3147 matches found
CVE-2007-4000
The kadm5modifypolicyinternal function in lib/kadm5/srv/svrpolicy.c in the Kerberos administration daemon kadmind in MIT Kerberos 5 krb5 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy"...
CVE-2007-1364
CVE-2007-1364 affects DropAFew before 0.2.1 and is an authorization flaw that allows remote attackers to perform privileged actions: (1) view arbitrary users’ logged calorie data via id in editlogcal.php, (2) add arbitrary links via links.php, and (3) create arbitrary users via newaccount2.php. T...
Authorization
Unspecified vulnerability in SunPlex Manager in Sun Cluster 3.1 4/04 allows local users with solaris.cluster.gui authorization to view arbitrary files via unspecified vectors...
CVE-2006-0922
CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php aka upload.php that allows remote attackers to upload arbitrary files vi...
CVE-2005-0409
CitrusDB 0.3.6 and earlier does not verify authorization for the 1 importcc.php and 2 uploadcc.php, which allows remote attackers to upload credit card data and obtain sensitive information such as the pathnames for temporary files that store credit card data, and facilitates the exploitation of...
CVE-2004-0652
CVE-2004-0652 affects BEA WebLogic Server and WebLogic Express (versions 7.0 with SP4, and 8.1 with SP2). The vulnerability arises from accessible internal methods that allow an attacker to obtain the boot credentials (username and password) needed to start the server. Impact is credential leakag...
