CVE-2007-4898

Technical details about CVE-2007-4898 are not publicly provided in the supplied documents. Monitor for updates from official advisories; current entries summarize an unspecified vulnerability in XWiki Multiwiki prior to 1.1 Enterprise RC2 without concrete technical specifics.

CVE-2007-4893

CVE-2007-4893 affects WordPress before 2.2.3 and WordPress MU before 1.2.5a, where unfiltered_html privilege is not properly verified, enabling cross-site scripting via modified data to post.php or page.php with a no_filter field. Exploitation details and affected versions are corroborated by mul...

CVE-2007-4894

CVE-2007-4894 covers multiple SQL injection vulnerabilities in WordPress before 2.2.3 and WordPress MU before 1.2.5a. The issue allows remote attackers to execute arbitrary SQL via the post_type parameter to the pingback.extensions.getPingbacks XML-RPC interface and other parameters related to ea...

CVE-2007-4895

CVE-2007-4895 : A directory traversal vulnerability affects Sisfo Kampus 2006 (Semarang 3) via dwoprn.php, enabling remote attackers to read arbitrary files using the f parameter. The linked documents confirm the issue but do not provide vendor patch/version details or mitigation steps. The NVD e...

CVE-2007-4897

PWLib contains a memory-management flaw that can cause a remote denial-of-service in Ekiga 2.0.5 and potentially other PWLib-linked apps by sending a long argument to PString::vsprintf. Public PoCs/exploits (e.g., Ekiga GetHostAddress DoS) exist, using a crafted SIP/INVITE payload over UDP to cra...

CVE-2007-4896

CVE-2007-4896 describes multiple XSS vulnerabilities in Toms Gaestebuch

CVE-2007-4900

CVE-2007-4900 describes a cross-site scripting (XSS) flaw in the logon page of RSA EnVision 3.3.6 Build 0115. The issue allows an attacker to inject arbitrary script/HTML via the username field, potentially enabling user-side script execution in a victim’s browser. The connected records confirm t...

CVE-2007-4892

CVE-2007-4892 describes multiple SQL injection vulnerabilities in SWSoft Plesk versions 7.6.1, 8.1.0, 8.1.1, and 8.2.0 for Windows. The underlying issue is SQL injection via the PLESKSESSID cookie, exploitable through (1) login.php3 and (2) auth.php3, allowing remote attackers to execute arbitrar...

CVE-2007-4893

wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user MU before 1.2.5a does not properly verify the unfilteredhtml privilege, which allows remote attackers to conduct cross-site scripting XSS attacks via modified data to 1 post.php or 2 page.php with a nofilter field...

CVE-2007-3739

mm/mmap.c in the hugetlb kernel, when run on PowerPC systems, does not prevent stack expansion from entering into reserved kernel page memory, which allows local users to cause a denial of service OOPS via unspecified vectors...

DSquare Exploit Pack: D2SEC_PDWIZARD

Name| d2secpdwizard ---|--- CVE| CVE-2007-4891 Exploit Pack| D2ExploitPack Description| Microsoft Visual Studio PDWizard.ocx ActiveX Arbitrary Code Execution Vulnerability Notes|...

CVE-2007-4138

The Winbind nssinfo extension nsswitch/idmapad.c in idmapad.so in Samba 3.0.25 through 3.0.25c, when the "winbind nss info" option is set to rfc2307 or sfu, grants all local users the privileges of gid 0 when the 1 RFC2307 or 2 Services for UNIX SFU primary group attribute is not defined...

CVE-2007-4138

The Winbind nssinfo extension nsswitch/idmapad.c in idmapad.so in Samba 3.0.25 through 3.0.25c, when the "winbind nss info" option is set to rfc2307 or sfu, grants all local users the privileges of gid 0 when the 1 RFC2307 or 2 Services for UNIX SFU primary group attribute is not defined...

CVE-2007-3740

CVE-2007-3740 describes a flaw in the CIFS filesystem of the Linux kernel prior to 2.6.22 where Unix extension support can fail to honor the process umask, enabling a local user to gain privileges. Affected are kernels with CIFS Unix extensions enabled; impact is local privilege escalation. Remed...

CVE-2007-3739

CVE-2007-3739 concerns the Linux kernel hugetlb code on PowerPC. The flaw allows a local attacker to trigger stack growth into reserved kernel page memory, enabling a denial of service (OOPS) via unspecified vectors. The issue is documented in Red Hat/Oracle Linux advisories of 2007 (e.g., RHSA-2...

CVE-2007-4890

CVE-2007-4890 affects the VB To VSI Support Library (VBTOVSI.DLL) 1.0.0.0 within Microsoft Visual Studio 6.0. The vulnerability is an absolute directory traversal in the SaveAs method that allows remote attackers to create or overwrite arbitrary files via a full pathname; the Load method can copy...

CVE-2007-4138

CVE-2007-4138 affects Samba 3.0.25 through 3.0.25c. The Winbind nss_info extension (nsswitch/idmap_ad.c) can grant all local users the privileges of gid 0 when winbind nss info is set to RFC2307 or SFU and the primary group attribute is not defined. This is a local privilege escalation vulnerabil...

CVE-2007-4138

The Winbind nssinfo extension nsswitch/idmapad.c in idmapad.so in Samba 3.0.25 through 3.0.25c, when the "winbind nss info" option is set to rfc2307 or sfu, grants all local users the privileges of gid 0 when the 1 RFC2307 or 2 Services for UNIX SFU primary group attribute is not defined...

CVE-2007-4889

The CVE-2007-4889 entry relates to PHP’s MySQL extension in PHP 5.2.4 and earlier, where remote attackers could bypass safe_mode and open_basedir restrictions using MySQL functions (LOAD_FILE, INTO DUMPFILE, INTO OUTFILE). Affected component: PHP MySQL extension (versions

CVE-2007-4891

CVE-2007-4891 concerns the PDWizard.ocx ActiveX control in Microsoft Visual Studio 6.0. Affected component: PDWizard.ocx (Visual Studio 6.0) with versions 6.0.0.9782 and earlier. Root cause: the PDWizard.ocx ActiveX control exposes dangerous methods (StartProcess, SyncShell, SaveAs, CABDefaultURL...