CVE-2007-1354

CVE-2007-1354 affects JBoss Application Server’s JMX Console (JBoss AS 4.0.2 and 4.0.5 before 20070416). The flaw is in JMXOpsAccessControlFilter, which stores the current user’s roles in a member variable, enabling a race condition where a remote authenticated administrator could log in during a...

CVE-2007-1354

The Access Control functionality JMXOpsAccessControlFilter in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by...

CVE-2007-3858

Multiple unspecified vulnerabilities in Oracle Database 10.2.0.3 allow remote authenticated users to have an unknown impact via 1 EXFSYS.DBMSRLMGRUTL in Rules Manager DB11 and 2 Program Interface DB13...

CVE-2007-3868

Multiple unspecified vulnerabilities in PeopleTools in Oracle PeopleSoft Enterprise 8.22.15, 8.47.13, 8.48.10, and 8.49.02 allows remote authenticated users or attackers to have an unknown impact via multiple vectors, aka 1 PSE01, 2 PSE02, and 3 PSE03...

CVE-2007-3782

CVE-2007-3782 affects MySQL Community Server up to version 5.0.44; remote authenticated users can gain update privileges for a table in another database through a view that refers to an external table. Root cause: a view cross-database reference allows privilege escalation. A fix is available in ...

CVE-2007-3781

MySQL Community Server before 5.0.45 does not require privileges such as SELECT for the source table in a CREATE TABLE LIKE statement, which allows remote authenticated users to obtain sensitive information such as the table structure...

CVE-2007-3600

WordPlugin in the wordintegration component in vtiger CRM before 5.0.3 allows remote authenticated users to bypass field level security permissions and merge arbitrary fields in an Email template, as demonstrated by the fields in the Contact module...

CVE-2005-4854

CVE-2005-4854 affects eZ publish versions 3.5–3.7 prior to 2005-08-30. The root cause is that a folder’s read permissions are not used to restrict notifications, allowing remote authenticated users to view sensitive information about changes to content in arbitrary folders. The connected sources ...

CVE-2007-3494

CVE-2007-3494 affects Papoo CMS 3.6 and possibly earlier. The vulnerability stems from a missing privilege check in backend administration plugin access (via interna/plugin.php and a devtools/templates/newdump_backend.html argument), enabling remote authenticated users to perform actions beyond t...

Stack overflow

Stack-based buffer overflow in the renameprincipal2svc function in kadmind for MIT Kerberos 1.5.3, 1.6.1, and other versions allows remote authenticated users to execute arbitrary code via a crafted request to rename a principal...

CVE-2007-2798

Stack-based buffer overflow in the renameprincipal2svc function in kadmind for MIT Kerberos 1.5.3, 1.6.1, and other versions allows remote authenticated users to execute arbitrary code via a crafted request to rename a principal...

CVE-2007-2798

Stack-based buffer overflow in the renameprincipal2svc function in kadmind for MIT Kerberos 1.5.3, 1.6.1, and other versions allows remote authenticated users to execute arbitrary code via a crafted request to rename a principal...

Mandrake Linux Security Advisory : proftpd (MDKSA-2007:130)

The Auth API in ProFTPD, when multiple simultaneous authentication modules are configured, did not require that the module that checks authentication is the same module that retrieves authentication data, which could possibly be used to allow remote attackers to bypass authentication. The updated...

CVE-2007-3295

Directory traversal vulnerability in Yet another Bulletin Board YaBB 2.1 and earlier allows remote authenticated users to execute arbitrary Perl code via a .. dot dot in the userlanguage profile setting, which sets the userlanguage key of the member hash, and is propagated to the language variabl...

CVE-2007-3280

The Database Link library dblink in PostgreSQL 8.1 implements functions via CREATE statements that map to arbitrary libraries based on the C programming language, which allows remote authenticated superusers to map and execute a function from any library, as demonstrated by using the system...

CVE-2007-3260

HP System Management Homepage SMH before 2.1.9 for Linux, when used with Novell eDirectory, assigns the eDirectory members to the root group, which allows remote authenticated eDirectory users to gain privileges...

CVE-2007-3113

Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service CPU consumption via a large value of the 1 graphheight or 2 graphwidth parameter, different vectors than CVE-2007-3112...

CVE-2007-2860

user.php in BoastMachine 3.0 platinum allows remote authenticated users to gain privileges via a modified id parameter, as demonstrated by an editpost action...

CVE-2007-2860

Summary (CVE-2007-2860): BoastMachine 3.0 platinum’s user.php allows privilege escalation for remote authenticated users by tampering the id parameter, as demonstrated by an edit_post action. The NVD entry lists a network attack with low complexity and partial confidentiality/integrity/availabili...

CVE-2007-2858

SQL injection vulnerability in the IP-Search functionality in the IP-Tracking Mod for phpBB 2.0.x allows remote authenticated administrators to execute arbitrary SQL commands via the Search Query field...