CVE-2006-7182

PHP remote file inclusion vulnerability in noticias.php in MNews 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter...

CVE-2007-1613

CVE-2007-1613 affects MPM Chat 2.5, exposing a directory traversal vulnerability in view.php. The flaw allows remote attackers to include and execute arbitrary local files by inserting .. into the logi parameter. Affected component is the view.php handler within MPM Chat 2.5; root cause is inadeq...

Design/Logic Flaw

The FTP protocol implementation in Opera 9.10 allows remote attackers to allows remote servers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response...

CVE-2007-1493

CVE-2007-1493 describes an SQL injection in nukesentinel.php for NukeSentinel 2.5.06 and earlier, caused by a permissive IP validation regex that allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header. This CVE is linked to an incomplete patch for CVE-2007-1172. C...

CVE-2007-1432

The CVE-2007-1432 entry concerns Grayscale Blog 0.8.0 (and possibly earlier) where remote attackers can gain privileges by sending crafted requests with modified arguments to PHP scripts (add_users.php, addblog.php, editblog.php, editlinks.php, edit_users.php, add_links.php). The underlying issue...

PYSEC-2007-3

Trac before 0.10.3.1 does not send a Content-Disposition HTTP header specifying an attachment in certain "unsafe" situations, which has unknown impact and remote attack vectors...

CVE-2007-1408

Multiple vulnerabilities in 1 bank.php, 2 landfill.php, 3 outposts.php, 4 tribes.php, 5 house.php, 6 tribearmor.php, 7 tribeastral.php, 8 tribeware.php, and 9 includes/head.php in Bartek Jasicki Vallheru before 1.3 beta have unknown impact and remote attack vectors, probably related to large...

CVE-2007-1395

Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.2 allows remote attackers to conduct cross-site scripting XSS attacks by injecting arbitrary JavaScript or HTML in a 1 db or 2 table parameter value followed by an uppercase end tag, which bypasses the protection...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in sitex allow remote attackers to inject arbitrary web script or HTML via 1 the sxYear parameter to calendar.php, 2 the search parameter to search.php, 3 the linkid parameter to redirect.php, or 4 the page parameter to calendarevents.php...

CVE-2007-1244

Cross-site request forgery CSRF vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php. NOTE: this issue can be leveraged to perform cross-site scripting X...

CVE-2007-1231

Multiple cross-site scripting XSS vulnerabilities in SQLiteManager 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 database name, 2 table name, 3 ViewName, 4 view, 5 trigger, and 6 function fields in main.php and certain other files...

Design/Logic Flaw

WebAPP before 0.9.9.5 does not properly manage e-mail addresses in certain contexts related to 1 the Recommend feature, Email Article 2 senders and 3 recipients, 4 New User Approval, 5 Edit Profiles, 6 the Newsletter Subscription form, 7 the Recommend form, and 8 sending of articles, which has...

CVE-2007-1179

WebAPP before 0.9.9.5 does not properly manage e-mail addresses in certain contexts related to 1 the Recommend feature, Email Article 2 senders and 3 recipients, 4 New User Approval, 5 Edit Profiles, 6 the Newsletter Subscription form, 7 the Recommend form, and 8 sending of articles, which has...

CVE-2006-7093

The CVE-2006-7093 entry describes a cross-site scripting (XSS) vulnerability in Mambo LaiThai, affecting versions 4.5.4 Security Patch 2 and earlier. The issue is an XSS flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The connected PT-2007-1371 en...

CVE-2007-1115

The child frames in Opera 9 before 9.20 inherit the default charset from the parent window when a charset is not specified in an HTTP Content-Type header or META tag, which allows remote attackers to conduct cross-site scripting XSS attacks, as demonstrated using the UTF-7 character set...

CVE-2007-1004

Mozilla Firefox might allow remote attackers to conduct spoofing and phishing attacks by writing to an about:blank tab and overlaying the location bar...

CVE-2006-7022

The Tools module in fx-APP 0.0.8.1 allows remote attackers to misrepresent the contents of a web page via an arbitrary URL in the url parameter to a showhtml action for index.php, which causes the URL to be displayed within an iframe...

CVE-2006-6984

The CVE-2006-6984 entry concerns GreenBrowser 3.4.0622 and describes a cross-domain information disclosure vulnerability. An attacker can cause the browser to reveal restricted content from a target domain by using an object tag with a data parameter referencing a link on the attacker’s site that...

[SECURITY] [DSA 1258-1] New Mozilla Firefox packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1258-1 [email protected] http://www.debian.org/security/ Martin Schulze February 7th, 2007 http://www.debian.org/security/faq -...

Cross site scripting

Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier allows remote attackers to overwrite arbitrary program variables and conduct other unauthorized activities, such as conduct a remote file inclusion attacks via the srcdir parameter in custom/importxml.php or b...