CVE-2007-6548

Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code via the 1 header and 2 footer parameters to modules/system/admin.php in a meta-generator action, 3 the disclaimer parameter to modules/system/admin.p...

CVE-2007-6548

CVE-2007-6548 affects RunCMS up to version 1.6.1 and involves multiple direct static code injection vulnerabilities. Remote authenticated administrators can inject arbitrary PHP code via specific parameters in admin interfaces: header/footer (modules/system/admin.php), disclaimer (modules/system/...

Sql injection

Multiple SQL injection vulnerabilities in phpMyRealty PMR 1.0.9 allow 1 remote attackers to execute arbitrary SQL commands via the type parameter to search.php and 2 remote authenticated administrators to execute arbitrary SQL commands via the listingupdateddays parameter to admin/findlistings.ph...

CVE-2007-6472

Multiple SQL injection vulnerabilities in phpMyRealty PMR 1.0.9 allow 1 remote attackers to execute arbitrary SQL commands via the type parameter to search.php and 2 remote authenticated administrators to execute arbitrary SQL commands via the listingupdateddays parameter to admin/findlistings.ph...

CVE-2007-6472

Multiple SQL injection vulnerabilities in phpMyRealty PMR 1.0.9 allow 1 remote attackers to execute arbitrary SQL commands via the type parameter to search.php and 2 remote authenticated administrators to execute arbitrary SQL commands via the listingupdateddays parameter to admin/findlistings.ph...

AST-2007-027 - Database matching order permits host-based authentication to be ignored

Asterisk Project Security Advisory - AST-2007-027 +------------------------------------------------------------------------+ | Product | Asterisk | |--------------------+---------------------------------------------------| | Summary | Database matching order permits host-based | | | authenticatio...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the mycalendar plugin before 0.13 for Serendipity allows remote attackers to perform actions as blog administrators, which can be leveraged to conduct cross-site scripting XSS attacks on the blog page...

CVE-2007-6390

Cross-site request forgery CSRF vulnerability in the mycalendar plugin before 0.13 for Serendipity allows remote attackers to perform actions as blog administrators, which can be leveraged to conduct cross-site scripting XSS attacks on the blog page...

CVE-2007-6390

Cross-site request forgery CSRF vulnerability in the mycalendar plugin before 0.13 for Serendipity allows remote attackers to perform actions as blog administrators, which can be leveraged to conduct cross-site scripting XSS attacks on the blog page...

CVE-2007-6390

CVE-2007-6390 affects the Serendipity mycalendar plugin (pre-0.13). The vulnerability is a CSRF flaw that could allow an attacker to perform actions as a blog administrator, which could be leveraged to enable or facilitate XSS on the blog page. Affected component: mycalendar plugin for Serendipit...

Sql injection

Multiple SQL injection vulnerabilities in SineCMS 2.3.4 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the id parameter to mods/Calendar/index.php, accessed through a Calendar info action to mods.php; the id parameter to admin/modsadm.php in a 2 Guestbook modifica or 3...

CVE-2007-6366

Multiple SQL injection vulnerabilities in SineCMS 2.3.4 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the id parameter to mods/Calendar/index.php, accessed through a Calendar info action to mods.php; the id parameter to admin/modsadm.php in a 2 Guestbook modifica or 3...

CVE-2007-6366

Multiple SQL injection vulnerabilities in SineCMS 2.3.4 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the id parameter to mods/Calendar/index.php, accessed through a Calendar info action to mods.php; the id parameter to admin/modsadm.php in a 2 Guestbook modifica or 3...

CVE-2007-6316

Cross-site scripting XSS vulnerability in BarracudaDrive Web Server before 3.8 allows remote attackers to inject arbitrary web script or HTML via the URI path in an HTTP GET request, which is activated by administrators viewing log files via the Trace page...

Boundary failure in GETDC mailslot

Description Secunia Research reported a vulnerability that allows for the execution of arbitrary code in nmbd. This defect is only be exploited when the "domain logons" parameter has been enabled in smb.conf. Patch Availability A patch addressing this defect has been posted to...

Design/Logic Flaw

Ingate Firewall before 4.6.0 and SIParator before 4.6.0 use cleartext storage for passwords of "administrators with less privileges," which might allow attackers to read these passwords via unknown vectors...

CVE-2007-6096

Ingate Firewall before 4.6.0 and SIParator before 4.6.0 use cleartext storage for passwords of "administrators with less privileges," which might allow attackers to read these passwords via unknown vectors...

Code injection

Direct static code injection vulnerability in dirsys/modules/config/post.php in JBC Explorer 7.20 RC1 and earlier allows remote authenticated administrators to inject arbitrary PHP code via the DEBUG parameter, which can be executed by accessing config.inc.php. NOTE: this can be exploited by...

CVE-2007-5914

Direct static code injection vulnerability in dirsys/modules/config/post.php in JBC Explorer 7.20 RC1 and earlier allows remote authenticated administrators to inject arbitrary PHP code via the DEBUG parameter, which can be executed by accessing config.inc.php. NOTE: this can be exploited by...

CVE-2007-5917

Cross-site request forgery CSRF vulnerability in admin/adminaccount.php in Skalinks 1.5 and earlier allows remote attackers to add arbitrary privileged accounts as administrators via the adminname, adminpassword, admintype, and Addadmin parameters...