Unpatched input validation flaw in Firefox 2.0.0.4

Firefox 2.0.0.4 contains a fix for a directory traversal vulnerability that allowed you to read local files through the resource protocol. However, the patch only partially fixed the vulnerability on Windows systems and accidentally circumvents an existing input validation check. The net result i...

Directory traversal

Multiple directory traversal vulnerabilities in Scallywag 2005-04-25 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the skinname parameter to template.php in 1 skin/dark/, 2 skin/gold/, or 3 skin/original/, a different vector than CVE-2007-2900. NOTE: the...

CVE-2007-2960

Multiple directory traversal vulnerabilities in Scallywag 2005-04-25 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the skinname parameter to template.php in 1 skin/dark/, 2 skin/gold/, or 3 skin/original/, a different vector than CVE-2007-2900. NOTE: the...

Directory traversal

Directory traversal vulnerability in blogs/index.php in b2evolution 1.6 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the coresubdir parameter...

CVE-2007-2681

Directory traversal vulnerability in blogs/index.php in b2evolution 1.6 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the coresubdir parameter...

CVE-2007-2681

Directory traversal vulnerability in blogs/index.php in b2evolution 1.6 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the coresubdir parameter...

CVE-2007-2633

Directory traversal vulnerability in H-Sphere SiteStudio 1.6 allows remote attackers to read, or include and execute, arbitrary local files via a .. dot dot in the template parameter...

Directory traversal

Directory traversal vulnerability in H-Sphere SiteStudio 1.6 allows remote attackers to read, or include and execute, arbitrary local files via a .. dot dot in the template parameter...

Directory traversal

Directory traversal vulnerability in Advanced Guestbook 2.4.2 allows remote attackers to bypass .htaccess settings, and execute arbitrary PHP local files or read arbitrary local templates, via a .. dot dot in a lang cookie, followed by a filename without its .php extension, as demonstrated via a...

CVE-2007-2503

PHP Turbulence 0.0.1 alpha is affected by a directory-traversal in turbulence.php via GLOBALS[tcore], allowing potential local file inclusion/execution. The issue stems from using a dot-dot path, with a note that a direct request to user/turbulence.php may trigger a fatal error before inclusion. ...

Directory traversal

Directory traversal vulnerability in wordtube-button.php in the wordTube 1.43 and earlier plugin for WordPress, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the wpPATH parameter...

CVE-2007-2483

Directory traversal vulnerability in js/wptable-button.php in the wp-Table 1.43 and earlier plugin for WordPress, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via the wpPATH parameter...

WordPress wordTube Plugin <= 1.43 - Directory Traversal

Because of this vulnerability, the attackers can include and execute arbitrary local files in the "wpPATH" parameter. Solution Update the plugin...

Directory traversal

Multiple directory traversal vulnerabilities in Quick and Dirty Blog QDBlog 0.4, and possibly earlier, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the theme parameter to categories.php and other unspecified files...

Directory traversal

Directory traversal vulnerability in includes/footer.php in News Manager Deluxe NMDeluxe 1.0.1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the template parameter...

Cross site scripting

footer.php in PunBB 1.2.14 and earlier allows remote attackers to include local files in include/user/ via a cross-site scripting XSS attack, or via the puninclude tag, as demonstrated by use of adminoptions.php to execute PHP code from an uploaded avatar file...

CVE-2007-2236

footer.php in PunBB 1.2.14 and earlier allows remote attackers to include local files in include/user/ via a cross-site scripting XSS attack, or via the puninclude tag, as demonstrated by use of adminoptions.php to execute PHP code from an uploaded avatar file...

Directory traversal

Directory traversal vulnerability in admin/index.php in Monkey CMS 0.0.3 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the adminskin parameter...

Directory traversal

Multiple directory traversal vulnerabilities in iXon CMS 0.30 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the themeurl parameter to 1 index.php, 2 page.php, 3 search.php, 4 single.php, and 5 archives.php...

Directory traversal

Directory traversal vulnerability in index.php in Kai Content Management System K-CMS 1.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the currenttheme parameter...