CVE-2007-2858

SQL injection vulnerability in the IP-Search functionality in the IP-Tracking Mod for phpBB 2.0.x allows remote authenticated administrators to execute arbitrary SQL commands via the Search Query field...

CVE-2007-2700

The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information...

samba code injection

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the 1 SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute...

[ MDKSA-2007:097 ] - Updated xscreensaver packages fix vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2007:097 http://www.mandriva.com/security/ Package : xscreensaver Date : May 2, 2007 Affected: 2007.0, 2007.1, Corporate 3.0 Problem Description: A problem with the way xscreensaver verifies user passwords was...

Mandrake Linux Security Advisory : xscreensaver (MDKSA-2007:097)

A problem with the way xscreensaver verifies user passwords was discovered by Alex Yamauchi. When a system is using remote authentication i.e. LDAP for logins, a local attacker able to cause a network outage on the system could cause xscreensaver to crash, which would unlock the screen. Updated...

DEBIAN-CVE-2007-2437

The X render Xrender extension in X.org X Window System 7.0, 7.1, and 7.2, with Xserver 1.3.0 and earlier, allows remote authenticated users to cause a denial of service daemon crash via crafted values to the 1 XRenderCompositeTrapezoids and 2 XRenderAddTraps functions, which trigger a...

security flaw

slapd in OpenLDAP before 2.3.25 allows remote authenticated users with selfwrite Access Control List ACL privileges to modify arbitrary Distinguished Names DN...

CVE-2007-2082

CVE-2007-2082 describes a direct static code injection vulnerability in admin/settings.php for MyBlog 0.9.8 and earlier. The issue allows remote authenticated admin users to inject arbitrary PHP code via the content parameter, which can be executed by accessing index.php. A separate vulnerability...

CVE-2007-2033

Summary (CVE-2007-2033) : Cisco Wireless Control System (WCS) is affected by an unspecified vulnerability in versions before 4.0.81.0. The issue allows remote authenticated users to read any configuration page by changing the group membership of user accounts (Bug ID CSCse78596). The NVD entry li...

CVE-2003-1325

The CVE affects Valve Software’s Half-Life CSTRIKE Dedicated Server. The SV_CheckForDuplicateNames function in versions such as 1.6 and earlier is vulnerable when handling a connection string to UDP port 27015, where a backslash character at the end of the string can trigger an infinite loop and ...

Default credentials

member.php in MyBB aka MyBulletinBoard, when debug mode is available, allows remote authenticated users to change the password of any account by providing the account's registered e-mail address in a debug request for a dolostpw action, which prints the change password verification code in the...

CVE-2007-0957

CVE-2007-0957 involves a stack-based buffer overflow in the krb5_klog_syslog function of the MIT Kerberos 5 kadm5 library used by kadmind and the KDC. The vulnerability arises from a boundary/format handling issue, enabling remote authenticated users to execute arbitrary code and modify the Kerbe...

CVE-2007-1882

The CVE-2007-1882 entry affects HP Mercury Quality Center 9.0, build 9.1.0.4352. The vulnerability lies in qcbin/servlet/tdservlet/TDAPI_GeneralWebTreatment, where remote authenticated users can execute arbitrary SQL commands via the RunQuery method. Documents confirm the affected component and t...

Kerberos telnet Crafted Username Remote Authentication Bypass

An authentication bypass vulnerability exists in the MIT krb5 telnet daemon due to a failure to sanitize malformed usernames. This allows usernames beginning with '-e' to be interpreted as a command-line flag by the login.krb5 program. A remote attacker can exploit this, via a crafted username, t...

xserver XC-MISC integer overflow

Integer overflow in ALLOCATELOCAL in the ProcXCMiscGetXIDList function in the XC-MISC extension in the X.Org X11 server xserver 7.1-1.1.0, and other versions before 20070403, allows remote authenticated users to execute arbitrary code via a large expression, which results in memory corruption...

krb5_klog_syslog() stack buffer overflow

Stack-based buffer overflow in the krb5klogsyslog function in the kadm5 library, as used by the Kerberos administration daemon kadmind and Key Distribution Center KDC, in MIT krb5 before 1.6.1 allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via...

CVE-2007-1836

The command line administration interface in Data Domain OS before 4.0.3.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in certain arguments to various commands, as demonstrated by the interface argument to the 1 ifconfig and 2 ping commands...

CVE-2007-1554

Direct static code injection vulnerability in admin/configuration.php in Guestbara 1.2 and earlier allows remote authenticated users to inject arbitrary PHP code into config.php via the 1 adminmail, 2 emotpatch, 3 login, 4 pass, and unspecified other parameters. NOTE: the provenance of this...

Orion-Blog 2.0 - Remote Authentication Bypass

Orion-Blog 2.0 - Remote Authentication Bypass Orion-Blog v2.0 Version Remote Privilege Escalation Exploit function ps unique.action=""+document.unique.site.value+"/admin/AdminBlogNewsEdit.asp"; unique.submit; --- Orion-Blog v2.0 Version Remote Privilege Escalation Exploit --- Site Address :...

Orion-Blog 2.0 - Remote Authentication Bypass

Orion-Blog v2.0 Version Remote Privilege Escalation Exploit function ps unique.action=""+document.unique.site.value+"/admin/AdminBlogNewsEdit.asp"; unique.submit; --- Orion-Blog v2.0 Version Remote Privilege Escalation Exploit --- Site Address : UniquE-KeyUniquE-Cracker [email protected]...