CVE-2007-4064

Multiple cross-site scripting XSS vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, 1 allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHPSELF; and 2 allow remote authenticated administrators to inject arbitrary web script or HTM...

Race condition

The Access Control functionality JMXOpsAccessControlFilter in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the web-based administration console in Citrix Access Gateway before firmware 4.5.5 allows remote attackers to perform certain configuration changes as administrators...

CVE-2007-3786

Cross-site request forgery CSRF vulnerability on the eSoft InstaGate EX2 UTM device before firmware 3.1.20070615 allows remote attackers to perform privileged actions as administrators. NOTE: the vendor disputes the distribution of the vulnerable software, stating that it was a custom build for a...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Email-Template module in Generic YouTube Clone Script allows remote attackers to upload files with arbitrary file types to templates/emails/ as administrators...

CVE-2007-3773

Cross-site request forgery CSRF vulnerability in the Email-Template module in Generic YouTube Clone Script allows remote attackers to upload files with arbitrary file types to templates/emails/ as administrators...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in pop/WizU.html in the management interface in Check Point VPN-1 Edge X Embedded NGX 7.0.33x on the Check Point VPN-1 UTM Edge allows remote attackers to perform privileged actions as administrators, as demonstrated by a request with the swuuser and...

CVE-2007-3489

Cross-site request forgery CSRF vulnerability in pop/WizU.html in the management interface in Check Point VPN-1 Edge X Embedded NGX 7.0.33x on the Check Point VPN-1 UTM Edge allows remote attackers to perform privileged actions as administrators, as demonstrated by a request with the swuuser and...

CVE-2007-3451

PHP remote file inclusion vulnerability in admin/index.php in 6ALBlog allows remote authenticated administrators to execute arbitrary PHP code via a URL in the pg parameter...

CVE-2007-3312

Directory traversal vulnerability in admin/pluginmanager.php in Jasmine CMS 1.0 allows remote authenticated administrators to include and execute arbitrary local files a .. dot dot in the u parameter. NOTE: a separate vulnerability could be leveraged to make this issue exploitable by remote...

Cross site scripting

Cross-site scripting XSS vulnerability in functions.php in the default theme in WordPress 2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the PATHINFO REQUESTURI to wp-admin/themes.php, a different vulnerability than CVE-2007-1622. NOTE: this might not...

CVE-2007-3238

Cross-site scripting XSS vulnerability in functions.php in the default theme in WordPress 2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the PATHINFO REQUESTURI to wp-admin/themes.php, a different vulnerability than CVE-2007-1622. NOTE: this might not...

CVE-2007-3238

Cross-site scripting XSS vulnerability in functions.php in the default theme in WordPress 2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the PATHINFO REQUESTURI to wp-admin/themes.php, a different vulnerability than CVE-2007-1622. NOTE: this might not...

WordPress Default Theme <= 2.2 - XSS

Because of this vulnerability, the authenticated administrators can inject arbitrary web script or HTML. Solution Update the theme...

IE 6 / Ademco co. ltd. ATNBaseLoader100 Module Remote BoF Exploit

No description provided by source. !-- IE 6 / Ademco, co., ltd. ATNBaseLoader100 Module ATNBaseLoader100.dll 5, 4, 0, 6 remote buffer overflow exploit / XP SP2 it version by rgod site: retrogod.altervista.org this activex is installed browsing some webcam pages try this google dork:...

Sql injection

SQL injection vulnerability in the IP-Search functionality in the IP-Tracking Mod for phpBB 2.0.x allows remote authenticated administrators to execute arbitrary SQL commands via the Search Query field...

CVE-2007-2858

SQL injection vulnerability in the IP-Search functionality in the IP-Tracking Mod for phpBB 2.0.x allows remote authenticated administrators to execute arbitrary SQL commands via the Search Query field...

CVE-2007-2858

SQL injection vulnerability in the IP-Search functionality in the IP-Tracking Mod for phpBB 2.0.x allows remote authenticated administrators to execute arbitrary SQL commands via the Search Query field...

CVE-2007-2630

The CVE-2007-2630 entry concerns an Incomplete blacklist vulnerability in the FCKeditor module’s filemanager/browse paths (config.php) used by ActiveCampaign 1-2-All (12All) versions 4.50–4.53.13. The issue allows remote authenticated administrators to upload and possibly execute .php4/.php5 file...

CVE-2007-2619

Symantec pcAnywhere 11.5.x and 12.0.x retains unencrypted login credentials for the most recent login within process memory, which allows local administrators to obtain the credentials by reading process memory, a different vulnerability than CVE-2006-3785...