CVE-2008-3922

awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function...

CVE-2008-3922

The awstatstotals.php script in AWStats Totals versions 1.0 through 1.14 is vulnerable to Remote Command Execution (RCE) . The root cause is the insufficient sanitization of the sort parameter, which is used by the multisort function to dynamically create an anonymous PHP function. A remote attac...

CVE-2008-2938

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than...

Directory traversal

Directory traversal vulnerability in index.php in 1 WSN Forum 4.1.43 and earlier, 2 Gallery 4.1.30 and earlier, 3 Knowledge Base WSNKB 4.1.36 and earlier, 4 Links 4.1.44 and earlier, and possibly 5 Classifieds before 4.1.30 allows remote attackers to include and execute arbitrary local files via ...

CVE-2008-3555

Directory traversal vulnerability in index.php in 1 WSN Forum 4.1.43 and earlier, 2 Gallery 4.1.30 and earlier, 3 Knowledge Base WSNKB 4.1.36 and earlier, 4 Links 4.1.44 and earlier, and possibly 5 Classifieds before 4.1.30 allows remote attackers to include and execute arbitrary local files via ...

CVE-2008-3555

Directory traversal vulnerability in index.php in 1 WSN Forum 4.1.43 and earlier, 2 Gallery 4.1.30 and earlier, 3 Knowledge Base WSNKB 4.1.36 and earlier, 4 Links 4.1.44 and earlier, and possibly 5 Classifieds before 4.1.30 allows remote attackers to include and execute arbitrary local files via ...

Directory traversal

Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bit parameter, as demonstrated by an upload to avatar/ of a .jpg file containing PHP...

CVE-2008-3415

Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bit parameter, as demonstrated by an upload to avatar/ of a .jpg file containing PHP...

CVE-2008-3415

CVE-2008-3415 affects CMScout 2.05 (and related listings reference CMScout 2.06). The vulnerability is a directory traversal in common.php when .htaccess is not supported, allowing remote attackers to include and execute arbitrary local files through crafted directory traversal sequences in the b...

Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : php5 vulnerabilities (USN-628-1)

It was discovered that PHP did not properly check the length of the string parameter to the fnmatch function. An attacker could cause a denial of service in the PHP interpreter if a script passed untrusted input to the fnmatch function. CVE-2007-4782 Maksymilian Arciemowicz discovered a flaw in t...

php htmlentities/htmlspecialchars multibyte sequences

The 1 htmlentities and 2 htmlspecialchars functions in PHP before 5.2.5 accept partial multibyte sequences, which has unknown impact and attack vectors, a different issue than CVE-2006-5465...

php htmlentities/htmlspecialchars multibyte sequences

The 1 htmlentities and 2 htmlspecialchars functions in PHP before 5.2.5 accept partial multibyte sequences, which has unknown impact and attack vectors, a different issue than CVE-2006-5465...

php htmlentities/htmlspecialchars multibyte sequences

The 1 htmlentities and 2 htmlspecialchars functions in PHP before 5.2.5 accept partial multibyte sequences, which has unknown impact and attack vectors, a different issue than CVE-2006-5465...

php htmlentities/htmlspecialchars multibyte sequences

The 1 htmlentities and 2 htmlspecialchars functions in PHP before 5.2.5 accept partial multibyte sequences, which has unknown impact and attack vectors, a different issue than CVE-2006-5465...

Directory traversal

Directory traversal vulnerability in phpi/rss.php in Ourvideo CMS 9.5, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the prefix parameter...

php htmlentities/htmlspecialchars multibyte sequences

The 1 htmlentities and 2 htmlspecialchars functions in PHP before 5.2.5 accept partial multibyte sequences, which has unknown impact and attack vectors, a different issue than CVE-2006-5465...

DEBIAN-CVE-2008-2942

Directory traversal vulnerability in patch.py in Mercurial 1.0.1 allows user-assisted attackers to modify arbitrary files via ".." dot dot sequences in a patch file...

mod_jk sends decoded URL to tomcat

modjk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. dot dot sequences and...

DEBIAN-CVE-2008-1036

The International Components for Unicode ICU library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting XS...

CVE-2008-2281

Cross-zone scripting vulnerability in the Print Table of Links feature in Internet Explorer 6.0, 7.0, and 8.0b allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via an HTML document with a link containing JavaScript sequences, which are evaluat...