CVE-2007-5330

CVE-2007-5330 affects CA BrightStor ARCserve Backup and BrightStor Enterprise Backup on Windows. The cadbd RPC service is vulnerable to remote code execution via stack-based buffer overflows in unspecified RPC procedures, and to memory corruption from handling of RPC arguments as pointers. Exploi...

[SECURITY] [DSA 1381-2] New Linux 2.6.18 packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1381-2 [email protected] http://www.debian.org/security/ Dann Frazier October 12th, 2007 http://www.debian.org/security/faq -...

Immunity Canvas: TIKIWIKI_EXEC

Name| tikiwikiexec ---|--- CVE| CVE-2007-5423 Exploit Pack| CANVAS Description| TikiWiki function create exploit Notes| CVSS: 7.5 Repeatability: Infinite VENDOR: Tikiwiki CVE Url: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5423 CVE Name: CVE-2007-5423...

CVE-2007-5423

tiki-graphformula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter, which are processed by createfunction...

CVE-2007-5425

SQL injection vulnerability in admin/index.php in Interspire ActiveKB 1.5 allows remote attackers to execute arbitrary SQL commands via the questId parameter in a hideQuestion ToDo action. NOTE: the catId vector is already covered by CVE-2007-5131...

CVE-2007-5427

Cross-site scripting XSS vulnerability in the comsearch component in Joomla! 1.0.13 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchword parameter. NOTE: this might be related to CVE-2007-4189.1...

CVE-2007-5431

include/imageupload.js in the MyFTPUploader module in Stride 1.0 contains sensitive information including FTP login credentials, which might allow remote attackers to gain unauthorized access to the FTP server being used by the module by viewing the source code...

CVE-2007-5425

CVE-2007-5425 is a SQL injection vulnerability in Interspire ActiveKB 1.5, exploitable via the questId parameter in admin/index.php under a hideQuestion ToDo action. The issue affects ActiveKB 1.5 (and relates to CVE-2007-5131 for the catId vector). The provided documents do not specify a patch o...

CVE-2007-5424

The CVE-2007-5424 entry concerns PHP 4/5 where the disable_functions setting can be bypassed via an alias (demonstrated via ini_alter when ini_set is disabled). Affected component: PHP’s configuration and function-disabling mechanism. Reported impact aligns with PARTIAL confidentiality/integrity/...

CVE-2007-5433

CVE-2007-5433 describes multiple cross-site scripting (XSS) vulnerabilities in Site-Up 2.64 and earlier within the index.cgi component. The affected vectors are the (1) search and (2) search mask fields, allowing remote attackers to inject arbitrary web script or HTML. The consolidated records al...

CVE-2007-5431

The CVE-2007-5431 entry affects Stride 1.0’s MyFTPUploader module, specifically the include/imageupload.js component. The root cause is that sensitive FTP login credentials are present in the source code, which could allow remote attackers to gain unauthorized access to the FTP server used by the...

CVE-2007-5358

CVE-2007-5358 affects Asterisk 1.4.x (before 1.4.13) voicemail functionality when using IMAP storage. The issue is described as multiple buffer overflows in voicemail handling, potentially allowing arbitrary code execution. Two attack vectors are noted: (1) remote attackers could execute arbitrar...

CVE-2007-5423

Summary: CVE-2007-5423 affects TikiWiki up to version 1.9.8, where tiki-graph_formula.php unsafely processes input in the f array via create_function(), enabling remote PHP code execution with the web server’s privileges. This is evidenced by multiple public advisories and exploit references (Met...

CVE-2007-5426

CVE-2007-5426 : The provided documents identify multiple cross-site scripting (XSS) vulnerabilities in ActiveKB NX 2.5.4 . The issue arises from injectable content via the page parameter to the default URI for some directories (examples include ActiveKB/ and default/categories/ActiveKB/). The roo...

CVE-2007-5432

Stride 1.0 has a default administrator username of "scott" with the password "running", which allows remote attackers to obtain administrative access through login.php...

CVE-2007-5429

The CVE-2007-5429 entry concerns Nucleus CMS version 3.01, where the vulnerability exists in index.php via the archive parameter. The issue is a cross-site scripting (XSS) flaw that could allow remote attackers to inject arbitrary web script or HTML. The available connected documents confirm the ...

CVE-2007-5432

CVE-2007-5432 refers to a vulnerability in Stride 1.0 where a default administrator account uses username "scott" and password "running". According to the provided documents, remote attackers could obtain administrative access via login.php. The core issue is the use of a hardcoded default creden...

CVE-2007-5427

CVE-2007-5427 is an XSS vulnerability affecting Joomla! prior to 1.0.13 in the com_search component, exploitable via the searchword parameter. The NVD entry ties it to a remote attacker scenario, with an impact profile indicating no confidentiality or availability impact and partial integrity imp...

CVE-2007-5428

CVE-2007-5428 is a cross-site scripting (XSS) vulnerability in UMI CMS. The flaw allows remote attackers to inject arbitrary web script or HTML via the search_string parameter to the default URI in search_do/. The issue is documented with CVSS v2.0 base metrics: AV:N/AC:M/Au:N/C:N/I:P/A:N, base s...

CVE-2007-5434

The CVE-2007-5434 entry describes a cross-site scripting (XSS) vulnerability in PRO-search versions up to 0.17.1, where an attacker can inject arbitrary script or HTML via the q parameter to the default URI. The issue stems from unsanitized user input in the query parameter, enabling remote scrip...