CVE-2007-6083

IceBB 1.0-rc6 contains a SQL injection in admin/index.php exploitable via the X-Forwarded-For HTTP header. Remote attackers can execute arbitrary SQL commands. The connected documents confirm the affected software and vulnerability class, but do not provide remediation steps or patched versions. ...

CVE-2007-6097

Affected products: Ingate Firewall (before 4.6.0) and SIParator (before 4.6.0). The vulnerability lies in their ICMP implementation, with the issue described as ICMP packets being “incorrectly accepted.” The impact is not explicitly quantified in the provided documents, but the CVE notes unknown ...

CVE-2007-6086

CVE-2007-6086 is a directory-traversal vulnerability in VigileCMS 1.4. The issue occurs in index.php where directory traversal sequences in the module parameter allow remote attackers to include and execute arbitrary local files. This leads to arbitrary code execution and partial/complete comprom...

CVE-2007-6090

CVE-2007-6090 is an XSS vulnerability in Nuked-Klan 1.7.5 where the index.php file parameter accepts unsanitized input, enabling remote attackers to inject arbitrary script via the file parameter. Exploitation details exist (Exploit-DB entry) showing crafted URLs that trigger script execution in ...

CVE-2007-6087

CVE-2007-6087 is a CSRF vulnerability in VigileCMS 1.4. The index.php changepass module accepts certain parameters that allow remote attackers to change the admin password. Affected component is the VigileCMS 1.4 web application; underlying issue is cross-site request forgery enabling unauthorize...

CVE-2007-6085

Multiple cross-site scripting XSS vulnerabilities in index.php in VigileCMS 1.4 allow remote attackers to inject arbitrary web script or HTML via the message field in the 1 vedipm or 2 livechat module...

CVE-2007-6089

CVE-2007-6089 affects meBiblio 0.4.5. The vulnerability is a PHP remote file inclusion in index.php, allowing an attacker to execute arbitrary PHP code via the action parameter. Root cause appears to be unsafe handling of a user-supplied URL in a file-inclusion operation. Affected component: inde...

CVE-2007-6091

CVE-2007-6091 relates to multiple SQL injection vulnerabilities in JiRo’s Banner System (JBS) 2.0, and possibly JiRo’s Upload Manager (JUS). The flaws reside in the login routine (files/login.asp), where the attacker can inject via the (1) Username (Login/Email) or (2) Password fields to execute ...

CVE-2007-6094

The CVE-2007-6094 entry describes a DoS vulnerability in the IPsec module of Ingate Firewall (and SIParator) prior to version 4.6.0. A remote attacker can crash the module by sending an IPsec Phase 2 proposal that lacks Perfect Forward Secrecy (PFS). Affected products: Ingate Firewall before 4.6....

Unfixed XSS vulnerability at fedho.com

Security researcher Uber0n, has submitted on 22/11/2007 a cross-site-scripting XSS vulnerability affecting fedho.com, which at the time of submission ranked 250260 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 29/11/2007. It is currently...

BitDefender在线扫描器OScan.OCX ActiveX控件堆溢出漏洞

BUGTRAQ ID: 26210 CVECAN ID: CVE-2007-5775 BitDefender Online Scanner是一款免费的在线杀毒软件。 BitDefender在线扫描器所捆绑的OScan.ocx控件中存在远程代码执行漏洞，远程攻击者可能利用此漏洞在用户系统上执行任意指令。 OScan.ocx的有漏洞函数为InitX，该函数取得了bstrLocation的字符串参数值用于确认调用域。InitX的IDL类似于以下： Function InitX ByVal bstrLocation as String As Boolean...

CVE-2007-6092

CVE-2007-6092 affects Ingate Firewall prior to 4.6.0 and SIParator prior to 4.6.0 via a buffer overflow in libsrtp. The available descriptions state unknown impact and attack vectors, with uncertainty about privilege boundaries. No remediation or mitigation details are provided in the connected d...

CVE-2007-6081

AdventNet EventLog Analyzer (Windows, build 4030, and possibly other versions) ships a MySQL instance with a default root/passwordless account, enabling remote attackers to gain privileges and modify logs. The vulnerability is fixed in EventLog Analyzer Build 6000. Affected component: bundled MyS...

CVE-2007-5612

IBM Director CIM Server (IBM Director 5.20.1 and earlier) is affected by CVE-2007-5612. The vulnerability allows a remote, unauthenticated attacker to cause a denial of service through a flood of idle connections, leading to high CPU usage, exhaustion of connection slots, and potential daemon cra...

CVE-2007-5499

...

CVE-2007-6078

SkyPortal RC6 contains multiple SQL injection vulnerabilities that could allow a remote, unauthenticated attacker to gain access to the back-end database and add, modify, or remove data by exploiting vulnerable endpoints such as nc_top.asp, inc_bookmarks.asp, inc_profile_functions.asp, inc_SUBSCR...

CVE-2007-6079

CVE-2007-6079 : A directory traversal vulnerability in include/common.php of bcoos 1.0.10 allows remote attackers to include and execute arbitrary local files via .. in xoopsOption[pagetype] for the default URI of modules/news/. The issue arises from the ability to traverse directories and includ...

CVE-2007-6080

CVE-2007-6080 : SQL injection in the banners module of bcoos, via bid parameter in modules/banners/click.php. Affected versions include 1.0.10 and 1.0.13; remote attackers could execute arbitrary SQL commands. Root cause identified as improper handling of input in the banners/click.php script. No...

CVE-2007-5499

This CVE entry is rejected/not used and does not represent an active vulnerability.

CVE-2007-6077

The session fixation protection mechanism in cgiprocess.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookieonly attribute from the DEFAULTSESSIONOPTIONS constant, which effectively causes cookieonly to be applied only to the first instantiation of CgiRequest, which allows remote...