CVE-2007-4153

Multiple cross-site scripting XSS vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via 1 the Options Database Table in the Admin Panel, accessed through options.php; or 2 the opmlurl parameter to link-import.php. NOTE: this might...

CVE-2007-4154

CVE-2007-4154: WordPress 2.2.1 contains an SQL injection vulnerability in options.php. Remote authenticated administrators can execute arbitrary SQL commands via the page_options parameter across (1) options-general.php, (2) options-writing.php, (3) options-reading.php, (4) options-discussion.php...

WordPress <= 2.2.1 - SQL Injection

Because of this vulnerability in options.php, the authenticated administrators can execute arbitrary SQL commands via the "pageoptions" parameter. Solution Update WordPress...

WordPress <= 2.2.1 - Multiple XSS

Because of these vulnerabilities, the authenticated administrators can inject arbitrary web script or HTML. Solution Update WordPress...

CVE-2007-4064

Multiple cross-site scripting XSS vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, 1 allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHPSELF; and 2 allow remote authenticated administrators to inject arbitrary web script or HTM...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, 1 allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHPSELF; and 2 allow remote authenticated administrators to inject arbitrary web script or HTM...

CVE-2007-4064

Multiple cross-site scripting XSS vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, 1 allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHPSELF; and 2 allow remote authenticated administrators to inject arbitrary web script or HTM...

CVE-2007-4064

Multiple cross-site scripting XSS vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, 1 allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHPSELF; and 2 allow remote authenticated administrators to inject arbitrary web script or HTM...

Race condition

The Access Control functionality JMXOpsAccessControlFilter in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the web-based administration console in Citrix Access Gateway before firmware 4.5.5 allows remote attackers to perform certain configuration changes as administrators...

CVE-2007-3786

Cross-site request forgery CSRF vulnerability on the eSoft InstaGate EX2 UTM device before firmware 3.1.20070615 allows remote attackers to perform privileged actions as administrators. NOTE: the vendor disputes the distribution of the vulnerable software, stating that it was a custom build for a...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Email-Template module in Generic YouTube Clone Script allows remote attackers to upload files with arbitrary file types to templates/emails/ as administrators...

CVE-2007-3773

Cross-site request forgery CSRF vulnerability in the Email-Template module in Generic YouTube Clone Script allows remote attackers to upload files with arbitrary file types to templates/emails/ as administrators...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in pop/WizU.html in the management interface in Check Point VPN-1 Edge X Embedded NGX 7.0.33x on the Check Point VPN-1 UTM Edge allows remote attackers to perform privileged actions as administrators, as demonstrated by a request with the swuuser and...

CVE-2007-3489

Cross-site request forgery CSRF vulnerability in pop/WizU.html in the management interface in Check Point VPN-1 Edge X Embedded NGX 7.0.33x on the Check Point VPN-1 UTM Edge allows remote attackers to perform privileged actions as administrators, as demonstrated by a request with the swuuser and...

CVE-2007-3451

PHP remote file inclusion vulnerability in admin/index.php in 6ALBlog allows remote authenticated administrators to execute arbitrary PHP code via a URL in the pg parameter...

CVE-2007-3312

Directory traversal vulnerability in admin/pluginmanager.php in Jasmine CMS 1.0 allows remote authenticated administrators to include and execute arbitrary local files a .. dot dot in the u parameter. NOTE: a separate vulnerability could be leveraged to make this issue exploitable by remote...

CVE-2007-3238

Cross-site scripting XSS vulnerability in functions.php in the default theme in WordPress 2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the PATHINFO REQUESTURI to wp-admin/themes.php, a different vulnerability than CVE-2007-1622. NOTE: this might not...

Cross site scripting

Cross-site scripting XSS vulnerability in functions.php in the default theme in WordPress 2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the PATHINFO REQUESTURI to wp-admin/themes.php, a different vulnerability than CVE-2007-1622. NOTE: this might not...

CVE-2007-3238

Cross-site scripting XSS vulnerability in functions.php in the default theme in WordPress 2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the PATHINFO REQUESTURI to wp-admin/themes.php, a different vulnerability than CVE-2007-1622. NOTE: this might not...