Archive
December 2007
Vulnerabilities first published in this month (UTC), newest first.
436 results · Feed
-
Unscored —
Multiple buffer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allow user-assisted remote attackers…
-
Unscored —
Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allows user-assisted remote attackers to force a client to downlo…
-
Unscored —CVE-2007-6270 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Absolute News Manager.NET 5.1 allow remote attackers to inject a…
-
Unscored —
Stack-based buffer overflow in emacs allows user-assisted attackers to cause a denial of service (application crash) an…
-
Unscored —CVE-2007-6269 Public exploit
Multiple SQL injection vulnerabilities in xlaabsolutenm.aspx in Absolute News Manager.NET 5.1 allow remote attackers to…
-
Unscored —CVE-2007-6273 Public exploit
Multiple format string vulnerabilities in the configuration file in SonicWALL GLobal VPN Client 3.1.556 and 4.0.0.810 a…
-
Unscored —CVE-2007-6271 Public exploit
Absolute News Manager.NET 5.1 allows remote attackers to obtain sensitive information via a direct request to getpath.a…
-
Unscored —
Multiple integer overflows in libext2fs in e2fsprogs before 1.40.3 allow user-assisted remote attackers to execute arbi…
-
Unscored —
The dataconn function in ftpd.c in netkit ftpd (netkit-ftpd) 0.17, when certain modifications to support SSL have been …
-
Unscored —
The iwl_set_rate function in compatible/iwl3945-base.c in iwlwifi 1.1.21 and earlier dereferences an iwl_get_hw_mode re…
-
Unscored —
The gss_userok function in appl/ftp/ftpd/gss_userok.c in Heimdal 0.7.2 does not allocate memory for the ticketfile poin…
-
Unscored —
Double free vulnerability in the getreply function in ftp.c in netkit ftp (netkit-ftp) 0.17 20040614 and later allows r…
-
Unscored —
Multiple unspecified vulnerabilities in the H.323 protocol implementation for Sun SunForum 3.2 and 3D 1.0 allow remote …
-
Unscored —CVE-2007-4575 EPSS 14%
HSQLDB before 1.8.0.9, as used in OpenOffice.org (OOo) 2 before 2.3.1, allows user-assisted remote attackers to execute…
-
Unscored —
A certain ActiveX control in axvlc.dll in VideoLAN VLC 0.8.6 before 0.8.6d allows remote attackers to execute arbitrary…
-
Unscored —
The installation process for Oracle 10g and llg uses accounts with default passwords, which allows remote attackers to …
-
Unscored —
Unspecified vulnerability in HP Select Identity 4.01 before 4.01.012 and 4.1x before 4.13.003 allows remote attackers t…
-
Unscored —CVE-2007-6261 Public exploit
Integer overflow in the load_threadstack function in the Mach-O loader (mach_loader.c) in the xnu kernel in Apple Mac O…
-
Unscored —
Double free vulnerability in the krb5_def_store_mkey function in lib/kdb/kdb_default.c in MIT Kerberos 5 (krb5) 1.5 has…
-
Unscored —
Double free vulnerability in the gss_krb5int_make_seal_token_v3 function in lib/gssapi/krb5/k5sealv3.c in MIT Kerberos …
-
Unscored —
Integer overflow in the svcauth_gss_get_principal function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (krb5) allows re…
-
Unscored —
The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when a…
-
Unscored —
Use-after-free vulnerability in the gss_indicate_mechs function in lib/gssapi/mechglue/g_initialize.c in MIT Kerberos 5…
-
Unscored —
SQL injection vulnerability in post.php in Beehive Forum 0.7.1 and earlier allows remote attackers to execute arbitrary…
-
Unscored —
Multiple unspecified vulnerabilities in Beehive Forum 0.7.1 have unknown "critical" impact and attack vectors, differen…
-
Unscored —CVE-2007-6240 Public exploit
SQL injection vulnerability in active.asp in Snitz Forums 2000 3.4.06 allows remote attackers to execute arbitrary SQL …
-
Medium 5.3
Mortbay Jetty vulnerable to Cross-site scripting
Cross-site scripting (XSS) vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies.
-
High 7.3
Improper Authentication in Mortbay Jetty
Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.
-
Unscored —CVE-2007-5355 EPSS 17%
The Web Proxy Auto-Discovery (WPAD) feature in Microsoft Internet Explorer 6 and 7, when a primary DNS suffix with thre…
-
Medium —
Mortbay Jetty CRLF Injection Vulnerability
CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
-
Unscored —CVE-2007-6231 Public exploit
Multiple PHP remote file inclusion vulnerabilities in tellmatic 1.0.7 allow remote attackers to execute arbitrary PHP c…
-
Unscored —
Unspecified vulnerability in Sun Solaris 10, when 64bit mode is used on the x86 platform, allows local users in a Linux…
-
Unscored —
The American Power Conversion (APC) AP7932 0u 30amp Switched Rack Power Distribution Unit (PDU), with rpdu 3.5.5 and ao…
-
Unscored —
Unspecified vulnerability in Apple QuickTime 7.2 on Windows XP allows remote attackers to execute arbitrary code via un…
-
Unscored —CVE-2007-6239 EPSS 27%
The "cache update reply processing" functionality in Squid 2.x before 2.6.STABLE17 and Squid 3.0 allows remote attacker…
-
Unscored —CVE-2007-6229 Public exploit
PHP remote file inclusion vulnerability in common/classes/class_HeaderHandler.lib.php in Rayzz Script 2.0 allows remote…
-
Unscored —
The RealNetworks RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll, as shipped with RealPlayer 11, allows remo…
-
Unscored —
Microsoft Windows Media Player (WMP) allows remote attackers to cause a denial of service (application crash) via a cer…
-
Unscored —CVE-2007-6232 Public exploit
Cross-site scripting (XSS) vulnerability in index.php in FTP Admin 0.1.0 allows remote attackers to inject arbitrary we…
-
Unscored —CVE-2007-6234 Public exploit
index.php in FTP Admin 0.1.0 allows remote attackers to bypass authentication and obtain administrative access via a lo…