CVE-2007-6478

CVE-2007-6478 affects Rosoft Media Player (versions including 4.1.7 and 4.1.8; possibly earlier) and is due to a stack-based buffer overflow in processing .M3U files. The vulnerability allows a remote attacker to execute arbitrary code or cause an application crash (DoS) by supplying a long strin...

CVE-2007-6493

The CVE-2007-6493 issue concerns the IMWeb.IMWebControl.1 ActiveX control (IMWeb.dll 7.0.0.x and possibly IMWebControl.dll in iMesh 7.1.0.x and earlier) that allows remote code execution via a crafted argument to the SetHandler method. The vulnerability is triggered when a user visits a specially...

CVE-2007-6486

CVE-2007-6486 affects LineShout 1.0’s shout.php (the shoutbox). The vulnerability is multiple cross-site scripting (XSS) weaknesses that allow remote attackers to inject arbitrary web script or HTML via the username (nickname) or message parameter. The description notes that some details are from...

CVE-2007-6496

Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to register arbitrary users via a request to hosting/addsubsite.asp with the loginname and password parameters set, when preceded by certain requests to hosting/default.asp and hosting/selectdomain.asp, a related issue to...

CVE-2007-6499

The CVE-2007-6499 entry concerns Hosting Controller 6.1 Hotfix 3.3 and earlier. Affected component: the FrontPage extensions uninstall feature via the fp2002/UNINSTAL.asp endpoint, where a remote authenticated user could trigger uninstall of FrontPage extensions for an arbitrary account by supply...

CVE-2007-6482

Technical details about CVE-2007-6482 are not publicly provided in the supplied documents. Monitor for updates from official advisories; current sources only reiterate an unspecified remote denial-of-service against Sun Ray Server's utdevmgrd.

CVE-2007-6502

CVE-2007-6502 affects Hosting Controller 6.1 Hotfix 3.3 and earlier. The vulnerability exposes sensitive information through: (1) AdminName and AdminLevel parameters in fp2000/NEWSRVR.asp that disclose usernames; (2) certain XML HTTP requests to hosting/css.asp via Microsoft.XMLHTTP/MSXML2.XMLHTT...

CVE-2007-6494

CVE-2007-6494 affects Hosting Controller 6.1 Hot fix 3.3 and earlier. The provided descriptions state a sequence-based authentication bypass where a remote attacker can obtain login access by first sending a request to hosting/addres reseller.asp with a username in the reseller parameter, followe...

CVE-2007-6497

CVE-2007-6497 affects Hosting Controller 6.1 Hotfix 3.3 and earlier. The vulnerability allows an unprivileged remote attacker to change arbitrary user profiles via Hosting/Addreseller.asp by supplying modified loginname and email, and allows remote authenticated users to modify account attributes...

CVE-2007-6504

The CVE-2007-6504 issue affects Hosting Controller 6.1, specifically IIS/iibind.asp, where remote authenticated users can alter the headers of arbitrary hosts via an unspecified parameter. Root cause: an unspecified parameter in iibind.asp enables header modification. Impact: header changes acros...

CVE-2007-6496

CVE-2007-6496 affects Hosting Controller 6.1 Hotfix 3.3 and earlier. The vulnerability allows remote attackers to register arbitrary users via addsubsite.asp with loginname and password parameters, after certain requests to default.asp and selectdomain.asp; it is a related issue to CVE-2005-1654....

CVE-2007-6501

The CVE affects Hosting Controller 6.1 Hotfix 3.3 and earlier. It describes an unspecified vulnerability that allows remote authenticated users to enable or disable the "pay type" via a request to adminsettings/choosetranstype.asp. The connected documents provide this basic impact but do not spec...

CVE-2007-6489

CVE-2007-6489 describes multiple XSS vulnerabilities in Falcon Series One CMS 1.4.3, exploitable via the guestbook action to index.php through the parameters gb_mail, gb_name, and gb_text (and unspecified other vectors). The NVD entry assigns a CVSS v2 base score of 7.5 (HIGH) with network attack...

CVE-2007-6490

The CVE-2007-6490 entry describes a CSRF vulnerability in Falcon Series One CMS 1.4.3 that allows remote attackers to change a user password via a specific changepass action to index.php. Public records confirm the affected software version (Falcon Series One CMS 1.4.3) and the vulnerability’s cr...

CVE-2007-6485

CVE-2007-6485 affects Centreon/Oreon 1.4.1. It enables remote PHP code execution via the fileOreonConf parameter in MakeXML.php and MakeXML4statusCounter.php under include/monitoring/engine/, exploitable by unauthenticated attackers over the network. The root cause is improper handling/sanitizati...

CVE-2007-6484

CVE-2007-6484 describes an SQL injection vulnerability in phpRPG 0.8, exploitable via the password parameter in index.php. Multiple sources (NVD, Red Hat, CVE lists) corroborate the issue, with provenance noted as originating from third-party information. The exploitation status is not detailed i...

CVE-2007-6480

CVE-2007-6480 affects Sun Management Center (Sun MC) 3.6.1, 3.6, and 3.5 Update 1, where a default account in the Oracle database component allows remote attackers to obtain database access and execute arbitrary code. The connected patch advisories show Solaris 8/9/10 patches (e.g., 127380-01, 12...

CVE-2007-6498

CVE-2007-6498 : Multiple SQL injection vulnerabilities in Hosting Controller 6.1 Hot fix 3.3 and earlier allow remote authenticated users to execute arbitrary SQL via parameters to Hosting/Addreseller.asp (email, loginname), accounts/accountmanager.asp (sortfield), OpenApi/GatewayVariables.asp (G...

CVE-2007-6472

CVE-2007-6472 affects phpMyRealty (PMR) 1.0.9, with two SQL injection vectors described in the records. Remote attackers can trigger arbitrary SQL via the type parameter to search.php, and remote authenticated administrators can execute arbitrary SQL via the listing_updated_days parameter to admi...

CVE-2007-6484

SQL injection vulnerability in index.php in phpRPG 0.8 allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...