CVE-2007-1157

Cross-site request forgery CSRF vulnerability in jmx-console/HtmlAdaptor in JBoss allows remote attackers to perform privileged actions as administrators via certain MBean operations, a different vulnerability than CVE-2006-3733...

CVE-2006-7078

CVE-2006-7078 describes multiple cross-site scripting (XSS) vulnerabilities in the Professional Home Page Tools Login Script, present as of July 2006. The issue allows remote attackers to inject arbitrary web script or HTML via the register script parameters (name, vorname, nachname). Documents c...

CVE-2006-7069

The CVE-2006-7069 entry documents a PHP remote file inclusion in smarty_config.php within Socketwiz Bookmarks 2.0 and earlier. The vulnerability arises from accepting user-controlled input via the root_dir parameter, enabling an attacker to execute arbitrary PHP code remotely. The referenced NVD ...

CVE-2006-7066

CVE-2006-7066 affects Microsoft Internet Explorer 6 on Windows XP SP2. The vulnerability allows remote denial of service (crash) by creating an object inside an iframe, deleting the frame via location.href = about:blank, then accessing a property of the object in the deleted frame, triggering a N...

CVE-2006-7065

CVE-2006-7065 affects Microsoft Internet Explorer (mshtml.dll). A crafted IFRAME referencing a particular XML file and XSL stylesheet can trigger a crash in mshtml.dll when a refresh occurs, described as probably a null pointer dereference. The issue is documented across Red Hat and NVD/CVE sourc...

CVE-2007-1141

The CVE-2007-1141 issue concerns Magic News Plus 1.0.2, where a PHP remote file inclusion vulnerability exists in preview.php. The root cause is the php_script_path parameter allowing an attacker-controlled URL to be included, enabling arbitrary PHP code execution on the server. This aligns with ...

CVE-2006-7084

...

CVE-2006-7067

CVE-2006-7067 affects Oracle 10g R2 (and possibly other versions). The vulnerability arises when an attacker can issue an invalid ALTER SESSION SET EVENTS command, which may trigger internal errors and potentially cause other impacts as described in the description. The connected documents do not...

CVE-2006-7072

CVE-2006-7072 corresponds to a cross-site scripting (XSS) vulnerability in GeoClassifieds Enterprise 2.0.5.2 and earlier. The flaw permits remote attackers to inject arbitrary web script and HTML via input parameters: b[username] and c to index.php, b[username] to admin/index.php, and c[phone] to...

CVE-2006-7075

Buffer overflow in the metareadflac function in metadecoder.c for Aqualung 0.9beta5 and earlier, and CVS 0.193.2 and earlier, allows user-assisted attackers to execute arbitrary code via a long Vorbis comment in a Free Lossless Audio Codec FLAC file...

CVE-2006-7083

The CVE-2006-7083 entry details a directory traversal flaw in Rigter Portal System (RPS) versions 1.0, 2.0, and 3.0 affecting index.php. An attacker can use ".." sequences in the id parameter to read arbitrary files. The description notes remote attack capability but does not provide exploit code...

CVE-2006-7080

Summary: CVE-2006-7080 affects exV2 versions up to 2.0.4.3, where the avatar upload feature is vulnerable to a directory traversal via the old_avatar parameter. Attacker-controlled ".." sequences can be used to delete arbitrary files on the server. The vulnerability is categorized with a CVSS v2 ...

CVE-2006-7085

CVE-2006-7085 affects Rigter Portal System (RPS) 1.0, 2.0 and 3.0. A direct request to add_art.php enables remote attackers to add arbitrary content and perform XSS. The entry notes that the issue was originally reported as SQL injection, but that is unlikely. No exploitation details, affected ve...

CVE-2006-7074

CVE-2006-7074 affects SmartSiteCMS 1.0. The vulnerability is in admin.php, allowing remote attackers to bypass authentication and gain administrator privileges by setting the userName cookie. The connected documents confirm the flaw but do not provide exploitation steps, a broader impact beyond a...

CVE-2006-7084

CVE-2006-7084 is a duplicate of CVE-2006-7083. The real details and impact pertain to CVE-2006-7083: a directory traversal vulnerability in Rigter Portal System (RPS) versions 1.0, 2.0, and 3.0. Remote attackers can read arbitrary files by supplying .. sequences in the id parameter of index.php. ...

CVE-2006-7073

Opentools Attachment Mod

CVE-2006-7070

CVE-2006-7070 affects Etomite CMS 0.6.1 and earlier. Unrestricted file upload via manager/media/ibrowser/scripts/rfiles.php using nfile[] allows a filename containing .php followed by a valid image extension (e.g., .gif or .jpg) and, after rename(), enables remote upload and execution of arbitrar...

CVE-2006-7075

The CVE-2006-7075 entry describes a buffer overflow in the meta_read_flac function (meta_decoder.c) affecting Aqualung 0.9beta5 and earlier and CVS 0.193.2 and earlier. The vulnerability allows user-assisted attackers to execute arbitrary code via a long Vorbis comment in a FLAC file. Impact is A...

CVE-2006-7071

CVE-2006-7071 is an SQL injection vulnerability affecting Invision Power Board (IPB) versions 2.1 up to 2.1.6. The flaw resides in the code path for Class_session.php (CLIENT_IP parameter) where user-supplied input is used in database queries, enabling remote attackers to execute arbitrary SQL co...

CVE-2006-7082

Rigter Portal System (RPS) versions 1.0–3.0 are affected by an authentication bypass vulnerability that allows remote attackers to upload arbitrary files via direct requests to adm/photos/images.php and adm/down/files.php. The CVE entry confirms unauthenticated access with potential partial confi...