CVE-2006-7174

The CVE-2006-7174 entry describes a PHP remote file inclusion vulnerability in phpBB’s Dimension module, specifically in includes/functions.php, allowing an attacker to execute arbitrary PHP code via a URL supplied to the phpbb_root_path parameter. The issue is categorized as a remote code execut...

Sql injection

SQL injection vulnerability in News/page.asp in NetVIOS Portal allows remote attackers to execute arbitrary SQL commands via the NewsID parameter. NOTE: this issue might be the same as CVE-2006-5954...

mercur-v1.txt

!/usr/bin/perl mercur-v1.pl Mercur v5.00.14 win32 remote exploit by mu-b - Dec 2006 - Tested on: Mercur v5.00.14 win32 use Getopt::Std; getopts't:n:', %arg; use Socket; use MIME::Base64; my $target; if defined$arg't' $target = $arg't' if !defined$target my $imapdport = 143; my $senddelay = 1; if...

CVE-2006-7173

CVE-2006-7173 affects PHP-Stats prior to 0.1.9.1b. Description: direct static code injection in admin.php allows remote PHP code execution via crafted option_new[report_w_day] in a preferenze action, which can later be accessed through option/php-stats-options.php. NVD assigns a HIGH base score (...

Cross site scripting

Cross-site scripting XSS vulnerability in CMDUSERSTATS in DirectAdmin allows remote attackers to inject arbitrary web script or HTML via the RESULT parameter, a different vector than CVE-2006-5983...

CVE-2006-7171

productreview.php in Koan Software Mega Mall allows remote attackers to obtain the installation path via a request with an empty value of the x parameter...

CVE-2006-7166

IBM WebSphere Application Server WAS 5.1.1.9 and earlier allows remote attackers to obtain JSP source code and other sensitive information via "a specific JSP URL."...

CVE-2006-7169

CVE-2006-7169 describes a PHP remote file inclusion in Ultimate PHP Board (UPB) 2.0 and earlier . The vulnerability affects the file includes/header_simple.php, where an attacker can cause arbitrary PHP code execution by supplying a URL in the _CONFIG[skin_dir] parameter. Public references indica...

CVE-2006-7168

CVE-2006-7168 is a PHP remote file inclusion vulnerability affecting the Add Name module (includes/not_mem.php). The underlying issue is a flaw that allows an attacker to supply a URL via the phpbb_root_path parameter, enabling remote PHP code execution. The description does not specify affected ...

CVE-2006-7165

IBM WebSphere Application Server (WAS) 5.0–5.1.1.0 is affected by CVE-2006-7165, allowing remote attackers to obtain JSP source code and other sensitive information through certain "special URIs." The provided documents do not specify a root cause in detail, nor any remediation steps or exploit s...

CVE-2006-7164

CVE-2006-7164 concerns IBM WebSphere Application Server 5.0.1–5.0.2.7 on Linux/UNIX. The issue is in SimpleFileServlet, which does not block certain invalid URIs and does not issue a security challenge, enabling remote attackers to read secure files and obtain sensitive information via certain re...

CVE-2006-7171

CVE-2006-7171 affects Koan Software Mega Mall. The vulnerability occurs in product_review.php, where remote attackers can cause disclosure of the installation path by sending a request with an empty value for the x[] parameter. The provided documents do not specify affected versions, root cause d...

CVE-2006-7166

CVE-2006-7166 affects IBM WebSphere Application Server (WAS) 5.1.1.9 and earlier. A remote attacker can obtain JSP source code and other sensitive information through a specific JSP URL. The provided documents do not specify the root cause details beyond this access to JSP content, nor do they in...

CVE-2007-1508

Cross-site scripting XSS vulnerability in CMDUSERSTATS in DirectAdmin allows remote attackers to inject arbitrary web script or HTML via the RESULT parameter, a different vector than CVE-2006-5983...

CVE-2006-7171

productreview.php in Koan Software Mega Mall allows remote attackers to obtain the installation path via a request with an empty value of the x parameter...

CVE-2006-7167

Technical details of CVE-2006-7167 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories; current sources reiterate an authentication bypass in ProRat Server 1.9 Fix2 without specifics.

CVE-2006-7164

SimpleFileServlet in IBM WebSphere Application Server 5.0.1 through 5.0.2.7 on Linux and UNIX does not block certain invalid URIs and does not issue a security challenge, which allows remote attackers to read secure files and obtain sensitive information via certain requests...

KLA10093 Multiple vulnerabilities in CA software

Multiple serious vulnerabilities have been found in ARCserve Backup. Malicious users can exploit these vulnerabilities to execute arbitrary code or cause denial of service. Below is a complete list of vulnerabilities 1. A buffer overflow can be exploited remotely via specially designed RPC...

Memory corruption

The Tape Engine in CA formerly Computer Associates BrightStor ARCserve Backup 11.5 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain RPC procedure arguments, which result in memory corruption, a different vulnerability than...

Design/Logic Flaw

The \Device\SymEvent driver in Symantec Norton Personal Firewall 2006 9.1.1.7, and possibly other products using symevent.sys 12.0.0.20, allows local users to cause a denial of service system crash via invalid data, as demonstrated by calling DeviceIoControl to send the data, a reintroduction of...