CVE-2007-6659

Multiple cross-site scripting XSS vulnerabilities in 2z project 0.9.6.1 allow remote attackers to inject arbitrary web script or HTML via the 1 contentshort or 2 contentfull parameter in an addnews action to the default URI; 3 the content parameter in a pm write action to 2z/admin.php; 4 the...

CVE-2007-6647

CVE-2007-6647 is a SQL injection vulnerability in the web app component w-Agora ≤ 4.2.1, exploitable via the cat parameter in index.php. The connected sources confirm the affected product and vulnerability class but do not provide a patch version or remediation steps within the available document...

CVE-2007-6653

The CVE-2007-6653 entry describes a Directory traversal vulnerability in Mihalism Multi Host 2.0.7, affecting the download.php script. The vulnerability allows remote attackers to read arbitrary files by manipulating the file parameter with a .. (dot dot) sequence. Documented impact is read acces...

CVE-2007-6665

CVE-2007-6665 describes an SQL injection vulnerability in Netchemia oneSCHOOL, specifically in admin/login.asp where the txtLoginID parameter can be exploited by remote attackers to run arbitrary SQL commands. The issue is documented across multiple sources (NVD/NIST, CVE listings) as affecting t...

CVE-2007-6654

CVE-2007-6654 is a buffer overflow in Macrovision InstallShield Update Service Web Agent 5.1.100.47363, affecting its ActiveX control. A remote attacker can execute arbitrary code by passing a long ProductCode string as the second argument to the DownloadAndExecute method. This entry is distinct ...

CVE-2007-6658

CVE-2007-6658 concerns a SQL injection in the CustomCMS (CCMS) 3.1 Demo, specifically in the files/admin.php/vars.php. The underlying issue is an injection vulnerability exploitable via the p parameter on the Console page, enabling remote attackers to execute arbitrary SQL commands. The available...

CVE-2007-6664

CVE-2007-6664 is a SQL injection vulnerability in WebPortal CMS 0.6.0 and earlier. The flaw resides in the index.php handling of the m parameter, allowing remote attackers to execute arbitrary SQL commands. The NVD notes a base score of 7.5 (High) with network access, low attack complexity, and n...

CVE-2007-6666

The CVE-2007-6666 issue affects Zenphoto rss.php, vulnerable in versions 1.1 through 1.1.3 via the albumnr parameter. The vulnerability is a SQL injection that allows remote attackers to execute arbitrary SQL commands through that input, potentially leading to data disclosure or modification. Ope...

CVE-2007-6598

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password...

CVE-2007-6598

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password...

CVE-2007-6599

CVE-2007-6599 describes a race condition in the OpenAFS fileserver that can cause a remote daemon crash (DoS) when file callbacks are acquired and returned concurrently, triggering linked-list operations without host_glock locking. Affected versions range from OpenAFS 1.3.40/1.3.50? through 1.4.5...

CVE-2007-6644

Joomla! before 1.5 RC4 allows remote authenticated administrators to promote arbitrary users to the administrator group, in violation of the intended security model...

CVE-2007-6645

Unspecified vulnerability in Joomla! before 1.5 RC4 allows remote authenticated users to gain privileges via unspecified vectors, aka "registered user privilege escalation vulnerability."...

CVE-2007-6640

Creammonkey (0.9–1.1) and GreaseKit (1.2–1.3) expose dangerous user-scripting APIs (GM_addStyle, GM_log, GM_openInTab, GM_setValue, GM_getValue, GM_xmlhttpRequest) to web pages, allowing a remote attacker to read/modify configuration or trigger HTTP requests from a page hosting a userscript. The ...

CVE-2007-6644

CVE-2007-6644 concerns Joomla! prior to version 1.5 RC4, where remote authenticated administrators could elevate arbitrary users to the administrator group, violating the intended security model. The description indicates an authenticated-admin privilege escalation vulnerability in the Joomla cor...

CVE-2007-6645

Joomla! CVE-2007-6645 affects Joomla before 1.5 RC4, allowing remote authenticated users to escalate privileges via unspecified vectors. Public docs confirm the issue and point to a fixed package in Joomla 1.0.15 per Mandriva MDVSA-2008:060; no exploit details are provided in the supplied sources.

CVE-2007-6642

CVE-2007-6642 concerns Joomla! before 1.5 RC4, with multiple CSRF vulnerabilities that allow remote attackers to perform admin-level actions via unspecified vectors, including adding a Super Admin, uploading extensions containing PHP code, and modifying configuration. The linked documents confirm...

CVE-2007-6639

CVE-2007-6639 describes a SQL injection vulnerability in IPTBB 0.5.4 and earlier, where the id parameter in the viewdir action of index.php can be exploited to execute arbitrary SQL commands remotely. Affected software is IPTBB (0.5.4 and earlier). The root cause is improper input handling in the...

CVE-2007-6639

SQL injection vulnerability in index.php in IPTBB 0.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewdir action...

CVE-2007-6641

CVE-2007-6641 is an XSS vulnerability in milliscripts Redirection, affecting dir.php where an attacker can inject arbitrary script/HTML by supplying the cat parameter in a browse action. The NVD entry lists a medium severity (CVSS v2: AV:N/AC:M/Au:N/C:N/I:P/A:N, base score 4.3). No exploitation d...