CVE-2007-4815

Multiple PHP remote file inclusion vulnerabilities in WebED in Markus Iser ED Engine 0.8999 alpha allow remote attackers to execute arbitrary PHP code via a URL in the Codebase parameter to 1 channeledit.php, 2 post.php, 3 view.php, or 4 viewitem.php in source/mod/rss/...

CVE-2007-4815

CVE-2007-4815 affects the WebED ED Engine 0.8999 alpha. The vulnerability is a set of multiple remote PHP file inclusion flaws that allow an attacker to execute arbitrary PHP code by supplying a crafted URL via the Codebase parameter to one of the following scripts: channeledit.php, post.php, vie...

Cross Site Scripting vulnerability in faq

It has been discovered that the extension faq is susceptible to cross site scripting XSS attacks, making it possible to execute arbitrary JavaScript. Component Type: Third party extension. This extension is not part of the TYPO3 default installation Affected Versions: Version 0.0.7 and all versio...

Debian DSA-1007-1 : drupal - several vulnerabilities

The Drupal Security Team discovered several vulnerabilities in Drupal, a fully-featured content management and discussion engine. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2006-1225 Due to missing input sanitising a remote attacker could inject...

Mandrake Linux Security Advisory : sash (MDKSA-2006:070)

Tavis Ormandy of the Gentoo Security Project discovered a vulnerability in zlib where a certain data stream would cause zlib to corrupt a data structure, resulting in the linked application to dump core CVE-2005-2096. Markus Oberhumber discovered additional ways that a specially crafted compresse...

[DRUPAL-SA-2006-003] Drupal 4.6.6 / 4.5.8 fixes session fixation issue

---------------------------------------------------------------------------- Drupal security advisory DRUPAL-SA-2006-003 ---------------------------------------------------------------------------- Advisory ID: DRUPAL-SA-2006-003 Project: Drupal core Date: 2006-03-13 Security risk: less critical...

DRUPAL-SA-2006-003 Session fixation vulnerability

If someone creates a clever enough URL and convinces you to click on it, and you later log in but you do not log off then the attacker may be able to impersonate you. Versions affected All Drupal versions before 4.6.6. Solution The fix to this issue requires PHP 4.3.2 or higher, which is higher...

Phorum 3.3.2a remote command execution

Target: Phorum 3.3.2a prior versions? Description: In Phorum 3.3.2a a bulletin board there's a security flaw that lets remote users include external php scripts and execute arbitary code. Found by: Markus [email protected] Vendor: http://www.phorum.org Notified Vendor: Yes, already fixed...

Markus Triska CGIForum 1.0 - thesection Directory Traversal

Markus Triska CGIForum 1.0 - thesection Directory Traversal source : https://www.securityfocus.com/bid/1963/info CGIForum is a commercial cgi script from Markus Triska which is designed to facilitate web-based threaded discussion forums. The script improperly validates user-supplied input to the...

Markus Triska CGIForum 1.0 - 'thesection' Directory Traversal

source : https://www.securityfocus.com/bid/1963/info CGIForum is a commercial cgi script from Markus Triska which is designed to facilitate web-based threaded discussion forums. The script improperly validates user-supplied input to the "thesection" parameter. If an attacker supplies a...