PT-2008-2240 · WordPress · Dmsguestbook

Name of the Vulnerable Software and Affected Versions: DMSGuestbook plugin for WordPress versions 1.7.0 through 1.8.0 Description: A directory traversal issue exists, allowing remote authenticated users to read arbitrary files. This is achieved by using a .. dot dot in the folder and file...

CVE-2007-6653

Directory traversal vulnerability in download.php in Mihalism Multi Host 2.0.7 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

CVE-2007-6662

Directory traversal vulnerability in file.php in CuteNews 2.6 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter, as demonstrated by reading the admin username and password hash in data/users.db.php...

Tikiwiki CMS tiki-listmovies.php文件目录遍历漏洞

BUGTRAQ ID: 27008 TikiWiki是一款网站内容管理系统，基于PHP+ADOdb+Smarty等技术构建。 TikiWiki的实现上存在输入验证漏洞，远程攻击者可能利用此漏洞非授权访问到服务器上任意文件的部分内容。 TikiWiki的tiki-listmovies.php脚本允许用户获得任意文件的前1000个字节。该脚本将movie参数值设置为$movie，删除最后4字节并添加.xml扩展名，然后调用fopen$confFile,'r'打开文件并读取文件的前1000个字节，接着传送这1000字节用作MovieWidth和MovieHeight...

CVE-2007-6090: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Nuked-Klan 1.7.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-5732: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in downloadfile.php in eLouai's Force Download of media files script, as available on 20071030 and earlier, allows remote attackers to read arbitrary files via the file parameter. NOTE: this issue only occurs in environments where the system administrator has not...

Directory traversal

Directory traversal vulnerability in admin/inc/help.php in ZZ:FlashChat 3.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the file parameter...

CVE-2003-1351: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in edittag.cgi in EditTag 1.1 allows remote attackers to read arbitrary files via a "%2F.." encoded slash dot dot in the file parameter...

CVE-2007-5099: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in show.php in David Watters Helplink 0.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the file parameter...

CVE-2007-4369

Directory traversal vulnerability in go/files in SOTEeSKLEP before 4.0 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

CVE-2007-3428: Undefined Security Weakness

Multiple unspecified vulnerabilities in phpTrafficA before 1.4.2 allow remote attackers to have an unknown impact via the file parameter to 1 plotStatBar.php or 2 plotStatPie.php, different vectors than CVE-2007-1076...

Design/Logic Flaw

downloadscript.asp in ASP Folder Gallery allows remote attackers to read arbitrary files via a filename in the file parameter...

CVE-2007-3158

downloadscript.asp in ASP Folder Gallery allows remote attackers to read arbitrary files via a filename in the file parameter...

CVE-2007-2486: Undefined Security Weakness

Directory traversal vulnerability in download.asp in Motobit 1.3 and 1.5 aka PStruh-CZ allows remote attackers to read arbitrary files via a .. dot dot in the File parameter...

CVE-2007-2368

picture.php in WebSPELL 4.01.02 and earlier allows remote attackers to read arbitrary files via the file parameter...

CVE-2007-2368

WebSPELL 4.01.02 (and earlier) is affected in picture.php where the file parameter can be abused to read arbitrary files. Root cause: improper handling of the file parameter allows remote attackers to access files, with no authentication and network-based access. The issue has a NVD CVSS v2 base ...

CVE-2007-2368: Undefined Security Weakness

picture.php in WebSPELL 4.01.02 and earlier allows remote attackers to read arbitrary files via the file parameter...

CVE-2007-2288: Undefined Security Weakness

PHP remote file inclusion vulnerability in info.php in Doruk100.net doruk100net allows remote attackers to execute arbitrary PHP code via a URL in the file parameter...

CVE-2007-2157

CVE-2007-2157 describes a directory traversal vulnerability in the Zomplog 3.8 application, specifically in upload/force_download.php. An attacker can use a dot-dot (..) sequence in the file parameter to read arbitrary files. The NVD entry confirms the issue and lists a high impact potential for ...

CVE-2007-1987

Multiple PHP remote file inclusion vulnerabilities in PHPEcho CMS 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the 1 pluginfile parameter to smarty/internals/core.loadpulgins.php or the 2 rootpath parameter to index.php. NOTE: CVE disputes 1 because the inclusion occurs...