CVE-2006-7021

The CVE-2006-7021 entry concerns a PHP remote file inclusion in Plume CMS 1.1.3. Specifically, dbinstall.php under manager/tools/link accepts a URL via the _PX_config[manager_path] parameter, allowing an attacker to execute arbitrary PHP code remotely. Affected software: Plume CMS 1.1.3; vulnerab...

CVE-2006-7015

PHP remote file inclusion vulnerability in admin.jobline.php in Jobline 1.1.1 allows remote attackers to execute arbitrary code via a URL in the mosConfigabsolutepath parameter. NOTE: CVE disputes this issue because the script is protected against direct requests...

CVE-2006-7014

CVE-2006-7014 affects BloggIT 1.01 and earlier. The issue is that admin.php does not properly establish a user session, enabling remote attackers to gain privileges via a direct request. The available connected documents confirm the affected software and the root cause (improper session establish...

CVE-2006-7017

CVE-2006-7017 involves multiple PHP remote file inclusion vulnerabilities in Indexu 5.0.1, triggered when an attacker supplies a URL in the admin_template_path parameter to various admin scripts (e.g., app_change_email.php, app_change_pwd.php, index.php, etc.). The underlying issue is unvalidated...

CVE-2006-7024

Harpia CMS

CVE-2006-7013

CVE-2006-7013 affects Simple Machines Forum (SMF) versions 1.0.7 and earlier and 1.1rc2 and earlier. The issue lets remote attackers spoof the user IP and evade bans by manipulating the X-Forwarded-For header, which is treated as the IP source instead of more reliable sources. The root cause is r...

CVE-2006-7011

PHP remote file inclusion vulnerability in adminips.php in Develooping Flash Chat allows remote attackers to execute arbitrary PHP code via a URL in the bannedfile parameter. NOTE: CVE disputes this vulnerability because bannedfile is set to a constant value...

CVE-2006-7016

CVE-2006-7016 affects phpjobboard. Remote attackers can bypass authentication and gain administrator privileges via a direct request to admin.php with adminop=job-edit . Root cause: improper access control on the admin-edit operation allowing bypass without valid credentials. Impact: unauthorized...

CVE-2006-7011

Summary: CVE-2006-7011 is a PHP remote file inclusion vulnerability affecting the adminips.php file in Develooping Flash Chat. An attacker could trigger arbitrary PHP code execution by supplying a URL in the banned_file parameter. The CVSS 2.0 base metrics indicate a High impact with partial conf...

CVE-2006-7022

The CVE-2006-7022 entry concerns fx-APP 0.0.8.1, where the Tools module allows remote attackers to misrepresent a web page’s contents by supplying an arbitrary URL in the url parameter to the showhtml action of index.php, causing that URL to render inside an iframe. The available description expl...

CVE-2006-7015

Jobline 1.1.1 is affected by a PHP remote file inclusion in admin.jobline.php, exploitable via a URL in the mosConfig_absolute_path parameter. The issue can allow remote code execution if the vulnerable script is accessible. The CVE entry notes that CVE disputes the vulnerability by stating the s...

CVE-2006-7019

Summary: CVE-2006-7019 affects phpwcms 1.2.5-DEV and earlier, and 1.1 prior to RC4, enabling remote arbitrary code execution via crafted arguments to the text_evento and email_eventonome_evento parameters. The vulnerable code paths are phpwcms_code_snippets/mail_file_form.php and sample_ext_php/m...

Fedora Core 6 : kernel-2.6.19-1.2911.fc6 (2007-226)

CVE-2006-0007: The key serial number collision avoidance code in the keyallocserial function in Linux kernel 2.6.9 up to 2.6.20 allows remote attackers to cause a denial of service crash via vectors that trigger a null dereference, as originally reported as 'spinlock CPU recursion.' Update to lin...

Moderate: ImageMagick security update

6.0.7.1-16.0.3 - update fix for CVS-2006-5456 6.0.7.1-16.0.2 - more security issues 217558, CVE-2006-5868; 192278, CVE-2006-2440 6.0.7.1-16.0.1 - fix more overflows 210921...

Microsoft Step-by-Step Interactive Training Buffer Overflow (MS07-005; CVE-2006-3448)

Step-by-Step Interactive Training is an engine for interactive training titles provided by Microsoft Press and other vendors. By using the Step-by-Step Interactive Training user interface Bookmark link files .CBO,.CBL,.CBM are created. These files allow easier access to a particular topic, and...

[SECURITY] [DSA 1259-1] New fetchmail packages fix information disclosure

-------------------------------------------------------------------------- Debian Security Advisory DSA 1259-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff February 14th, 2007 http://www.debian.org/security/faq -...

Authentication flaw

Till Gerken phpPolls 1.0.3 allows remote attackers to bypass authentication and perform certain administrative actions via a direct request to phpPollAdmin.php3. NOTE: this issue might subsume CVE-2006-3764...

CVE-2006-5860

CVE-2006-5860 is an XSS vulnerability affecting Adobe JRun 4.0 in its administrator console as used with ColdFusion. The available connected sources confirm the flaw allows an attacker to inject arbitrary web script or HTML into the admin browser session, via unknown vectors. The JVN entry additi...

CVE-2007-0913

Unspecified vulnerability in Microsoft Powerpoint allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as exploited by Trojan.PPDropper.G. NOTE: as of 20070213, it is not clear whether this is the same issue as CVE-2006-5296, CVE-2006-4694, CVE-2006-3876,...

Design/Logic Flaw

Unspecified vulnerability in Microsoft Powerpoint allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as exploited by Trojan.PPDropper.G. NOTE: as of 20070213, it is not clear whether this is the same issue as CVE-2006-5296, CVE-2006-4694, CVE-2006-3876,...