CVE-2007-5156

Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP code via a file whose name contains ".php."...

CVE-2007-5152

Summary: CVE-2007-5152 affects Sun Java System Access Manager 7.1 when installed in a Sun Java System Application Server 9.1 container. The issue is that authentication is not required after a container restart, enabling remote attackers to perform administrative tasks. The vulnerability is evide...

CVE-2007-5164

CVE-2007-5164 is a PHP remote file inclusion in UniversiBO 1.3.4 affecting htmls/forum/includes/topic_review.php via the phpbb_root_path parameter. The issue’s root cause is an include in a function that is not called on a direct request, and CVE notes that this dispute exists. No public exploit ...

CVE-2007-5150

CVE-2007-5150 describes an SQL injection in the is_god function of includes/nukesentinel.php in NukeSentinel 2.5.11, allowing remote attackers to inject SQL via base64-encoded data in an admin cookie (distinct from CVE-2007-5125). The available documents specify the vulnerable component and trigg...

CVE-2007-5156

Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP code via a file whose name contains ".php."...

CVE-2007-5146

CVE-2007-5146 ffects dedi-group Der Dirigent 1.0. Multiple PHP remote file inclusion vulnerabilities allow remote attackers to execute arbitrary PHP code via a URL in the dedi_path parameter to: inc.generate_code.php, fnc.type_forms.php, fnc.type.php (backend/inc/), frontend.php or backend.php (p...

CVE-2007-5147

Puzzle Apps CMS 2.2.1 is affected by multiple PHP remote file inclusion vulnerabilities that allow an attacker to supply a URL via parameters (MODULEDIR, COREROOT, THISDIR, etc.) to trigger inclusion in various modules/files, leading to remote code execution. Affected paths include core/modules/m...

CVE-2007-5154

Aipo (Aimluck, Inc.) and Aipo ASP 3.0.1.0 and earlier are affected by a session fixation vulnerability. The issue allows an attacker to impersonate a user by obtaining or forcing a valid session ID, enabling potentially privileged actions once the user logs in. The JVN entry describes risk as use...

CVE-2007-5156

CVE-2007-5156 references an incomplete blacklist vulnerability in FCKeditor’s editor/filemanager/upload/php/upload.php, used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and other products. The flaw allows remote attackers to upload and execute arbitrary PHP code by submitting a...

CVE-2007-5158

Technical details for CVE-2007-5158 are not provided in the connected documents. The Initial Description notes focus-stealing via onkeydown in IE6, but no concrete product, impact, or remediation is included here. Monitor for official updates.

CVE-2007-5165

The CVE-2007-5165 issue affects myIpacNG-stats (MINGS) v0.05, where init.php accepts a URL in the MINGS_BASE parameter, enabling potential remote PHP code execution via a remote file inclusion vulnerability. The description notes that this claim is disputed by CVE because MINGS_BASE is defined be...

CVE-2007-5155

IceGUI.DLL in ICEOWS 4.20b is affected. The vulnerability occurs when a function is invoked with incorrect arguments, allowing user-assisted remote attackers to execute arbitrary code via a long filename in the header of an ACE archive, which triggers a stack-based buffer overflow.

CVE-2007-5150

SQL injection vulnerability in the isgod function in includes/nukesentinel.php in NukeSentinel 2.5.11 allows remote attackers to execute arbitrary SQL commands via base64-encoded data in an admin cookie, a different vector than CVE-2007-5125...

CVE-2007-5144

CVE-2007-5144: A buffer overflow in the GDI engine of Windows Live Messenger (MSN Live 8.1) could be triggered by placing a malformed file in a new folder under the Sharing Folders path and triggering a synchronize operation. The issue allows user-assisted remote attackers to cause a denial of se...

CVE-2007-5167

CVE-2007-5167 describes a PHP remote file inclusion vulnerability in phpLister 0.5-pre2, exploitable via a URL in the nom_rep_systeme parameter of .systeme/fonctions.php. The underlying issue is that user-provided input can influence included files, enabling remote PHP code execution. Affected so...

CVE-2007-5163

The CVE concerns Nexty 1.01.A Beta and a PHP remote file inclusion in includes/functions/layout.php exploited via the rel parameter to run arbitrary PHP. The issue is disputed by CVE because the include occurs in a function not called on direct request. Connected sources corroborate the vulnerabi...

CVE-2007-5160

CVE-2007-5160 affects the Thierry Leriche Restaurant Management System (ReMaSys) 0.5. The vulnerability is described as multiple PHP remote file inclusion flaws allowing an attacker to execute arbitrary PHP code via a URL in either the DIR_ROOT parameter to global.php or the DIR_PAGE parameter to...

CVE-2007-5162

CVE-2007-5162 affects Ruby 1.8.5/1.8.6: Net::HTTP and Net::HTTPS do not verify the server certificate CN against the requested domain, enabling MITM or spoofed sites. The connected MiracleLinux advisory ( AXSA-2007-63:01 ) reiterates the flaw across multiple Net modules (including Net::HTTP/Net::...

CVE-2007-5151

CVE-2007-5151 affects NukeSentinel 2.5.12: the abget_admin function in includes/nukesentinel.php is vulnerable to SQL injection via base64-encoded data in an admin cookie, allowing remote SQL execution. Documentation shows the vulnerability but provides no patch details in the connected sources; ...

CVE-2007-5153

Technical details about CVE-2007-5153 are not publicly available in the provided documents; affected products, impact, and remediation specifics are not disclosed. Monitor for updates from official sources.