Immunity Canvas: JOOMLAFLASHFUN_INCLUDE

Name| joomlaflashfuninclude ---|--- CVE| CVE-2007-4955 Exploit Pack| CANVAS Description| Joomla Flashfun Component Remote File Inclusion Notes| CVE Name: CVE-2007-4955 VENDOR: Joomla Repeatability: Infinite References: http://secunia.com/advisories/26799/ CVE Url:...

CVE-2007-4950

PHP remote file inclusion vulnerability in form/dbform/employee.php in PHPortal 0.2.7 allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENTROOT parameter. NOTE: this issue is disputed by CVE, since DOCUMENTROOT cannot be modified by an attacker...

CVE-2007-4955

The CVE-2007-4955 entry describes a PHP remote file inclusion vulnerability in the Joomla! Flash Fun! extension (com_joomlaflashfun) version 1.0. The issue allows an attacker to remotely execute arbitrary PHP code by supplying a URL in the mosConfig_live_site parameter within admin.joomlaflashfun...

CVE-2007-4949

Multiple PHP remote file inclusion vulnerabilities in phpReactor 1.2.7pl1 allow remote attackers to execute arbitrary PHP code via a URL in the pathtohomedir parameter to 1 ekilat.com-int.tpl.php, 2 phpreactor.org-top.tpl.php, or 3 ekilat.com-top.tpl.php in examples/. NOTE: this issue has been...

CVE-2007-4954

CVE-2007-4954 describes a PHP remote file inclusion in the Joomla! 1.0 extension joom12Pic (com_joom12pic), specifically via the mosConfig_live_site parameter in admin.joom12pic.php. The vulnerability allows an attacker to supply a crafted URL and potentially execute arbitrary PHP code on the ser...

CVE-2007-4952

Affected software: OmniStar Article Manager. Vulnerability (CVE-2007-4952): SQL injection in article.php via the page_id parameter in a favorite op action, a different vector than CVE-2006-5917; remote attackers may execute arbitrary SQL commands. Related entry CVE-2006-5917 describes multiple SQ...

CVE-2007-4947

The CVE-2007-4947 entry documents multiple PHP remote file inclusion vulnerabilities in myphpPagetool 0.4.3. The vulnerability arises from inadequate validation of user-supplied input in the ptinclude parameter of /doc/admin/index.php (and related help*.php files), allowing an attacker to supply ...

CVE-2007-0326

The CVE-2007-0326 entry concerns the PhotoChannel Networks Photo Upload Plugin ActiveX control. Affected software: Photo Upload Plugin ActiveX before version 2.0.0.10. Root cause: multiple stack-based buffer overflows in the ActiveX control could allow a remote, unauthenticated attacker to execut...

CVE-2007-4957

CVE-2007-4957 concerns a vulnerability in Chupix CMS 0.2.3 where download.php is susceptible to multiple directory traversal flaws. An attacker can cause the application to read or overwrite arbitrary files by supplying a leading “..” in the parameters (1) fichier or (2) repertoire, or to create ...

CVE-2007-4951

CVE-2007-4951 is a PHP remote file inclusion in YaPiG 0.95b (sample.php) allowing arbitrary PHP code execution via a URL in the YAPIG_PATH parameter. The issue is reported as disputed by CVE since YAPIG_PATH is defined before use. No exploitation details are provided in the documents. A remediati...

CVE-2007-4949

The CVE-2007-4949 entry describes multiple PHP remote file inclusion issues in phpReactor 1.2.7pl1 where remote code execution could occur via a URL in the pathtohomedir parameter to certain files (ekilat.com-int.tpl.php, phpreactor.org-top.tpl.php, ekilat.com-top.tpl.php) located in the examples...

CVE-2007-4956

CVE-2007-4956 affects KwsPHP 1.0 with multiple SQL injection weaknesses: login.php (pseudo parameter), index.php (carnet editer in Member_Space), and index.php (typenav in stats). Root cause is SQL injection in those parameters; CVSS says network attack, no auth, impact partial confidentiality/in...

CVE-2007-0997

Race condition in the tee systee system call in the Linux kernel 2.6.17 through 2.6.17.6 might allow local users to cause a denial of service system crash, obtain sensitive information kernel memory contents, or gain privileges via unspecified vectors related to a potentially dropped ipipe lock...

CVE-2007-4942

PHP remote file inclusion vulnerability in modules/Discipline/StudentFieldBreakdown.php in Focus/SIS 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the FocusPath parameter, a different vector than CVE-2007-4806. NOTE: the provenance of this information is unknown...

CVE-2007-4137

Off-by-one error in the QUtf8Decoder::toUnicode function in Trolltech Qt 3 allows context-dependent attackers to cause a denial of service crash via a crafted Unicode string that triggers a heap-based buffer overflow. NOTE: Qt 4 has the same error in the QUtf8Codec::convertToUnicode function, but...

CVE-2007-4938

Heap-based buffer overflow in libmpdemux/aviheader.c in MPlayer 1.0rc1 and earlier allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a .avi file with certain large "indx truck size" and nEntriesInuse values, and a certain wLongsPerEntry...

CVE-2007-4938

Heap-based buffer overflow in libmpdemux/aviheader.c in MPlayer 1.0rc1 and earlier allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a .avi file with certain large "indx truck size" and nEntriesInuse values, and a certain wLongsPerEntry...

CVE-2007-0004

The NFS client implementation in the kernel in Red Hat Enterprise Linux RHEL 3, when a filesystem is mounted with the noacl option, checks permissions for the open system call via vfspermission mode bits data rather than an NFS ACCESS call to the server, which allows local client processes to...

Remote file inclusion

PHP remote file inclusion vulnerability in modules/Discipline/StudentFieldBreakdown.php in Focus/SIS 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the FocusPath parameter, a different vector than CVE-2007-4806. NOTE: the provenance of this information is unknown...

CVE-2007-1865

The ipv6getsockoptsticky function in the kernel in Red Hat Enterprise Linux RHEL Beta 5.1.0 allows local users to obtain sensitive information kernel memory contents via a negative value of the len parameter. NOTE: this issue has been disputed in a bug comment, stating that "len is ignored when...