CVE-2007-6644

CVE-2007-6644 concerns Joomla! prior to version 1.5 RC4, where remote authenticated administrators could elevate arbitrary users to the administrator group, violating the intended security model. The description indicates an authenticated-admin privilege escalation vulnerability in the Joomla cor...

CVE-2007-6645

Joomla! CVE-2007-6645 affects Joomla before 1.5 RC4, allowing remote authenticated users to escalate privileges via unspecified vectors. Public docs confirm the issue and point to a fixed package in Joomla 1.0.15 per Mandriva MDVSA-2008:060; no exploit details are provided in the supplied sources.

CVE-2007-6639

SQL injection vulnerability in index.php in IPTBB 0.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewdir action...

CVE-2007-6639

CVE-2007-6639 describes a SQL injection vulnerability in IPTBB 0.5.4 and earlier, where the id parameter in the viewdir action of index.php can be exploited to execute arbitrary SQL commands remotely. Affected software is IPTBB (0.5.4 and earlier). The root cause is improper input handling in the...

CVE-2007-6637

Multiple cross-site scripting XSS vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver CS3 or Adobe Acrobat Connect. NOTE: the asfunction: vector is already covered by...

CVE-2007-6621

Directory traversal vulnerability in joovili.images.php in Joovili 3.0.0 through 3.0.6 allows remote attackers to read arbitrary files via a .. dot dot in the picture parameter...

CVE-2007-6633

CVE-2007-6633 involves multiple cross-site scripting (XSS) vulnerabilities in FAQMasterFlexPlus (potentially versions 1.5 or 1.52). The issues allow remote attackers to inject arbitrary web script or HTML via the cat_name parameter to faq.php and via parameters to admin actions (add/edit/delete c...

CVE-2007-6620

Directory traversal vulnerability in include/images.inc.php in Joovili 2.x allows remote attackers to read arbitrary files via a .. dot dot in the picture parameter...

CVE-2007-6620

CVE-2007-6620 affects Joovili 2.x, where a directory traversal flaw exists in include/images.inc.php that lets remote attackers read arbitrary files by supplying a .. in the picture parameter. This vulnerability’s impact is confirmed as reading files (partial confidentiality exposure) with networ...

CVE-2007-6621

Joovili 3.0.0–3.0.6 is affected by a directory traversal flaw in joovili.images.php that allows remote attackers to read arbitrary files via a .. sequence in the picture parameter. The underlying cause is improper handling of the picture input, enabling file reads outside the web root. Impact is ...

CVE-2007-6622

ZeusCMS 0.3 and earlier is affected by an SQL injection in security.php that can be triggered via the Referer HTTP header, allowing remote attackers to manipulate SQL queries and potentially access or modify data. The issue is described consistently across CVE-2007-6622 records; exploitation deta...

CVE-2007-6623

CVE-2007-6623 describes an absolute path traversal vulnerability in ZeusCMS 0.3 and earlier. The issue allows remote attackers to list arbitrary directories by supplying a full pathname in the dir parameter. This is a server-side path disclosure risk that could enable traversal beyond intended di...

CVE-2007-6624

The CVE-2007-6624 issue is a directory traversal/local file inclusion vulnerability in PNphpBB2 1.2i and earlier, exploitable via a .. in the phpEx parameter of printview.php. The active impact is indicated as partial confidentiality, integrity, and availability (CVSS v2 base score 6.8). The vuln...

CVE-2007-6630

The CVE-2007-6630 entry describes a vulnerability in Netembryo 0.0.4 where the Url_init function in utils/url.c processes a malformed URI containing a "/:" sequence. This can allow remote attackers to trigger a NULL dereference and a daemon crash (denial of service) as demonstrated by a request l...

CVE-2007-6636

CVE-2007-6636 affects Bitflu (StorageFarabDb module) before version 0.42. A user-assisted remote attacker can craft a .torrent file to create or append data to arbitrary files on the affected system. The description specifies the vulnerability but does not provide a patch or mitigation detail wit...

CVE-2007-6631

CVE-2007-6631 describes multiple buffer overflows in the LScube libnemesi 0.6.4-rc1 and earlier. The vulnerability allows remote code execution via crafted RTSP traffic, including: a reply beginning with a long version string that overflows handle_rtsp_pkt in rtsp_handlers.c; excessively long hea...

MacroVision InstallShield Update Service DownloadAndExecute buffer overflow

Added: 01/04/2008 CVE: CVE-2007-6654 BID: 27013 OSVDB: 39980 Background MacroVision InstallShield is software for creating installers or software packages. Problem A buffer overflow in the DownloadAndExecute function in the Update Service ActiveX control allows command execution when a user loads...

MacroVision InstallShield Update Service DownloadAndExecute buffer overflow

Added: 01/04/2008 CVE: CVE-2007-6654 BID: 27013 OSVDB: 39980 Background MacroVision InstallShield is software for creating installers or software packages. Problem A buffer overflow in the DownloadAndExecute function in the Update Service ActiveX control allows command execution when a user loads...

CUPS SNMP后端asn1_get_string()函数远程栈溢出漏洞

BUGTRAQ ID: 26917 CVECAN ID: CVE-2007-5849 Common Unix Printing System CUPS是一款通用Unix打印系统，是Unix环境下的跨平台打印解决方案，基于Internet打印协议，提供大多数PostScript和raster打印机服务。 CUPS处理包含畸形数据的SNMP请求时存在漏洞，远程攻击者可能利用此漏洞控制服务器。...

CVE-2007-6632

The CVE-2007-6632 entry concerns showCode.php in xml2owl 0.1.1 where remote attackers can execute arbitrary commands via shell metacharacters in the path parameter. The affected component is the xml2owl PHP application (version 0.1.1). The vulnerability is a shell command injection in the path pa...