CVE-2005-1439: Undefined Security Weakness

Directory traversal vulnerability in attachments.php in osTicket allows remote attackers to read arbitrary files via .. sequences in the file parameter...

CVE-2005-1233: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in PHP Labs proFile allows remote attackers to inject arbitrary web script or HTML via the 1 dir or 2 file parameters...

PT-2005-1857 · Ciamos +2 · Ciamos +2

Name of the Vulnerable Software and Affected Versions: RUNCMS version 1.1A CIAMOS version 0.9.2 RC1 e-Xoops version 1.05 Rev3 Description: The issue allows remote attackers to read arbitrary PHP files by specifying the pathname in the file parameter. This can be used to read sensitive information...

CVE-2004-1607

slxweb.dll in SalesLogix 6.1 allows remote attackers to obtain sensitive information via a 1 Library or 2 Attachment request with an invalid file parameter, which reveals the path in an error message...

CVE-2004-2508

Cross-site scripting XSS vulnerability in main.cgi in Linksys WVC11B Wireless-B Internet Video Camera allows remote attackers to inject arbitrary web script or HTML via the nextfile parameter...

CVE-2004-2347

blog.cgi in Leif M. Wright Web Blog 1.1 and 1.1.5 allows remote attackers to execute arbitrary commands via shell metacharacters such as '|' in the file parameter of ViewFile requests...

CVE-2004-1202

Cross-site scripting XSS vulnerability in parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to inject arbitrary web script or HTML via the file parameter...

CVE-2004-1202: Undefined Security Weakness

Cross-site scripting XSS vulnerability in parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to inject arbitrary web script or HTML via the file parameter...

CVE-2004-1607

slxweb.dll in SalesLogix 6.1 allows remote attackers to obtain sensitive information via a 1 Library or 2 Attachment request with an invalid file parameter, which reveals the path in an error message...

CVE-2003-0051: Undefined Security Weakness

parsexml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to obtain the physical path of the server's installation path via a NULL file parameter...

CVE-2004-0725: Undefined Security Weakness

Cross-site scripting XSS vulnerability in help.php in Moodle 1.3.2 and 1.4 dev allows remote attackers to inject arbitrary web script or HTML via the file parameter...

CVE-2003-0278

Cross-site scripting XSS vulnerability in normalhtml.cgi in Happycgi.com Happymall 4.3 and 4.4 allows remote attackers to insert arbitrary web script via the file parameter...

CVE-2003-0278

Cross-site scripting XSS vulnerability in normalhtml.cgi in Happycgi.com Happymall 4.3 and 4.4 allows remote attackers to insert arbitrary web script via the file parameter...

CVE-2003-0278: Undefined Security Weakness

Cross-site scripting XSS vulnerability in normalhtml.cgi in Happycgi.com Happymall 4.3 and 4.4 allows remote attackers to insert arbitrary web script via the file parameter...

CVE-2003-0243

Happycgi.com Happymall 4.3 and 4.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter for the 1 normalhtml.cgi or 2 memberhtml.cgi scripts...

CVE-2002-1423

tmpview.php in FUDforum before 2.2.0 allows remote attackers to read arbitrary files via an absolute pathname in the file parameter...

EUVD-2002-0871

showtemp.cfm for Gafware CFXImage 1.6.6 allows remote attackers to read arbitrary files via 1 a .. or 2 a C: style pathname in the FILE parameter...

CVE-2002-0879: Undefined Security Weakness

showtemp.cfm for Gafware CFXImage 1.6.6 allows remote attackers to read arbitrary files via 1 a .. or 2 a C: style pathname in the FILE parameter...

CVE-2002-0975: Undefined Security Weakness

Buffer overflow in Microsoft DirectX Files Viewer ActiveX control xweb.ocx 2.0.6.15 and earlier allows remote attackers to execute arbitrary via a long File parameter...

CVE-2002-0206

index.php in Francisco Burzi PHP-Nuke 5.3.1 and earlier, and possibly other versions before 5.5, allows remote attackers to execute arbitrary PHP code by specifying a URL to the malicious code in the file parameter...