phpBB vulnerable to file disclosure

Overview The phpBB input validation methods may fail to sanitize user input resulting in a disclosure of arbitrary file data. Description phpBB is a customizable open source bulletin board package. It contains functionality that allows users to specify graphic files for use as "avatars." These...

iDEFENSE Security Advisory 02.22.05: phpBB Group phpBB Arbitrary File Disclosure Vulnerability

phpBB Group phpBB Arbitrary File Disclosure Vulnerability iDEFENSE Security Advisory 02.22.05 www.idefense.com/application/poi/display?id=204&type=vulnerabilities February 22, 2005 I. BACKGROUND phpBB is an open source bulletin board package written in the PHP web scripting language. More...

phpBB <= 2.0.11 Multiple Vulnerabilities

The remote host is running phpBB version 2.0.11 or older. Such versions suffer from multiple vulnerabilities: - full path display on critical messages. - full path disclosure in username handling caused by a PHP 4.3.10 bug. - arbitrary file disclosure vulnerability in avatar handling functions. -...

glFTPd 1.x/2.0 'ZIP' Plugins - Multiple Directory Traversal Vulnerabilities

source: https://www.securityfocus.com/bid/12586/info It is reported that various ZIP related plugins supplied with the server contain multiple directory traversal vulnerabilities. These issues may allow remote attackers to determine the existence of files on a computer and also disclose arbitrary...

glFTPd 1.x2.0 ZIP Plugins - Multiple Directory Traversal Vulnerabilities

glFTPd 1.x2.0 ZIP Plugins - Multiple Directory Traversal Vulnerabilities source: https://www.securityfocus.com/bid/12586/info It is reported that various ZIP related plugins supplied with the server contain multiple directory traversal vulnerabilities. These issues may allow remote attackers to...

lighttpd -- script source disclosure vulnerability

The lighttpd website reports: In lighttpd 1.3.7 and below it is possible to fetch the source files which should be handled by CGI or FastCGI applications. The vulnerability is in the handling of urlencoded trailing NUL bytes. Installations that do not use CGI or FastCGI are not affected...

RaidenHTTPD 1.1.27 - Remote File Disclosure

RaidenHTTPD 1.1.27 - Remote File Disclosure source: https://www.securityfocus.com/bid/12451/info RaidenHTTPD is reported prone to a remote file disclosure vulnerability. It is reported that the service does not correctly handle requests for restricted files that reside outside of the web document...

RaidenHTTPD 1.1.27 - Remote File Disclosure

source: https://www.securityfocus.com/bid/12451/info RaidenHTTPD is reported prone to a remote file disclosure vulnerability. It is reported that the service does not correctly handle requests for restricted files that reside outside of the web document root folder. A remote attacker may exploit...

Xoops Incontent Module Traversal Arbitrary PHP File Source Disclosure

The remote host is running Incontent, a third-party module for Xoops. The version of Incontent installed on the remote host fails to sanitize user-supplied input to the 'url' parameter of the 'modules/incontent/index.php' script before using it to read a file whose contents are returned. By passi...

[SA14064] Xoops Incontent Module Arbitrary File Content Disclosure

TITLE: Xoops Incontent Module Arbitrary File Content Disclosure SECUNIA ADVISORY ID: SA14064 VERIFY ADVISORY: http://secunia.com/advisories/14064/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: Incontent 3.x module for Xoops...

STG Security Advisory 2005-01-20.22

STG Security Advisory: SSA-20050120-22 JSBoard file disclosure vulnerability. Revision 1.0 Date Published: 2005-01-20 KST Last Update: 2005-01-20 KST Disclosed by SSR Team [email protected] Summary ======== JSBoard is one of widely used web BBS applications in Korea. Because of an input...

STG Security Advisory: [SSA-20050120-22] JSBoard file disclosure vulnerability

STG Security Advisory: SSA-20050120-22 JSBoard file disclosure vulnerability. Revision 1.0 Date Published: 2005-01-20 KST Last Update: 2005-01-20 KST Disclosed by SSR Team [email protected] Summary ======== JSBoard is one of widely used web BBS applications in Korea. Because of an input...

FKey Arbitrary Remote File Disclosure

The remote finger daemon possibly 'fkey' allows users to read arbitrary files by supplying a file name that is 10 characters or shorter. A remote attacker could exploit this to read sensitive information, which could be used to mount further attacks. C Tenable Network Security, Inc...

STG Security Advisory 2005-01-13.25

STG Security Advisory: SSA-20050113-25 ZeroBoard multiple vulnerabilities Revision 1.1 Date Published: 2004-12-31 KST Last Update: 2005-1-13 Disclosed by SSR Team [email protected] Summary ======= ZeroBoard is one of widely used web BBS applications in Korea. However, an input validation...

ss11012005.txt

/ / / \ / / / / / \ \ \ \ / / / / / \ / / // / / / / / / / / / // // / / / // / / / / // , / // / /// // //// // ,/ // / // \ / / / // / / // / /// , / // Ref: SS11012005 SYSTEMSECURE.ORG - Advisory/Exploit PUBLIC ADVISORY Software: MPM Guestbook Pro 1.05 maybe all versions Link:...

STG Security Advisory: [SSA-20050113-25] ZeroBoard multiple vulnerabilities

STG Security Advisory: SSA-20050113-25 ZeroBoard multiple vulnerabilities Revision 1.1 Date Published: 2004-12-31 KST Last Update: 2005-1-13 Disclosed by SSR Team [email protected] Summary ======= ZeroBoard is one of widely used web BBS applications in Korea. However, an input validation...

moodle142.txt

+------------------------------------------------------------------------------+ | | | Multiple Vulnerabilities in Moodle | | ================================== | | | | Author: Bartek Nowotarski | | Published: 2004-12-27 |...

PT-2004-2917 · Oscommerce · Oscommerce

Name of the Vulnerable Software and Affected Versions: osCommerce version 2.2 Description: A directory traversal issue exists, allowing remote attackers to view arbitrary files by including a .. dot dot in the filename argument of the file manager.php script. Recommendations: For osCommerce versi...

GLSA-200412-19 : phpMyAdmin: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200412-19 phpMyAdmin: Multiple vulnerabilities Nicolas Gregoire exaprobe.com has discovered two vulnerabilities that exist only on a webserver where PHP safemode is off. These vulnerabilities could lead to command execution or fil...

phpMyAdmin: Multiple vulnerabilities

Background phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL databases from a web-browser. Description Nicolas Gregoire exaprobe.com has discovered two vulnerabilities that exist only on a webserver where PHP safemode is off. These vulnerabilities could lead to...