CVE-2002-1819

CVE-2002-1819 describes a directory traversal vulnerability in TinyHTTPD 0.1.0 that allows remote attackers to read or execute arbitrary files via a ".." in the URL. The cited sources (NVD, CVE list, Red Hat advisory) confirm the existence of this flaw but do not provide patch details or explicit...

CVE-2005-1451

The CVE-2005-1451 entry affects Serendipity’s media manager prior to version 0.8. The vulnerability allows remote attackers to upload and execute arbitrary files of type .php or .shtml, enabling possible remote code execution on the affected server. The available documents do not provide addition...

OpenText FirstClass 8.0 Client Arbitrary File Execution

Product: OpenText FirstClass 8.0 Client Homepage: http://www.firstclass.com Platform: Microsoft Windows Description: Insufficient validation of user input allows arbitrary file execution FirstClass bookmark files allow the user to organise their web address's using the familiar FirstClass desktop...

CVE-2004-1368

ISQLPlus in Oracle 10g Application Server allows remote attackers to execute arbitrary files via an absolute pathname in the file parameter to the load.uix script...

CVE-2004-1426

Directory traversal vulnerability in index.php in KorWeblog 1.6.2-cvs and earlier allows remote attackers to read arbitrary files and execute arbitrary PHP files via .. dot dot sequences in the lng parameter...

CVE-2004-1408

The addImage method for admin.class.php in Image Gallery Web Application 0.9.10 does not properly check filenames, which allows remote attackers to upload and execute arbitrary files...

Microsoft Internet Explorer treats arbitrary files as images for drag and drop operations

Overview Microsoft Internet Explorer IE treats arbitrary files as images during drag and drop mouse operations. This could allow an attacker to trick a user into copying a file to a location where it may be executed, such as the Windows StartUp folder. Description IE treats any file referenced by...

CVE-2004-1368

ISQLPlus in Oracle 10g Application Server allows remote attackers to execute arbitrary files via an absolute pathname in the file parameter to the load.uix script...

CVE-2004-0650

UploadServlet in Cisco Collaboration Server CCS running ServletExec before 3.0E allows remote attackers to upload and execute arbitrary files via a direct call to the UploadServlet URL...

PHP-Nuke v 6.7 + Windows = File Upload

Informations : °°°°°°°°°°°°° Language : PHP Version : 6.7 Website : http://www.phpnuke.org Problem : File Upload PHP Code/Location : °°°°°°°°°°°°°°°°°°° modules/WebMail/mailattach.php :...

N/X Web Content Management System 2002 Prerelease 1 - 'menu.inc.php?c_path' Remote File Inclusion

source: https://www.securityfocus.com/bid/6500/info N/X Web Content Management System is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. An attacker may exploit this by supplying a path to a maliciously created file, located on an...

AOL Instant Messenger 4.8.2790 - Local File Execution

AOL Instant Messenger 4.8.2790 - Local File Execution source: https://www.securityfocus.com/bid/6027/info AOL Instant Messenger AIM is prone to an issue which may allow attackers to execute arbitrary files on the client system. It is possible to send a malicious link which references local files ...

PHP-Address 0.2 e - Remote File Inclusion

source: https://www.securityfocus.com/bid/5039/info PHP-Address is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. If the remote file is a PHP script, this may allow for execution of attacker-supplied PHP code with the privileges of the...

osCommerce 2.1 - Remote File Inclusion

source: https://www.securityfocus.com/bid/5037/info osCommerce is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. If the remote file is a PHP script, this may allow for execution of attacker-supplied PHP code with the privileges of the...

W-Agora 4.1.x - Remote File Inclusion

source: https://www.securityfocus.com/bid/4977/info W-Agora is prone to an issue which may allow an attacker to include arbitrary files located on a remote server. In particular, the 'incdir' variable found in a number of the W-Agora scripts defines the path to the configuration file. It is...

Clicky Web Pseudo-frames 1.0 - Remote File Inclusion

source: https://www.securityfocus.com/bid/4756/info Pseudo-frames is an application written in PHP and is maintained by Clicky Web. Pseudo-frames permit remote file including. As a result, a remote attacker may include an arbitrary file located on a remote host. If this file is a PHP script, it...

Clicky Web Pseudo-frames 1.0 - Remote File Inclusion

Clicky Web Pseudo-frames 1.0 - Remote File Inclusion source: https://www.securityfocus.com/bid/4756/info Pseudo-frames is an application written in PHP and is maintained by Clicky Web. Pseudo-frames permit remote file including. As a result, a remote attacker may include an arbitrary file located...

Oracle JSP Apache/Jserv Path Translation Arbitrary JSP File Execution

Detects Vulnerability in the execution of JSPs outside docroot. A potential security vulnerability has been discovered in Oracle JSP releases 1.0.x through 1.1.1 in Apache/Jserv. This vulnerability permits access to and execution of unintended JSP files outside the docroot in Apache/Jserv. For...

PHProjekt 3.1 - Remote File Inclusion

PHProjekt 3.1 - Remote File Inclusion source: https://www.securityfocus.com/bid/4284/info PHProjekt is a freely available, open source PHP Groupware package. It is actively maintained by the PHProjekt Development Team. It will run on most Linux and Unix variants, in addition to Microsoft Windows...

php.windows.txt

Title 17/2/2002 PHP for Windows Arbitrary Files Execution GIF, MP3 Summary Through PHP.EXE, an attacker can cause PHP to interpret any file as a PHP file, even if its extensions are not PHP. This would enable the remote attacker to execute arbitrary commands, leading to a system compromise. Detai...