CVE-2007-5094

Heap-based buffer overflow in iaspam.dll in the SMTP Server in Ipswitch IMail Server 8.01 through 8.11 allows remote attackers to execute arbitrary code via a set of four different e-mail messages with a long boundary parameter in a certain malformed Content-Type header line, the string "MIME" by...

CVE-2007-5105

Cross-site scripting XSS vulnerability in wp-register.php in WordPress 2.0 and 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the useremail parameter...

CVE-2007-5106

Cross-site scripting XSS vulnerability in wp-register.php in WordPress 2.0 allows remote attackers to inject arbitrary web script or HTML via the userlogin parameter...

Immunity Canvas: WORDSMITH_INCLUDE

Name| wordsmithinclude ---|--- CVE| CVE-2007-5102 Exploit Pack| CANVAS Description| Wordsmith Remote file inclusion Notes| CVSS: 6.8 Repeatability: Infinite VENDOR: Wordsmith CVE Url: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5102 CVE Name: CVE-2007-5102...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in phpBB Plus 1.53, and 1.53a before 20070922, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter to 1 language/langgerman/langadminalbum.php, 2...

Immunity Canvas: DFDCART_INCLUDE

Name| dfdcartinclude ---|--- CVE| CVE-2007-5098 Exploit Pack| CANVAS Description| DFD Cart Remote file inclusion Notes| CVSS: 6.8 Repeatability: Infinite VENDOR: DFD Cart CVE Url: https://vulners.com/cve/CVE-2007-5098 CVE Name: CVE-2007-5098...

CVE-2007-5104

The provided connected records describe SQL injection vulnerabilities in the bcoos package (versions 1.0.10 and earlier). For CVE-2007-5104, remote attackers can inject via the gid parameter to modules/arcade/index.php in a show_stats action. For CVE-2007-6266, similar issues allow injection via ...

CVE-2007-5102

CVE-2007-5102 describes a PHP remote file inclusion in Wordsmith 1.0 RC1. When register_globals is enabled, an attacker can trigger arbitrary PHP code execution by supplying a URL in the _path parameter to config.inc.php. The vulnerability stems from unsafely including user-controlled input in th...

CVE-2007-5099

CVE-2007-5099 : Affected software is David Watters Helplink 0.1.0. The vulnerability is a PHP remote file inclusion in show.php, exploitable via a URL supplied to the file parameter, allowing an attacker to execute arbitrary PHP code. Connected documents confirm the issue and cite CVSS 7.5; explo...

CVE-2007-5094

The CVE pertains to Ipswitch IMail Server (8.01–8.11) where a heap-based buffer overflow in iaspam.dll within the SMTP Server can be triggered by συγκεκριed malformed Content-Type headers (long boundary parameter, a lone “MIME” line, and long Content-Transfer-Encoding lines). This allows remote c...

CVE-2007-5101

ChironFS before 1.0 RC7 contains a local privilege escalation vulnerability. When files are created, the system sets user/group ownership to the mounter account instead of the creator account, enabling local users to gain privileges. Affected component: ChironFS (before 1.0 RC7). The issue stems ...

CVE-2007-5095

Microsoft Windows Media Player WMP 9 on Windows XP SP2 invokes Internet Explorer to render HTML documents contained inside some media files, regardless of what default web browser is configured, which might allow remote attackers to exploit vulnerabilities in software that the user does not expec...

CVE-2007-5106

Cross-site scripting XSS vulnerability in wp-register.php in WordPress 2.0 allows remote attackers to inject arbitrary web script or HTML via the userlogin parameter...

CVE-2007-5105

CVE-2007-5105 is a Cross-site Scripting (XSS) flaw in WordPress versions 2.0 and 2.0.1, exploitable via the user_email parameter in wp-register.php. The underlying issue is a script/HTML injection vulnerability that remote attackers can trigger, as documented across multiple sources (WordPress wp...

CVE-2007-5097

The vulnerability concerns Online Fantasy Football League (OFFL) version 0.2.6. It is a PHP remote file inclusion in lib/classes/offl_nflteam.php triggered via a URL parameter (DOC_ROOT), which could allow an attacker to execute arbitrary PHP code on the server. The issue is noted as disputed by ...

CVE-2007-5098

DFD Cart is affected by multiple PHP remote file inclusion flaws in version 1.1.4 and earlier when register_globals is on. The vulnerability allows an attacker to craft a URL for set_depth that causes inclusion of arbitrary PHP code via specific target paths in app.lib/product.control/core.php/pr...

CVE-2007-5100

CVE-2007-5100 describes PHP remote file inclusion in phpBB Plus 1.53 and 1.53a prior to 2007-09-22. The vulnerability occurs when register_globals is enabled and an attacker can craft a URL that sets phpbb_root_path to include arbitrary PHP code via language/lang_german/lang_main_album.php, langu...

CVE-2007-5095

CVE-2007-5095 affects Microsoft Windows Media Player 9 on Windows XP SP2, where WMP invokes Internet Explorer to render HTML documents embedded in certain media files (notably via the HTMLView parameter in .asx files). Root cause is the browser rendering trigger from within WMP, potentially expos...

CVE-2007-5103

The CVE-2007-5103 entry describes a directory traversal in Wordsmith 1.0 RC1’s config.inc.php when register_globals is on. An attacker can craft a .. payload in the _path parameter to cause inclusion and execution of local files. The vulnerability arises from insufficient validation of the path, ...

CVE-2007-5100

Multiple PHP remote file inclusion vulnerabilities in phpBB Plus 1.53, and 1.53a before 20070922, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter to 1 language/langgerman/langadminalbum.php, 2...