Default credentials

The Random Cookie Password functionality in the loaduser function in cgi-bin/cgi-lib/subs.pl in web-app.org WebAPP before 0.9.9.7 does not clear the 1 username, 2 password, 3 usertheme, and 4 userlang cookies for unauthorized users, which has unknown impact and remote attack vectors...

Design/Logic Flaw

The editprofile3 function in cgi-bin/cgi-lib/user.pl in web-app.org WebAPP before 0.9.9.7 does not properly check the 1 themes.dat, 2 languages.dat, 3 profession.dat, 4 gen.dat, 5 marstat.dat, 6 states.dat, and 7 ages.dat files before saving profile settings of members, which has unknown impact a...

CVE-2007-3423

cgi-bin/cgi-lib/instantmessage.pl in web-app.org WebAPP before 0.9.9.7 uses the From field of an instant message as the beginning of the .dat file name when the 1 imview2 or 2 imview3 function reads a an internal IM, or a message from a b guest or c removed member, which has unknown impact and...

CVE-2007-3424

The moveim function in cgi-bin/cgi-lib/instantmessage.pl in web-app.org WebAPP before 0.9.9.7 uses the tocat parameter as a subdirectory name when moving an instant message, which has unknown impact and remote attack vectors...

CVE-2007-3424

The affected software is WebAPP (Web-app.org) prior to version 0.9.9.7. The vulnerability lies in the moveim function of cgi-bin/cgi-lib/instantmessage.pl, which uses the tocat parameter as a subdirectory name when moving an instant message. The underlying impact is described as unknown in the so...

CVE-2007-3423

CVE-2007-3423 affects WebAPP (web-app.org) WebAPP versions before 0.9.9.7. The vulnerable component is cgi-bin/cgi-lib/instantmessage.pl, where the From field of an instant message is used as the beginning of the .dat filename when the imview2 or imview3 function reads messages from an internal I...

CVE-2007-3422

WebAPP (web-app.org) before 0.9.9.7 is affected by CVE-2007-3422. The getcgi function in cgi-bin/cgi-lib/subs.pl parses query strings containing (1) non‑printing characters, (2) certain printing characters not common in URLs, or (3) invalid URL encoding sequences. Impact is stated as unknown with...

CVE-2007-3420

The CVE concerns WebAPP (web-app.org) prior to version 0.9.9.7, where the Random Cookie Password feature in the loaduser function (cgi-bin/cgi-lib/subs.pl) fails to clear four cookies (username, password, usertheme, userlang) for unauthorized users. This creates a potential, described as having u...

CVE-2007-3422

The getcgi function in cgi-bin/cgi-lib/subs.pl in web-app.org WebAPP before 0.9.9.7 attempts to parse query strings that contain 1 non-printing characters, 2 certain printing characters that do not commonly occur in URLs, or 3 invalid URL encoding sequences, which has unknown impact and remote...

CVE-2007-3154

Unspecified vulnerability in Walter Zorn wztooltip.js aka wztooltips before 4.01, as used by eGroupWare before 1.2.107-2 and other packages, has unknown impact and remote attack vectors...

CVE-2007-3154

Vulnerability CVE-2007-3154 affects Walter Zorn wz_tooltip.js (aka wz_tooltips) prior to 4.01, used by eGroupWare before 1.2.107-2. The connected records describe an unspecified vulnerability with unknown impact and remote attack vectors; no concrete root cause, affected versions, exploit details...

CVE-2007-3023

unsp.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 does not properly calculate the end of a certain buffer, with unknown impact and remote attack vectors...

DEBIAN-CVE-2007-3023

unsp.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 does not properly calculate the end of a certain buffer, with unknown impact and remote attack vectors...

CVE-2007-3023

CVE-2007-3023 is discussed in multiple connected sources as part of the ClamAV vulnerabilities list. The Debian advisory (DSA-1320-1) and related OpenVAS entries describe several issues in ClamAV, including: (1) the NsPack decompression path not sanitising an internal length variable, potentially...

CVE-2007-3023

unsp.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 does not properly calculate the end of a certain buffer, with unknown impact and remote attack vectors...

CVE-2007-3023

unsp.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 does not properly calculate the end of a certain buffer, with unknown impact and remote attack vectors...

CVE-2007-2655

CVE-2007-2655 affects NetWin Webmail 3.1s-1 used in SurgeMail prior to version 3.8i2. The vulnerability is described as a potential format string issue that could enable remote code execution. Details are limited in the provided sources; no concrete exploit method, affected module/file, or patch/...

php make_http_soap_request flaw

Buffer overflow in the makehttpsoaprequest function in PHP before 5.2.2 has unknown impact and remote attack vectors, possibly related to "/" slash characters...

php libxmlrpc library overflow

Buffer overflow in the bundled libxmlrpc library in PHP before 4.4.7, and 5.x before 5.2.2, has unknown impact and remote attack vectors...

CVE-2007-1864

Buffer overflow in the bundled libxmlrpc library in PHP before 4.4.7, and 5.x before 5.2.2, has unknown impact and remote attack vectors...