197 matches found
PT-2012-2119
Name of the Vulnerable Software and Affected Versions Open Business Management OBM versions 2.4.0-rc13 and earlier Description The issue allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the module parameter in an "export page" action. This is a...
CVE-2012-3805
Multiple cross-site scripting XSS vulnerabilities in the getAllPassedParams function in system/functions.php in Kajona before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 absendername, 2 absenderemail, or 3 absendernachricht parameter to the content page; 4...
CVE-2012-1207
Directory traversal vulnerability in frontend/core/engine/javascript.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to read arbitrary files via a .. dot dot in the module parameter to frontend/js.php...
CVE-2012-1207: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in frontend/core/engine/javascript.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to read arbitrary files via a .. dot dot in the module parameter to frontend/js.php...
PT-2012-3130
Name of the Vulnerable Software and Affected Versions Fork CMS versions 3.2.4 and earlier Description A directory traversal issue allows remote attackers to read arbitrary files via a .. dot dot in the module parameter to "frontend/js.php". This could potentially expose sensitive information...
CVE-2011-4543
Multiple directory traversal vulnerabilities in osCommerce 3.0.2 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 set or 2 module parameter to a OM/Core/Site/Admin/Application/templatesmodules/pages/info.php, b...
Sql injection
SQL injection vulnerability in comments.php in SiteEngine 7.1 allows remote attackers to execute arbitrary SQL commands via the module parameter...
CVE-2010-4357
SQL injection vulnerability in comments.php in SiteEngine 7.1 allows remote attackers to execute arbitrary SQL commands via the module parameter...
PT-2010-5434
Name of the Vulnerable Software and Affected Versions SiteEngine version 7.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the module parameter in comments.php. Recommendations For SiteEngine version 7.1, avoid using the module parameter in...
CVE-2010-4357: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in comments.php in SiteEngine 7.1 allows remote attackers to execute arbitrary SQL commands via the module parameter...
Miniweb 2.0 - Full Path Disclosure
Miniweb 2.0 Full Path Disclosure Name Miniweb 2.0 Vendor http://www.miniweb2.com Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2009-12-12 X. INDEX I. ABOUT THE APPLICATION II. DESCRIPTION III. ANALYSIS IV. SAMPLE CODE V...
CVE-2009-3216: Improper Limitation of a Pathname to a Restricted Directory
Multiple directory traversal vulnerabilities in iWiccle 1.01, when magicquotesgpc is disabled, allow remote attackers to read arbitrary files via a .. dot dot in 1 the show parameter to the admin module, reachable through index.php; or 2 the module parameter to index.php...
CVE-2009-2081: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in help.php in phpWebThings 1.5.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the module parameter...
CVE-2009-1488: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in admin/load.php in FunGamez RC1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the module parameter to index.php...
Directory traversal
Directory traversal vulnerability in admin.php in Malleo 1.2.3 allows remote authenticated administrators to include and execute arbitrary local files via a .. dot dot in the module parameter...
CVE-2008-6551
Multiple directory traversal vulnerabilities in e-Vision CMS 2.0.2 and earlier, when magicquotesgpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in 1 an adminlang cookie to admin/index.php; or the module parameter to 2...
CVE-2008-6551
Multiple directory traversal vulnerabilities in e-Vision CMS 2.0.2 and earlier, when magicquotesgpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in 1 an adminlang cookie to admin/index.php; or the module parameter to 2...
CVE-2008-5943
Multiple directory traversal vulnerabilities in NavBoard 16 2.6.0 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the module parameter to 1 adminmodules.php and 2 modules.php...