Coppermine Photo Gallery showdoc.php f Parameter Local File Inclusion

The installed version of Coppermine Photo Gallery fails to sanitize user input to the 'f' parameter in the 'docs/showdoc.php' script before using it in a PHP 'include' function. An unauthenticated attacker may be able to exploit this flaw to view arbitrary files or to execute arbitrary PHP code,...

NOCC <= 1.0 Multiple Vulnerabilities

The remote host is running NOCC, an open source webmail application written in PHP. The installed version of NOCC is affected by a local file include flaw because it fails to sanitize user input to the 'lang' parameter of the 'index.php' script before using it to include other PHP files. Regardle...

Plume CMS < 1.0.3 Remote File Inclusion

The system is running Plume CMS a simple but powerful content management system. The version installed does not sanitize user input in the 'PXconfigmanagerpath' parameter in the 'prepend.php' file. This allows an attacker to include arbitrary files and execute code on the system. This flaw is...

NeoMail neomail.pl sort Parameter XSS

The remote host is running NeoMail, an open source webmail application written in Perl. The installed version of this software fails to validate the 'sort' parameter in the 'neomail.pl' script before using it to generate dynamic content. An attacker may be able to exploit this issue to inject...

Flyspray install-0.9.7.php adodbpath Parameter Remote File Inclusion

The remote host is running Flyspray, an open source, web-based, bug tracking system written in PHP. The installed version of Flyspray contains an installation script that does not require authentication and that fails to sanitize user input to the 'adodbpath' parameter before using it in a PHP...

RunCMS Multiple Script bbPath Parameter Remote File Inclusion

The installed version of RunCMS fails to validate user input to the 'bbPath' parameter of two scripts. An unauthenticated attacker may be able to leverage this issue to view arbitrary files on the remote host or to execute arbitrary PHP code, possibly taken from third-party hosts. Note that...

PHP iCalendar Multiple Script Remote File Inclusion

The remote host appears to be running PHP iCalendar, a web-based iCal file viewer / parser written in PHP. The installed version of PHP iCalendar fails to validate user input to the 'getdate' parameter of the 'search.php' script as well as the 'file' parameter of 'template.php' script. Provided...

Loudblog backend_settings.php Multiple Parameter Remote File Inclusion

The remote host is running Loudblog, a PHP application for publishing podcasts and similar media files. The installed version of Loudblog fails to validate user input to the 'GLOBALSpath' and 'language' parameters before using them in the 'loudblog/inc/backendsettings.php' script in a PHP 'includ...

Website Baker Admin Login SQL Injection

The remote host is running Website Baker, a PHP-based content management system. The installed version of Website Baker fails to validate user input to the username parameter of the 'admin/login/index.php' script before using it to generate database queries. An unauthenticated attacker can levera...

Invision Power Board Dragoran Portal Module index.php site Parameter SQL Injection

The installation of Invision Power Board on the remote host contains an optional plugin module known as Dragoran Portal that fails to sanitize input to the 'site' parameter of the 'index.php' script before using it in database queries. An attacker may be able to leverage this issue to disclose...

RCBlog index.php post Parameter Traversal Arbitrary File Access

The remote host is running RCBlog, a blog written in PHP. The remote version of this software fails to sanitize user-supplied input to the 'post' parameter of the 'index.php' script. An attacker can use this to access arbitrary files on the remote host provided PHP's 'magicquotes' setting is...

Lyris ListManager Subscription Form Administrative Command Injection

The remote host appears to be running ListManager, a web-based commercial mailing list management application from Lyris. According to its banner, the version of ListManager installed on the remote host does not sufficiently sanitize input to the 'pw' parameter when processing new subscription...

Ubuntu 4.10 / 5.04 / 5.10 : php4, php5 vulnerabilities (USN-232-1)

Eric Romang discovered a local Denial of Service vulnerability in the handling of the 'session.savepath' parameter in PHP's Apache 2.0 module. By setting this parameter to an invalid value in an .htaccess file, a local user could crash the Apache server. CVE-2005-3319 A Denial of Service flaw was...

ELOG < 2.6.1 Multiple Remote Vulnerabilities (Traversal, FS)

The remote host appears to be using ELOG, a web-based electronic logbook application. The version of ELOG installed on the remote host fails to filter directory traversal strings before processing GET requests. An attacker can exploit this issue to retrieve the contents of arbitrary files from th...

Ubuntu 4.10 / 5.04 : linux-source-2.6.8.1, linux-source-2.6.10 vulnerabilities (USN-131-1)

Colin Percival discovered an information disclosure in the 'Hyper Threading Technology' architecture in processors which are capable of simultaneous multithreading in particular Intel Pentium 4, Intel Mobile Pentium 4, and Intel Xeon processors. This allows a malicious thread to monitor the...

Ubuntu 4.10 : postgresql vulnerabilities (USN-79-1)

The execution of custom PostgreSQL functions can be restricted with the EXECUTE privilege. However, previous versions did not check this privilege when executing a function which was part of an aggregate. As a result, any database user could circumvent the EXECUTE restriction of functions with a...

Ubuntu 4.10 : php4 vulnerabilities (USN-66-1)

FraMe from kernelpanik.org reported that the cURL module does not respect openbasedir restrictions. As a result, scripts which used cURL to open files with an user-specified path could read arbitrary local files outside of the openbasedir directory. Stefano Di Paola discovered a vulnerability in...

PHP Upload Center index.php filename Parameter Directory Traversal Arbitrary File Access

The remote host is running PHP Upload Center, a file manager written in PHP. The version of PHP Upload Center installed on the remote host fails to remove directory traversal sequences user input to the 'filename' parameter of the 'index.php' script. An attacker can leverage this flaw to read...

ADOdb server.php sql Parameter SQL Injection

The remote host is running ADOdb, a database abstraction library for PHP. The installed version of ADOdb includes a test script named 'server.php' that fails to sanitize user input to the 'sql' parameter before using it in database queries. An attacker can exploit this issue to launch SQL injecti...

Web Wiz check_user.asp txtUserName Parameter SQL Injection

The remote host is running an ASP application from Web Wiz, such as Password Login, Journal, Polls, or Site News. The installed version of the Web Wiz application fails to validate user input to the 'txtUserName' parameter of the 'admin/checkuser.asp' script before using it in database queries. A...