CVE-2007-2699

The CVE-2007-2699 entry concerns BEA WebLogic Express/Server 9.0/9.1 where the Administration Console fails to enforce Domain Security Policies, allowing remote administrative users in the Deployer role to upload arbitrary files. The connected documents indicate an abuse scenario via the WebLogic...

CVE-2007-2698

The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows remote attackers to obtain sensitive credential information...

CVE-2007-2699

The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files...

Design Flaw in Deutsche Telekom Speedport w700v broadband router

Hi, I'd like to inform you about a vulnerability in the Deutsche Telekom Speedport w700v DSL router. Currently it's the standard device that is shipped with new DSL contracts. I - TITLE Security advisory: Weaknesses in the login process of the web interface of the Speedport w700v DSL Router and...

Design/Logic Flaw

Incomplete blacklist vulnerability in filemanager/browser/default/connectors/php/config.php in the FCKeditor module, as used in ActiveCampaign 1-2-All aka 12All 4.50 through 4.53.13, and possibly other products, allows remote authenticated administrators to upload and possibly execute .php4 and...

Snaps! Gallery 1.4.4 - Remote User Pass Change

Snaps! Gallery 1.4.4 - Remote User Pass Change ?php / \|/// \ - - // @ @ ----oOOo---oOOo--------------------------------------------------- Y! Underground Group [email protected] Dj7xpl.2600.ir ----ooooO-----Ooooo-------------------------------------------------- \ / \ /...

CVE-2007-2334

Nortel VPN Router aka Contivity 1000, 2000, 4000, and 5000 before 505.149, 505.3xx before 505.304, and 6.x before 605.140 has two template HTML files lacking certain verification tags, which allows remote attackers to access the administration interface and change the device configuration via...

Design/Logic Flaw

Nortel VPN Router aka Contivity 1000, 2000, 4000, and 5000 before 505.149, 505.3xx before 505.304, and 6.x before 605.140 has two template HTML files lacking certain verification tags, which allows remote attackers to access the administration interface and change the device configuration via...

CVE-2007-2334

Nortel VPN Router aka Contivity 1000, 2000, 4000, and 5000 before 505.149, 505.3xx before 505.304, and 6.x before 605.140 has two template HTML files lacking certain verification tags, which allows remote attackers to access the administration interface and change the device configuration via...

CVE-2007-2334

The CVE-2007-2334 issue affects Nortel VPN Router (Contivity) 1000/2000/4000/5000 prior to specific firmware revisions: 5_05.149, 5_05.304 for 5_05.x line, and 6.x prior to 6_05.140. The vulnerability arises from two template HTML files that lack certain verification tags, enabling remote attacke...

McAfee E-Business Administration Agent Detection

An Administration Agent for McAfee E-Business Server is listening on the remote host. McAfee E-Business Server is an enterprise tool for digitally encrypting and signing electronic files, and the Administration Agent allows for remote administration of the E-Business Server on the remote host...

Asterisk multiple security vulnerabilities

Multiple buffer overflows on T.38 SDP SIP channels parsing. DoS in administration interface. Multiple security vulnerabilities in parsing SIP replies...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Database Administration dba module 4.6.x-, and before 4.7.x-1.2 in the 4.7.x-1. series, for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified vectors relating to 1 direct display of data from the database...

CVE-2007-2159

Multiple cross-site scripting XSS vulnerabilities in the Database Administration dba module 4.6.x-, and before 4.7.x-1.2 in the 4.7.x-1. series, for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified vectors relating to 1 direct display of data from the database...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Database Administration dba module 4.6.x-, and before 4.7.x-1.2 in the 4.7.x-1. series, for Drupal allow remote attackers to perform unauthorized actions as an arbitrary user, a related issue to CVE-2006-5476...

CVE-2007-2160

Multiple cross-site request forgery CSRF vulnerabilities in the Database Administration dba module 4.6.x-, and before 4.7.x-1.2 in the 4.7.x-1. series, for Drupal allow remote attackers to perform unauthorized actions as an arbitrary user, a related issue to CVE-2006-5476...

CVE-2007-2159

Multiple cross-site scripting XSS vulnerabilities in the Database Administration dba module 4.6.x-, and before 4.7.x-1.2 in the 4.7.x-1. series, for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified vectors relating to 1 direct display of data from the database...

Cross site scripting

Cross-site scripting XSS vulnerability in boundaryrules.jsp in the Administration Front End for Oracle Enterprise Ultra Search, as used in Database Server 9.2.0.8, 10.1.0.5, and 10.2.0.2, and in Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2.0 allows remote attackers to inject arbitrary HTM...

CVE-2007-2119

CVE-2007-2119 is an XSS vulnerability in the Administration Front End for Oracle Enterprise (Ultra) Search. The issue affects boundary_rules.jsp and allows remote attackers to inject arbitrary HTML or script via the EXPTYPE parameter. Affected components include the Oracle Database Server variant...

CVE-2007-2020

Unspecified vulnerability in administration.php in xodagallery allows remote attackers to execute arbitrary code via the cmd parameter. NOTE: CVE disputes this vulnerability because administration.php does not use the cmd parameter for inclusion...