CWE-914 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-914/ Sun, 26 Feb 2023 09:06:17 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-914 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-914/ 32 32 CVE-2007-2431 https://cvevulnerability.com/cve_vulnerabilities/cve-2007-2431/ Sun, 26 Feb 2023 09:06:17 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2007-2431/ Dynamic variable evaluation vulnerability in shared/config/tce_config.php in TCExam 4.0.011 and earlier allows remote attackers to conduct cross-site scripting (XSS) and possibly other attacks by modifying critical variables such as $_SERVER, as demonstrated by injecting web script via the _SERVER[SCRIPT_NAME] parameter.

The post CVE-2007-2431 appeared first on CVE Vulnerability.

]]> Dynamic variable evaluation vulnerability in shared/config/tce_config.php in TCExam 4.0.011 and earlier allows remote attackers to conduct cross-site scripting (XSS) and possibly other attacks by modifying critical variables such as $_SERVER, as demonstrated by injecting web script via the _SERVER[SCRIPT_NAME] parameter.

The post CVE-2007-2431 appeared first on CVE Vulnerability.

]]> CVE-2007-0649 https://cvevulnerability.com/cve_vulnerabilities/cve-2007-0649/ Sun, 26 Feb 2023 09:05:34 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2007-0649/ Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier allows remote attackers to overwrite arbitrary program variables and conduct other unauthorized activities, such as conduct (a) remote file inclusion attacks via the srcdir parameter in custom/import_xml.php or (b) cross-site scripting (XSS) attacks via the rootdir parameter in interface/login/login_frame.php, via vectors associated with extract operations […]

The post CVE-2007-0649 appeared first on CVE Vulnerability.

]]> Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier allows remote attackers to overwrite arbitrary program variables and conduct other unauthorized activities, such as conduct (a) remote file inclusion attacks via the srcdir parameter in custom/import_xml.php or (b) cross-site scripting (XSS) attacks via the rootdir parameter in interface/login/login_frame.php, via vectors associated with extract operations on the (1) POST and (2) GET superglobal arrays. NOTE: this issue was originally disputed before the extract behavior was identified in post-disclosure analysis. Also, the original report identified “Open Conference Systems,” but this was an error.

The post CVE-2007-0649 appeared first on CVE Vulnerability.

]]>