Design/Logic Flaw

Unspecified vulnerability in TunnelRunner in SSHKeychain before 0.8.2 beta, and possibly later versions, allows local users to gain privileges via unspecified vectors...

CVE-2007-4438

Session fixation vulnerability in Ampache before 3.3.3.5 allows remote attackers to hijack web sessions via unspecified vectors...

Design/Logic Flaw

Multiple vulnerabilities in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allow local users to create arbitrary files via 1 unspecified vectors where an attacker's umask is honored, 2 /etc/ld.so.preload, 3 certain "cron data file locations", and other unspecified vectors possibly involvi...

Buffer overflow

Buffer overflow in the at program on IBM AIX 5.3 allows local users to gain privileges via unspecified vectors...

CVE-2007-4301

Multiple cross-site scripting XSS vulnerabilities in the management interface in WebCart 2.20 through 2.25 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

The isChecked function in Toolbar.DLL in Advanced Searchbar before 3.33 allows remote attackers to cause a denial of service NULL dereference and browser crash via unspecified vectors...

CVE-2007-4234

Unspecified vulnerability in Camera Life before 2.6 allows remote attackers to download private photos via unspecified vectors associated with the names of the photos. NOTE: some of these details are obtained from third party information...

CVE-2007-4112

Multiple SQL injection vulnerabilities in Advanced Webhost Billing System AWBS before 2.6.0, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be leveraged for XSS attacks that "bypass AWBS's anti-XSS input validation...

Default configuration

Unspecified vulnerability in Advanced Webhost Billing System AWBS before 2.6.0 allows remote authenticated users to obtain configuration data about other dedicated servers via unspecified vectors...

Sql injection

SQL injection vulnerability in editpost.php in phpMyForum before 4.1.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: some of these details are obtained from third party information...

CVE-2007-4113

Unspecified vulnerability in Advanced Webhost Billing System AWBS before 2.6.0 allows remote authenticated users to obtain configuration data about other dedicated servers via unspecified vectors...

CVE-2007-4050

Unspecified vulnerability in WebUI in ADempiere Bazaar before 3.3 beta Victoria edition allows remote attackers to access system-level windows via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the login CGI program in Aruba Mobility Controller 2.5.4.18 and earlier, and 2.4.8.6-FIPS and earlier FIPS versions, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-4023

Cross-site scripting XSS vulnerability in the login CGI program in Aruba Mobility Controller 2.5.4.18 and earlier, and 2.4.8.6-FIPS and earlier FIPS versions, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-4016

Unspecified vulnerability in the client components in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition before 4.5 HF1 allows attackers to execute arbitrary code via unspecified vectors...

CVE-2006-7221

Multiple off-by-one errors in fsplib.c in fsplib before 0.8 allow attackers to cause a denial of service via unspecified vectors involving the 1 name and 2 dname entry attributes...

Format string

lighttpd 1.4.15, when run on 32 bit platforms, allows remote attackers to cause a denial of service daemon crash via unspecified vectors involving the use of incompatible format specifiers in certain debugging messages in the 1 modscgi, 2 modfastcgi, and 3 modwebdav modules...

CVE-2007-3943

SQL injection vulnerability in Infinite Responder before 1.48 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: some of these details are obtained from third party information...

CVE-2007-3942

SMF 1.1.3 is affected by a directory traversal issue in index.php that could allow remote inclusion of local files via the sourcedir parameter or the actionArray hash. The root cause is unclear in some sources, as CVE notes that sourcedir and actionArray are defined before use and disputes exist ...

Sql injection

Multiple SQL injection vulnerabilities in Insanely Simple Blog 0.5 and earlier allow remote attackers to execute arbitrary SQL commands via the currentsubsection parameter to index.php and other unspecified vectors...