Archive
23 January 2007
Vulnerabilities first published on this day (UTC), newest first.
44 results · Feed
-
Unscored —
pam_unix.so in Linux-PAM 0.99.7.0 allows context-dependent attackers to log into accounts whose password hash, as store…
-
Unscored —
Multiple buffer overflows in LGSERVER.EXE in CA BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.1…
-
Unscored —
Unspecified vulnerability in IBM OS/400 R530 and R535 has unknown impact and remote attack vectors, related to an "Inte…
-
Unscored —
Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 6.20, 6.4x, 7.01, and 7.50 allows remote attacke…
-
Unscored —
Directory traversal vulnerability in Conti FTPServer 1.0 Build 2.8 allows remote attackers to read arbitrary files and …
-
Unscored —
The FTP server in the NEC MultiWriter 1700C allows remote attackers to redirect traffic to other sites (aka FTP bounce)…
-
Unscored —
The web server in the NEC MultiWriter 1700C allows remote attackers to modify the device configuration via unspecified …
-
Unscored —CVE-2006-6951 Public exploit
Cross-site scripting (XSS) vulnerability in blog.php in OdysseusBlog allows remote attackers to inject arbitrary web sc…
-
Unscored —
Conti FTPServer 1.0 Build 2.8 stores user passwords in cleartext in MyServerSettings.ini, which allows local users to o…
-
Unscored —
MyODBC Japanese conversion edition 3.51.06, 2.50.29, and 2.50.25 allows remote attackers to cause a denial of service v…
-
Unscored —
BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2 does not properly set the severity …
-
Unscored —
AVM Fritz!Box 7050, and possibly other product models, allows remote attackers to cause a denial of service (VoIP appli…
-
Unscored —
T-Com Speedport 500V routers with firmware 1.31 allow remote attackers to bypass authentication and reconfigure the dev…
-
Unscored —
Unspecified vulnerability in BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2, when …
-
Unscored —CVE-2007-0429 Public exploit
DivXBrowserPlugin (aka DivX Web Player) npdivx32.dll, as distributed with DivX Player 6.4.1, allows remote attackers to…
-
Unscored —CVE-2007-0430 Public exploit
The shared_region_map_file_np function in Apple Mac OS X 10.4.8 and earlier kernel allows local users to cause a denial…
-
Unscored —
Unspecified vulnerability in the chtbl_lookup function in hash.c for WzdFTPD 8.0 and earlier allows remote attackers to…
-
Unscored —
BEA AquaLogic Service Bus 2.0, 2.1, and 2.5 does not properly reject malformed request messages to a proxy service, whi…
-
Unscored —
BEA WebLogic Server 7.0 through 7.0 SP7, 8.1 through 8.1 SP5, 9.0, and 9.1, when using the WebLogic Server 6.1 compatib…
-
Unscored —
The BEA WebLogic Server proxy plug-in before June 2006 for the Apache HTTP Server does not properly handle protocol err…
-
Unscored —
BEA WebLogic Server 8.1 through 8.1 SP5, 9.0, 9.1, and 9.2 Gold, when WS-Security is used, does not properly validate c…
-
Unscored —
Unspecified vulnerability in the thread management in BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9…
-
High —
Django Arbitrary Code Execution
bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a (1) .po or (2) .mo file.
-
Unscored —
Untrusted search path vulnerability in writeconfig in Apple Mac OS X 10.4.8 allows local users to gain privileges via a…
-
Unscored —
BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the…
-
Unscored —
BEA WebLogic Server 6.1 through 6.1 SP7, and 7.0 through 7.0 SP7 allows remote attackers to cause a denial of service (…
-
Unscored —
Unspecified vulnerability in the BEA WebLogic Server proxy plug-in for Netscape Enterprise Server before September 2006…
-
Unscored —
The WSEE runtime (WS-Security runtime) in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when decrypting c…
-
Unscored —
Multiple buffer overflows in the (1) main function in (a) client.c, and the (2) server_setup and (3) server_client_conn…
-
Unscored —
BEA WebLogic Server 8.1 through 8.1 SP5 stores cleartext data in a backup of config.xml after offline editing, which al…
-
Unscored —
BEA WebLogic Server 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1 does not enforce a security policy that decl…
-
Unscored —
BEA WebLogic Portal 9.2 does not properly handle when an administrator deletes entitlements for a role, which causes ot…
-
Unscored —
BEA Weblogic Server 8.1 through 8.1 SP4 does not properly validate client certificates when reusing cached connections,…
-
Unscored —
BEA WebLogic Server 9.0, 9.1, and 9.2 Gold allows remote attackers to obtain sensitive information via malformed HTTP r…
-
Unscored —
Format string vulnerability in Apple iChat 3.1.6 allows remote attackers to cause a denial of service (null pointer der…
-
Unscored —
BEA WebLogic Server 8.1 through 8.1 SP5 does not properly enforce access control after a dynamic update and dynamic red…
-
Unscored —
BEA WebLogic Portal 9.2, when running in a WebLogic Server clustered environment using WebLogic Portal entitlements, do…
-
Unscored —
Unspecified vulnerability in BEA WebLogic Platform and Server 8.1 through 8.1 SP5, and JRockit 1.4.2 R4.5 and earlier, …
-
Medium —
Django Improper Access Control
The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user.
-
Unscored —
Stack-based buffer overflow in Microsoft Help Workshop 4.03.0002 allows user-assisted remote attackers to execute arbit…