Sql injection

Multiple SQL injection vulnerabilities in Frogss CMS 0.7 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 dzial parameter to a katalog.php, or the 2 t parameter to b forum.php or c forum/viewtopic.php, different vectors than CVE-2006-4536...

Sql injection

Multiple SQL injection vulnerabilities in the Virtual War VWar 1.5.0 R15 module for PHP-Nuke allow remote attackers to execute arbitrary SQL commands via the n parameter to extra/online.php and other unspecified scripts in extra/. NOTE: this might be same vulnerability as CVE-2006-4142; however,...

CVE-2006-7197

CVE-2006-7197 : The AJP connector in Apache Tomcat 5.5.15 (via mod_jk) has an incorrect chunk length that can cause a buffer over-read in ajp_process_callback, enabling a remote attacker to read memory portions. The linked records (e.g., GHSA-JPQR-VH55-XQXF and RHSA entries) confirm this vulnerab...

CVE-2007-2255

Multiple PHP remote file inclusion vulnerabilities in Download-Engine 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in the 1 engdir parameter to addmember.php, 2 langpath parameter to admin/enginelib/class.phpmailer.php, and the 3 spawroot parameter to...

Stack overflow

Stack-based buffer overflow in eXtremail 2.1.1 and earlier allows remote attackers to execute arbitrary code via a long DNS response. NOTE: this might be related to CVE-2006-6926...

CVE-2007-2187

Stack-based buffer overflow in eXtremail 2.1.1 and earlier allows remote attackers to execute arbitrary code via a long DNS response. NOTE: this might be related to CVE-2006-6926...

CVE-2007-2187

Stack-based buffer overflow in eXtremail 2.1.1 and earlier allows remote attackers to execute arbitrary code via a long DNS response. NOTE: this might be related to CVE-2006-6926...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Database Administration dba module 4.6.x-, and before 4.7.x-1.2 in the 4.7.x-1. series, for Drupal allow remote attackers to perform unauthorized actions as an arbitrary user, a related issue to CVE-2006-5476...

[SECURITY] [DSA 1279-1] New webcalendar packages fix cross-site scripting

-------------------------------------------------------------------------- Debian Security Advisory DSA 1279-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff April 22nd, 2007 http://www.debian.org/security/faq -...

Fedora Core 5 : ImageMagick-6.2.5.4-4.2.1.fc5.8 (2007-414)

Thu Apr 5 2007 Norm Murray 6.2.5.4-4.2.1.fc5.8 - more overflows 235075, CVE-2007-1797 - Fri Sep 22 2006 Norm Murray 6.2.5.4-4.2.1.fc5.7 - more overflows 210921 CVE-2006-5456 - Fri Sep 22 2006 Norm Murray 6.2.5.4-4.2.1.fc5.6 - fix ImageMagick-perl building 203975 - Thu Sep 7 2006 Norm Murray -...

Cross site scripting

Cross-site scripting XSS vulnerability in weblog.php in my little weblog allows remote attackers to inject arbitrary web script or HTML via the id parameter, a different vector than CVE-2006-6087...

CVE-2007-2096

PHP remote file inclusion vulnerability in common.php in Hinton Design PHPHD Download System phphddownloads allows remote attackers to execute arbitrary PHP code via a URL in the phphdrealpath parameter. NOTE: this issue may be present in versions from 2006...

CVE-2007-2102

CVE-2007-2102 is a cross-site scripting (XSS) vulnerability in the weblog.php component of my little weblog . The provided details specify that the vulnerability can be triggered by supplying a crafted value to the id parameter, allowing remote attackers to inject arbitrary web script or HTML. Th...

CVE-2006-7194

The CVE describes a PHP remote file inclusion in Agora 1.4 RC1 (MysqlfinderAdmin.php) where enabling register_globals allows an attacker to execute arbitrary PHP code via a URL in the _SESSION[PATH_COMPOSANT] parameter. This is a server-side code execution risk exposed through a local file inclus...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Open-gorotto 2.0a 2006/02/08 edition, 2006/03/19 edition, and 2006/04/07 edition before 20070416 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to 1 pub/modules/d/top.html; 2 /pub/modules/a/access.html;...

Security fix for the ALT Linux 6 package lha version 2:1.14i-alt2

April 15, 2007 Michael Shigorin 2:1.14i-alt2 - ac20050924p1: security fixes for CVE-2006-4335, CVE-2006-4337, CVE-2006-4338 DoS, system access - removed patch1, patch2, patch4, patch5 didn't apply...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Pineapple Technologies Lore 1 allow remote attackers to execute arbitrary PHP code via a URL in the 1 langpath parameter to thirdparty/phpmailer/class.phpmailer.php or the 2 getpluginfilepath parameter to...

CVE-2007-2006

Multiple SQL injection vulnerabilities in login.php in pL-PHP beta 0.9 allow remote attackers to execute arbitrary SQL commands via the 1 login or 2 pass parameter...

CVE-2006-7193

PHP remote file inclusion vulnerability in unittest/testcases.php in Smarty 2.6.1 allows remote attackers to execute arbitrary PHP code via a URL in the SMARTYDIR parameter. NOTE: this issue is disputed by CVE and a third party because SMARTYDIR is a constant...

CVE-2007-2006

CVE-2007-2006 describes multiple SQL injection vulnerabilities in login.php of the pL-PHP beta 0.9. The flaw allows remote attackers to inject SQL commands via the login or pass parameters, enabling arbitrary SQL execution. The referenced sources confirm the affected component and parameters, but...