CVE-2008-2913

Directory traversal vulnerability in func.php in Devalcms 1.4a, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the currentpath parameter, in conjunction with certain ... triple dot and ..... sequences in the currentfile...

CVE-2008-2876

CVE-2008-2876 affects the web app mUnky version 0.0.1 . The vulnerability is a directory traversal in index.php that allows an attacker to cause local file inclusion via a .. in the zone parameter, enabling arbitrary local file access/execution according to the entry. The CVSS metrics in the init...

CVE-2008-2687

Directory traversal vulnerability in inc/config.php in ProManager 0.73 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter...

ajarticle-sql.txt

--==+================================================================================+==-- --==+ AJ Article 1.0 featuredarticle.php Remote SQL Injection Vulnerability +==-- --==+================================================================================+==-- Discovered By: t0pP8uZz Discovere...

CVE-2008-1838

The connected data shows a related CVE (CVE-2008-6526) describing a SQL injection in BosDev BosClassifieds: index.php via the cat_id parameter, a vector different from CVE-2008-1838’s cat parameter. This confirms that BosClassifieds 3.0 stores user-supplied input in a way exploitable through SQL,...

CVE-2008-1555

Directory traversal vulnerability in system/b/contentFiles/gbincluder.php in BolinOS 4.6.1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the bFileToInclude parameter...

CVE-2008-1354

SQL injection vulnerability in MyIssuesView.asp in Advanced Data Solutions Virtual Support Office-XP VSO-XP allows remote attackers to execute arbitrary SQL commands via the IssueID parameter...

CVE-2008-1325

Multiple directory traversal vulnerabilities in index.php in Uberghey CMS 0.3.1 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 pageid and 2 language parameters. NOTE: this might be the same issue as CVE-2008-1324...

CVE-2008-1231

JSPWiki Edit.jsp editor parameter traversal (CVE-2008-1231) is documented in a Nessus plugin entry (JSPWiki Editor LFI). The issue affects JSPWiki versions 2.4.104 and 2.5.139, where input to the editor parameter is not sanitized, allowing a remote attacker to perform a local file inclusion by us...

GLSA-200803-04 : Mantis: XSS

The remote host is affected by the vulnerability described in GLSA-200803-04 Mantis: XSS seiji reported that the filename for the uploaded file in bugreport.php is not properly sanitised before being stored. Impact : A remote attacker could upload a file with a specially crafted to a bug report,...

CVE-2008-0818

Multiple directory traversal vulnerabilities in freePHPgallery 0.6 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the lang cookie to 1 comment.php, 2 index.php, and 3 show.php...

CVE-2008-0745

CVE-2008-0745 concerns a directory traversal vulnerability in aides/index.php of DomPHP 0.82, where an attacker can influence the page parameter with a ../ sequence to include and execute local files. Public records in NVD/NVD-derived entries describe a remote exploit path via this parameter, yie...

CVE-2008-0458

CVE-2008-0458 describes a directory traversal vulnerability in SLAED CMS 2.5 Lite. The flaw exists in index.php’s newlang parameter, where a .. path component in the parameter can cause local file inclusion and arbitrary code execution. Affected component: function/sources.php (LITE version). Thi...

CVE-2007-6686

The URL rewrite module in Menalto Gallery before 2.2.4 allows attackers to include and execute arbitrary local files via unknown vectors related to the admin controller...

Sql injection

SQL injection vulnerability in loginform.asp in Instant Softwares Dating Site allows remote attackers to execute arbitrary SQL commands via the Password parameter, a different product than CVE-2006-6021. NOTE: some of these details are obtained from third party information...

CVE-2007-6344

Directory traversal vulnerability in modules/cms/index.php in Mcms Easy Web Make 1.3, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the template parameter...

CVE-2007-6184

Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter...

CVE-2007-5821

Multiple directory traversal vulnerabilities in DM Guestbook 0.4.1 and earlier allow remote attackers to include and execute arbitrary local files via a .. dot dot in 1 the lng parameter to a guestbook.php, b admin/admin.guestbook.php, or c auto/globnew.php; or 2 the lngdefault parameter to...

RealNetworks RealPlayer文件解析函数多个漏洞

RealPlayer是一款流行的媒体播放程序。 RealPlayer解析特殊构建的文件存在多个内存破坏问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 -当解析特殊构建的.mov文件，存在如下有问题代码： --//- snip ----//----------------------------------------------------- 62448F24 8B4D E2 MOV ECX,DWORD PTR SS:EBP-1E ; 1 62448F27 8B45 DE MOV EAX,DWORD PTR SS:EBP-22 62448F2A 2BC1 SUB EAX,E...

CVE-2002-2334

Joe text editor 2.8 through 2.9.7 does not remove the group and user setuid bits for backup files, which could allow local users to execute arbitrary setuid and setgid root programs when root edits scripts owned by other users...