CVE-2007-6587

Plogger 1.0 Beta 3.0 is affected by a SQL injection in plog-rss.php via the id parameter. The issue allows remote attackers to manipulate the database and potentially read/modify data. The vulnerability is confirmed across CVE-2007-6587 entries in NVD/NIST and corroborated by Nessus plugin covera...

CVE-2007-6588

The provided records indicate a Cross-site scripting (XSS) vulnerability in PHCDownload 1.10, exploitable via the username field in an unspecified component. Affected software: PHCDownload 1.10. Root cause: inadequate sanitization of the username input leading to script/HTML injection. Impact: po...

CVE-2007-6589

CVE-2007-6589 affects Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7. The jar protocol handler fails to update the origin when an inner URL parameter yields an HTTP redirect, enabling remote XSS via a jar: URI. No exploitation details are provided in the documents. Remediation: upgrad...

CVE-2007-6577

CVE-2007-6577 affects zBlog 1.2, with multiple SQL injection vulnerabilities in index.php. The flaws allow remote attackers to manipulate the database via the categ action (categ parameter) or the articles action (article parameter). Root cause is improper handling/sanitization of user input in i...

CVE-2007-6593

CVE-2007-6593 is a buffer overflow in Autonomy KeyView (l123sr.dll) used by IBM Lotus Notes (versions 5.x–8.x) when viewing Lotus 1-2-3 (.123) Worksheet files. The vulnerability arises from a boundary/stack-based overflow in SRANGE handling, enabling user‑assisted remote code execution if a malic...

CVE-2007-6569

Sun Java System Web Proxy Server 4.x (and Web Server) are vulnerable to cross-site scripting in the View Error Log/related log-viewing function (BugID 6566246). The JVN entry confirms the issue is a client-side script injection via unspecified vectors, affecting the Web Server and Web Proxy Serve...

CVE-2007-6570

CVE-2007-6570 describes a Cross-site scripting (XSS) vulnerability in Sun Java System Web Proxy Server’s View URL Database functionality. Affected software versions are Sun Web Proxy Server 4.x before 4.0.6 and 3.x before 3.6 SP11. The vulnerability allows remote attackers to inject arbitrary web...

CVE-2007-6578

The CVE-2007-6578 entry documents a SQL injection in the PHP ZLink 0.3 application, specifically in go.php via the id parameter. The vulnerability allows remote attackers to execute arbitrary SQL commands, as described in multiple sources (e.g., NVD entry). No mitigation, patch, or affected versi...

CVE-2007-6591

CVE-2007-6591 affects KDE Konqueror 3.5.5 and 3.95.00. When a user accepts an SSL certificate based on the CN in the DN, Konqueror also treats it as valid for all names in subjectAltName:dNSName, even though SANs cannot be examined in the product. This enables attackers to trick users into accept...

CVE-2007-6590

CVE-2007-6590 is rejected/not used; duplicate of CVE-2008-2809; references removed.

CVE-2007-6585

The CVE-2007-6585 entry describes a PHP remote file inclusion vulnerability in NmnNewsletter 1.0.7, where an attacker can execute arbitrary PHP code by supplying a URL in the output parameter of confirmUnsubscription.php. This is a remote exploit with medium severity (CVSS v2 base score 6.8) and ...

CVE-2007-6579

CVE-2007-6579 covers multiple SQL injection vulnerabilities in Ip Reg 0.3 (and later 0.4) that let remote attackers run arbitrary SQL commands via parameters such as vlan_id (to vlanview.php, vlanedit.php, vlandel.php), assetclassgroup_id (to assetclassgroupview.php), and subnet_id (to nodelist.p...

CVE-2007-6581

CVE-2007-6581 : Multiple directory traversal vulnerabilities affect Social Engine 2.0. The issue allows remote attackers to include and execute arbitrary local files via a ".." in the global_lang parameter to header_album.php, header_blog.php, or header_group.php, and similarly to admin_header_al...

CVE-2007-6576

CVE-2007-6576 affects Adult Script 1.6.5 and earlier. It describes multiple SQL injection vulnerabilities allowing remote attackers to execute arbitrary SQL commands via the id parameter to videolink_count.php or links.php. The entry lists CVSS2 base score 7.5 (HIGH) with network access, no authe...

[SECURITY] [DSA 1441-1] New peercast packages fix arbitrary code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1441-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst December 28, 2007 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1439-1] New typo3-src packages fix SQL injection

------------------------------------------------------------------------ Debian Security Advisory DSA-1439-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst December 28, 2007 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1438-1] New tar packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1438-1 [email protected] http://www.debian.org/security/ Florian Weimer December 28, 2007 http://www.debian.org/security/faq -...

CVE-2007-6552

Directory traversal vulnerability in index.php in AuraCMS 2.2 allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the act parameter, possibly involving the news pilih component; as demonstrated by including admin/adminusers.php to bypass a protection...

CVE-2007-6555

PHP remote file inclusion vulnerability in modules/modpxtlatest.php in the mosDirectory comdirectory 2.3.2 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALSmosConfigabsolutepath parameter...

CVE-2007-6550

form.php in PMOS Help Desk 2.4 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct eval injection attacks and execute arbitrary PHP code via the options array parameter...