Weekly Vulnerabilities Reports > July 30 to August 5, 2007

Overview

121 new vulnerabilities reported during this period, including 14 critical vulnerabilities and 26 high severity vulnerabilities. This weekly summary report vulnerabilities in 112 products from 73 vendors including Apple, Alstrasoft, Tibco, Codewidgets, and Visionsoft. Vulnerabilities are notably categorized as "Improper Restriction of Operations within the Bounds of a Memory Buffer", "Cross-site Scripting", "SQL Injection", "Path Traversal", and "Configuration".

  • 116 reported vulnerabilities are remotely exploitables.
  • 16 reported vulnerabilities have public exploit available.
  • 9 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
  • 113 reported vulnerabilities are exploitable by an anonymous user.
  • Apple has the most reported vulnerabilities, with 16 reported vulnerabilities.
  • Visionsoft has the most reported critical vulnerabilities, with 4 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

14 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2007-08-03 CVE-2007-4150 Visionsoft Remote vulnerability in Visionsoft Audit 12.4.0.0

The Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0 uses weak cryptography (XOR) when (1) transmitting passwords, which allows remote attackers to obtain sensitive information by sniffing the network; and (2) storing passwords in the configuration file, which allows local users to obtain sensitive information by reading this file.

10.0
2007-08-03 CVE-2007-4149 Visionsoft Remote vulnerability in Visionsoft Audit 12.4.0.0

The Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0 does not require authentication for (1) the "LOG." command, which allows remote attackers to create or overwrite arbitrary files; (2) the SETTINGSFILE command, which allows remote attackers to overwrite the ini file, and reconfigure VSAOD or cause a denial of service; or (3) the UNINSTALL command, which allows remote attackers to cause a denial of service (daemon shutdown).

10.0
2007-08-03 CVE-2007-4148 Visionsoft Remote vulnerability in Visionsoft Audit 12.4.0.0

Heap-based buffer overflow in the Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0 allows remote attackers to cause a denial of service (persistent daemon crashes) or execute arbitrary code via a long filename in a "LOG." command.

10.0
2007-08-01 CVE-2007-4121 E Commerce Solutions Products admin.aspx SQL Injection vulnerability in E-Commerce Solutions products

Multiple SQL injection vulnerabilities in admin.aspx in E-Commerce Scripts Shopping Cart Script, Multi-Vendor E-Shop Script, and Auction Script allow remote attackers to execute arbitrary SQL commands via the (1) EmailAdd (Username) and (2) Pass (password) parameters.

10.0
2007-07-30 CVE-2007-4074 Centre FOR Speech Technology Research
Suse
Configuration vulnerability in multiple products

The default configuration of Centre for Speech Technology Research (CSTR) Festival 1.95 beta (aka 2.0 beta) on Gentoo Linux, SUSE Linux, and possibly other distributions, is run locally with elevated privileges without requiring authentication, which allows local and remote attackers to execute arbitrary commands via the local daemon on port 1314, a different vulnerability than CVE-2001-0956.

10.0
2007-07-30 CVE-2007-3911 Bakbone Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Bakbone Netvault Reporter

Multiple heap-based buffer overflows in (1) clsscheduler.exe (aka scheduler client) and (2) srvscheduler.exe (aka scheduler server) in BakBone NetVault Reporter 3.5 before Update4 allow remote attackers to execute arbitrary code via long filename arguments in HTTP requests.

10.0
2007-07-30 CVE-2007-4050 Adempiere Authentication Bypass vulnerability in ADempiere Bazaar WebUI

Unspecified vulnerability in WebUI in ADempiere Bazaar before 3.3 beta Victoria edition allows remote attackers to access system-level windows via unspecified vectors.

10.0
2007-08-03 CVE-2007-4155 EMC Remote Code Execution vulnerability in EMC VMWare 6.0.0

Absolute path traversal vulnerability in a certain ActiveX control in vielib.dll in EMC VMware 6.0.0 allows remote attackers to execute arbitrary local programs via a full pathname in the first two arguments to the (1) CreateProcess or (2) CreateProcessEx method.

9.3
2007-08-03 CVE-2007-4152 Visionsoft Remote vulnerability in Visionsoft Audit 12.4.0.0

The Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0 allows remote attackers to conduct replay attacks by capturing and resending data from the DETAILS and PROCESS sections of a session that schedules an audit.

9.3
2007-08-01 CVE-2007-4120 Jelsoft Remote File Include vulnerability in Jelsoft Vbulletin 3.6.5

** DISPUTED ** Multiple PHP remote file inclusion vulnerabilities in Jelsoft vBulletin 3.6.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) classfile parameter to includes/functions.php, the (2) nextitem parameter to includes/functions_cron.php, and the (3) specialtemplates parameter to includes/functions_forumdisplay.php.

9.3
2007-07-31 CVE-2007-4105 Baidu Remote Code Execution vulnerability in Baidu Soba Search BAR 5.4

A certain ActiveX control in BaiduBar.dll in Baidu Soba Search Bar 5.4 allows remote attackers to execute arbitrary code via a request containing "a link to download and a file to execute," possibly involving remote file inclusion.

9.3
2007-07-30 CVE-2007-4067 Clever Components Unspecified vulnerability in Clever Components Internet Activex Suite

Absolute path traversal vulnerability in the clInetSuiteX6.clWebDav ActiveX control in CLINETSUITEX6.OCX in Clever Internet ActiveX Suite 6.2 allows remote attackers to create or overwrite arbitrary files via a full pathname in the second argument to the GetToFile method.

9.3
2007-07-30 CVE-2007-4061 Nessus Multiple vulnerability in Nessus vulnerability Scanner 3.0.6

Directory traversal vulnerability in a certain ActiveX control in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to create or overwrite arbitrary files via a ..

9.3
2007-07-30 CVE-2007-4060 Frank Yaul Buffer Overflow vulnerability in Frank Yaul Corehttp 0.5.3Alpha

Multiple buffer overflows in the HttpSprockMake function in http.c in Frank Yaul corehttp 0.5.3alpha allow remote attackers to execute arbitrary code via a long string in the (1) method name or (2) URI in an HTTP request.

9.0

26 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2007-08-03 CVE-2007-4162 Tibco Remote Security vulnerability in Tibco Rendezvous 7.5.2

TIBCO Rendezvous (RV) 7.5.2 does not protect confidentiality or integrity of inter-daemon communication, which allows remote attackers to capture and spoof traffic.

7.8
2007-08-03 CVE-2007-4158 Tibco Resource Management Errors vulnerability in Tibco Rendezvous 7.5.2/7.5.3/7.5.4

Memory leak in TIBCO Rendezvous (RV) daemon (rvd) 7.5.2, 7.5.3 and 7.5.4 allows remote attackers to cause a denial of service (memory consumption) via a packet with a length field of zero, a different vulnerability than CVE-2006-2830.

7.8
2007-07-31 CVE-2007-4103 Digium Remote Denial of Service vulnerability in Digium products

The IAX2 channel driver (chan_iax2) in Asterisk Open 1.2.x before 1.2.23, 1.4.x before 1.4.9, and Asterisk Appliance Developer Kit before 0.6.0, when configured to allow unauthenticated calls, allows remote attackers to cause a denial of service (resource exhaustion) via a flood of calls that do not complete a 3-way handshake, which causes an ast_channel to be allocated but not released.

7.8
2007-07-30 CVE-2007-4093 Minb Information Disclosure vulnerability in Minb IS NOT A Blog 0.1.0

Minb Is Not a Blog (minb) stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing usernames and encrypted passwords via a direct request for db/users.db.

7.8
2007-07-30 CVE-2007-4062 Nessus Path Traversal vulnerability in Nessus vulnerability Scanner 3.0.6

The SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to delete arbitrary files via unspecified vectors involving the deleteNessusRC method, probably a directory traversal vulnerability.

7.8
2007-08-03 CVE-2007-4163 Index Script SQL-Injection vulnerability in Index Script 2.7/2.8

Multiple SQL injection vulnerabilities in IndexScript 2.7 and 2.8 before 20070726 allow remote attackers to execute arbitrary SQL commands via the (1) cat_id, (2) start_id, (3) row[parent_id], and (4) row[cat_id] parameters to unspecified components, related to use of these parameters within include/utils.php.

7.5
2007-08-03 CVE-2007-4156 Woliocms SQL Injection vulnerability in WolioCMS

Multiple SQL injection vulnerabilities in wolioCMS allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to member.php in a page action, related to a SELECT statement in common.php; and the (2) loginid parameter (uid variable), and possibly the (3) pwd parameter, to admin/index.php.

7.5
2007-08-03 CVE-2007-4147 Interspire Multiple Unspecified vulnerability in Interspire Articlelive NX 0.3/0.4

Multiple unspecified vulnerabilities in Interspire ArticleLive NX before 1.7.1.2 have unknown impact and attack vectors, possibly related to (1) AL_SANITIZE and (2) "Calling the constructor to make sure things are checked, safe mode, etc."

7.5
2007-08-01 CVE-2007-4128 Firestorm Technologies SQL Injection vulnerability in Firestorm Technologies Gmaps 1.00

SQL injection vulnerability in index.php in the Firestorm Technologies GMaps (com_gmaps) 1.00 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the mapId parameter in a viewmap action.

7.5
2007-08-01 CVE-2007-4119 Berthanas Ziyaretci SQL Injection vulnerability in Berthanas Ziyaretci Defteri 2.0

Multiple SQL injection vulnerabilities in yonetici.asp in Berthanas Ziyaretci Defteri 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) user and (2) Pass fields.

7.5
2007-08-01 CVE-2007-4118 JX Development Remote Security vulnerability in JX Development PHPvoter 0.6

PHP remote file inclusion vulnerability in includes/functions.inc.php in phpVoter 0.6 allows remote attackers to execute arbitrary PHP code via a URL in the sitepath parameter.

7.5
2007-07-31 CVE-2007-4114 Suskunduygular SQL Injection vulnerability in Suskunduygular Uyelik Sistemi 1.2

Multiple SQL injection vulnerabilities in unuttum.asp in SuskunDuygular Uyelik Sistemi 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) kadi or (2) email parameter.

7.5
2007-07-31 CVE-2007-4110 Codewidgets SQL Injection vulnerability in Message Board / Threaded Discussion Forum Sign_In.ASPX

SQL injection vulnerability in sign_in.aspx in Message Board / Threaded Discussion Forum Application Template allows remote attackers to execute arbitrary SQL commands via the Password parameter.

7.5
2007-07-31 CVE-2007-4109 Codewidgets SQL Injection vulnerability in Online Store Application Template Sign_In.ASPX

SQL injection vulnerability in sign_in.aspx in WebStore (Online Store Application Template) allows remote attackers to execute arbitrary SQL commands via the Password parameter.

7.5
2007-07-31 CVE-2007-4108 Codewidgets SQL Injection vulnerability in Online Event Registration Template Sign_In.ASPX

SQL injection vulnerability in sign_in.aspx in WebEvents (Online Event Registration Template) allows remote attackers to execute arbitrary SQL commands via the Password parameter.

7.5
2007-07-31 CVE-2007-4107 Phpmyforum SQL Injection vulnerability in phpMyForum EditPost.PHP

SQL injection vulnerability in editpost.php in phpMyForum before 4.1.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

7.5
2007-07-30 CVE-2007-4095 BSM Store SQL Injection vulnerability in BSM Store Dependent Forums 1.0.2

SQL injection vulnerability in BSM Store Dependent Forums 1.02 allows remote attackers to execute arbitrary SQL commands via a Username field in an unspecified component, probably the FrmUserName parameter in login.asp.

7.5
2007-07-30 CVE-2007-4094 Idevspot Remote Security vulnerability in PHPHostBot

PHP remote file inclusion vulnerability in library/authorize.php in IDevSpot PhpHostBot allows remote attackers to execute arbitrary PHP code via a URL in the login_form parameter, a different vector than CVE-2006-3776.

7.5
2007-07-30 CVE-2007-4084 Alstrasoft SQL-Injection vulnerability in Alstrasoft Affiliate Network PRO 8.0

Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to execute arbitrary SQL commands via (1) the pgmid parameter in an uploadProducts action to merchants/index.php and possibly (2) the rowid parameter to merchants/temp.php.

7.5
2007-07-30 CVE-2007-4076 ASP Indir SQL Injection vulnerability in ASP Indir Alisveris Sitesi Script 0

Multiple SQL injection vulnerabilities in index.asp in Alisveris Sitesi Scripti allow remote attackers to execute arbitrary SQL commands via the (1) product_id or (2) cat_id parameter in a product mod action.

7.5
2007-07-30 CVE-2007-4069 Index Script SQL Injection vulnerability in Index Script Index Script 2.8

SQL injection vulnerability in show_cat.php in IndexScript 2.8 and earlier allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.

7.5
2007-07-30 CVE-2007-4056 Adult Directory SQL Injection vulnerability in Adult Directory Adult Directory

SQL injection vulnerability in directory.php in Prozilla Adult Directory allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action.

7.5
2007-07-30 CVE-2007-4055 8Pixel NET SQL Injection vulnerability in 8Pixel.Net Simple Blog 3.0

SQL injection vulnerability in comments_get.asp in SimpleBlog 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

7.5
2007-07-30 CVE-2007-4054 Php123 SQL Injection vulnerability in PHP123 Top Sites Category.PHP

SQL injection vulnerability in category.php in PHP123 Top Sites allows remote attackers to execute arbitrary SQL commands via the cat parameter.

7.5
2007-07-30 CVE-2007-4053 Linpha SQL Injection vulnerability in LinPHA New_images.PHP

SQL injection vulnerability in include/img_view.class.php in LinPHA 1.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the order parameter to new_images.php.

7.5
2007-08-01 CVE-2007-4125 HP Remote Denial Of Service vulnerability in HP Hp-Ux 11.11/11.23/11.31

Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport functionality in HP-UX B.11.11, B.11.23, and B.11.31 allows remote attackers to cause an unspecified denial of service via unknown vectors.

7.1

78 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2007-08-03 CVE-2007-3743 Apple Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Apple Safari 3.0.0B/3.0.1B

Stack-based buffer overflow in bookmark handling in Apple Safari 3 Beta before Update 3.0.3 on Windows allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a bookmark with a long title.

6.8
2007-08-03 CVE-2007-3388 Trolltech Format String vulnerability in Trolltech Qt QTextEdit

Multiple format string vulnerabilities in (1) qtextedit.cpp, (2) qdatatable.cpp, (3) qsqldatabase.cpp, (4) qsqlindex.cpp, (5) qsqlrecord.cpp, (6) qglobal.cpp, and (7) qsvgdevice.cpp in QTextEdit in Trolltech Qt 3 before 3.3.8 20070727 allow remote attackers to execute arbitrary code via format string specifiers in text used to compose an error message.

6.8
2007-08-03 CVE-2007-2408 Apple Improper Input Validation vulnerability in Apple Safari 3.0.1/3.0.2

WebKit in Apple Safari 3 Beta before Update 3.0.3 does not properly recognize an unchecked "Enable Java" setting, which allows remote attackers to execute Java applets via a crafted web page.

6.8
2007-08-03 CVE-2007-4140 LFS Buffer Overflow vulnerability in LFS Live for Speed S2 Alphapatch0.5

Buffer overflow in Live for Speed (LFS) S2 ALPHA PATCH 0.5x allows user-assisted remote attackers to execute arbitrary code via a .mpr file (replay file) that contains a long car name.

6.8
2007-08-03 CVE-2007-3747 Apple Multiple Security vulnerability in Apple Mac OS X 2007-007

The Java interface to CoreAudio on Apple Mac OS X 10.3.9 and 10.4.10 does not restrict object instantiation and manipulation to valid heap addresses, which allows remote attackers to execute arbitrary code via a crafted applet.

6.8
2007-08-03 CVE-2007-3746 Apple Multiple Security vulnerability in Apple Mac OS X 2007-007

The Java interface to CoreAudio on Apple Mac OS X 10.3.9 and 10.4.10 does not properly check the bounds of heap read and write operations, which allows remote attackers to execute arbitrary code via a crafted applet.

6.8
2007-08-03 CVE-2007-3745 Apple Multiple Security vulnerability in Apple Mac OS X 2007-007

The Java interface to CoreAudio on Apple Mac OS X 10.3.9 and 10.4.10 contains an unsafe interface that is exposed by JDirect, which allows remote attackers to free arbitrary memory and thereby execute arbitrary code.

6.8
2007-08-03 CVE-2007-2406 Apple Multiple Security vulnerability in Apple Mac OS X 2007-007

Quartz Composer on Apple Mac OS X 10.4.10 does not initialize a certain object pointer, which might allow user-assisted remote attackers to execute arbitrary code via a crafted Quartz Composer file.

6.8
2007-08-03 CVE-2007-2405 Apple Multiple Security vulnerability in Apple Mac OS X 2007-007

Integer underflow in Preview in PDFKit on Apple Mac OS X 10.4.10 allows remote attackers to execute arbitrary code via a crafted PDF file.

6.8
2007-08-03 CVE-2007-2403 Apple Multiple Security vulnerability in Apple Mac OS X 2007-007

CFNetwork on Apple Mac OS X 10.3.9 and 10.4.10 does not properly validate ftp: URIs, which allows remote attackers to trigger the transmission of arbitrary FTP commands to arbitrary FTP servers.

6.8
2007-08-01 CVE-2007-4127 LE Ralf Unspecified vulnerability in LE Ralf Image Gallery 1.0

** DISPUTED ** PHP remote file inclusion vulnerability in check_entry.php in Ralf Image Gallery (RIG), aka Raphael Moll RIG Image Gallery, 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the dir_abs_src parameter.

6.8
2007-08-01 CVE-2007-4117 Platon Unspecified vulnerability in Platon PHPwebfilemanager 0.5

** DISPUTED ** PHP remote file inclusion vulnerability in index.php in phpWebFileManager 0.5 allows remote attackers to execute arbitrary PHP code via a URL in the PN_PathPrefix parameter.

6.8
2007-07-31 CVE-2007-4116 Metyus SQL Injection vulnerability in Metyus Forum Portal 1.0

SQL injection vulnerability in philboard_forum.asp in Metyus Forum Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the forumid parameter.

6.8
2007-07-31 CVE-2007-4112 Advanced Webhost Billing System Multiple vulnerability in Advanced Webhost Billing System

Multiple SQL injection vulnerabilities in Advanced Webhost Billing System (AWBS) before 2.6.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

6.8
2007-07-31 CVE-2007-4111 Codewidgets SQL Injection vulnerability in Real Estate Listing Website Application Template Login Dialog

SQL injection vulnerability in the login script in Real Estate listing website application template, when logging in as user or manager, allows remote attackers to execute arbitrary SQL commands via the Password parameter.

6.8
2007-07-31 CVE-2007-4106 Codewidgets SQL Injection vulnerability in Pay Roll Time Sheet and Punch Card Application With Web UI Login.ASP

SQL injection vulnerability in login.asp in CodeWidgets Pay Roll - Time Sheet and Punch Card Application With Web Interface allows remote attackers to execute arbitrary SQL commands via the Password parameter.

6.8
2007-07-31 CVE-2007-4101 Global Centre Remote File Include vulnerability in Global Centre Aplomb Poll 1.1

Multiple PHP remote file inclusion vulnerabilities in Madoa Poll 1.1 allow remote attackers to execute arbitrary PHP code via the Madoa parameter to (1) index.php, (2) vote.php, and (3) admin.php.

6.8
2007-07-31 CVE-2007-2953 VIM Development Group Remote Format String vulnerability in VIM Development Group VIM 7.0/7.1/7.1.38

Format string vulnerability in the helptags_one function in src/ex_cmds.c in Vim 6.4 and earlier, and 7.x up to 7.1, allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a help-tags tag in a help file, related to the helptags command.

6.8
2007-07-30 CVE-2007-3387 Apple
Freedesktop
Gpdf Project
Xpdfreader
Debian
Canonical
Integer Overflow OR Wraparound vulnerability in multiple products

Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function.

6.8
2007-07-30 CVE-2007-4086 Alstrasoft SQL-Injection vulnerability in Video Share Enterprise

Multiple SQL injection vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to execute arbitrary SQL commands via (1) the gid parameter to gmembers.php, or (2) the UID parameter to (a) uvideos.php, (b) ugroups.php, (c) uprofile.php, (d) ufavour.php, (e) ufriends.php, or (f) uplaylist.php.

6.8
2007-07-30 CVE-2007-4085 Alstrasoft SQL-Injection vulnerability in AskMe Pro

Multiple SQL injection vulnerabilities in AlstraSoft AskMe Pro allow remote attackers to execute arbitrary SQL commands via the (1) que_id parameter to forum_answer.php or (2) the cat_id parameter to search.php.

6.8
2007-08-03 CVE-2007-4154 Wordpress SQL-Injection vulnerability in Wordpress 2.2.1

SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the page_options parameter to (1) options-general.php, (2) options-writing.php, (3) options-reading.php, (4) options-discussion.php, (5) options-privacy.php, (6) options-permalink.php, (7) options-misc.php, and possibly other unspecified components.

6.5
2007-07-30 CVE-2007-4057 Neocrome Unspecified vulnerability in Neocrome Seditio

Unrestricted file upload vulnerability in pfs.php in Neocrome Seditio 121 and earlier allows remote authenticated users to upload arbitrary PHP code via a filename ending with (1) .php.gif, (2) .php.jpg, or (3) .php.png.

6.5
2007-07-30 CVE-2007-4097 TOR Multiple vulnerability And Information Disclosure Weaknesses in Tor

Tor before 0.1.2.15 sends "destroy cells" containing the reason for tearing down a circuit, which allows remote attackers to obtain sensitive information, contrary to specifications.

6.4
2007-07-30 CVE-2007-4080 Alstrasoft Cross-Site Scripting vulnerability in Alstrasoft E-Friends 4.0

Cross-site scripting (XSS) vulnerability in index.php AlstraSoft E-Friends allows remote attackers to inject arbitrary web script or HTML via the p_id parameter in a people_card action.

6.4
2007-08-03 CVE-2007-3744 Apple Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Apple mac OS X and mac OS X Server

Heap-based buffer overflow in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) implementation in mDNSResponder on Apple Mac OS X 10.4.10 before 20070731 allows network-adjacent remote attackers to execute arbitrary code via a crafted packet.

5.8
2007-07-30 CVE-2007-4099 TOR Multiple vulnerability And Information Disclosure Weaknesses in Tor

Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.

5.8
2007-07-30 CVE-2007-4098 TOR Multiple vulnerability And Information Disclosure Weaknesses in Tor

Tor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might allow remote attackers with control over Tor routers to inject cells into arbitrary streams.

5.8
2007-07-30 CVE-2007-4096 TOR Multiple vulnerability And Information Disclosure Weaknesses in Tor

Buffer overflow in Tor before 0.1.2.15, when using BSD natd support, allows remote attackers to cause a denial of service via unspecified vectors.

5.8
2007-07-30 CVE-2007-4068 Webyapar SQL Injection vulnerability in Webyapar 2.0

Multiple SQL injection vulnerabilities in Webyapar 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the kat_id parameter to the default URI in a download action or (2) the id parameter to the default URI in a duyurular_detay action.

5.8
2007-07-30 CVE-2007-4059 Vmware Unspecified vulnerability in VMWare Workstation 5.5.3

Absolute path traversal vulnerability in a certain ActiveX control in IntraProcessLogging.dll 5.5.3.42958 in EMC VMware allows remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the SetLogFileName method.

5.8
2007-08-03 CVE-2007-3748 Apple Multiple Security vulnerability in Apple Mac OS X 2007-007

Buffer overflow in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) implementation in iChat on Apple Mac OS X 10.3.9 and 10.4.10 allows network-adjacent remote attackers to execute arbitrary code via a crafted packet.

5.4
2007-08-03 CVE-2007-4160 Tibco Remote Security vulnerability in Tibco Rendezvous 7.5.2

The default configuration of TIBCO Rendezvous (RV) 7.5.2 clients, when -no-multicast is omitted, uses a multicast group as the destination for a network message, which might make it easier for remote attackers to capture message contents by sniffing the network.

5.0
2007-08-03 CVE-2007-4159 Tibco Information Disclosure vulnerability in Tibco Rendezvous 7.5.2

index.html in the HTTP administration interface in certain daemons in TIBCO Rendezvous (RV) 7.5.2 allows remote attackers to obtain sensitive information, such as a user name and IP addresses, via a direct request.

5.0
2007-08-03 CVE-2007-4157 Phpblogger Information Disclosure vulnerability in PHPblogger PHP-Blogger 2.2.7

PHPBlogger stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing an admin password hash via a direct request for data/pref.db.

5.0
2007-08-03 CVE-2007-2404 Apple Multiple Security vulnerability in Apple Mac OS X 2007-007

CRLF injection vulnerability in CFNetwork on Apple Mac OS X 10.3.9 and 10.4.10 before 20070731 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in an unspecified context.

5.0
2007-08-01 CVE-2007-4123 Hitachi Information Disclosure vulnerability in Groupmax Groupware Server

The Groupmax Scheduler_Facilities management tool in Hitachi Groupmax Groupware Server 07-00-/F through 07-32-/A before 20070731 does not properly manage schedule server configuration data, which might allow attackers to obtain sensitive information via unspecified vectors.

5.0
2007-07-31 CVE-2007-4100 Mldonkey Unspecified vulnerability in Mldonkey

MLDonkey before 2.9.0 does not load certain code from $MLDONKEY/web_infos/ before the network modules become active, which allows remote attackers to bypass the IP blocklist.

5.0
2007-07-30 CVE-2007-4092 Ifoto Directory Traversal vulnerability in iFoto

Directory traversal vulnerability in index.php in iFoto 1.0.1 and earlier allows remote attackers to list arbitrary directories, and possibly download arbitrary photos, via a ..

5.0
2007-07-30 CVE-2007-4073 Tincan Remote Security vulnerability in Webbler CMS

Webbler CMS before 3.1.6 does not properly restrict use of "mail a friend" forms, which allows remote attackers to send arbitrary amounts of forged e-mail.

5.0
2007-07-30 CVE-2007-4072 Tincan Information Disclosure vulnerability in Webbler CMS

Webbler CMS before 3.1.6 provides the full installation path within HTML comments in certain documents, which allows remote attackers to obtain sensitive information by viewing the HTML source, as demonstrated by viewing the source generated from index.php.

5.0
2007-08-01 CVE-2007-4124 Hitachi Unspecified vulnerability in Hitachi products

The session failover function in Cosminexus Component Container in Cosminexus 6, 6.7, and 7 before 20070731, as used in multiple Hitachi products, can use session data for the wrong user under unspecified conditions, which might allow remote authenticated users to obtain sensitive information, corrupt another user's session data, and possibly gain privileges.

4.9
2007-07-30 CVE-2007-4070 SUN Information Disclosure vulnerability in SUN Solaris 10.0/8.0/9.0

Unspecified vulnerability in Low Bandwidth X proxy (lbxproxy) on Sun Solaris 8 through 10 before 20070725 allows local users to read arbitrary files with root group ownership via unknown vectors.

4.9
2007-07-30 CVE-2007-4051 Ultradefrag Buffer Overflow vulnerability in Ultradefrag 1.0.3

Heap-based buffer overflow in the FindFiles function in UltraDefrag 1.0.3 allows local users to gain privileges via a file with a long pathname.

4.6
2007-08-03 CVE-2007-4161 Tibco Denial-Of-Service vulnerability in Tibco Rendezvous 7.5.2

rvd in TIBCO Rendezvous (RV) 7.5.2, when -no-lead-wc is omitted, might allow remote attackers to cause a denial of service (network instability) via a subject name with a leading (1) '*' (asterisk) or (2) '>' (greater than) wildcard character.

4.3
2007-08-03 CVE-2007-4151 Visionsoft Remote vulnerability in Visionsoft Audit 12.4.0.0

The Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0 allows remote attackers to obtain sensitive information via (1) a LOG.ON command, which reveals the logging pathname in the server response; (2) a VER command, which reveals the version number in the server response; and (3) a connection, which reveals the version number in the banner.

4.3
2007-08-03 CVE-2007-4146 Webevents Cross-Site Scripting vulnerability in WebEvent Webevent.CGI

Cross-site scripting (XSS) vulnerability in webevent.cgi in WebEvent 2.61 through 4.03 allows remote attackers to inject arbitrary web script or HTML via the cmd parameter.

4.3
2007-08-03 CVE-2007-4145 Bluesky Buffer Overflow vulnerability in BlueSkyChat ActiveX Control

Heap-based buffer overflow in the BlueSkychat (BlueSkyCat) ActiveX control (V2.V2Ctrl.1) in v2.ocx 8.1.2.0 and earlier allows remote attackers to execute arbitrary code via a long string in the second argument to the ConnecttoServer method.

4.3
2007-08-03 CVE-2007-4144 Mitridat Cross-Site Scripting vulnerability in Mitridat Form Processor PRO

Cross-site scripting (XSS) vulnerability in sample-forms/simple-contact-form-with-preview/simple-contact-form-with-preview.html in MitriDAT eMail Form Processor Pro allows remote attackers to inject arbitrary web script or HTML via the base_path parameter, possibly related to (1) formprocessorpro.php in the PHP version of the product, and (2) formprocessorpro.pl in the Perl version of the product.

4.3
2007-08-03 CVE-2007-4142 IBM Cross-Site Scripting vulnerability in IBM Lotus Sametime Server

Cross-site scripting (XSS) vulnerability in IBM Lotus Sametime Server 7.5.1 before 20070731 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a crafted Sametime meeting.

4.3
2007-08-03 CVE-2007-3742 Apple Configuration vulnerability in Apple Safari 3.0.0B/3.0.1B

WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, does not properly handle the interaction between International Domain Name (IDN) support and Unicode fonts, which allows remote attackers to create a URL containing "look-alike characters" (homographs) and possibly perform phishing attacks.

4.3
2007-08-03 CVE-2007-4141 Openrat Cross-Site Scripting vulnerability in Openrat CMS 0.8Beta1

OpenRat CMS 0.8-beta1 and earlier allows remote attackers to obtain sensitive information via a request containing an XSS sequence in the action parameter to index.php, which reveals the path in an error message.

4.3
2007-08-03 CVE-2007-4139 Wordpress Cross-Site Scripting vulnerability in Wordpress 2.2.1

Cross-site scripting (XSS) vulnerability in the Temporary Uploads editing functionality (wp-admin/includes/upload.php) in WordPress 2.2.1, allows remote attackers to inject arbitrary web script or HTML via the style parameter to wp-admin/upload.php.

4.3
2007-08-03 CVE-2007-2410 Apple Multiple Security vulnerability in Apple Mac OS X 2007-007

WebCore on Apple Mac OS X 10.3.9 and 10.4.10 retains properties of certain global objects when a new URL is visited in the same window, which allows remote attackers to conduct cross-site scripting (XSS) attacks.

4.3
2007-08-03 CVE-2007-2409 Apple Multiple Security vulnerability in Apple Mac OS X 2007-007

Cross-domain vulnerability in WebCore on Apple Mac OS X 10.3.9 and 10.4.10 allows remote attackers to obtain sensitive information via a popup window, which is able to read the current URL of the parent window.

4.3
2007-08-01 CVE-2007-4122 Hitachi Denial Of Service vulnerability in Hitachi Jp1-Cm2-Hierarchical Viewer 06.00/06.71B

Unspecified vulnerability in Hitachi JP1/Cm2/Hierarchical Viewer (HV) 06-00 through 06-71-/B allows remote attackers to cause a denial of service (application stop and web interface outage) via certain "unexpected data."

4.3
2007-07-31 CVE-2007-4115 Itcms Cross-Site Scripting vulnerability in Itcms 0.2

Multiple cross-site scripting (XSS) vulnerabilities in IT!CMS (itcms) 0.2 allow remote attackers to inject arbitrary web script or HTML via the wndtitle parameter to (1) lang-en.php, (2) menu-ed.php, or (3) titletext-ed.php.

4.3
2007-07-31 CVE-2007-4104 WP Feedstats HTML Injection vulnerability in WordPress WP-FeedStats

Multiple cross-site scripting (XSS) vulnerabilities in the WP-FeedStats before 2.4 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, one of which involves an rss2 feed with an invalid or missing blog with an XSS sequence in the query string.

4.3
2007-07-31 CVE-2007-4102 Sblog Cross-Site Scripting vulnerability in Sblog 0.7.3Beta

Cross-site scripting (XSS) vulnerability in search.php for sBlog 0.7.3 Beta allows remote attackers to inject arbitrary HTML and web script via a leading '"/></> sequence in the search string.

4.3
2007-07-30 CVE-2007-4090 Vikingboard Cross-Site Scripting vulnerability in Vikingboard 0.1.2

Multiple cross-site scripting (XSS) vulnerabilities in Vikingboard 0.1.2 allow remote attackers to inject arbitrary web script or HTML via (1) the URI to inc/lib/screen.php or (2) the title parameter to post.php.

4.3
2007-07-30 CVE-2007-4089 Vikingboard Unspecified vulnerability in Vikingboard 0.1.2

Vikingboard 0.1.2 allows remote attackers to obtain sensitive information via the debug parameter to (1) forum.php, (2) cp.php, and possibly other unspecified components.

4.3
2007-07-30 CVE-2007-4088 Vikingboard Cross-Site Scripting vulnerability in Vikingboard 0.1.2

Multiple cross-site scripting (XSS) vulnerabilities in Vikingboard 0.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) id, (2) f, (3) quote, and (4) act parameters to cp.php; the (5) u parameter to user.php; the (6) f parameter to post.php; the (7) s parameter to topic.php; the (8) quote, (9) t, (10) poll, and (11) p parameters to post.php; the (12) Message Title field of a private message (PM) in mode 6 of cp.php; the (13) title field of a private message (PM) in mode 7 of cp.php; and (14) allow user-assisted remote attackers to inject arbitrary web script or HTML via a dosearch action to search.php, which reflects the first lines of all posts by a user.

4.3
2007-07-30 CVE-2007-4087 Alstrasoft Cross-Site Scripting vulnerability in Video Share Enterprise

AlstraSoft Video Share Enterprise allows remote attackers to obtain sensitive information (the full path) via (1) a ' (quote) character in the category parameter to view_video.php, or (2) an XSS sequence in the UID parameter to (a) uprofile.php, (b) channel_detail.php, (c) uvideos.php, (d) groups_home.php, or (e) ufriends.php.

4.3
2007-07-30 CVE-2007-4083 Alstrasoft Cross-Site Scripting vulnerability in AskMe Pro

Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft AskMe Pro allow remote attackers to inject arbitrary web script or HTML via (1) the cat_id parameter to search.php or the (2) typ parameter to register.php.

4.3
2007-07-30 CVE-2007-4082 Alstrasoft Cross-Site Scripting vulnerability in Article Manager Pro

Cross-site scripting (XSS) vulnerability in contact_author.php AlstraSoft Article Manager Pro allows remote attackers to inject arbitrary web script or HTML via the userid parameter.

4.3
2007-07-30 CVE-2007-4081 Alstrasoft Input Validation vulnerability in Alstrasoft Affiliate Network PRO 8.0

Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to inject arbitrary web script or HTML via vectors in (a) merchants/index.php, including the (1) id or (2) msg parameter in a programedit action; the (3) pgmid parameter in an uploadProducts action; the (4) d, (5) m, or (6) y parameter in a daily action; the (7) err parameter in a ProgramReport action; the (8) i, (9) txtto, (10) txtfrom, or (11) programs parameter in a LinkReport action; or the (12) msg parameter in an add_money action; and one vector in (b) merchants/temp.php using (13) the rowid parameter.

4.3
2007-07-30 CVE-2007-4079 Alstrasoft Cross-Site Scripting vulnerability in AlstraSoft SMS Text Messaging Enterprise

Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft SMS Text Messaging Enterprise allow remote attackers to inject arbitrary web script or HTML via the (1) domain or (2) q parameter to (a) admin/membersearch.php, or (3) the userid parameter to (b) admin/edituser.php.

4.3
2007-07-30 CVE-2007-4078 Alstrasoft Cross-Site Scripting vulnerability in Alstrasoft Text ADS Enterprise 2.1

Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Text Ads Enterprise allow remote attackers to inject arbitrary web script or HTML via the (1) r parameter to (a) forgot_uid.php, the (2) query or (3) sk parameter to (b) search_results.php, or (4) the pageId parameter to (c) website_page.php.

4.3
2007-07-30 CVE-2007-4077 Alstrasoft Cross-Site Scripting vulnerability in Video Share Enterprise

Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to inject arbitrary web script or HTML via the (1) msg, (2) page, (3) viewkey, or (4) viewtype parameter to (a) view_video.php; the (5) next parameter to (b) signup.php; the (6) search_id parameter to (c) search_result.php; the (7) category or (8) page parameter to (d) video.php; the (9) receiver parameter to (e) compose.php; the (10) catgy parameter to (f) groups.php; the (11) channelname parameter to (g) siteadmin/channels.php; or the (12) uname parameter to (h) siteadmin/muser.php.

4.3
2007-07-30 CVE-2007-4075 ASP Indir Cross-Site Scripting vulnerability in ASP Indir Alisveris Sitesi Script 0

Cross-site scripting (XSS) vulnerability in index.asp in Alisveris Sitesi Scripti allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search mod action.

4.3
2007-07-30 CVE-2007-4071 Tincan Cross-Site Scripting vulnerability in Webbler CMS

Multiple cross-site scripting (XSS) vulnerabilities in uploader/index.php in Webbler CMS before 3.1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) login parameter.

4.3
2007-07-30 CVE-2007-4064 Drupal Cross-Site Scripting vulnerability in Drupal

Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, (1) allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHP_SELF; and (2) allow remote authenticated administrators to inject arbitrary web script or HTML via custom content type names.

4.3
2007-07-30 CVE-2007-4063 Drupal Cross-Site Request Forgery vulnerability in Drupal

Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.2 allow remote attackers to (1) delete comments, (2) delete content revisions, and (3) disable menu items as privileged users, related to improper use of HTTP GET and the Forms API.

4.3
2007-07-30 CVE-2007-4058 EMC Path Traversal vulnerability in EMC VMWare 6.0.0

Absolute path traversal vulnerability in a certain ActiveX control in vielib.dll 2.2.5.42958 in EMC VMware 6.0.0 allows remote attackers to execute arbitrary local programs via a full pathname in the first argument to the StartProcess method.

4.3
2007-07-30 CVE-2007-4052 Nukedit Cross-Site Scripting vulnerability in Nukedit 4.9.7B

Cross-site scripting (XSS) vulnerability in utilities/login.asp in nukedit 4.9.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter.

4.3
2007-07-30 CVE-2007-4048 Phpsysinfo Cross-Site Scripting vulnerability in phpSysInfo

Cross-site scripting (XSS) vulnerability in index.php in phpSysInfo 2.5.4-dev and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

4.3
2007-08-03 CVE-2007-4143 Phpcoupon Remote Payment Bypass vulnerability in phpCoupon

user.php in the Billing Control Panel in phpCoupon allows remote authenticated users to obtain Premium Member status, and possibly acquire free coupons, via a modified URL containing a certain billing parameter and REQ=auth, status=success, and custom=upgrade substrings, possibly related to PayPal transactions.

4.0
2007-08-03 CVE-2007-2407 Apple
Samba
Multiple Security vulnerability in Apple Mac OS X 2007-007

The Samba server on Apple Mac OS X 10.3.9 and 10.4.10, when Windows file sharing is enabled, does not enforce disk quotas after dropping privileges, which allows remote authenticated users to use disk space in excess of quota.

4.0

3 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2007-07-31 CVE-2007-4113 Advanced Webhost Billing System Multiple vulnerability in Advanced Webhost Billing System

Unspecified vulnerability in Advanced Webhost Billing System (AWBS) before 2.6.0 allows remote authenticated users to obtain configuration data about other dedicated servers via unspecified vectors.

3.5
2007-08-03 CVE-2007-4153 Wordpress Cross-Site Scripting vulnerability in Wordpress 2.2.1

Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the Options Database Table in the Admin Panel, accessed through options.php; or (2) the opml_url parameter to link-import.php.

2.1
2007-08-01 CVE-2007-4126 SUN Local Denial of Service vulnerability in SUN Solaris 10.0

Unspecified vulnerability in the dynamic tracing framework (DTrace) on Sun Solaris 10 before 20070730 allows local users with PRIV_DTRACE_USER privileges to cause a denial of service (panic or hang) via unspecified use of certain DTrace programs.

1.5