CVE-2007-2149: Undefined Security Weakness

Stephen Craton aka WiredPHP Chatness 2.5.3 and earlier stores usernames and unencrypted passwords in 1 classes/vars.php and 2 classes/varstuff.php, and recommends 0666 or 0777 permissions for these files, which allows local users to gain privileges by reading the files, and allows remote attacker...

CVE-2007-2115

Unspecified vulnerability in the Change Data Capture CDC component in Oracle Database 9.2.0.7, 10.1.0.5, and 10.2.0.2 has unknown impact and attack vectors, aka DB09. NOTE: as of 20070424, oracle has not disputed reliable claims that this issue involves multiple SQL injection vulnerabilities in t...

CVE-2007-1992: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in the comzoom 2.5 beta 2 and earlier module for Mambo allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to 1 EXIFMakernote.php or 2 EXIF.php in classes/iptc/...

CVE-2007-1850: Undefined Security Weakness

Directory traversal vulnerability in classes/captcha/captcha.jpg.php in Drake CMS allows remote attackers to read arbitrary files or list arbitrary directories, and obtain the installation path, via a .. dot dot in the dprivate parameter. NOTE: Drake CMS has only a beta version available, and the...

CVE-2007-1848: Undefined Security Weakness

Cross-site scripting XSS vulnerability in admin/classes/ui.dta.php in Drake CMS allows remote attackers to inject arbitrary web script or HTML via the desctitle field. NOTE: Drake CMS has only a beta version available, and the vendor has previously stated "We do not consider security reports vali...

CVE-2006-7071: Undefined Security Weakness

SQL injection vulnerability in classes/classsession.php in Invision Power Board IPB 2.1 up to 2.1.6 allows remote attackers to execute arbitrary SQL commands via the CLIENTIP parameter...

OPENi-CMS Site Protection Plugin Remote File Inclusion Vulnerability

Exploit for unknown platform in category web applications ==================================================================== OPENi-CMS Site Protection Plugin Remote File Inclusion Vulnerability ====================================================================...

OPENi-CMS Site Protection Plugin - Remote File Inclusion

------------------------------------------------------------------------------------ ECHOADV64$2007 Openi CMS plugins site protection remote file inclusion ------------------------------------------------------------------------------------ Author : Ahmad Muammar W.K a.k.a y3dips Date Found :...

CVE-2007-0867: Undefined Security Weakness

PHP remote file inclusion vulnerability in classes/menu.php in Site-Assistant 0990 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pathsversion parameter...

CVE-2007-0848: Undefined Security Weakness

PHP remote file inclusion vulnerability in classes/classmail.inc.php in Maian Recipe 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the pathtofolder parameter...

CVE-2007-0630: Undefined Security Weakness

Multiple SQL injection vulnerabilities in the generatecsv function in classes/class.news.php in X-dev xNews 1.3 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id, 2 from, and 3 q parameters, different vectors than CVE-2007-0569. NOTE: The provenance of this...

CVE-2006-6636

Unspecified vulnerability in the Utility Classes for IBM WebSphere Application Server WAS before 5.1.1.13 and 6.x before 6.0.2.17 has unknown impact and attack vectors...

CVE-2006-6636: Undefined Security Weakness

Unspecified vulnerability in the Utility Classes for IBM WebSphere Application Server WAS before 5.1.1.13 and 6.x before 6.0.2.17 has unknown impact and attack vectors...

Chaussette远程文件包含漏洞

Chaussette是一款基于PHP的WEB应用程序。 Chaussette不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是多个脚本对用户提交的'BASE'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Chaussette http://freshmeat.net/redir/chaussette/64502/urlzip/chaussette.zip...

CVE-2006-6394

SQL injection vulnerability in certain database classes in Jonas Gauffin Publicera 1.0-rc2 and earlier might allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2006-6394

The CVE-2006-6394 entry describes an SQL injection vulnerability in certain database classes of Jonas Gauffin Publicera 1.0-rc2 and earlier, potentially allowing remote attackers to execute arbitrary SQL commands via unspecified vectors. Affected software: Jonas Gauffin Publicera 1.0-rc2 and earl...

Chaussette <= 080706 (_BASE) Remote File Include Vulnerabilities

No description provided by source. Chaussette Remote File Inclusion CreW: ToXiC Bug Found By Drago84 Source Code: http://freshmeat.net/redir/chaussette/64502/urlzip/chaussette.zip Page Affect /Classes/Evenement.php /Classes/Event.php /Classes/Eventformonth.php /Classes/Eventformonthperday.php...

CVE-2006-5911

CVE-2006-5911 concerns multiple PHP remote file inclusion vulnerabilities in Campware Campsite prior to 2.6.2. The flaw allows an attacker to cause arbitrary PHP code execution by supplying a URL in the g_documentRoot parameter to a large set of Campware PHP scripts (including Alias.php, Article....

CVE-2006-5911: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Campware Campsite before 2.6.2 allow remote attackers to execute arbitrary PHP code via a URL in the gdocumentRoot parameter to 1 Alias.php, 2 Article.php, 3 ArticleAttachment.php, 4 ArticleComment.php, 5 ArticleData.php, 6 ArticleImage.php, 7...

IBM WebSphere snoopservlet Path Disclosure

This script attempts to enumerate the actual physical path of the servlet classes by requesting a version of 'snoopservlet' which is missing required classes. An attacker, gaining information about the actual physical layout of the file system, can use the information in crafting more complex...