CVE-2006-7125

The CVE-2006-7125 entry describes a Cross-site Scripting (XSS) vulnerability in Joomla BSQ Sitestats versions 1.8.0 and 2.2.1. The issue allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header, which is not properly sanitized when an administrator views site sta...

CVE-2006-7119

PHP remote file inclusion vulnerability in kernel/system/startup.php in J. He PHPGiggle 12.08 and earlier, as distributed on comscripts.com, allows remote attackers to execute arbitrary PHP code via a URL in the CFGPHPGIGGLEROOT parameter...

CVE-2006-7114

In CVE-2006-7114, P-News 2.0 stores db/user.txt under the web document root, exposing user credentials due to insufficient access control. This allows remote attackers to directly request the file and obtain usernames and password hashes. The issue is corroborated by the NVD entry; no additional ...

CVE-2006-7120

CVE-2006-7120 is a PHP remote file inclusion in lib/php/phphtmllib-2.5.4; specifically, the vulnerability affects maintain 3.0.0-RC2 via example6.php where a URL supplied to the phphtmllib parameter can lead to code execution. The PT-2007-1398 analysis confirms the affected components: lib/php/ph...

CVE-2006-7121

The CVE-2006-7121 entry concerns the HTTP server in the Linksys SPA-921 VoIP Desktop Phone. The vulnerability allows remote attackers to trigger a denial of service (reboot) by sending an excessively long URL or overly long credentials during Basic Authentication. The available references documen...

CVE-2006-7116

Kubix 0.7 and earlier are affected by a SQL injection in includes/functions.php. The vulnerability is exploitable via the member_id parameter ($id variable) to index.php, enabling remote attackers to execute arbitrary SQL commands and bypass authentication. This is supported by multiple sources (...

CVE-2006-7130

CVE-2006-7130 affects Jinzora 2.1 and earlier. A PHP remote file inclusion flaw in backend/primitives/cache/media.php allows an attacker to cause arbitrary PHP code execution by supplying a crafted URL in the include_path parameter. This is a distinct vector from CVE-2006-6770. The vulnerability ...

CVE-2006-7127

CVE-2006-7127 affects the JAF CMS (versions 4.0 and 4.0 RC2). Affected component: the forum/ directory handling pages (forum/main.php and forum/headlines.php). Root cause: remote PHP code execution via a crafted URL passed to the main_dir parameter, enabling an attacker to include and run arbitra...

CVE-2006-7134

CVE-2006-7134 describes an unrestricted file upload vulnerability in main_user.php (Upload Tool for PHP 1.0). The vulnerability allows remote attackers to upload and execute arbitrary files with executable extensions such as .php, enabling remote code execution on affected systems. The provided d...

CVE-2006-7124

CVE-2006-7124 describes a PHP remote file inclusion in BSQ Sitestats (Joomla) 1.8.0 and possibly earlier versions prior to 2.2.1. The flaw, triggered by the baseDir parameter in external/rssfeeds.php, allows an attacker to execute arbitrary PHP code on the affected server. Impact is noted as part...

CVE-2006-7126

CVE-2006-7126 affects Joomla BSQ Sitestats versions 1.8.0 and 2.2.1. The vulnerability is an SQL injection caused by unsanitized input in the query string (possibly PHP_SELF), enabling remote attackers to execute arbitrary SQL commands. The connected sources confirm the affected product and the i...

CVE-2006-7112

MD-Pro before 1.0.77 (MD-Pro 1.0.76 and earlier) contains a directory traversal vulnerability in error.php exploitable via the PNSVlang cookie. Remote authenticated users can read and include arbitrary files by uploading a GIF via AddDownload or injecting PHP into a log file, then accessing it. T...

QuickTime < 7.1.5 Multiple Vulnerabilities (Windows)

According to its version, the installation of QuickTime on the remote Windows host is affected by multiple buffer overflows. An attacker may be able to leverage these issues to crash the affected application or to execute arbitrary code on the remote host by sending a specially crafted file to a...

Fedora Core 5 : kernel-2.6.19-1.2288.2.1.fc5 (2007-277)

Updated to kernel 2.6.19.5-rc1 plus additional fixes : http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.19.4 2.6.19.5-rc1: 4 V4L fixes 3 usbaudio fixes 3 wireless driver fixes 2 IDE driver cable detection fixes NFS bugfix various other fixes CVE-2007-0772: Summary: The Linux kernel befor...

Fedora Core 6 : kernel-2.6.19-1.2911.6.4.fc6 (2007-291)

Updated to kernel 2.6.19.5 plus additional fixes : http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.19.4 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.19.5 CVE-2007-0772: Summary: The Linux kernel before 2.6.20.1 allows remote attackers to cause a denial of service oops via a...

CVE-2006-7109

Unrestricted file upload vulnerability in IMCE before 1.6, a Drupal module, allows remote authenticated users to upload arbitrary PHP code via a filename with a double extension such as .php.gif...

CVE-2006-7109

Summary: CVE-2006-7109 is an unrestricted file upload vulnerability in the IMCE Drupal module (before 1.6). The issue allows remote authenticated users to upload arbitrary PHP code by using a filename with a double extension such as .php.gif. Details from connected docs: The HackerOne report prov...

CVE-2006-7108

login in util-linux-2.12a skips pamacctmgmt and chauthtok when authentication is skipped, such as when a Kerberos krlogin session has been established, which might allow users to bypass intended access policies that would be enforced by pamacctmgmt and chauthtok...

CVE-2006-7108

login in util-linux-2.12a skips pamacctmgmt and chauthtok when authentication is skipped, such as when a Kerberos krlogin session has been established, which might allow users to bypass intended access policies that would be enforced by pamacctmgmt and chauthtok...

CVE-2006-7108

login in util-linux-2.12a skips pamacctmgmt and chauthtok when authentication is skipped, such as when a Kerberos krlogin session has been established, which might allow users to bypass intended access policies that would be enforced by pamacctmgmt and chauthtok...