CVE-2007-6285

CVE-2007-6285 concerns autofs5 in some Linux distros (notably RHEL4/5) where the default -hosts map lacked the nodev mount option. This allowed a local user who controls a remote NFS server to create device files on that server and potentially access important devices on the client via the defaul...

CVE-2007-6485

Multiple PHP remote file inclusion vulnerabilities in Centreon 1.4.1 aka Oreon 1.4 allow remote attackers to execute arbitrary PHP code via a URL in the fileOreonConf parameter to 1 MakeXML.php or 2 MakeXML4statusCounter.php in include/monitoring/engine/...

CVE-2007-6476

GF-3XPLORER 2.4 allows remote attackers to obtain configuration information via a direct request to explorer/phpinfo.php, which calls the phpinfo function...

CVE-2007-6496

Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to register arbitrary users via a request to hosting/addsubsite.asp with the loginname and password parameters set, when preceded by certain requests to hosting/default.asp and hosting/selectdomain.asp, a related issue to...

CVE-2007-6496

Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to register arbitrary users via a request to hosting/addsubsite.asp with the loginname and password parameters set, when preceded by certain requests to hosting/default.asp and hosting/selectdomain.asp, a related issue to...

CVE-2007-6484

SQL injection vulnerability in index.php in phpRPG 0.8 allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-6501

Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to enable or disable "pay type" via a request to adminsettings/choosetranstype.asp...

autofs5 security update

CentOS Errata and Security Advisory CESA-2007:1177 Updated autofs5 technology preview packages that fix a security issue are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The autofs utility...

CVE-2007-6486

CVE-2007-6486 affects LineShout 1.0’s shout.php (the shoutbox). The vulnerability is multiple cross-site scripting (XSS) weaknesses that allow remote attackers to inject arbitrary web script or HTML via the username (nickname) or message parameter. The description notes that some details are from...

CVE-2007-6478

CVE-2007-6478 affects Rosoft Media Player (versions including 4.1.7 and 4.1.8; possibly earlier) and is due to a stack-based buffer overflow in processing .M3U files. The vulnerability allows a remote attacker to execute arbitrary code or cause an application crash (DoS) by supplying a long strin...

CVE-2007-6491

Kvaliitti WebDoc 3.0 CMS is affected by multiple SQL injection vulnerabilities. The issues allow remote attackers to execute arbitrary SQL commands via (1) cat_id in categories.asp, (2) document_id in categories.asp, and (3)/(4) cat_id and document_id in subcategory.asp. Root cause is unsafely ha...

CVE-2007-6479

In Dokeos 1.8.4, the component My productions (main/auth/profile.php) has an unrestricted file upload flaw. Remote authenticated users can upload and execute arbitrary PHP files by using a filename with a double extension, accessible under main/upload/users/ .

CVE-2007-6472

CVE-2007-6472 affects phpMyRealty (PMR) 1.0.9, with two SQL injection vectors described in the records. Remote attackers can trigger arbitrary SQL via the type parameter to search.php, and remote authenticated administrators can execute arbitrary SQL via the listing_updated_days parameter to admi...

CVE-2007-6495

CVE-2007-6495 affects Hosting Controller 6.1 Hot fix 3.3 and earlier. A remote authenticated user can modify Dirroot via AddUser (accounts/AccountActions.asp) to change permissions on web root folders (db, www, Special, log). This can enable remote code execution by making Forum\db executable as ...

CVE-2007-6476

GF-3XPLORER 2.4 is affected by CVE-2007-6476 via an information-disclosure in explorer/phpinfo.php that calls phpinfo. This allows remote attackers to obtain configuration information. The CVSS data indicates network access, low attack complexity, and no authentication required, with partial conf...

CVE-2007-6474

GF-3XPLORER 2.4 contains multiple XSS vulnerabilities exploitable via the newdir parameter to index_3x.php (and other vectors). Remote attackers can inject arbitrary web script/HTML. The exact root cause details, affected versions beyond 2.4, exploit status, and remediation steps are not specifie...

CVE-2007-6498

CVE-2007-6498 : Multiple SQL injection vulnerabilities in Hosting Controller 6.1 Hot fix 3.3 and earlier allow remote authenticated users to execute arbitrary SQL via parameters to Hosting/Addreseller.asp (email, loginname), accounts/accountmanager.asp (sortfield), OpenApi/GatewayVariables.asp (G...

CVE-2007-6482

Technical details about CVE-2007-6482 are not publicly provided in the supplied documents. Monitor for updates from official advisories; current sources only reiterate an unspecified remote denial-of-service against Sun Ray Server's utdevmgrd.

CVE-2007-6481

Technical details are not publicly available in the provided documents; no affected products/versions or vectors are specified. Monitor for updates.

CVE-2007-6494

CVE-2007-6494 affects Hosting Controller 6.1 Hot fix 3.3 and earlier. The provided descriptions state a sequence-based authentication bypass where a remote attacker can obtain login access by first sending a request to hosting/addres reseller.asp with a username in the reseller parameter, followe...