Immunity Canvas: WORDTUBE_REMOTE

Name| wordtuberemote ---|--- CVE| CVE-2007-2481 Exploit Pack| CANVAS Description| WordPress Plugin WordTube Remote Include Notes| CVSS: 6.8 Repeatability: Infinite VENDOR: alexrabe.boelinger.com CVE Url: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2481 CVE Name: CVE-2007-2481...

CVE-2007-2481

The WordTube WordPress plugin (versions ≤ 1.43) is vulnerable to a Remote File Inclusion via the wpPATH parameter when register_globals is enabled. This can allow an attacker to execute arbitrary PHP code on the server. The affected component is the wordtube-button.php in WordTube 1.43 and earlie...

VMSA-2006-0004 Cross site scripting vulnerability and other fixes

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------- VMware Security Advisory Advisory ID: VMSA-2006-0004 Synopsis: Cross site scripting vulnerability and other fixes Knowledge base URL:http://kb.vmware.com/kb/2118366 Issue date:...

CVE-2006-2481

VMware ESX Server 2.0.x before 2.0.2 and 2.x before 2.5.2 patch 4 stores authentication credentials in base 64 encoded format in the vmware.mui.kid and vmware.mui.sid cookies, which allows attackers to gain privileges by obtaining the cookies using attacks such as cross-site scripting CVE-2005-36...

CVE-2006-2481

VMware ESX Server vulnerability CVE-2006-2481 affects ESX 2.0.x before 2.0.2 and 2.x before 2.5.2 patch 4. The Management Interface stores authentication credentials in base64-encoded form inside cookies (vmware.mui.kid and vmware.mui.sid). If an attacker can access these cookies (e.g., via cross...

CVE-2004-2481

CVE-2004-2481 affects MyProxy 6.58. The vulnerability allows remote authenticated users in the Users Tab to connect to arbitrary hosts from the MyProxy server by issuing a CONNECT command, bypassing access restrictions. No explicit exploit code or affected version range beyond 6.58 is provided in...

CVE-2005-2481

CVE-2005-2481 affects ColdFusion Fusebox 4.1.0. The issue is that a malformed or invalid fuseaction parameter allows remote attackers to cause an error message that leaks the full server path. Documents confirm the affected product and the nature of the information disclosure, but do not provide ...