Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in ZPanel 2.0 allow remote attackers to execute arbitrary PHP code via a URL in 1 the body parameter to templates/ZPanelV2/template.php or 2 the page parameter to zpanel.php. NOTE: the zpanel.php vector may overlap CVE-2005-0793.2. NOTE: the...

Pagesetter for PostNuke index.php id Parameter Traversal Arbitrary File Access

The third-party Pagesetter module for PostNuke installed on the remote host fails to sanitize input to the 'id' parameter before using it to display a file in the function 'pagesetterfilepreview' of the script 'pnfile.php'. An unauthenticated attacker can exploit this issue to view arbitrary file...

CVE-2006-7045

CVE-2006-7045 affects Clan Manager Pro (CMPRO) versions 1.1.0 and earlier. The vulnerability is a PHP remote file inclusion flaw that lets an attacker supply a URL via the (1) rootpath and possibly (2) sitepath parameters to (a) cmpro.ext/comment.core.inc.php and (b) cmpro.intern/comment.core.inc...

Cisco Firewall Services Module HTTPS Traffic Temporary Denial of Service Vulnerability

Cisco Firewall Services Module versions versions prior to 3.13.11 contain a vulnerability that could allow an unauthenticated, remote attacker to create a denial of service DoS condition. The vulnerability is due to an error when the embedded HTTPS server handles certain types of requests. An...

Design/Logic Flaw

Unspecified vulnerability in the "Show debugging information" feature in MoinMoin 1.5.7 allows remote attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-0901

Removed by vendor...

Buffer overflow

Buffer overflow in SmidgeonSoft PEBrowse Professional 8.2.1.0 allows user-assisted remote attackers to execute arbitrary code via certain executable files in PE format. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-0879

CVE-2007-0879 describes a buffer overflow in SmidgeonSoft PEBrowse Professional 8.2.1.0 that allows a user‑assisted remote attacker to execute arbitrary code via certain PE-format executable files . The underlying cause is a buffer overflow in processing PE files, leading to potential compromise ...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in local Calendar System 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the 1 TEMPLATEDIR parameter to a showinvoices.php, b showmonth.php, c showevents.php, d retrieveinvoice.php, e modifyitem.php, and f lookupuserid.php; ...

Information displayed in the security field should be approached with caution. – Opera Security Advisories

Information displayed in the security field should be approached with caution. – Opera Security Advisories OPCOM Team | February 9, 2007 Summary Even though a Certificate Authority has verified and signed it, a usershould not trust the Organization name without checking the domain name.A fraudule...

CVE-2007-0854

Remote file inclusion vulnerability in scripts2/objcache in cPanel WebHost Manager WHM allows remote attackers to execute arbitrary code via a URL in the obj parameter. NOTE: a third party claims that this issue is not file inclusion because the contents are not parsed, but the attack can be used...

Remote file inclusion

Remote file inclusion vulnerability in scripts2/objcache in cPanel WebHost Manager WHM allows remote attackers to execute arbitrary code via a URL in the obj parameter. NOTE: a third party claims that this issue is not file inclusion because the contents are not parsed, but the attack can be used...

CVE-2007-0852

Cross-site scripting XSS vulnerability in DevTrack 6.x allows remote attackers to inject arbitrary web script or HTML via the "Keyword search" form field and unspecified other form fields that populate a public saved query. NOTE: the provenance of this information is unknown; the details are...

Directory traversal

Multiple directory traversal vulnerabilities in Cedric CLAIRE PortailPhp 2 allow remote attackers to read arbitrary files via a .. dot dot in the chemin parameter to 1 modnews/index.php or 2 modnews/goodies.php. NOTE: The provenance of this information is unknown; the details are obtained solely...

CVE-2007-0821

Multiple directory traversal vulnerabilities in Cedric CLAIRE PortailPhp 2 allow remote attackers to read arbitrary files via a .. dot dot in the chemin parameter to 1 modnews/index.php or 2 modnews/goodies.php. NOTE: The provenance of this information is unknown; the details are obtained solely...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Contact Details functionality in Yahoo! Messenger 8.1.0.209 and earlier allow user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG element to the 1 First Name, 2 Last Nam...

Stack overflow

Stack-based buffer overflow in GOM Player 2.0.12.3375 allows user-assisted remote attackers to execute arbitrary code via a .ASX file with a long URI in the "ref href" tag. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

Drupal Multiple Module $_SESSION Manipulation CAPTCHA Bypass

The version of Drupal installed on the remote host includes at least one third-party module that adds a captcha to various forms e.g. user registration that is affected by a security bypass vulnerability. A remote attacker, using a specially crafted 'editcaptcharesponse' parameter, can bypass...

Multiple Orcale security vulnerabilities.... again...

Released security update fixes 17 security vulnerabilities for Oracle Database, 9 vulnerabilities in Oracle HTTP Server, 12 security vulnerabilities for Oracle Application Server, 7 vulnerabilities for Oracle E-Business Suite, 6 security bugs in Oracle Enterprise Manager, 3 bugs in Oracle...

Sql injection

Multiple SQL injection vulnerabilities in the generatecsv function in classes/class.news.php in X-dev xNews 1.3 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id, 2 from, and 3 q parameters, different vectors than CVE-2007-0569. NOTE: The provenance of this...