CVE-2007-6376

Directory traversal vulnerability in autohtml.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the filename parameter, a different vector than CVE-2006-4190. NOTE: the provenance of this information is unknown; the detail...

CVE-2007-6377

Stack-based buffer overflow in the PassThru functionality in ext.dll in BadBlue 2.72b and earlier allows remote attackers to execute arbitrary code via a long query string...

CVE-2007-6364

Cross-site scripting XSS vulnerability in modificarPerfil.php in JLMForo System allows remote authenticated users to inject arbitrary web script or HTML via a signature...

CVE-2007-6358

pdftops.pl before 1.20 in alternate pdftops filter allows local users to overwrite arbitrary files via a symlink attack on the pdfin.PID.tmp temporary file, which is created when pdftops reads a PDF file from stdin, such as when pdftops is invoked by CUPS...

CVE-2007-6376

CVE-2007-6376 describes a directory traversal vulnerability in the PHP-Nuke 8.0 AutoHTML module (autohtml.php). The root cause is that the filename parameter can be manipulated with a …/ path, enabling local file inclusion and arbitrary code execution on the server. The vulnerability affects PHP-...

CVE-2007-6378

CVE-2007-6378 is a directory-traversal vulnerability in BadBlue 2.72b and earlier, affecting the upload.dll component. An attacker can supply a filename with ".." to create or overwrite arbitrary files remotely. The provided documents specify only the vulnerability description and do not include ...

CVE-2007-6367

Multiple cross-site scripting XSS vulnerabilities in the guestbook in SineCMS 2.3.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 username user or 2 comment commento field, different vectors than CVE-2007-2357...

CVE-2007-6364

Cross-site scripting XSS vulnerability in modificarPerfil.php in JLMForo System allows remote authenticated users to inject arbitrary web script or HTML via a signature...

CVE-2007-4707

CVE-2007-4707 concerns Apple QuickTime before 7.3.1, where the Flash media handler contains multiple vulnerabilities that can be exploited by a crafted QuickTime movie to remotely execute arbitrary code. Affected product: QuickTime (Windows and Mac OS X) prior to 7.3.1; vulnerability class is des...

CVE-2007-5582

CiscoWorks Server/XSS in the Common Services login page (CS) affects CS 3.0.x and 3.1, possibly earlier 2.6, allowing remote injection of arbitrary script or HTML via unspecified vectors. The vulnerability is documented as a cross-site scripting issue in the login page; the provided sources do no...

CVE-2007-6360

The CVE-2007-6360 issue affects Sun eXtended System Control Facility (XSCF) Control Package (XCP) firmware before 1050 on SPARC Enterprise M4000, M5000, M8000, and M9000 servers. The vulnerability allows remote attackers to trigger memory exhaustion via network traffic (telnet, ssh, or http), cau...

CVE-2007-6361

CVE-2007-6361 affects Gekko 0.8.2 and earlier. The issue is that sensitive information is stored under the web root, with potentially insufficient access control, which could allow remote attackers to read certain files under temp/ (demonstrated by a log file recording blog-entry titles). Note th...

CVE-2007-6364

CVE-2007-6364 describes a cross-site scripting (XSS) vulnerability in the modificarPerfil.php component of the JLMForo System. The issue allows remote authenticated users to inject arbitrary web script or HTML via a signature field. According to the CVE entry, the affected product is JLMForo Syst...

CVE-2007-6365

CVE-2007-6365 describes a cross-site scripting (XSS) vulnerability in the Event Calendar component of bcoos 1.0.10, specifically in modules/ecal/display.php, where an attacker can inject arbitrary script or HTML via the month parameter. The affected product is bcoos 1.0.10; the issue is a client-...

CVE-2007-6370

CVE-2007-5583 (Cisco IP Phone 7940, firmware P0S3-08-7-00) allows remote denial of service via a sequence of SIP INVITE requests where the Request-URI lacks a user name; CVE-2007-6370 is a duplicate of this vulnerability. No remediation details are provided in the connected documents.

CVE-2007-6370

...

CVE-2007-6374

CVE-2007-6374 concerns multiple XSS flaws in Bitweaver 2.0.0 and earlier, exploitable via PATH_INFO in four endpoints: /users/register.php, /search/index.php, /wiki/index.php (editcomments action), and /forums/index.php. The vulnerability allows remote attackers to inject arbitrary script or HTML...

CVE-2007-6368

The CVE-2007-6368 entry concerns ezContents 1.4.5, where a directory traversal flaw in index.php allows remote attackers to read arbitrary files via a .. (dot dot) in the link parameter. This vulnerability is documented across multiple sources (NVD, CVE List, PRION, PRion, etc.), indicating the a...

CVE-2007-6380

CVE-2007-6380 describes multiple SQL injection vulnerabilities in e-Xoops (exoops) versions 1.08 and 1.05 Rev 1–3. The flaws allow remote attackers to execute arbitrary SQL commands via the parameter lid targeting various scripts under modules/ (mylinks/ratelink.php, adresses/ratefile.php, mydown...

CVE-2007-6358

CVE-2007-6358 affects the Common UNIX Printing System (cupsys). The flaw is in pdftops.pl (pdftops filter) where insecure handling of a temporary file created when reading PDFs from stdin can be exploited via a symlink to overwrite arbitrary files, enabling local access/denial of service. Public ...