Computer Security
[EN] securityvulns.ru no-pyccku


ICMP flood DoS against PalmOS
updated since 15.05.2003
Published:21.08.2007
Source:
SecurityVulns ID:2822
Type:remote
Threat Level:
5/10
Description:ICMP flood causes device to fail temporary.
Original documentdocumentSYMANTEC, SYMSA-2007-007: Palm OS Treo Smartphone Denial of Service (21.08.2007)
 documentShaun Moore, PalmOS ICMP flood DoS. (15.05.2003)

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
Published:21.08.2007
Source:
SecurityVulns ID:8071
Type:remote
Threat Level:
5/10
Description:PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.
Affected:MCLINKSCOUNTER : mcLinksCounter 1.2
 MYREFERER : My_REFERER 1.08
 BUTTERFLY : Butterfly online vistors counter 1.08
 GURURHABER : Gurur Portal 2.0
 JOOMLA : SimpleFAQ 2.11
CVE:CVE-2007-4486 (Multiple PHP remote file inclusion vulnerabilities in index.php in Linkliste 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) styl[top], (2) url_eintrag, or (3) styl[themen] parameter.)
 CVE-2007-4484 (PHP remote file inclusion vulnerability in login.php in My_REFERER 1.08 allows remote attackers to execute arbitrary PHP code via a URL in the value parameter.)
 CVE-2007-4479 (Cross-site scripting (XSS) vulnerability in search.html in Search Engine Builder allows remote attackers to inject arbitrary web script or HTML via the searWords parameter.)
 CVE-2006-4863 (** DISPUTED ** Multiple PHP remote file inclusion vulnerabilities in Marc Cagninacci mcLinksCounter 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the langfile parameter in (1) login.php, (2) stats.php, (3) detail.php, or (4) erase.php. NOTE: CVE and a third party dispute this vulnerability, because the langfile parameter is set to english.php in each file.)
Original documentdocumentI. D., [Full-disclosure] OSNews (21.08.2007)
 documentHackers Center Security Group, Invision Power Board D22-Shoutbox HTML Injections (21.08.2007)
 documentk1tk4t_(at)_newhack.org, Mambo Component SimpleFAQ V2.11 - Remote SQL Injection (21.08.2007)
 documentthe.dumenci_(at)_gmail.com, Gurur Haber v2.0 (21.08.2007)
 documentIvan Niiiil, My_REFERER v.1.08 Remote File Include (21.08.2007)
 documentIvan Niiiil, Butterfly online vistors counter 1.08 RFI (21.08.2007)
 documentIvan Niiiil, mcLinksCounter 1.2 Remote File Include by iNs (21.08.2007)
 documentMustLive, Vulnerability in Search Engine Builder (21.08.2007)

Planet VC-200M DSL router DoS
Published:21.08.2007
Source:
SecurityVulns ID:8072
Type:remote
Threat Level:
5/10
Description:Inaccessible administration interface on HTTP GET request with missed Host: header.
Affected:PLANET : VC-200M
CVE:CVE-2007-4477 (The administration interface in the Planet VC-200M VDSL2 router allows remote attackers to cause a denial of service (administration interface outage) via an HTTP request without a Host header.)
Original documentdocumentDmitry Zubov, Planet VC-200M (21.08.2007)

rFactor game / gMotor2 engine multiple security vulnerabilities
Published:21.08.2007
Source:
SecurityVulns ID:8073
Type:remote
Threat Level:
5/10
Description:Buffer overflow and multiple denial of service conditions.
Affected:RFACTOR : rFactor 1.250
Original documentdocumentLuigi Auriemma, Multiple vulnerabilities in rFactor 1.250 (21.08.2007)
Files:Exploits rFactor <= 1.250 multiple vulnerabilities
 Exploits gMotor2 engine multiple vulnerabilities

Toribash multiple security vulnerabilities
Published:21.08.2007
Source:
SecurityVulns ID:8074
Type:remote
Threat Level:
5/10
Description:Format string vulnerability, multiple buffer overflows, multiple DoS conditions.
Affected:TORIBASH : Toribash 2.71
Original documentdocumentLuigi Auriemma, Multiple vulnerabilities in Toribash 2.71 (21.08.2007)
Files:Exploits Toribash <= 2.71 multiple vulnerabilities

Checkpoint ZoneAlarm multiple privilege escalations
Published:21.08.2007
Source:
SecurityVulns ID:8075
Type:local
Threat Level:
6/10
Description:Vsdatant.sys driver multiple IOCTLs buffer overflows. Weak permissions for executable files.
Affected:CHECKPOINT : ZoneAlarm 7.0
CVE:CVE-2007-4216 (vsdatant.sys 6.5.737.0 in Check Point Zone Labs ZoneAlarm before 7.0.362 allows local users to gain privileges via a crafted Interrupt Request Packet (Irp) in a METHOD_NEITHER (1) IOCTL 0x8400000F or (2) IOCTL 0x84000013 request, which can be used to overwrite arbitrary memory locations.)
 CVE-2005-2932
Original documentdocumentIDEFENSE, iDefense Security Advisory 08.20.07: Check Point Zone Labs Multiple Products Privilege Escalation Vulnerability (21.08.2007)
 documentIDEFENSE, iDefense Security Advisory 08.20.07: Check Point Zone Labs VSDATANT Multiple IOCTL Privilege Escalation Vulnerabilities (21.08.2007)
 documentReversemode, [Reversemode Advisory] CheckPoint ZoneLabs Vsdatant.sys multiple local privilege escalation vulnerabilities (21.08.2007)

NVIDIA Linux drivers DoS
Published:21.08.2007
Source:
SecurityVulns ID:8076
Type:local
Threat Level:
6/10
Description:Invalid value sent to device may cause hardware damage.
Affected:NVIDIA : nvidia-drivers 1.0
 NVIDIA : nvidia-drivers 100.14
CVE:CVE-2007-3532 (NVIDIA drivers (nvidia-drivers) before 1.0.7185, 1.0.9639, and 100.14.11, as used in Gentoo Linux and possibly other distributions, creates /dev/nvidia* device files with insecure permissions, which allows local users to modify video card settings, cause a denial of service (crash or physical video card damage), and obtain sensitive information.)
Original documentdocumentGENTOO, [ GLSA 200708-14 ] NVIDIA drivers: Denial of Service (21.08.2007)

Rsync off-by-one buffer overflow
Published:21.08.2007
Source:
SecurityVulns ID:8077
Type:client
Threat Level:
5/10
Description:Multiple off-by-on overflows.
Affected:RSYNC : rsync 2.6
CVE:CVE-2007-4091 (Multiple off-by-one errors in the sender.c in rsync 2.6.9 might allow remote attackers to execute arbitrary code via directory names that are not properly handled when calling the f_name function.)
Original documentdocumentMANDRIVA, [ MDKSA-2007:166 ] - Updated rsync packages fix off-by-one buffer overflow (21.08.2007)

EMC Legato Networker buffer overflow
Published:21.08.2007
Source:
SecurityVulns ID:8078
Type:remote
Threat Level:
5/10
Description:Buffer overflow in SUNRPC (TCP/111) Networker Remote Exec Service.
Affected:EMC : Legat oNetWorker 7.2
CVE:CVE-2007-3618 (Stack-based buffer overflow in the NetWorker Remote Exec Service (nsrexecd.exe) in EMC Software NetWorker 7.x.x allows remote attackers to execute arbitrary code via a (1) poll or (2) kill request with a "long invalid subcmd.")
Original documentdocumentZDI, ZDI-07-049: EMC Legato Networker Remote Exec Service Stack Overflow Vulnerabilities (21.08.2007)

Mercury/32 / Mercury/NLM SMTP server buffer overflow
Published:21.08.2007
Source:
SecurityVulns ID:8079
Type:remote
Threat Level:
7/10
Description:Buffer overflow on oversized CRAM-MD5 authentication string.
Affected:PMAIL : Mercury/32 4.51
 PMAIL : Mercury/NLM 1.48
Original documentdocumentPMAIL, Mercury/32 v4.52 / Mercury/NLM v1.49, August 2007 (21.08.2007)
 documenteliteb0y_(at)_hushmail.com, [Full-disclosure] Mercury SMTPD Remote Preauth Stack Based Overrun (21.08.2007)
Files:Mercury SMTPD Remote Preauth Stack Based Overrun PoC

Cisco 7940 SIP IPPhones DoS
Published:21.08.2007
Source:
SecurityVulns ID:8080
Type:remote
Threat Level:
5/10
Description:A sequence of malformed SIP requests causes device to crash.
Affected:CISCO : Cisco 7940
Original documentdocumentRadu State, [Full-disclosure] 3 messsages attack remote DOS on Cisco 7940 (21.08.2007)
 documentRadu State, [Full-disclosure] 10 messages SIP Remote DOS on Cisco 7940 SIP Phone (21.08.2007)
Files:10 messages SIP Remote DOS on Cisco 7940 SIP Phone PoC
 [Full-disclosure] 3 messsages attack remote DOS on Cisco 7940 PoC

Microsoft Internet Explorer saved pages crossite scripting
updated since 21.08.2007
Published:24.11.2008
Source:
SecurityVulns ID:8081
Type:client
Threat Level:
3/10
Description:Crossite scripting in context of local machine is possible on saving URL with address like http://site/--><script>alert("XSS")</script>
Affected:MICROSOFT : Windows 2000 Server
 MICROSOFT : Windows 2000 Professional
 MICROSOFT : Windows XP
 MICROSOFT : Windows 2003 Server
CVE:CVE-2007-4478 (Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6.0 allows user-assisted remote attackers to inject arbitrary web script or HTML in the local zone via a URI, when the document at the associated URL is saved to a local file, which then contains the URI string along with the document's original content.)
Original documentdocumentMustLive, Code Execution via XSS in Internet Explorer (24.11.2008)
 documentDavid Vaartjes, [Fwd: RE: XSS via IE MOTW feature. [sd]] (22.08.2007)
 documentMustLive, Vulnerability in Internet Explorer (21.08.2007)

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod