CVE-2007-1893

xmlrpc xmlrpc.php in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publishposts functionality, which can be used to "publish a previously saved post."...

Mandrake Linux Security Advisory : kernel (MDKSA-2007:078)

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel : When SELinux hooks are enabled, the kernel could allow a local user to cause a DoS crash via a malformed file stream that triggers a NULL pointer derefernece CVE-2006-6056. Multiple buffer overflows in the 1 read and 2...

OpenAFS: Privilege escalation

Background OpenAFS is a distributed network filesystem. Description Benjamin Bennett discovered that the OpenAFS client contains a design flaw where cache managers do not use authenticated server connections when performing actions not requested by a user. Impact If setuid is enabled on the clien...

Unfixed XSS vulnerability at www.fulltorrent.net

Security researcher MaXWeL, has submitted on 04/03/2007 a cross-site-scripting XSS vulnerability affecting www.fulltorrent.net, which at the time of submission ranked 45821 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/03/2007. It is...

Unfixed XSS vulnerability at www.newasp.net

Security researcher cyber, has submitted on 31/03/2007 a cross-site-scripting XSS vulnerability affecting www.newasp.net, which at the time of submission ranked 13481 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 31/03/2007. It is currently...

Unfixed XSS vulnerability at www.cstiger.de

Security researcher zuppergazi, has submitted on 17/03/2007 a cross-site-scripting XSS vulnerability affecting www.cstiger.de, which at the time of submission ranked 1106260 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 17/03/2007. It is...

Cross site scripting

Cross-site scripting XSS vulnerability in the wpexplainnonce function in the nonce AYS functionality wp-includes/functions.php for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and...

CVE-2007-0710

The Bonjour functionality in iChat in Apple Mac OS X 10.3.9 allows remote attackers to cause a denial of service persistent application crash via unspecified vectors, possibly related to CVE-2007-0614...

CVE-2007-0710

Summary (CVE-2007-0710) The Bonjour functionality in iChat on Apple Mac OS X 10.3.9 is affected. The vulnerability allows a remote attacker on the same network to cause a denial of service (persistent application crash) by triggering how iChat/Bonjour handles certain TXT records (TXT key hashes)....

getID3 library and Audio, Mediafield - arbitrary code execution

The getID3 library used by Audio and Mediafield contains a directory with scripts demonstrating use of the library. These scripts allow any visitor to browse the filesystem, read and delete files or write to zero-byte files or files with an mp3 extension. These actions are only limited by the...

CVE-2007-0958

Linux kernel 2.6.x before 2.6.20 allows local users to read unreadable binaries by using the interpreter PTINTERP functionality and triggering a core dump, a variant of CVE-2004-1073...

CVE-2007-0925

Cross-site scripting XSS vulnerability in search/SearchResults.aspx in Community Server allows remote attackers to inject arbitrary web script or HTML via the q parameter...

Authentication flaw

nabopoll 1.1.2 allows remote attackers to bypass authentication and access certain administrative functionality via a direct request for 1 configedit.php, 2 templateedit.php, or 3 surveyedit.php in admin/...

CVE-2007-0873

nabopoll 1.1.2 allows remote attackers to bypass authentication and access certain administrative functionality via a direct request for 1 configedit.php, 2 templateedit.php, or 3 surveyedit.php in admin/...

Cross site scripting

Allonsvoter 1.0 allows remote attackers to bypass authentication and access certain administrative functionality via a direct request for 1 adminajouter.php or 2 adminsupprimer.php. NOTE: this could be leveraged to conduct cross-site scripting XSS attacks...

CVE-2007-0873

NABOpoll 1.1.2 is vulnerable to an authentication-bypass that lets remote attackers access certain administrative functionality by directly requesting admin URLs. Specifically, requesting (1) config_edit.php, (2) template_edit.php, or (3) survey_edit.php in the admin/ directory can bypass login c...

CVE-2007-0873

nabopoll 1.1.2 allows remote attackers to bypass authentication and access certain administrative functionality via a direct request for 1 configedit.php, 2 templateedit.php, or 3 surveyedit.php in admin/...

EUVD-2007-0869

nabopoll 1.1.2 allows remote attackers to bypass authentication and access certain administrative functionality via a direct request for 1 configedit.php, 2 templateedit.php, or 3 surveyedit.php in admin/...

CVE-2007-0874

Allonsvoter 1.0 allows remote attackers to bypass authentication and access certain administrative functionality via a direct request for 1 adminajouter.php or 2 adminsupprimer.php. NOTE: this could be leveraged to conduct cross-site scripting XSS attacks...

Security feature bypass

Unspecified vulnerability in the Chat Room functionality in Yahoo! Messenger 8.1.0.239 and earlier allows remote attackers to cause a denial of service via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...