CVE-2007-5380

Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."...

CVE-2007-5597

CVE-2007-5597 affects Drupal core: hook_comments in Drupal 4.7.x (before 4.7.8) and 5.x (before 5.3) does not pass the publication status of comments. This can allow attackers to bypass access restrictions and cause modules (e.g., Organic groups, Subscriptions) to mail or process unpublished comm...

CVE-2007-5594

CVE-2007-5594 concerns Drupal 5.x before 5.3, where the Drupal Forms API protection is not applied to the user deletion form. This allows remote attackers to delete users via a cross-site request forgery (CSRF) attack. The connected advisories document an upgrade to Drupal 5.3 (e.g., Fedora-2007-...

CVE-2007-5592

CVE-2007-5592 describes multiple PHP remote file inclusion vulnerabilities in awzMB 4.2 beta 1 and earlier. An attacker can supply a URL in the Setting[OPT_includepath] parameter to load remote PHP code via the following files in modules/: adminhelp.php; admin.incl.php; reg.incl.php; help.incl.ph...

CVE-2007-5589

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via certain input available in 1 PHPSELF in a serverstatus.php, and b grabglobals.lib.php, c displaychangepassword.lib.php, and d common.lib.php in...

CVE-2007-5598

CVE-2007-5598 affects the Weblinks module for Drupal, specifically versions 4.7.x before 4.7.x-1.0 and 5.x before 5.x-1.8. The vulnerability is a cross-site scripting (XSS) issue that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The connected documents c...

CVE-2007-5589

CVE-2007-5589 is a cross-site scripting vulnerability in phpMyAdmin affecting versions prior to a patched release (noted in multiple advisories). The vulnerability arises from input echoed via PHP_SELF and PATH_INFO in several files inside libraries/ and common.inc.php (and possibly via REQUEST_U...

CVE-2007-5600

CVE-2007-5600 affects Artmedic CMS 3.4 and earlier. The vulnerability is an incomplete blacklist in index.php that enables remote PHP code execution via the page parameter when using URLs with UNC share pathnames or protocols such as ftps, ssh2.sftp, or ssh2.scp, since PHP remote file inclusion c...

CVE-2007-5593

Drupal 5.x before 5.3 is vulnerable: if the configured database server is unreachable, an attacker can trigger arbitrary code execution by exploiting install.php vectors that cause settings.php to be modified. The issue is addressed by upgrading Drupal to 5.3 (e.g., Drupal 5.3-1 for the affected ...

CVE-2007-5596

CVE-2007-5596 affects Drupal’s core Upload module in Drupal 4.7.x (before 4.7.8) and 5.x (before 5.3). The vulnerability arises from a whitelist that includes the .html extension, allowing remote attackers to upload .html files that can trigger cross-site scripting (XSS). Public details in the co...

CVE-2007-5590

Miranda IM is affected by stack-based buffer overflow vulnerabilities described across multiple CVEs in 2007. Specifically, Red Hat and NVD entries indicate that Miranda IM 0.6.8 and 0.7.0 are exploitable via crafted Yahoo! Messenger packets to gain arbitrary code execution, with potential overla...

CVE-2007-5380

CVE-2007-5380 affects Ruby on Rails

CVE-2007-5379

CVE-2007-5379 affects Ruby on Rails installations using Rails prior to 1.2.4. The vulnerability stems from Hash.from_xml (Hash#from_xml) using XmlSimple unsafely, enabling remote attackers to determine the existence of arbitrary files and read arbitrary XML files (e.g., passwords from Pidgin .pur...

CVE-2007-5599

CVE-2007-5599 affects awrate 1.0 with multiple PHP remote file inclusion (RFI) vulnerabilities. The issue allows remote attackers to execute arbitrary PHP code by supplying a URL in the toroot parameter used by (1) 404.php or (2) topbar.php, representing vectors distinct from CVE-2006-6368. The r...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2007-5587. Reason: This candidate is a duplicate of CVE-2007-5587. Notes: All CVE users should reference CVE-2007-5587 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

Immunity Canvas: MS07_067

Name| ms07067 ---|--- CVE| CVE-2007-5587 Exploit Pack| CANVAS Description| Macrovision SecDrv.sys Arbitrary Overwrite Notes| References: www.microsoft.com/technet/security/Bulletin/MS07-067.mspx CVE Name: CVE-2007-5587 VENDOR: Microsoft MSADV: MS07-067 Date public: 10/17/07 CVE Url:...

CVE-2007-5587

A buffer overflow vulnerability exists in the Macrovision SafeDisc secdrv.sys driver (versions before 4.3.86.0 ) on Microsoft Windows XP SP2, XP Professional x64/x64 SP2, and Server 2003 SP1/SP2/x64/x64 SP2. A local user can exploit this by providing a specially crafted argument to a METHOD_NEITH...

CVE-2007-5586

...

CVE-2007-5586

CVE-2007-5587 describes a local elevation of privilege in the Macrovision SafeDisc driver (secdrv.sys). The vulnerability exists in how the driver handles configuration parameters and is exploitable via a crafted argument to a METHOD_NEITHER IOCTL, allowing a local attacker to execute arbitrary c...

DEBIAN-CVE-2007-5585

xscreensaver 5.03 and earlier, when running without xscreensaver-gl-extras GL extras installed, crashes when /usr/bin/xscreensaver-gl-helper does not exist and a user attempts to unlock the screen, which allows attackers with physical access to gain access to the locked session...