6708 matches found
CVE-2007-6472
Multiple SQL injection vulnerabilities in phpMyRealty PMR 1.0.9 allow 1 remote attackers to execute arbitrary SQL commands via the type parameter to search.php and 2 remote authenticated administrators to execute arbitrary SQL commands via the listingupdateddays parameter to admin/findlistings.ph...
AST-2007-027 - Database matching order permits host-based authentication to be ignored
Asterisk Project Security Advisory - AST-2007-027 +------------------------------------------------------------------------+ | Product | Asterisk | |--------------------+---------------------------------------------------| | Summary | Database matching order permits host-based | | | authenticatio...
CVE-2007-6390
Cross-site request forgery CSRF vulnerability in the mycalendar plugin before 0.13 for Serendipity allows remote attackers to perform actions as blog administrators, which can be leveraged to conduct cross-site scripting XSS attacks on the blog page...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in the mycalendar plugin before 0.13 for Serendipity allows remote attackers to perform actions as blog administrators, which can be leveraged to conduct cross-site scripting XSS attacks on the blog page...
CVE-2007-6390
CVE-2007-6390 affects the Serendipity mycalendar plugin (pre-0.13). The vulnerability is a CSRF flaw that could allow an attacker to perform actions as a blog administrator, which could be leveraged to enable or facilitate XSS on the blog page. Affected component: mycalendar plugin for Serendipit...
CVE-2007-6390
Cross-site request forgery CSRF vulnerability in the mycalendar plugin before 0.13 for Serendipity allows remote attackers to perform actions as blog administrators, which can be leveraged to conduct cross-site scripting XSS attacks on the blog page...
CVE-2007-6366
Multiple SQL injection vulnerabilities in SineCMS 2.3.4 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the id parameter to mods/Calendar/index.php, accessed through a Calendar info action to mods.php; the id parameter to admin/modsadm.php in a 2 Guestbook modifica or 3...
Sql injection
Multiple SQL injection vulnerabilities in SineCMS 2.3.4 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the id parameter to mods/Calendar/index.php, accessed through a Calendar info action to mods.php; the id parameter to admin/modsadm.php in a 2 Guestbook modifica or 3...
CVE-2007-6366
Multiple SQL injection vulnerabilities in SineCMS 2.3.4 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the id parameter to mods/Calendar/index.php, accessed through a Calendar info action to mods.php; the id parameter to admin/modsadm.php in a 2 Guestbook modifica or 3...
CVE-2007-6316
Cross-site scripting XSS vulnerability in BarracudaDrive Web Server before 3.8 allows remote attackers to inject arbitrary web script or HTML via the URI path in an HTTP GET request, which is activated by administrators viewing log files via the Trace page...
Boundary failure in GETDC mailslot
Description Secunia Research reported a vulnerability that allows for the execution of arbitrary code in nmbd. This defect is only be exploited when the "domain logons" parameter has been enabled in smb.conf. Patch Availability A patch addressing this defect has been posted to...
Design/Logic Flaw
Ingate Firewall before 4.6.0 and SIParator before 4.6.0 use cleartext storage for passwords of "administrators with less privileges," which might allow attackers to read these passwords via unknown vectors...
CVE-2007-6096
Ingate Firewall before 4.6.0 and SIParator before 4.6.0 use cleartext storage for passwords of "administrators with less privileges," which might allow attackers to read these passwords via unknown vectors...
Code injection
Direct static code injection vulnerability in dirsys/modules/config/post.php in JBC Explorer 7.20 RC1 and earlier allows remote authenticated administrators to inject arbitrary PHP code via the DEBUG parameter, which can be executed by accessing config.inc.php. NOTE: this can be exploited by...
CVE-2007-5917
Cross-site request forgery CSRF vulnerability in admin/adminaccount.php in Skalinks 1.5 and earlier allows remote attackers to add arbitrary privileged accounts as administrators via the adminname, adminpassword, admintype, and Addadmin parameters...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in admin/adminaccount.php in Skalinks 1.5 and earlier allows remote attackers to add arbitrary privileged accounts as administrators via the adminname, adminpassword, admintype, and Addadmin parameters...
CVE-2007-5914
Direct static code injection vulnerability in dirsys/modules/config/post.php in JBC Explorer 7.20 RC1 and earlier allows remote authenticated administrators to inject arbitrary PHP code via the DEBUG parameter, which can be executed by accessing config.inc.php. NOTE: this can be exploited by...
Cisco Unified MeetingPlace Login Screen Cross-Site Scripting Vulnerability
Cisco Unified MeetingPlace versions 5.3.235.0 and prior, 5.4, and 6.0 contain a vulnerability that could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. This vulnerability is due to insufficient filtering of parameters passed to the Login form of Cisco Unified...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in blockseditdo.php in sBlog 0.7.3 Beta allows remote attackers to change arbitrary blocks as administrators...