CVE-2006-1339: Undefined Security Weakness

Directory traversal vulnerability in inc/functions.inc.php in CuteNews 1.4.1 and possibly other versions, when registerglobals is enabled, allows remote attackers to include arbitrary files via a .. dot dot sequence and trailing NULL %00 byte in the archive parameter in an HTTP POST or COOKIE...

[SA19289] CuteNews "archive" Disclosure of Sensitive Information Vulnerability

TITLE: CuteNews "archive" Disclosure of Sensitive Information Vulnerability SECUNIA ADVISORY ID: SA19289 VERIFY ADVISORY: http://secunia.com/advisories/19289/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: CuteNews 1.x...

CVE-2006-0660: Undefined Security Weakness

Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to 1 read arbitrary files or trigger an error message path disclosure via ".." or invalid names in the archive parameter to index.php, or 2 include arbitrary files via the template parameter to...

phpWordPress 3.0 SQL inj.

phpWordPress Article Manager 3.0 SQL inj. Vuln. dicovered by : r0t Date: 25 nov. 2005 Orginal advisory:http://pridels.blogspot.com/2005/11/phpwordpress-30-sql-inj.html Vendor:http://www.word-press.net/ affected version: 3.0 and prior. Vuln. Description: Input passed to the "poll" "category" and...

CVE-2005-3592: Undefined Security Weakness

index.php CuteNews 1.4.0 and earlier allows remote attackers to obtain the path of the installation path of the application by triggering an error message, such as by entering multiple ../ dot dot slash in the archive parameter...