allows remote attackers to execute arbitrary code via a long string in the ProductCode argument (second argument) to the DownloadAndExecute method, a different vulnerability than CVE-2007-0321, CVE-2007-2419, and CVE-2007-5660.
unknown
2008-01-04
10.0CVE-2007-6654
FULLDISC
MILW0RM
XF
March Networks -- 3204 DVRMarch Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames, passwords, device names, and IP addresses via a direct request for scripts/logfiles.tar.gz.
unknown
2008-01-03
10.0CVE-2007-6638
MILW0RM
OTHER-REF
OTHER-REF
OTHER-REF
BID
SECUNIA
MatPo Bilder Galerie -- MatPo Bilder GaleriePHP remote file inclusion vulnerability in includes/tumbnail.php in MatPo Bilder Galerie 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter.
unknown
2008-01-04
7.5CVE-2007-6649
MILW0RM
MatPo Bilder Galerie -- Kontakt FormularPHP remote file inclusion vulnerability in includes/function.php in Kontakt Formular 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.
unknown
2008-01-04
7.5CVE-2007-6655
MILW0RM
Mihalism -- Multi HostPHP remote file inclusion vulnerability in source/includes/load_forum.php in Mihalism Multi Forum Host 3.0.x and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mfh_root_path parameter.
unknown
2008-01-04
7.5CVE-2007-6657
MILW0RM
MyPHP Forum -- MyPHP ForumSQL injection vulnerability in faq.php in MyPHP Forum 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the member.php vector is already covered by CVE-2005-0413.
unknown
2008-01-04
7.5CVE-2007-6667
MILW0RM
BID
Netchemia -- oneSCHOOLSQL injection vulnerability in admin/login.asp in Netchemia oneSCHOOL allows remote attackers to execute arbitrary SQL commands via the txtLoginID parameter.
unknown
2008-01-04
7.5CVE-2007-6665
MILW0RM
BID
Pragmatic Utopia -- PU ArcadeSQL injection vulnerability in index.php in the Pragmatic Utopia PU Arcade (com_puarcade) 2.0.3 and 2.1.3 Beta component for Joomla! allows remote attackers to execute arbitrary SQL commands via the fid parameter.
unknown
2008-01-04
7.5CVE-2007-6663
MILW0RM
BID
W-Agora -- W-AgoraSQL injection vulnerability in index.php in w-Agora 4.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cat parameter.
unknown
2008-01-04
7.5CVE-2007-6647
MILW0RM
WebPortal -- WebPortal CMSSQL injection vulnerability in index.php in WebPortal CMS 0.6.0 and earlier allows remote attackers to execute arbitrary SQL commands via the m parameter.
unknown
2008-01-04
7.5CVE-2007-6664
MILW0RM
BID
xcms -- xcmscpie.php in XCMS 1.83 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct direct static code injection attacks and execute arbitrary code via the testo_0 parameter in a cpie admin action to index.php, which writes to dati/generali/footer.dtb (aka the XCMS footer).
unknown
2008-01-04
7.5CVE-2007-6652
MILW0RM
Zenphoto -- zenphotoSQL injection vulnerability in rss.php in Zenphoto 1.1 through 1.1.3 allows remote attackers to execute arbitrary SQL commands via the albumnr parameter.
unknown
2008-01-04
7.5CVE-2007-6666
MILW0RM
BID
ZeusCMS -- ZeusCMSSQL injection vulnerability in security.php in ZeusCMS 0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header.
unknown
2008-01-03
7.5CVE-2007-6622
MILW0RM
BID
SECUNIA

Back to top

Medium Vulnerabilities
Primary
Vendor -- Product
Description
Discovered
Published
CVSS ScoreSource & Patch Info
2z Project -- 2z ProjectMultiple cross-site scripting (XSS) vulnerabilities in 2z project 0.9.6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) contentshort or (2) contentfull parameter in an addnews action to the default URI; (3) the content parameter in a pm write action to 2z/admin.php; (4) the referer parameter to templates/default/usermenu.tpl, accessed through index.php; or the (5) newavatar or (6) newphoto parameter in a profile action to the default URI under 2z/.
unknown
2008-01-04
4.3CVE-2007-6659
BUGTRAQ
BID
2z Project -- 2z Project2z project 0.9.6.1 allows remote attackers to obtain sensitive information via (1) a request to index.php with an invalid template or (2) a request to the default URI with certain year and month parameters, which reveals the path in various error messages.
unknown
2008-01-04
5.0CVE-2007-6660
BUGTRAQ
BID
2z Project -- 2z Project2z project 0.9.6.1 allows attackers to change the password without supplying the old password.
unknown
2008-01-04
6.4CVE-2007-6661
BUGTRAQ
BID
Adobe -- Flash Player Plugin
Adobe -- Flash Player
Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver CS3 or Adobe Acrobat Connect. NOTE: the asfunction: vector is already covered by CVE-2007-6244.1.
unknown
2008-01-03
4.3CVE-2007-6637
OTHER-REF
BID
SECTRACK
Agares Media -- phpAutoVideoPHP remote file inclusion vulnerability in admin/frontpage_right.php in Agares Media phpAutoVideo 2.21 allows remote attackers to execute arbitrary PHP code via a URL in the loadadminpage parameter, a related issue to CVE-2007-6542.
unknown
2008-01-03
6.8CVE-2007-6614
MILW0RM
OTHER-REF
BID
FRSIRT
SECUNIA
Agares Media -- phpAutoVideoDirectory traversal vulnerability in includes/block.php in Agares Media phpAutoVideo 2.21 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the selected_provider parameter.
unknown
2008-01-03
6.8CVE-2007-6615
MILW0RM
OTHER-REF
BID
FRSIRT
SECUNIA
AGENCY4NET -- WEBFTPDirectory traversal vulnerability in download2.php in AGENCY4NET WEBFTP 1 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the file parameter.
unknown
2008-01-03
6.4CVE-2008-0091
MILW0RM
VIM
BID
Apple -- SafariApple Safari 2, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, which makes it easier for remote attackers to trick a user into accepting an invalid certificate for a spoofed web site.
unknown
2007-12-28
4.3CVE-2007-6592
BUGTRAQ
BUGTRAQ
OTHER-REF
Atlassian -- JIRACross-site scripting (XSS) vulnerability in 500page.jsp in JIRA Enterprise Edition before 3.12.1 allows remote attackers to inject arbitrary web script or HTML, which is not properly handled when generating error messages, as demonstrated by input originally sent in the URI to secure/CreateIssue. NOTE: some of these details are obtained from third party information.
unknown
2008-01-03
4.3CVE-2007-6617
OTHER-REF
SECUNIA
Atlassian -- JIRAJIRA Enterprise Edition before 3.12.1 allows remote attackers to delete another user's shared filter via a modified filter ID.
unknown
2008-01-03
5.0CVE-2007-6618
OTHER-REF
SECUNIA
Bitflu -- BitfluUnspecified vulnerability in the StorageFarabDb module in Bitflu before 0.42 allows user-assisted remote attackers to create or append data to arbitrary files via a crafted .torrent file.
unknown
2008-01-03
5.8CVE-2007-6636
OTHER-REF
BID
SECUNIA
Bitweaver -- R2 CMSDirectory traversal vulnerability in wiki/edit.php in Bitweaver R2 CMS allows remote attackers to obtain sensitive information (script source code) via a .. (dot dot) in the suck_url parameter.
unknown
2008-01-04
6.4CVE-2007-6651
MILW0RM
OTHER-REF
CutePHP -- CuteNewsDirectory traversal vulnerability in file.php in CuteNews 2.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, as demonstrated by reading the admin username and password hash in data/users.db.php.
unknown
2008-01-04
5.8CVE-2007-6662
BUGTRAQ
Dovecot -- DovecotDovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.
unknown
2008-01-03
6.8CVE-2007-6598
BUGTRAQ
BUGTRAQ
MLIST
MLIST
BID
FRSIRT
Feng -- FengLScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via (1) a malformed Transport header, which triggers misparsing in parse_transport_header in RTSP_setup.c, as demonstrated by a Transport header that contains only a "RTP/AVP;unicast;client_port" sequence; or (2) a malformed Range header, which triggers misparsing in parse_play_time_range in RTSP_Play, as demonstrated by an empty Range header.
unknown
2008-01-03
5.0CVE-2007-6628
BUGTRAQ
OTHER-REF
OTHER-REF
BID
Feng -- FengInterpretation conflict in LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a User-Agent header line that contains a carriage-return character, which is considered a line delimiter when the header is split into individual lines, but not when log_user_agent in RTSP_utils.c parses the content of the User-Agent line.
unknown
2008-01-03
5.0CVE-2007-6629
BUGTRAQ
OTHER-REF
OTHER-REF
BID
Feng -- FengThe Url_init function in utils/url.c in Netembryo 0.0.4, when used by LScube Feng, allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a malformed URI containing a "/:" sequence, as demonstrated by a "DESCRIBE /: RTSP/1.0" request.
unknown
2008-01-03
5.0CVE-2007-6630
BUGTRAQ
OTHER-REF
OTHER-REF
BID
GNU -- libcdioStack-based buffer overflow in the print_iso9660_recurse function in iso-info (src/iso-info.c) in GNU Compact Disc Input and Control Library (libcdio) 0.79 and earlier allows context-dependent attackers to cause a denial of service (core dump) and possibly execute arbitrary code via a disk or image that contains a long joilet file name.
unknown
2008-01-03
5.0CVE-2007-6613
MLIST
OTHER-REF
OTHER-REF
Integry Systems -- LiveCartMultiple cross-site scripting (XSS) vulnerabilities in LiveCart 1.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the return parameter to user/remindPassword, (2) the q parameter to the category script, (3) the return parameter to the order script, or (4) the email parameter to user/remindComplete.
unknown
2008-01-03
4.3CVE-2007-6646
BUGTRAQ
OTHER-REF
BID
XF
Joomla -- JoomlaMultiple cross-site request forgery (CSRF) vulnerabilities in Joomla! before 1.5 RC4 allow remote attackers to (1) add a Super Admin, (2) upload an extension containing arbitrary PHP code, and (3) modify the configuration as administrators via unspecified vectors.
unknown
2008-01-03
6.8CVE-2007-6642
BUGTRAQ
OTHER-REF
SECTRACK
Joomla -- JoomlaCross-site scripting (XSS) vulnerability in the com_poll component in Joomla! before 1.5 RC4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
unknown
2008-01-03
4.3CVE-2007-6643
OTHER-REF
SECTRACK
Joomla -- JoomlaJoomla! before 1.5 RC4 allows remote authenticated administrators to promote arbitrary users to the administrator group, in violation of the intended security model.
unknown
2008-01-03
6.5CVE-2007-6644
OTHER-REF
SECTRACK
Joovili -- JooviliDirectory traversal vulnerability in include/images.inc.php in Joovili 2.x allows remote attackers to read arbitrary files via a .. (dot dot) in the picture parameter.
unknown
2008-01-03
6.4CVE-2007-6620
MILW0RM
Joovili -- JooviliDirectory traversal vulnerability in joovili.images.php in Joovili 3.0.0 through 3.0.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the picture parameter.
unknown
2008-01-03
6.4CVE-2007-6621
MILW0RM
Mantis -- MantisCross-site scripting (XSS) vulnerability in view.php in Mantis before 1.1.0 allows remote attackers to inject arbitrary web script or HTML via a filename.
unknown
2008-01-03
4.3CVE-2007-6611
OTHER-REF
OTHER-REF
BID
SECUNIA
MaraDNS -- MaraDNSMaraDNS 1.0 before 1.0.41, 1.2 before 1.2.12.08, and 1.3 before 1.3.07.04 allows remote attackers to cause a denial of service via a crafted DNS packet that prevents an authoritative name (CNAME) record from resolving, aka "improper rotation of resource records."
unknown
2008-01-03
5.0CVE-2008-0061
OTHER-REF
OTHER-REF
Microsoft -- Internet Explorer
DivX -- DivX Player
A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long argument to the SetPassword method.
unknown
2008-01-03
5.0CVE-2008-0090
MILW0RM
BID
Mihalism -- Multi HostDirectory traversal vulnerability in download.php in Mihalism Multi Host 2.0.7 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
unknown
2008-01-04
5.0CVE-2007-6653
MILW0RM
MilliScripts -- MilliScriptsCross-site scripting (XSS) vulnerability in dir.php in milliscripts allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a browse action.
unknown
2008-01-03
4.3CVE-2007-6641
BUGTRAQ
BID
XF
Mongrel -- MongrelDirectory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences (".%252e").
unknown
2008-01-03
6.4CVE-2007-6612
MLIST
MLIST
MLIST
MLIST
OTHER-REF
NetBizCity -- FAQMasterFlexPlusMultiple cross-site scripting (XSS) vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to inject arbitrary web script or HTML via (1) the cat_name parameter to faq.php; and unspecified parameters to the (2) add categories, (3) edit categories, (4) delete categories, (5) add faq, (6) edit faq, and (7) delete faq Admin scripts.
unknown
2008-01-03
4.3CVE-2007-6633
FULLDISC
BID
SECUNIA
NetBizCity -- FAQMasterFlexPlusMultiple SQL injection vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to execute arbitrary SQL commands via the category_id parameter to faq.php, and unspecified other vectors involving additional scripts.
unknown
2008-01-03
6.8CVE-2007-6634
FULLDISC
BID
SECUNIA
NetBizCity -- FAQMasterFlexPlusFAQMasterFlexPlus, possibly 1.5 or 1.52, stores the admin password in cleartext in a database, which might allow context-dependent attackers to obtain the password via unspecified database access.
unknown
2008-01-03
6.4CVE-2007-6635
FULLDISC
Novell -- Novell Identity ManagerThe Platform Service Process (asampsp) in Fan-Out Driver Platform Services for Novell Identity Manager (IDM) 3.5.1 allows remote attackers to cause a denial of service (daemon crash) via unspecified network traffic that triggers a syslog message containing invalid format string specifiers, as demonstrated by a Nessus scan.
unknown
2008-01-03
5.0CVE-2007-6625
OTHER-REF
FRSIRT
SECTRACK
SECUNIA
XF
OpenAFS -- OpenAFSRace condition in fileserver in OpenAFS 1.3.50 through 1.4.5 and 1.5.0 through 1.5.27 allows remote attackers to cause a denial of service (daemon crash) by simultaneously acquiring and giving back file callbacks, which causes the handler for the GiveUpAllCallBacks RPC to perform linked-list operations without the host_glock lock.
unknown
2008-01-03
4.3CVE-2007-6599
MLIST
OTHER-REF
phpWebsite -- phpWebSiteCross-site scripting (XSS) vulnerability in index.php in the search module in Appalachian State University phpWebSite 1.4.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
unknown
2008-01-03
4.3CVE-2008-0092
BUGTRAQ
OTHER-REF
BID
PNphpBB -- PNphpBBDirectory traversal vulnerability in printview.php in PNphpBB2 1.2i and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phpEx parameter.
unknown
2008-01-03
6.8CVE-2007-6624
MILW0RM
OTHER-REF
BID
XF
SanyBee Gallery -- SanyBee GalleryDirectory traversal vulnerability in index.php in SanyBee Gallery 0.1.0 and 0.1.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter.
unknown
2008-01-04
5.0CVE-2007-6648
MILW0RM
BID
SECUNIA
SimpleForum -- SimpleForumCross-site scripting (XSS) vulnerability in simpleforum.cgi in SimpleForum 4.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchkey parameter in a search action. NOTE: some of these details are obtained from third party information.
unknown
2008-01-03
4.3CVE-2007-6616
BUGTRAQ
BID
SECUNIA
XF
SourceForge -- Greasekit
SourceForge -- Creammonkey
Creammonkey 0.9 through 1.1 and GreaseKit 1.2 through 1.3 does not properly prevent access to dangerous functions, which allows remote attackers to read the configuration, modify the configuration, or send an HTTP request via the (1) GM_addStyle, (2) GM_log, (3) GM_openInTab, (4) GM_setValue, (5) GM_getValue, or (6) GM_xmlhttpRequest function within a web page on which a userscript is configured.
unknown
2008-01-03
6.4CVE-2007-6640
OTHER-REF
SECUNIA
XF
xml2owl -- xml2owlshowCode.php in xml2owl 0.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter.
unknown
2008-01-03
6.8CVE-2007-6632
MILW0RM
OTHER-REF
BID
ZeusCMS -- ZeusCMSAbsolute path traversal vulnerability in ZeusCMS 0.3 and earlier might allow remote attackers to list arbitrary directories via a full pathname in the dir parameter.
unknown
2008-01-03
5.0CVE-2007-6623
MILW0RM
BID
SECUNIA

Back to top

Low Vulnerabilities
Primary
Vendor -- Product
Description
Discovered
Published
CVSS Score
Source & Patch Info
- There were no low vulnerabilities for this week-

Back to top


 

Was this document helpful?  Yes  |  Somewhat  |  No

Back to Top