CVSS: 10.0EPSS: 3%CPEs: 6EXPL: 0CVE-2007-0956 – Unauthorized access via krb5-telnet daemon
https://notcve.org/view.php?id=CVE-2007-0956
The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a '-' character, a similar issue to CVE-2007-0882. El demonio telnet (telnetd) en MIT krb5 anterior a 1.6.1 permite a atacantes remotos evitar la validación y ganar accesos al sistema a través de un nombre de usuario comenzando con el carácter '-', un asunto similar a CVE-2007-0882. • ftp://patches.sgi.com/support/free/security/advisories/20070401-01-P.asc http://lists.suse.com/archive/suse-security-announce/2007-Apr/0001.html http://secunia.com/advisories/24706 http://secunia.com/advisories/24735 http://secunia.com/advisories/24736 http://secunia.com/advisories/24740 http://secunia.com/advisories/24750 http://secunia.com/advisories/24755 http://secunia.com/advisories/24757 http://secunia.com/advisories/24785 http://secunia.com/advisories/24786 http:/&#x • CWE-306: Missing Authentication for Critical Function •
CVSS: 6.8EPSS: 4%CPEs: 5EXPL: 1CVE-2007-1562 – Mozilla FireFox 1.5.x/2.0 - FTP PASV Port-Scanning
https://notcve.org/view.php?id=CVE-2007-1562
The FTP protocol implementation in Mozilla Firefox before 1.5.0.11 and 2.x before 2.0.0.3 allows remote attackers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response. La implementación del protocolo FTP en Mozilla Firefox anterior a versión 1.5.0.11 y versión 2.x anterior a 2.0.0.3 permite a los atacantes remotos forzar al cliente a conectarse a otros servidores, realizar un análisis de puerto proxy o conseguir información confidencial por medio de la especificación de una dirección de servidor alterno en una respuesta PASV de FTP. • https://www.exploit-db.com/exploits/29768 http://bindshell.net/papers/ftppasv/ftp-client-pasv-manipulation.pdf http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 http://secunia.com/advisories/25476 http://secunia.com/advisories/25490 http://secunia.com/advisories/25858 http://www.mozilla.org/security/announce/2007/mfsa2007-11.html http://www.novell.com/linux/security/advisories/2007_36_mozilla.html http://www.openwall.com/lists/oss-security/2020/12/09/ • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 17%CPEs: 11EXPL: 0CVE-2007-1463
https://notcve.org/view.php?id=CVE-2007-1463
Format string vulnerability in Inkscape before 0.45.1 allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a URI, which is not properly handled by certain dialogs. Vulnerabilidad en el formato de cadena en el Inkscape anterior al 0.45.1 permite a atacantes con la intervención del usuario ejecutar código de su elección mediante especificadores del formato de cadena en una URI,lo que no es manejado correctamente mediante ciertos diálogos. • http://secunia.com/advisories/24584 http://secunia.com/advisories/24597 http://secunia.com/advisories/24615 http://secunia.com/advisories/24661 http://secunia.com/advisories/24859 http://secunia.com/advisories/25072 http://sourceforge.net/project/shownotes.php?group_id=93438&release_id=495106 http://www.gentoo.org/security/en/glsa/glsa-200704-10.xml http://www.mandriva.com/security/advisories?name=MDKSA-2007:069 http://www.novell.com/linux/security/advisories/2007_8_sr.html h •
CVSS: 6.8EPSS: 1%CPEs: 6EXPL: 0CVE-2007-0780
https://notcve.org/view.php?id=CVE-2007-0780
browser.js in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 uses the requesting URI to identify child windows, which allows remote attackers to conduct cross-site scripting (XSS) attacks by opening a blocked popup originating from a javascript: URI in combination with multiple frames having the same data: URI. browser.js en Mozilla Firefox 1.5.x versiones anteriores a 1.5.0.10 y 2.x versiones anteriores a 2.0.0.2, y SeaMonkey versiones anteriores a 1.0.8, usa la URI de petición para identificar ventanas hijo, lo cual permite a atacantes remotos conducir ataques de secuencias de comandos en sitios cruzados (XSS) al abrir una ventana emergente bloqueada originada de una URI javascript: en combinación con múltiples marcos teniendo la misma URI data: • ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc http://fedoranews.org/cms/node/2713 http://fedoranews.org/cms/node/2728 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html http://rhn.redhat.com/errata/RHSA-2007-0077.html http://secunia.com/advisories/24205 http://secunia.com/adv • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 1%CPEs: 7EXPL: 0CVE-2007-0778
https://notcve.org/view.php?id=CVE-2007-0778
The page cache feature in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 can generate hash collisions that cause page data to be appended to the wrong page cache, which allows remote attackers to obtain sensitive information or enable further attack vectors when the target page is reloaded from the cache. La característica caché de página en Mozilla Firefox versiones anteriores a 1.5.0.10 y 2.x versiones anteriores a 2.0.0.2, y SeaMonkey versiones anteriores a 1.0.8 puede generar colisiones de tablas hash que provocan que se añada datos de página a la caché equivocada, lo cual permite a atacantes remotos obtener información confidencial o habilitar otros vectores de ataque cuando la página objetivo se recarga de la caché. • ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc http://fedoranews.org/cms/node/2713 http://fedoranews.org/cms/node/2728 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html http://rhn.redhat.com/errata/RHSA-2007-0077.html http://secunia.com/advisories/24205 http://secunia.com/adv • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •