CVE-2007-5927

Directory traversal vulnerability in OpenBase 10.0.5 and earlier allows remote authenticated users to create files with arbitrary contents via a .. dot dot in the first argument to the GlobalLog stored procedure. NOTE: this can be leveraged to execute arbitrary code using CVE-2007-5926...

CVE-2007-5924

The CVE-2007-5924 entry describes a cross-site scripting (XSS) vulnerability in the Web Server (HTTP) task of IBM Lotus Domino. Affected products are IBM Lotus Domino versions prior to 6.5.6 FP2 and 7.x prior to 7.0.2 FP2. The vulnerability allows remote authenticated users to inject arbitrary we...

CVE-2007-5919

MyWebFTP, possibly 5.3.2, stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain an MD5 password hash via a direct request for pass/pass.txt...

CVE-2007-5926

CVE-2007-5926 and CVE-2007-5927 describe vulnerabilities in OpenBase 10.0.5 and earlier. The issues allow remote authenticated users to (1) execute arbitrary commands by passing shell metacharacters to stored procedures such as AsciiBackup and OEMLicenseInstall, and (2) perform directory traversa...

CVE-2007-5926

OpenBase 10.0.5 and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to the 1 AsciiBackup, 2 OEMLicenseInstall, and possibly other stored procedures...

CVE-2007-5921

CVE-2007-5921 concerns an unspecified vulnerability in the ioctl interface of the Solaris Volume Manager (SVM) on Solaris 9 and 10 that allows local users to trigger a denial of service (panic). The core issue and affected components are not detailed in the initial description. Connected document...

CVE-2007-5912

The CVE-2007-5912 issue is a SQL injection vulnerability in mailer.php of jPORTAL 2, exploitable via the to parameter to allow remote execution of arbitrary SQL commands. Connected sources confirm the affected component and the root cause as an input-based SQL injection; no public fix version or ...

CVE-2007-5917

CVE-2007-5917 is a CSRF vulnerability in Skalinks 1.5 and earlier, affecting admin/admin_account.php. The issue allows remote attackers to add arbitrary privileged administrator accounts via the admin_name, admin_password, admin_type, and Add_admin parameters. No remediation steps or patch versio...

CVE-2007-5929

CVE-2007-5929 describes a buffer overflow in OpenBase

CVE-2007-5916

The CVE-2007-5916 entry describes an SQL injection in the login page of phphelpdesk 0.6.16, exploitable via unspecified login-related parameters and allowing remote execution of arbitrary SQL commands. The connected documents reiterate the same description; no remediation, exploit specifics, or a...

CVE-2007-5911

CVE-2007-5911 affects Viewpoint Media Player 3.2 via the AxMetaStream ActiveX control (AxMetaStream.dll 3.3.2.26). The vulnerability consists of multiple stack-based buffer overflows that allow remote attackers to execute arbitrary code when passing long strings to any of the following methods: B...

CVE-2007-5928

OpenBase 10.0.5 and earlier is affected. Remote authenticated users can trigger a free of an arbitrary memory location by supplying long strings in a SELECT statement. The root cause is unclear, with indications it may be a buffer overflow. Affected product/version: OpenBase

CVE-2007-5920

CVE-2007-5920 affects PicoFlat CMS (pre-0.4.18). The issue allows remote attackers to include certain files via unspecified vectors, likely due to a directory traversal flaw, potentially bypassing authentication and enabling file uploads by including pico_insert.php or other admin scripts. The ex...

CVE-2007-5922

The CVE-2007-5922 entry refers to the Cypress 1.0k script for BitchX, where the modules/mdop.m file contains an externally introduced backdoor that emails sensitive information (hostnames, usernames, shell history) to a fixed address. The available documents confirm the backdoor presence and the ...

CVE-2007-5915

CVE-2007-5915 is a directory traversal vulnerability affecting phphelpdesk 0.6.16 in index.php (whattodo parameter). An attacker can include and execute arbitrary local files by supplying a .. (dot dot) path, leading to partial confidentiality, integrity, and availability impact per the NVD CVSSv...

CVE-2007-5925

CVE-2007-5925 affects the MySQL InnoDB engine: the convert_search_mode_to_innobase function in ha_innodb.cc can be triggered by a remote, authenticated user through a CONTAINS operation on an indexed column, causing an assertion error and a database crash. Affected product/version family: MySQL 5...

CVE-2007-5911

Multiple stack-based buffer overflows in the AxMetaStream ActiveX control in AxMetaStream.dll 3.3.2.26 in Viewpoint Media Player 3.2 allow remote attackers to execute arbitrary code via a long string argument to the 1 BroadcastKey, 2 BroadcastKeyFileURL, 3 Component, 4 ComponentClassID, 5...

CVE-2007-4570

CVE-2007-4570 concerns an algorithmic complexity vulnerability in the MCS translation daemon (mcstrans) version 0.2.3 that allows a local attacker to cause a denial of service by targeting a large range of compartments in sensitivity labels. Public documents from various advisories (ELSA-2007-054...

CVE-2007-5396

Miranda IM 0.7.1 is affected by a format-string vulnerability in the ext_yahoo_contact_added function (yahoo.c) that allows remote code execution via a Y7 Buddy Authorization packet containing format specifiers in the contact Yahoo! handle (who). This CVE-2007-5396 issue is triggered by crafted i...

Unfixed XSS vulnerability at www.romania.org

Security researcher BeyazKurt, has submitted on 11/10/2007 a cross-site-scripting XSS vulnerability affecting www.romania.org, which at the time of submission ranked 213204 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 01/11/2007. It is...