Design/Logic Flaw

admin/uploadfiles.php in Zomplog 3.8.1 and earlier does not check for administrative credentials, which allows remote attackers to perform administrative actions via a direct request. NOTE: this can be leveraged for code execution by exploiting CVE-2007-5231...

CVE-2007-5232

CVE-2007-5232 affects Sun JRE/JDK and related runtimes where applet caching enables a DNS rebinding attack that can bypass an applet’s outbound connection protections. Connected OSV entries (RHSA-2007:0963, RHSA-2008:0132, RHSA-2008:0100, RHSA-2008:0156, etc.) indicate Red Hat Java components (in...

CVE-2007-5231

CVE-2007-5231 affects Zomplog prior to 3.8.1: an unrestricted file upload in admin/upload_files.php allows remote authenticated administrators to upload and execute arbitrary PHP files by sending a modified MIME type. Note that CVE-2007-5230 shows this can be leveraged for code execution and coul...

CVE-2007-5231

Unrestricted file upload vulnerability in admin/uploadfiles.php in Zomplog 3.8.1 and earlier allows remote authenticated administrators to upload and execute arbitrary .php files by sending a modified MIME type. NOTE: this can be exploited by unauthenticated attackers by leveraging CVE-2007-5230...

CVE-2007-5234

CVE-2007-5234 affects Ossigeno CMS 2.2 alpha3. A PHP remote file inclusion vulnerability exists in upload/common/footer.php, allowing an attacker to execute arbitrary PHP code via the level parameter. The issue is confirmed across multiple sources; exploitation details are not provided in these d...

CVE-2007-5228

CVE-2007-5228 is a Drupal XSS vulnerability in the subscription functionality of the Project issue tracking module. The issue enables remote authenticated users with project create or edit permissions to inject arbitrary web script or HTML via unspecified vectors in the (1) individual and (2) ove...

CVE-2007-5230

CVE-2007-5230 concerns Zomplog 3.8.1 and earlier where admin/upload_files.php does not require administrative credentials, enabling remote attackers to perform administrative actions via a direct request. This is linked to CVE-2007-5231, which describes an unrestricted file upload vulnerability i...

CVE-2007-5233

Affected product: Web Templates Management (1.3) — index.php SQL Injection vulnerability. Root cause: inadequate sanitization of user-supplied data before constructing SQL queries. Impact (as stated): attacker could compromise the application and access or modify data via the SQL injection vector...

CVE-2007-5229

The CVE-2007-5229 entry describes a CSRF vulnerability in the WordPress plugin FeedBurner FeedSmith 2.2 . The vulnerability allows remote attackers to modify plugin settings and hijack blog feeds by submitting malicious requests to wp-admin/options-general.php, which send parameters to FeedBurner...

CVE-2007-3918

CVE-2007-3918 describes a cross-site scripting (XSS) vulnerability in GForge 4.6b2, specifically in account/verify.php via the confirm_hash parameter. An unauthenticated attacker could cause arbitrary HTML/script to be executed in a user’s browser. Public references from Debian DSA-1383-1 indicat...

CVE-2007-4568

Integer overflow in the buildrange function in X.Org X Font Server xfs before 1.0.5 allows context-dependent attackers to execute arbitrary code via 1 QueryXBitmaps and 2 QueryXExtents protocol requests with crafted size values, which triggers a heap-based buffer overflow...

Immunity Canvas: XFS_SWAPCHAR2B

Name| xfsswapchar2b ---|--- CVE| CVE-2007-4990 Exploit Pack| CANVAS Description| xfsswapchar2b Notes| CVE Name: CVE-2007-4990 Notes: Repeatability: Infinite References: CVE Url: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4990 Date public: CVSS: 7.5...

CVE-2007-4568

Integer overflow in the buildrange function in X.Org X Font Server xfs before 1.0.5 allows context-dependent attackers to execute arbitrary code via 1 QueryXBitmaps and 2 QueryXExtents protocol requests with crafted size values, which triggers a heap-based buffer overflow...

CVE-2007-5226

ircserver.c in dircproxy 1.2.0 and earlier allows remote attackers to cause a denial of service segmentation fault via an ACTION command without a parameter, which triggers a NULL pointer dereference, as demonstrated using a blank /me message from irssi...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2007-4568. Reason: This candidate is a reservation duplicate of CVE-2007-4568. Notes: All CVE users should reference CVE-2007-4568 instead of this candidate. All references and descriptions in this candidate have been removed to...

CVE-2007-4989

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2007-4568. Reason: This candidate is a reservation duplicate of CVE-2007-4568. Notes: All CVE users should reference CVE-2007-4568 instead of this candidate. All references and descriptions in this candidate have been removed to...

CVE-2007-0447

The CVE-2007-0447 entry corresponds to a heap-based buffer overflow in the Decomposer used by Symantec products (notably Symantec Antivirus Scan Engine / Mail Security for Exchange/Domino) when processing crafted CAB archives, enabling remote code execution. Connected details corroborate: a heap ...

CVE-2007-3699

CVE-2007-3699 affects the Decomposer component in multiple Symantec products, enabling remote attackers to trigger a denial of service (infinite loop) by crafting the PACK_SIZE field in a RAR header. Connected Nessus entries reiterate this as part of “Symantec Mail Security Engine/Scanner” vulner...

CVE-2007-4989

...

CVE-2007-4989

CVE-2007-4989 is a reservation duplicate of CVE-2007-4568 (the active entry). The connected Nessus/NASL documents describe CVE-2007-4568 as an integer overflow in the X.Org X Font Server (xfs) before 1.0.5 that enables a remote attacker to execute arbitrary code via crafted QueryXBitmaps/QueryXEx...