CVE-2007-0335

CVE-2007-0335 affects Jax Petition Book 1.0.3.06. Affected component: languagepack handling in jax_petitionbook.php and smileys.php. Root cause: directory traversal via a .. in the languagepack parameter enables inclusion of arbitrary local files. Impact: remote attackers can include and execute ...

KLA10293 Multiple vulnerabilities in PentaWare

Multiple serious vulnerabilities have been found in PentaWare. Malicious users can exploit these vulnerabilities to cause denial of service or extract files to an arbitrary directory. Below is a complete list of vulnerabilities 1. Unknown vectors can be exploited remotely via a specially designed...

Apple Quicktime HREFTrack Cross-Zone Scripting vulnerability

Overview Web browsers running the Apple QuickTime plugin may allow remote web sites to reference content on the local filesystem. This may allow an attacker to execute script within the security context of the local machine. Description Web browser plugins that allow remote web sites to reference...

Directory traversal

Directory traversal vulnerability in index.php in L2J Statistik Script 0.09 and earlier, when registerglobals is enabled and magicquotes is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the page parameter, as demonstrated by injecting PHP...

Directory traversal

Directory traversal vulnerability in language.php in VerliAdmin 0.3 and earlier, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log fil...

CVE-2006-6731

Multiple buffer overflows in Sun Java Development Kit JDK and Java Runtime Environment JRE 5.0 Update 7 and earlier, Java System Development Kit SDK and JRE 1.4.212 and earlier 1.4.x versions, and SDK and JRE 1.3.118 and earlier allow attackers to develop Java applets that read, write, or execute...

Links: Arbitrary Samba command execution

Background Links is a web browser running in both graphics and text modes. Description Teemu Salmela discovered that Links does not properly validate "smb://" URLs when it runs smbclient commands. Impact A remote attacker could entice a user to browse to a specially crafted "smb://" URL and execu...

CVE-2006-6465

WikyBlog v1.3.2 and earlier exposes a directory traversal risk in WBmap.php via the l parameter. The vulnerability is described as allowing remote inclusion/execution of local files, with the note that the l parameter is validated by ctype_alpha before use, which CVE disputes. Affected software i...

CVE-2006-6419

jce.php in the JCE Admin Component in Ryan Demmer Joomla Content Editor JCE 1.1.0 beta 2 and earlier for Joomla! comjce allows remote attackers to include and possibly execute arbitrary local files via the 1 plugin or 2 file parameter. NOTE: The provenance of this information is unknown; the...

CVE-2006-6390

Multiple directory traversal vulnerabilities in Open Solution Quick.Cart 2.0, when registerglobals is enabled and magicquotesgpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the configdbtype parameter to 1 categories.php, 2 couriers.php, 3...

CVE-2006-6390

Multiple directory traversal vulnerabilities in Open Solution Quick.Cart 2.0, when registerglobals is enabled and magicquotesgpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the configdbtype parameter to 1 categories.php, 2 couriers.php, 3...

CVE-2006-6242

Multiple directory traversal vulnerabilities in Serendipity 1.0.3 and earlier allow remote attackers to read or include arbitrary local files via a .. dot dot sequence in the serendipitycharset parameter in 1 include/lang.inc.php; or to plugins/ scripts 2...

CVE-2006-6242

CVE-2006-6242 affects Serendipity 1.0.3 and earlier. The issue is multiple directory traversal/local file inclusion (LFI) flaws triggered by an unsanitized serendipity[charset] parameter, allowing an attacker to read or include arbitrary local files. The basic entry points include include/lang.in...

FreeBSD : kronolith -- arbitrary local file inclusion vulnerability (a8af7d70-8007-11db-b280-0008743bf21a)

iDefense Labs reports : Remote exploitation of a design error in Horde's Kronolith could allow an authenticated web mail user to execute arbitrary PHP code under the security context of the running web server. The vulnerability specifically exists due to a design error in the way it includes...

CVE-2006-5733

Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the PNSVlang PNSV lang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then includ...

CVE-2006-5716

CVE-2006-5716 affects FreeNews 2.1. A directory traversal flaw in aff_news.php allows remote attackers to include local files via a ".." sequence in the chemin parameter when aff_news is not set to "1". The vulnerability targets the file handling logic in FreeNews 2.1 and can expose local files t...

CVE-2006-5604

CVE-2006-5604 is a directory traversal vulnerability in phpcards.header.php of phpCards 1.3. It allows remote attackers to include and execute arbitrary local files by supplying a .. (dot dot) in the CardLanguageFile parameter. According to the NVD entry, the impact is partial confidentiality, in...

CVE-2006-5528

Directory traversal vulnerability in mod.php in SchoolAlumni Portal 2.26 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the mod parameter. NOTE: some of these details are obtained from third party information...

CVE-2006-5554

Directory traversal vulnerability in index.php in Imageview 5 allows remote attackers to read or execute arbitrary local files via a .. dot dot in the usersettings cookie, as demonstrated by using the MyFile parameter in albumview.php to upload a text/plain .gif file containing PHP code, which is...

CVE-2006-5554

Directory traversal vulnerability in index.php in Imageview 5 allows remote attackers to read or execute arbitrary local files via a .. dot dot in the usersettings cookie, as demonstrated by using the MyFile parameter in albumview.php to upload a text/plain .gif file containing PHP code, which is...