Archive
April 2007
Vulnerabilities first published in this month (UTC), newest first.
631 results · Feed
-
Unscored —
EMC RSA Security SiteKey allows remote attackers to display the correct image via a man-in-the-middle (MITM) attack in …
-
Unscored —
EMC RSA Security SiteKey does not set the secure qualifier on the SiteKey Flash token (aka the PassMark Flash shared ob…
-
Unscored —
EMC RSA Security SiteKey issues challenge-bypass tokens that persist forever without a cancellation interface for end u…
-
Unscored —
The Google Web Toolkit (GWT) framework exchanges data using JavaScript Object Notation (JSON) without an associated pro…
-
Unscored —
The Getahead Direct Web Remoting (DWR) framework 1.1.4 exchanges data using JavaScript Object Notation (JSON) without a…
-
Unscored —CVE-2007-2380 EPSS 12%
The Microsoft Atlas framework exchanges data using JavaScript Object Notation (JSON) without an associated protection s…
-
Unscored —CVE-2007-2372 Public exploit
admin/send_mod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exi…
-
Unscored —
The MochiKit framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, …
-
Unscored —
The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without a…
-
Unscored —
The jQuery framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, wh…
-
Unscored —CVE-2007-2373 Public exploit
SQL injection vulnerability in viewcat.php in the WF-Links (wflinks) 1.03 and earlier module for XOOPS allows remote at…
-
Unscored —CVE-2007-2368 Public exploit
picture.php in WebSPELL 4.01.02 and earlier allows remote attackers to read arbitrary files via the file parameter.
-
Unscored —
The Yahoo! UI framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme,…
-
Unscored —CVE-2007-2371 Public exploit
admin/index.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier provides access to configuration modificatio…
-
Unscored —
The agent remote upgrade interface in Symantec Enterprise Security Manager (ESM) before 20070405 does not verify the au…
-
Unscored —CVE-2007-2374 EPSS 17%
Unspecified vulnerability in Microsoft Windows 2000, XP, and Server 2003 allows user-assisted remote attackers to execu…
-
Unscored —CVE-2007-2369 Public exploit
Directory traversal vulnerability in picture.php in WebSPELL 4.01.02 and earlier, when PHP before 4.3.0 is used, allows…
-
Unscored —
The Dojo framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, whic…
-
Unscored —CVE-2007-2367 Public exploit
Buffer overflow in wserve_console.exe in Wserve HTTP Server (whttp) 4.6 allows remote attackers to cause a denial of se…
-
Unscored —CVE-2007-2370 Public exploit
SQL injection vulnerability in index.php in the John Mordo Jobs 2.4 and earlier module for XOOPS allows remote attacker…
-
Unscored —
The Moo.fx framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, wh…
-
Unscored —
The Script.aculo.us framework exchanges data using JavaScript Object Notation (JSON) without an associated protection s…
-
Unscored —
Unspecified vulnerability in IBM WebSphere Application Server (WAS) before 5.1.1.14, and WAS for z/OS 601 before 6.0.2.…
-
Unscored —
ncp in Novell eDirectory before 8.7.3 SP9, and 8.8.x before 8.8.1 FTF2, does not properly handle NCP fragments with a n…
-
Unscored —
Buffer overflow in Corel Paint Shop Pro 11.20 allows user-assisted remote attackers to execute arbitrary code via a cra…
-
Unscored —
Buffer overflow in Adobe Photoshop CS2 and CS3, Photoshop Elements 5.0, Illustrator CS3, and GoLive 9 allows user-assis…
-
Unscored —CVE-2007-2363 Public exploit
Buffer overflow in IrfanView 4.00 and earlier allows user-assisted remote attackers to execute arbitrary code via a cra…
-
Unscored —
Buffer overflow in Ghost Service Manager, as used in Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery,…
-
Unscored —
Unspecified vulnerability in the HP Power Manager Remote Agent (RA) 4.0Build10 and earlier in HP-UX B.11.11 and B.11.23…
-
Unscored —
Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user…
-
Unscored —
Multiple format string vulnerabilities in AFFLIB 2.2.6 allow remote attackers to execute arbitrary code via certain com…
-
Unscored —
Multiple format string vulnerabilities in AFFLIB before 2.2.6 allow remote attackers to execute arbitrary code via cert…
-
Unscored —
Cross-site scripting (XSS) vulnerability in mods/Core/result.php in SineCms 2.3.4 allows remote attackers to inject arb…
-
Medium 5.3
Apache Axis allows Exposure of Sensitive Information to an Unauthorized Actor
Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
-
Unscored —
Multiple stack-based buffer overflows in AFFLIB before 2.2.6 allow remote attackers to cause a denial of service (crash…
-
Unscored —
Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Invision Power Board (IP.Board) 2.1.x and 2.2.x allows remote attackers to …
-
Unscored —
File descriptor leak in the PDF handler in Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service…
-
Unscored —CVE-2007-2364 Public exploit
Multiple PHP remote file inclusion vulnerabilities in burnCMS 0.2 and earlier allow remote attackers to execute arbitra…
-
Unscored —
AFFLIB 2.2.8 and earlier allows attackers to execute arbitrary commands via shell metacharacters involving (1) certain …