CVE-2007-5380

Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."...

Immunity Canvas: AWZMB_INCLUDE

Name| awzmbinclude ---|--- CVE| CVE-2007-5592 Exploit Pack| CANVAS Description| awzMB remote file include Notes| CVSS: 6.8 Repeatability: Infinite VENDOR: awzMB CVE Url: https://vulners.com/cve/CVE-2007-5592 CVE Name: CVE-2007-5592...

CVE-2007-5593

install.php in Drupal 5.x before 5.3, when the configured database server is not reachable, allows remote attackers to execute arbitrary code via vectors that cause settings.php to be modified...

CVE-2007-5589

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via certain input available in 1 PHPSELF in a serverstatus.php, and b grabglobals.lib.php, c displaychangepassword.lib.php, and d common.lib.php in...

CVE-2007-5379

Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.fromxml Hashfromxml method, which uses XmlSimple XML::Simple unsafely, as demonstrated by reading passwords fro...

CVE-2007-5588

Cross-site scripting XSS vulnerability in mnoGoSearch before 3.2.43 allows remote attackers to inject arbitrary web script or HTML via the t parameter in search.cgi, as reachable from search.htm-dist...

CVE-2007-5598

CVE-2007-5598 affects the Weblinks module for Drupal, specifically versions 4.7.x before 4.7.x-1.0 and 5.x before 5.x-1.8. The vulnerability is a cross-site scripting (XSS) issue that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The connected documents c...

CVE-2007-5590

Miranda IM is affected by stack-based buffer overflow vulnerabilities described across multiple CVEs in 2007. Specifically, Red Hat and NVD entries indicate that Miranda IM 0.6.8 and 0.7.0 are exploitable via crafted Yahoo! Messenger packets to gain arbitrary code execution, with potential overla...

CVE-2007-5600

CVE-2007-5600 affects Artmedic CMS 3.4 and earlier. The vulnerability is an incomplete blacklist in index.php that enables remote PHP code execution via the page parameter when using URLs with UNC share pathnames or protocols such as ftps, ssh2.sftp, or ssh2.scp, since PHP remote file inclusion c...

CVE-2007-5589

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via certain input available in 1 PHPSELF in a serverstatus.php, and b grabglobals.lib.php, c displaychangepassword.lib.php, and d common.lib.php in...

CVE-2007-5594

CVE-2007-5594 concerns Drupal 5.x before 5.3, where the Drupal Forms API protection is not applied to the user deletion form. This allows remote attackers to delete users via a cross-site request forgery (CSRF) attack. The connected advisories document an upgrade to Drupal 5.3 (e.g., Fedora-2007-...

CVE-2007-5593

Drupal 5.x before 5.3 is vulnerable: if the configured database server is unreachable, an attacker can trigger arbitrary code execution by exploiting install.php vectors that cause settings.php to be modified. The issue is addressed by upgrading Drupal to 5.3 (e.g., Drupal 5.3-1 for the affected ...

CVE-2007-5380

CVE-2007-5380 affects Ruby on Rails

CVE-2007-5589

CVE-2007-5589 is a cross-site scripting vulnerability in phpMyAdmin affecting versions prior to a patched release (noted in multiple advisories). The vulnerability arises from input echoed via PHP_SELF and PATH_INFO in several files inside libraries/ and common.inc.php (and possibly via REQUEST_U...

CVE-2007-5379

CVE-2007-5379 affects Ruby on Rails installations using Rails prior to 1.2.4. The vulnerability stems from Hash.from_xml (Hash#from_xml) using XmlSimple unsafely, enabling remote attackers to determine the existence of arbitrary files and read arbitrary XML files (e.g., passwords from Pidgin .pur...

CVE-2007-5596

CVE-2007-5596 affects Drupal’s core Upload module in Drupal 4.7.x (before 4.7.8) and 5.x (before 5.3). The vulnerability arises from a whitelist that includes the .html extension, allowing remote attackers to upload .html files that can trigger cross-site scripting (XSS). Public details in the co...

CVE-2007-5592

CVE-2007-5592 describes multiple PHP remote file inclusion vulnerabilities in awzMB 4.2 beta 1 and earlier. An attacker can supply a URL in the Setting[OPT_includepath] parameter to load remote PHP code via the following files in modules/: adminhelp.php; admin.incl.php; reg.incl.php; help.incl.ph...

CVE-2007-5599

CVE-2007-5599 affects awrate 1.0 with multiple PHP remote file inclusion (RFI) vulnerabilities. The issue allows remote attackers to execute arbitrary PHP code by supplying a URL in the toroot parameter used by (1) 404.php or (2) topbar.php, representing vectors distinct from CVE-2006-6368. The r...

CVE-2007-5597

CVE-2007-5597 affects Drupal core: hook_comments in Drupal 4.7.x (before 4.7.8) and 5.x (before 5.3) does not pass the publication status of comments. This can allow attackers to bypass access restrictions and cause modules (e.g., Organic groups, Subscriptions) to mail or process unpublished comm...

Immunity Canvas: MS07_067

Name| ms07067 ---|--- CVE| CVE-2007-5587 Exploit Pack| CANVAS Description| Macrovision SecDrv.sys Arbitrary Overwrite Notes| References: www.microsoft.com/technet/security/Bulletin/MS07-067.mspx CVE Name: CVE-2007-5587 VENDOR: Microsoft MSADV: MS07-067 Date public: 10/17/07 CVE Url:...