[ECHO_ADV_94$2008] Kmita Mail <= 3.0 (file) Remote File Inclusion Vulnerability

ECHOADV94$2008 ----------------------------------------------------------------------------------------- ECHOADV94$2008 Kmita Mail = 3.0 file Remote File Inclusion Vulnerability ----------------------------------------------------------------------------------------- Author : M.Hasran Addahroni...

Kmita Tellfriend <= 2.0 (file) Remote File Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================== Kmita Tellfriend = 2.0 file Remote File Inclusion Vulnerability ================================================================== \ /\ \ / | \ \ | / \ // / | \ | \ \ Y...

CVE-2008-1782

phpdemo/viewsource.php in Advanced Software Engineering ChartDirector 4.1 allows remote attackers to read sensitive files via the file parameter...

CVE-2008-1782

CVE-2008-1782 affects Advanced Software Engineering ChartDirector 4.1: phpdemo/viewsource.php allows remote attackers to read sensitive files via the file parameter, leading to partial confidentiality impact. No further remediation details are provided in the connected documents.

CVE-2008-1782: Exposure of Sensitive Information to an Unauthorized Actor

phpdemo/viewsource.php in Advanced Software Engineering ChartDirector 4.1 allows remote attackers to read sensitive files via the file parameter...

Path traversal

Absolute path traversal vulnerability in dload.php in the mygallery 2.3 plugin for e107 allows remote attackers to obtain sensitive information via a full pathname in the file parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-1296

Multiple cross-site scripting XSS vulnerabilities in EncapsGallery 1.11.2 allow remote attackers to inject arbitrary web script or HTML via the file parameter to 1 watermark.php and 2 catalogwatermark.php in core/. NOTE: the provenance of this information is unknown; the details are obtained sole...

CVE-2008-1296: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in EncapsGallery 1.11.2 allow remote attackers to inject arbitrary web script or HTML via the file parameter to 1 watermark.php and 2 catalogwatermark.php in core/. NOTE: the provenance of this information is unknown; the details are obtained sole...

CVE-2003-1545: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in nukestyles.com viewpage.php addon for PHP-Nuke allows remote attackers to read arbitrary files via a full pathname in the file parameter. NOTE: This was originally reported as an issue in PHP-Nuke 6.5, but this is an independent addon...

CVE-2008-0617

Multiple cross-site scripting XSS vulnerabilities in the DMSGuestbook 1.7.0 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 file parameter to wp-admin/admin.php, or the 2 messagefield parameter in the guestbook page, and the 3 title parameter in the...

PT-2008-2240 · WordPress · Dmsguestbook

Name of the Vulnerable Software and Affected Versions: DMSGuestbook plugin for WordPress versions 1.7.0 through 1.8.0 Description: A directory traversal issue exists, allowing remote authenticated users to read arbitrary files. This is achieved by using a .. dot dot in the folder and file...

PT-2008-2242 · Dmssoftware · Dmsguestbook

Name of the Vulnerable Software and Affected Versions: DMSGuestbook version 1.7.0 Description: The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the "file" parameter to "wp-admin/admin.php", the "messagefield" parameter in the guestbook page, or th...

CVE-2007-6653

Directory traversal vulnerability in download.php in Mihalism Multi Host 2.0.7 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

CVE-2007-6662

Directory traversal vulnerability in file.php in CuteNews 2.6 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter, as demonstrated by reading the admin username and password hash in data/users.db.php...

Tikiwiki CMS tiki-listmovies.php文件目录遍历漏洞

BUGTRAQ ID: 27008 TikiWiki是一款网站内容管理系统，基于PHP+ADOdb+Smarty等技术构建。 TikiWiki的实现上存在输入验证漏洞，远程攻击者可能利用此漏洞非授权访问到服务器上任意文件的部分内容。 TikiWiki的tiki-listmovies.php脚本允许用户获得任意文件的前1000个字节。该脚本将movie参数值设置为$movie，删除最后4字节并添加.xml扩展名，然后调用fopen$confFile,'r'打开文件并读取文件的前1000个字节，接着传送这1000字节用作MovieWidth和MovieHeight...

CVE-2007-6090: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Nuked-Klan 1.7.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-5732: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in downloadfile.php in eLouai's Force Download of media files script, as available on 20071030 and earlier, allows remote attackers to read arbitrary files via the file parameter. NOTE: this issue only occurs in environments where the system administrator has not...

Directory traversal

Directory traversal vulnerability in admin/inc/help.php in ZZ:FlashChat 3.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the file parameter...

CVE-2003-1351: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in edittag.cgi in EditTag 1.1 allows remote attackers to read arbitrary files via a "%2F.." encoded slash dot dot in the file parameter...

CVE-2007-5099: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in show.php in David Watters Helplink 0.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the file parameter...