Directory traversal

Directory traversal vulnerability in the BlueCat Networks Proteus IPAM appliance 2.0.2.0 Adonis DNS/DHCP appliance 5.0.2.8 allows remote authenticated administrators, with certain TFTP privileges, to create and overwrite arbitrary files via a .. dot dot in a pathname. NOTE: this can be leveraged...

CVE-2007-4226

CVE-2007-4226 describes a directory traversal in the BlueCat Networks Proteus IPAM appliance 2.0.2.0 (Adonis DNS/DHCP appliance 5.0.2.8). The vulnerability allows remote authenticated administrators with certain TFTP privileges to create and overwrite arbitrary files through a .. in a pathname, w...

CVE-2007-4226

Directory traversal vulnerability in the BlueCat Networks Proteus IPAM appliance 2.0.2.0 Adonis DNS/DHCP appliance 5.0.2.8 allows remote authenticated administrators, with certain TFTP privileges, to create and overwrite arbitrary files via a .. dot dot in a pathname. NOTE: this can be leveraged...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via 1 the Options Database Table in the Admin Panel, accessed through options.php; or 2 the opmlurl parameter to link-import.php. NOTE: this might...

CVE-2007-4154

SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the pageoptions parameter to 1 options-general.php, 2 options-writing.php, 3 options-reading.php, 4 options-discussion.php, 5 options-privacy.php, 6...

CVE-2007-4153

Multiple cross-site scripting XSS vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via 1 the Options Database Table in the Admin Panel, accessed through options.php; or 2 the opmlurl parameter to link-import.php. NOTE: this might...

Sql injection

SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the pageoptions parameter to 1 options-general.php, 2 options-writing.php, 3 options-reading.php, 4 options-discussion.php, 5 options-privacy.php, 6...

CVE-2007-4153

Multiple cross-site scripting XSS vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via 1 the Options Database Table in the Admin Panel, accessed through options.php; or 2 the opmlurl parameter to link-import.php. NOTE: this might...

CVE-2007-4154

SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the pageoptions parameter to 1 options-general.php, 2 options-writing.php, 3 options-reading.php, 4 options-discussion.php, 5 options-privacy.php, 6...

CVE-2007-4154

CVE-2007-4154: WordPress 2.2.1 contains an SQL injection vulnerability in options.php. Remote authenticated administrators can execute arbitrary SQL commands via the page_options parameter across (1) options-general.php, (2) options-writing.php, (3) options-reading.php, (4) options-discussion.php...

CVE-2007-4153

Multiple cross-site scripting XSS vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via 1 the Options Database Table in the Admin Panel, accessed through options.php; or 2 the opmlurl parameter to link-import.php. NOTE: this might...

CVE-2007-4153

Multiple cross-site scripting XSS vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via 1 the Options Database Table in the Admin Panel, accessed through options.php; or 2 the opmlurl parameter to link-import.php. NOTE: this might...

WordPress <= 2.2.1 - Multiple XSS

Because of these vulnerabilities, the authenticated administrators can inject arbitrary web script or HTML. Solution Update WordPress...

WordPress <= 2.2.1 - SQL Injection

Because of this vulnerability in options.php, the authenticated administrators can execute arbitrary SQL commands via the "pageoptions" parameter. Solution Update WordPress...

CVE-2007-4064

Multiple cross-site scripting XSS vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, 1 allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHPSELF; and 2 allow remote authenticated administrators to inject arbitrary web script or HTM...

CVE-2007-4064

Multiple cross-site scripting XSS vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, 1 allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHPSELF; and 2 allow remote authenticated administrators to inject arbitrary web script or HTM...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, 1 allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHPSELF; and 2 allow remote authenticated administrators to inject arbitrary web script or HTM...

CVE-2007-4064

Multiple cross-site scripting XSS vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, 1 allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHPSELF; and 2 allow remote authenticated administrators to inject arbitrary web script or HTM...

Race condition

The Access Control functionality JMXOpsAccessControlFilter in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the web-based administration console in Citrix Access Gateway before firmware 4.5.5 allows remote attackers to perform certain configuration changes as administrators...