Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2007-4880. Reason: This candidate is a duplicate of CVE-2007-4880. Notes: All CVE users should reference CVE-2007-4880 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

DSquare Exploit Pack: D2SEC_URIPDF

Name| d2securipdf ---|--- CVE| CVE-2007-5020 Exploit Pack| D2ExploitPack Description| Mailto vulnerability in Adobe Acrobat Notes|...

CVE-2007-5033

The provided data confirms CVE-2007-5033 is an XSS vulnerability in profile.php of phpBB XS 2. The flaw allows remote attackers to inject arbitrary web script or HTML via the selfdes parameter in a profile_info editprofile action. Affected component: profile.php in phpBB XS 2; root cause: insuffi...

CVE-2007-5032

CVE-2007-5032 is a Cross-site request forgery (CSRF) in admin.php of Francisco Burzi’s PHP-Nuke. An attacker can add administrative accounts by sending a request that abuses AddAuthor with crafted add_name/add_radminsuper parameters. Documented impact includes partial confidentiality, integrity, ...

CVE-2007-5029

CVE-2007-5029 affects Dibbler 0.6.0. The issue is a lack of validation of certain length parameters for buffer sizes, enabling a remote attacker to trigger a buffer over-read and cause a denial of service (daemon crash). The described failure points are within the TSrvMsg constructor in SrvMessag...

CVE-2007-5032

Cross-site request forgery CSRF vulnerability in admin.php in Francisco Burzi PHP-Nuke allows remote attackers to add administrative accounts via an AddAuthor action with modified addname and addradminsuper parameters...

CVE-2007-5031

The CVE-2007-5031 issue affects Dibbler 0.6.0, specifically the TSrvOptIA_NA::rebind implementation in SrvOptions/SrvOptIA_NA.cpp. A remote attacker can trigger a NULL dereference and daemon crash by sending a REBIND message with an invalid IA_NA option, leading to a denial of service. Exploitati...

CVE-2007-4991

The CVE-2007-4991 issue affects Microsoft ISA Server 2004 SP1 and SP2, where the SOCKS4 Proxy can leak the destination IP address of another user’s session. The root cause is that an empty packet to the SOCKS4 proxy elicits a response containing the last IP address proxied through the server. Imp...

CVE-2007-4496

The CVE-2007-4496 issue affects VMware products: VMware Workstation (before 5.5.5.56455), VMware Player (before 1.0.5.56455 and Player 2 before 2.0.1 55017), ACE (before 1.0.3.54075 and ACE 2 before 2.0.1 55017), and VMware Server (before 1.0.4 56528). It allows an authenticated guest OS user wit...

CVE-2007-5023

CVE-2007-5023 describes an unquoted Windows search path vulnerability that could allow local users to gain privileges in EMC VMware products. Affected are VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, VMware Player before 1.0.5 Build 56455 and Player 2 before 2.0.1...

CVE-2007-5027

CVE-2007-5027 involves multiple XSS vulnerabilities in the web management panel (cgi-bin/ddns) of the WBR3404TX broadband router with firmware R1.94p0vTIG. The flaws allow remote attackers to inject arbitrary JavaScript/HTML via the DD or DU parameters. The provided documents confirm the affected...

CVE-2007-0063

CVE-2007-0063 affects the DHCP server in VMware-related products (Workstation, Player, ACE, Server) prior to the listed builds. An integer underflow in the DHCP server can trigger a stack-based buffer overflow when processing malformed DHCP packets, enabling remote code execution. Mitigation in t...

CVE-2007-4497

CVE-2007-4497 is an unspecified vulnerability affecting VMware products (Workstation prior to 5.5.5 Build 56455, Player prior to 1.0.5 Build 56455, Player 2 prior to 2.0.1 Build 55017, ACE prior to 1.0.3 Build 54075, ACE 2 prior to 2.0.1 Build 55017, and Server prior to 1.0.4 Build 56528). It all...

CVE-2007-5026

CVE-2007-5026 affects dBlog CMS (likely version 2.0). The issue arises from storing sensitive data under the web root with insufficient access control, enabling remote attackers to directly request dblog.mdb and download the admin password hash database. Public details confirm the vulnerability d...

CVE-2007-5026

dBlog CMS, probably 2.0, stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing an admin password hash via a direct request for dblog.mdb...

CVE-2007-0062

CVE-2007-0062: The vulnerability affects ISC DHCPD 3.0.x (before 3.0.7) and 3.1.x (before 3.1.1), plus the DHCP servers in VMware Workstation/Player, ACE, and related products. It is caused by a stack-based buffer overflow triggered by a malformed DHCP packet with a large dhcp-max-message-size, p...

CVE-2007-5028

CVE-2007-5028 affects Dibbler 0.6.0 on Linux. The issue is weak world-writable permissions for unspecified files in /var/lib/dibbler, with unknown impact and local attack vectors. Public documents from NVD, Red Hat, Ubuntu, Debian, OSV, and others corroborate the weak-permission description; no c...

CVE-2007-5025

CVE-2007-5025 concerns EMC VMware ACE before 1.0.3 Build 54075. The vulnerability arises from an unspecified manipulation of images stored in virtual machines downloaded by the user, with an unknown impact described in the source materials. The available connected documents confirm the product/ve...

CVE-2007-4569

CVE-2007-4569 affects KDE kdebase (KDM) where autologin combined with “shutdown with password” enables a local attacker to bypass password protection and login to arbitrary accounts. The primary sources tie this to KDE 3.3.0–3.5.7 and describe the login bypass via unspecified vectors; OpenVAS/Nes...

CVE-2007-4065

CVE-2007-4065 concerns libvorbisfile in Xiph.Org libvorbis prior to 1.2.0, where a crafted OGG file can trigger an infinite loop in context-dependent attackers, causing a denial of service. Multiple advisories (e.g., RHSA-2007-0845, SLES/SUSE updates, Fedora/Mandriva/Scientific Linux/OpenVAS list...