CVE-2007-5168

CVE-2007-5168 describes multiple PHP remote file inclusion vulnerabilities in ClanLite 1.23.01.2005. An attacker can execute arbitrary PHP code by supplying a URL in the root_path parameter to either modules/serveur_jeux.php or conf/conf-php.php. The entry notes that vector 1 is disputed because ...

CVE-2007-5161

CVE-2007-5161 describes a cross-zone scripting vulnerability in the internal browser of the i-Systems Feedreader 3.10. The issue allows remote attackers to inject arbitrary web script or HTML via an item in a feed, demonstrated by a WordPress blog update. The vulnerability stems from how the inte...

CVE-2007-5159

CVE-2007-5159: The ntfs-3g package before 1.913-2.fc7 in Fedora 7 and ntfs-3g in Ubuntu 7.10/Gutsy assigns incorrect permissions (setuid root) to mount.ntfs-3g. This allows local users with fuse group membership to read from and write to arbitrary block devices, possibly involving a file descript...

CVE-2007-5149

The CVE-2007-5149 entry describes a PHP remote file inclusion vulnerability in NewsCMS/Public Media Manager (PMM) 1.3, specifically in NewsCMS/news/newstopic_inc.php where an attacker can cause arbitrary PHP code execution through a URL supplied in the indir parameter. The affected component is t...

CVE-2007-5166

CVE-2007-5166 affects SiteSys 1.0a with multiple PHP remote file inclusion vulnerabilities. The issue allows an attacker to cause arbitrary PHP code execution by supplying a URL to the doc_root parameter for inc/pagehead.inc.php or inc/pageinit.inc.php. Root cause: unsanitized doc_root parameter ...

CVE-2007-5158

The focus handling for the onkeydown event in Microsoft Internet Explorer 6.0 allows remote attackers to change field focus and copy keystrokes via a certain use of a JavaScript htmlFor attribute, as demonstrated by changing focus from a textarea to a file upload field, a related issue to...

CVE-2007-5143

F-Secure Anti-Virus for Windows Servers 7.0 64-bit edition is affected by CVE-2007-5143. Local users can bypass virus scanning by placing a crafted (archive or packed executable) into the system32 directory. In many environments this does not cross privilege boundaries since a process that can wr...

CVE-2007-5167

PHP remote file inclusion vulnerability in .systeme/fonctions.php in phpLister 0.5-pre2 allows remote attackers to execute arbitrary PHP code via a URL in the nomrepsysteme parameter...

Unfixed XSS vulnerability at www.sgsguvenlik.com

Security researcher BackDoor, has submitted on 30/09/2007 a cross-site-scripting XSS vulnerability affecting www.sgsguvenlik.com, which at the time of submission ranked 8856718 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 02/10/2007. It is...

Unfixed Redirect vulnerability at votetrustusa.org

Security researcher Narcoticxs, has submitted on 30/09/2007 a Redirect vulnerability affecting votetrustusa.org, which at the time of submission ranked 6974463 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/10/2007. It is currently unfixed...

Unfixed Redirect vulnerability at www.migrationsrecht.net

Security researcher Narcoticxs, has submitted on 30/09/2007 a Redirect vulnerability affecting www.migrationsrecht.net, which at the time of submission ranked 702132 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/10/2007. It is currently...

Unfixed XSS vulnerability at www.otostore.com

Security researcher BackDoor, has submitted on 30/09/2007 a cross-site-scripting XSS vulnerability affecting www.otostore.com, which at the time of submission ranked 181045 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/10/2007. It is...

Unfixed XSS vulnerability at www.lemmefind.ro

Security researcher www.r3t.n3t.nl, has submitted on 30/09/2007 a cross-site-scripting XSS vulnerability affecting www.lemmefind.ro, which at the time of submission ranked 210055 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 02/10/2007. It is...

Unfixed XSS vulnerability at www.xixixi.jp

Security researcher kusomiso.com, has submitted on 30/09/2007 a cross-site-scripting XSS vulnerability affecting www.xixixi.jp, which at the time of submission ranked 2030221 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 02/10/2007. It is...

Unfixed Redirect vulnerability at www.eyezberg.com

Security researcher Narcoticxs, has submitted on 30/09/2007 a Redirect vulnerability affecting www.eyezberg.com, which at the time of submission ranked 153668 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/10/2007. It is currently unfixed. ...

phpBB Mod OpenID 0.2.0 BBStore.php Remote File Inclusion Vuln

Exploit for unknown platform in category web applications ============================================================= phpBB Mod OpenID 0.2.0 BBStore.php Remote File Inclusion Vuln ============================================================= ============================================ = = =...

Microsoft Visual Studio PDWizard.ocx ActiveX vulnerability

Added: 09/30/2007 CVE: CVE-2007-4891 BID: 25638 OSVDB: 37106 Background Microsoft Visual Studio is a product for facilitating software development on Windows operating systems. Problem ActiveX controls contained in the PDWizard.ocx file in Microsoft Visual Studio 6.0 expose the StartProcess metho...

Unfixed Redirect vulnerability at www.lib.utc.edu

Security researcher Narcoticxs, has submitted on 30/09/2007 a Redirect vulnerability affecting www.lib.utc.edu, which at the time of submission ranked 105940 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/10/2007. It is currently unfixed. I...

Unfixed Redirect vulnerability at yedibilge.net

Security researcher Narcoticxs, has submitted on 30/09/2007 a Redirect vulnerability affecting yedibilge.net, which at the time of submission ranked 6151414 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/10/2007. It is currently unfixed. If...

Xitami 2.5c2 Web Server If-Modified-Since Overflow

This module exploits a stack buffer overflow in the iMatix Corporation Xitami Web Server. If a malicious user sends an If-Modified-Since header containing an overly long string, it may be possible to execute a payload remotely. Due to size constraints, this module uses the Egghunter technique. Th...