Design/Logic Flaw

The FTP protocol implementation in Opera 9.10 allows remote attackers to allows remote servers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response...

CVE-2007-1493

CVE-2007-1493 describes an SQL injection in nukesentinel.php for NukeSentinel 2.5.06 and earlier, caused by a permissive IP validation regex that allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header. This CVE is linked to an incomplete patch for CVE-2007-1172. C...

CVE-2007-1432

The CVE-2007-1432 entry concerns Grayscale Blog 0.8.0 (and possibly earlier) where remote attackers can gain privileges by sending crafted requests with modified arguments to PHP scripts (add_users.php, addblog.php, editblog.php, editlinks.php, edit_users.php, add_links.php). The underlying issue...

PYSEC-2007-3

Trac before 0.10.3.1 does not send a Content-Disposition HTTP header specifying an attachment in certain "unsafe" situations, which has unknown impact and remote attack vectors...

CVE-2007-1408

Multiple vulnerabilities in 1 bank.php, 2 landfill.php, 3 outposts.php, 4 tribes.php, 5 house.php, 6 tribearmor.php, 7 tribeastral.php, 8 tribeware.php, and 9 includes/head.php in Bartek Jasicki Vallheru before 1.3 beta have unknown impact and remote attack vectors, probably related to large...

CVE-2007-1395

Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.2 allows remote attackers to conduct cross-site scripting XSS attacks by injecting arbitrary JavaScript or HTML in a 1 db or 2 table parameter value followed by an uppercase end tag, which bypasses the protection...

CVE-2007-1231

Multiple cross-site scripting XSS vulnerabilities in SQLiteManager 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 database name, 2 table name, 3 ViewName, 4 view, 5 trigger, and 6 function fields in main.php and certain other files...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in sitex allow remote attackers to inject arbitrary web script or HTML via 1 the sxYear parameter to calendar.php, 2 the search parameter to search.php, 3 the linkid parameter to redirect.php, or 4 the page parameter to calendarevents.php...

CVE-2007-1244

Cross-site request forgery CSRF vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php. NOTE: this issue can be leveraged to perform cross-site scripting X...

Design/Logic Flaw

WebAPP before 0.9.9.5 does not properly manage e-mail addresses in certain contexts related to 1 the Recommend feature, Email Article 2 senders and 3 recipients, 4 New User Approval, 5 Edit Profiles, 6 the Newsletter Subscription form, 7 the Recommend form, and 8 sending of articles, which has...

CVE-2007-1179

WebAPP before 0.9.9.5 does not properly manage e-mail addresses in certain contexts related to 1 the Recommend feature, Email Article 2 senders and 3 recipients, 4 New User Approval, 5 Edit Profiles, 6 the Newsletter Subscription form, 7 the Recommend form, and 8 sending of articles, which has...

CVE-2006-7093

The CVE-2006-7093 entry describes a cross-site scripting (XSS) vulnerability in Mambo LaiThai, affecting versions 4.5.4 Security Patch 2 and earlier. The issue is an XSS flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The connected PT-2007-1371 en...

CVE-2007-1115

The child frames in Opera 9 before 9.20 inherit the default charset from the parent window when a charset is not specified in an HTTP Content-Type header or META tag, which allows remote attackers to conduct cross-site scripting XSS attacks, as demonstrated using the UTF-7 character set...

CVE-2007-1004

Mozilla Firefox might allow remote attackers to conduct spoofing and phishing attacks by writing to an about:blank tab and overlaying the location bar...

CVE-2006-7022

The Tools module in fx-APP 0.0.8.1 allows remote attackers to misrepresent the contents of a web page via an arbitrary URL in the url parameter to a showhtml action for index.php, which causes the URL to be displayed within an iframe...

CVE-2006-6984

The CVE-2006-6984 entry concerns GreenBrowser 3.4.0622 and describes a cross-domain information disclosure vulnerability. An attacker can cause the browser to reveal restricted content from a target domain by using an object tag with a data parameter referencing a link on the attacker’s site that...

[SECURITY] [DSA 1258-1] New Mozilla Firefox packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1258-1 [email protected] http://www.debian.org/security/ Martin Schulze February 7th, 2007 http://www.debian.org/security/faq -...

Cross site scripting

Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier allows remote attackers to overwrite arbitrary program variables and conduct other unauthorized activities, such as conduct a remote file inclusion attacks via the srcdir parameter in custom/importxml.php or b...

CVE-2007-0630

CVE-2007-0630 describes multiple SQL injection vulnerabilities in the generate_csv function of X-dev xNews 1.3 and earlier. The affected component is generate_csv in classes/class.news.php, with vulnerable parameters (id, from, q). The issue enables remote attackers to execute arbitrary SQL comma...

Remote file inclusion

PHP remote file inclusion vulnerability in includes/functions.visohotlink.php in VisoHotlink 1.01 and possibly earlier allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...