CVE-2007-4319

The management interface in ZyNOS firmware 3.62WK.6 on the Zyxel Zywall 2 device allows remote authenticated administrators to cause a denial of service infinite reboot loop via invalid configuration data. NOTE: this issue might not cross privilege boundaries, and it might be resultant from CSRF;...

CVE-2007-4318

Cross-site scripting XSS vulnerability in Forms/General1 in the management interface in ZyNOS firmware 3.62WK.6 on the Zyxel Zywall 2 device allows remote authenticated administrators to inject arbitrary web script or HTML via the sysSystemName parameter...

Cross site scripting

The management interface in ZyNOS firmware 3.62WK.6 on the Zyxel Zywall 2 device allows remote authenticated administrators to cause a denial of service infinite reboot loop via invalid configuration data. NOTE: this issue might not cross privilege boundaries, and it might be resultant from CSRF;...

CVE-2007-4318

Cross-site scripting XSS vulnerability in Forms/General1 in the management interface in ZyNOS firmware 3.62WK.6 on the Zyxel Zywall 2 device allows remote authenticated administrators to inject arbitrary web script or HTML via the sysSystemName parameter...

CVE-2007-4318

CVE-2007-4318 is a cross-site scripting (XSS) vulnerability in the Zyxel Zywall 2 device running ZyNOS firmware 3.62(WK.6). The issue affects the management interface (Forms/General_1) where the sysSystemName parameter can be manipulated by remote authenticated administrators to inject arbitrary ...

Directory traversal

Directory traversal vulnerability in the BlueCat Networks Proteus IPAM appliance 2.0.2.0 Adonis DNS/DHCP appliance 5.0.2.8 allows remote authenticated administrators, with certain TFTP privileges, to create and overwrite arbitrary files via a .. dot dot in a pathname. NOTE: this can be leveraged...

CVE-2007-4226

CVE-2007-4226 describes a directory traversal in the BlueCat Networks Proteus IPAM appliance 2.0.2.0 (Adonis DNS/DHCP appliance 5.0.2.8). The vulnerability allows remote authenticated administrators with certain TFTP privileges to create and overwrite arbitrary files through a .. in a pathname, w...

CVE-2007-4226

Directory traversal vulnerability in the BlueCat Networks Proteus IPAM appliance 2.0.2.0 Adonis DNS/DHCP appliance 5.0.2.8 allows remote authenticated administrators, with certain TFTP privileges, to create and overwrite arbitrary files via a .. dot dot in a pathname. NOTE: this can be leveraged...

CVE-2007-4154

SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the pageoptions parameter to 1 options-general.php, 2 options-writing.php, 3 options-reading.php, 4 options-discussion.php, 5 options-privacy.php, 6...

Sql injection

SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the pageoptions parameter to 1 options-general.php, 2 options-writing.php, 3 options-reading.php, 4 options-discussion.php, 5 options-privacy.php, 6...

CVE-2007-4154

SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the pageoptions parameter to 1 options-general.php, 2 options-writing.php, 3 options-reading.php, 4 options-discussion.php, 5 options-privacy.php, 6...

CVE-2007-4153

Multiple cross-site scripting XSS vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via 1 the Options Database Table in the Admin Panel, accessed through options.php; or 2 the opmlurl parameter to link-import.php. NOTE: this might...

CVE-2007-4154

CVE-2007-4154: WordPress 2.2.1 contains an SQL injection vulnerability in options.php. Remote authenticated administrators can execute arbitrary SQL commands via the page_options parameter across (1) options-general.php, (2) options-writing.php, (3) options-reading.php, (4) options-discussion.php...

CVE-2007-4153

Multiple cross-site scripting XSS vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via 1 the Options Database Table in the Admin Panel, accessed through options.php; or 2 the opmlurl parameter to link-import.php. NOTE: this might...

WordPress <= 2.2.1 - SQL Injection

Because of this vulnerability in options.php, the authenticated administrators can execute arbitrary SQL commands via the "pageoptions" parameter. Solution Update WordPress...

CVE-2007-4064

Multiple cross-site scripting XSS vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, 1 allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHPSELF; and 2 allow remote authenticated administrators to inject arbitrary web script or HTM...

Race condition

The Access Control functionality JMXOpsAccessControlFilter in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by...

CVE-2007-3451

PHP remote file inclusion vulnerability in admin/index.php in 6ALBlog allows remote authenticated administrators to execute arbitrary PHP code via a URL in the pg parameter...

CVE-2007-3312

Directory traversal vulnerability in admin/pluginmanager.php in Jasmine CMS 1.0 allows remote authenticated administrators to include and execute arbitrary local files a .. dot dot in the u parameter. NOTE: a separate vulnerability could be leveraged to make this issue exploitable by remote...

Cross site scripting

Cross-site scripting XSS vulnerability in functions.php in the default theme in WordPress 2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the PATHINFO REQUESTURI to wp-admin/themes.php, a different vulnerability than CVE-2007-1622. NOTE: this might not...