Design/Logic Flaw

Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2, and K-Meleon 0.9.13 allows user-assisted remote attackers to open local files via a web page with an IMG element containing a SRC attribute with a non-image file:// URL, then tricking the user into...

CVE-2006-1942

Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2, and K-Meleon 0.9.13 allows user-assisted remote attackers to open local files via a web page with an IMG element containing a SRC attribute with a non-image file:// URL, then tricking the user into...

CVE-2006-1942

Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2, and K-Meleon 0.9.13 allows user-assisted remote attackers to open local files via a web page with an IMG element containing a SRC attribute with a non-image file:// URL, then tricking the user into...

Directory traversal

Directory traversal vulnerability in the loadConfig function in index.php in phpWebSite 0.10.2 and earlier allows remote attackers to include arbitrary local files and execute arbitrary PHP code via the hubdir parameter, as demonstrated by including accesslog. NOTE: in some cases, arbitrary remot...

CVE-2006-1819

The CVE-2006-1819 issue affects phpWebSite prior to 0.10.2, where the hub_dir parameter in index.php is not properly validated, enabling local file inclusion via include() and possible PHP code execution. The root cause is inadequate verification of hub_dir, which can allow an attacker to referen...

Directory traversal

Directory traversal vulnerability in acc.php in QuickBlogger 1.4 allows remote attackers to read or include arbitrary local files via the request parameter. NOTE: this issue can also produce resultant XSS when the associated include statement fails...

CVE-2006-1791

Directory traversal vulnerability in acc.php in QuickBlogger 1.4 allows remote attackers to read or include arbitrary local files via the request parameter. NOTE: this issue can also produce resultant XSS when the associated include statement fails...

CVE-2006-1791

Directory traversal vulnerability in acc.php in QuickBlogger 1.4 allows remote attackers to read or include arbitrary local files via the request parameter. NOTE: this issue can also produce resultant XSS when the associated include statement fails...

CVE-2006-1777

Directory traversal vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the s parameter, as demonstrated by injecting PHP sequences into an Apache errorlog file, which...

Directory traversal

Directory traversal vulnerability in PHPList 2.10.2 and earlier allows remote attackers to include arbitrary local files via the 1 GLOBALSdatabasemodule or 2 GLOBALSlanguagemodule parameters, which overwrite the underlying $GLOBALS variable...

CVE-2006-1746

The CVE-2006-1746 issue affects phpList <= 2.10.2, where the index.php’s database_module (and language_module) handling allows Local File Inclusion by overwriting $GLOBALS via user-supplied GLOBALS[database_module]/GLOBALS[language_module]. The root cause is inadequate input sanitization and, ...

Code injection

index.php in Shopweezle 2.0 allows remote attackers to include arbitrary local files via the url parameter...

Code injection

Unspecified vulnerability in ecotwo Shopsystem 1.0-192 and earlier allows remote attackers to include arbitrary local files via 1 the lang parameter in news.php and 2 other unspecified vectors...

CVE-2006-1684

Unspecified vulnerability in ecotwo Shopsystem 1.0-192 and earlier allows remote attackers to include arbitrary local files via 1 the lang parameter in news.php and 2 other unspecified vectors...

CVE-2006-1684

CVE-2006-1684 affects ecotwo Shopsystem 1.0-192 and earlier. The vulnerability allows remote attackers to include arbitrary local files via the lang parameter in news.php and other unspecified vectors, enabling local file inclusion. The NVD entry lists a (Network) attack vector with low complexit...

Solaris Sun Cluster SunPlex Manager privilege escalation

User with solaris.cluster.gui authorization can access any local files...

Directory traversal

Directory traversal vulnerability in 1 initiate.php and 2 possibly other PHP scripts in Turnkey Web Tools PHP Live Helper 1.8, and possibly later versions, allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the language cookie, as...

CVE-2006-1478

CVE-2006-1478 affects Turnkey Web Tools PHP Live Helper 1.8 (and possibly later versions). The vulnerability is a directory traversal in (1) initiate.php and possibly other PHP scripts, allowing remote authenticated users to include and execute arbitrary local files. The attack relies on crafted ...

CVE-2006-1346

Directory traversal vulnerability in inc/setLang.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a langfile parameter, as demonstrated by injecting PHP sequences into an Apache accesslog file...

Directory traversal

Directory traversal vulnerability in inc/setLang.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a langfile parameter, as demonstrated by injecting PHP sequences into an Apache accesslog file...