EUVD-2007-6454

Malware in sbrugna...

EUVD-2007-6455

Malware in sbrugna...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in 1 the dirclasses parameter to sitemap.xml.php or 2 the error parameter to errors.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to inject arbitrary web script or HTML via the 1 gbmail, 2 gbname, and 3 gbtext parameters in a guestbook action to index.php, and unspecified other vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Falcon Series One CMS 1.4.3 allows remote attackers to change a password via a certain changepass action to index.php...

CVE-2007-6488

Multiple PHP remote file inclusion vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in 1 the dirclasses parameter to sitemap.xml.php or 2 the error parameter to errors.php...

CVE-2007-6489

Multiple cross-site scripting XSS vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to inject arbitrary web script or HTML via the 1 gbmail, 2 gbname, and 3 gbtext parameters in a guestbook action to index.php, and unspecified other vectors...

CVE-2007-6490

Cross-site request forgery CSRF vulnerability in Falcon Series One CMS 1.4.3 allows remote attackers to change a password via a certain changepass action to index.php...

CVE-2007-6488

Falcon Series One CMS 1.4.3 is affected by multiple PHP remote file inclusion vulnerabilities. An attacker can cause arbitrary PHP code execution by providing a URL in (1) dir[classes] to sitemap.xml.php or (2) error to errors.php. The underlying issue is insecure handling of user-supplied URLs l...

CVE-2007-6490

The CVE-2007-6490 entry describes a CSRF vulnerability in Falcon Series One CMS 1.4.3 that allows remote attackers to change a user password via a specific changepass action to index.php. Public records confirm the affected software version (Falcon Series One CMS 1.4.3) and the vulnerability’s cr...

CVE-2007-6489

CVE-2007-6489 describes multiple XSS vulnerabilities in Falcon Series One CMS 1.4.3, exploitable via the guestbook action to index.php through the parameters gb_mail, gb_name, and gb_text (and unspecified other vectors). The NVD entry assigns a CVSS v2 base score of 7.5 (HIGH) with network attack...

CVE-2007-6489

Multiple cross-site scripting XSS vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to inject arbitrary web script or HTML via the 1 gbmail, 2 gbname, and 3 gbtext parameters in a guestbook action to index.php, and unspecified other vectors...

CVE-2007-6488

Multiple PHP remote file inclusion vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in 1 the dirclasses parameter to sitemap.xml.php or 2 the error parameter to errors.php...

CVE-2007-6490: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Falcon Series One CMS 1.4.3 allows remote attackers to change a password via a certain changepass action to index.php...

CVE-2007-6488: Improper Input Validation

Multiple PHP remote file inclusion vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in 1 the dirclasses parameter to sitemap.xml.php or 2 the error parameter to errors.php...

CVE-2007-6489: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to inject arbitrary web script or HTML via the 1 gbmail, 2 gbname, and 3 gbtext parameters in a guestbook action to index.php, and unspecified other vectors...