CVE-2006-6028: Undefined Security Weakness

Directory traversal vulnerability in textview.php in Anton Vlasov DoSePa 1.0.4 allows remote attackers to read arbitrary files via a .. dot dot sequence or absolute file path in the file parameter...

PT-2006-6675 · Dosepa · Dosepa

Name of the Vulnerable Software and Affected Versions: DoSePa version 1.0.4 Description: A directory traversal issue exists, allowing remote attackers to read arbitrary files. This is achieved by using a .. dot dot sequence or absolute file path in the file parameter. Recommendations: For version...

CVE-2006-5031: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter, followed by a filename ending with "%00" and a .js filename...

CVE-2006-4651: Undefined Security Weakness

Directory traversal vulnerability in download/index.php, and possibly download.php, in threesquared.net aka Ben Speakman Php download allows remote attackers to overwrite arbitrary local files via .. dot dot sequence in the file parameter...

CVE-2006-4268: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 file, 2 x, and 3 y parameters in a admin/filemanager/preview.php; and the 4 email parameter in b admin/login.php...

CVE-2006-4258: Undefined Security Weakness

Absolute path traversal vulnerability in the get functionality in Anti-Spam SMTP Proxy ASSP allows remote authenticated users to read arbitrary files via 1 C:\ Windows drive letter, 2 UNC, and possibly other types of paths in the file parameter...

CVE-2006-4081

previewemail.cgi in Barracuda Spam Firewall BSF 3.3.01.001 through 3.3.03.053 allows remote attackers to execute commands via shell metacharacters "|" pipe symbol in the file parameter. NOTE: the attack can be extended to arbitrary commands by the presence of CVE-2006-4000...

CVE-2006-4081: Undefined Security Weakness

previewemail.cgi in Barracuda Spam Firewall BSF 3.3.01.001 through 3.3.03.053 allows remote attackers to execute commands via shell metacharacters "|" pipe symbol in the file parameter. NOTE: the attack can be extended to arbitrary commands by the presence of CVE-2006-4000...

CVE-2006-4000: Undefined Security Weakness

Directory traversal vulnerability in cgi-bin/previewemail.cgi in Barracuda Spam Firewall BSF 3.3.01.001 through 3.3.03.053 allows remote authenticated users to read arbitrary files via a .. dot dot in the file parameter...

CVE-2006-3737

Cross-site scripting XSS vulnerability in filemanager/filemanager.php in the control panel in SWsoft Plesk 8.0 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the file parameter...

CVE-2006-3737: Undefined Security Weakness

Cross-site scripting XSS vulnerability in filemanager/filemanager.php in the control panel in SWsoft Plesk 8.0 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the file parameter...

CVE-2006-3337: Undefined Security Weakness

Cross-site scripting XSS vulnerability in frontend/x/files/select.html in cPanel 10.8.2-CURRENT 118 and earlier allows remote attackers to inject arbitrary web script or HTML via the file parameter...

CVE-2006-3006: Undefined Security Weakness

Cross-site scripting XSS vulnerability in iFoto 0.20, and possibly other versions before 0.50, allows remote attackers to inject arbitrary HTML or web script via a base64-encoded file parameter...

CVE-2006-2437

The CVE-2006-2437 entry concerns Caucho Resin’s viewfile servlet in the Resin documentation package (resin-doc) for versions 3.0.17 and 3.0.18. The available sources in the connected documents describe an arbitrary file disclosure: an unauthenticated remote attacker can obtain the contents of fil...

Directory traversal

Directory traversal vulnerability in help/index.php in X7 Chat 2.0 and earlier allows remote attackers to include arbitrary files via .. dot dot sequences in the helpfile parameter...

CVE-2006-1909: Undefined Security Weakness

Directory traversal vulnerability in index.php in Coppermine 1.4.4 allows remote attackers to read arbitrary files via a .//./ modified dot dot slash in the file parameter, which causes a regular expression to collapse the sequences into standard "../" sequences...

Coppermine Photo Gallery index.php file Parameter Local File Inclusion

The version of Coppermine Gallery installed on the remote host fails to properly sanitize input to the 'file' parameter of the 'index.php' script before using it in a PHP 'includeonce' function. Regardless of PHP's 'registerglobals' setting, an unauthenticated attacker may be able to exploit this...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in bol.cgi in BlankOL 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 file or 2 function parameter...

CVE-2006-1404: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in bol.cgi in BlankOL 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 file or 2 function parameter...

CVE-2006-1348: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers to inject arbitrary web script or HTML via the langfile parameter, which is injected into an error message. NOTE: this issue might be resultant from CVE-2006-1346...