CVE-2008-0601: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in All Club CMS ACCMS 0.0.1f and earlier allows remote attackers to execute arbitrary SQL commands via the name parameter...

Path traversal

Absolute path traversal vulnerability in explorerdir.php in Frimousse 0.0.2 allows remote attackers to read arbitrary files and list arbitrary directories via a full pathname in the name parameter...

CVE-2008-0093

Multiple cross-site scripting XSS vulnerabilities in newticket.php in eTicket 1.5.5.2, and 1.5.6 RC2 and RC3, allow remote attackers to inject arbitrary web script or HTML via the 1 Name and 2 Subject parameters...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in newticket.php in eTicket 1.5.5.2, and 1.5.6 RC2 and RC3, allow remote attackers to inject arbitrary web script or HTML via the 1 Name and 2 Subject parameters...

CVE-2008-0093: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in newticket.php in eTicket 1.5.5.2, and 1.5.6 RC2 and RC3, allow remote attackers to inject arbitrary web script or HTML via the 1 Name and 2 Subject parameters...

t1lib font filename string overflow

Buffer overflow in the intT1EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in phpgd2.dll in the gd PHPGD2...

t1lib font filename string overflow

Buffer overflow in the intT1EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in phpgd2.dll in the gd PHPGD2...

CVE-2003-1463: Improper Input Validation

Absolute path traversal vulnerability in Alt-N Technologies WebAdmin 2.0.0 through 2.0.2 allows remote attackers with administrator privileges to 1 determine the installation path by reading the contents of the Name parameter in a link, and 2 read arbitrary files via an absolute path in the Name...

CVE-2007-5478

Cross-site scripting XSS vulnerability in projects in Nabh Stringbeans Portal sbportal 3.2 allows remote attackers to inject arbitrary web script or HTML via the projectname parameter...

CVE-2007-4043: Improper Authentication

file.cgi in Secure Computing SecurityReporter aka Network Security Analyzer before 4.6.3 allows remote attackers to bypass authentication via a name parameter ending with a "%00.gif" sequence. NOTE: a separate traversal vulnerability could be leveraged to download arbitrary files...

Authentication flaw

file.cgi in Secure Computing SecurityReporter aka Network Security Analyzer 4.6.3 allows remote attackers to bypass authentication via a name parameter that specifies the eventcache directory and a non-GIF file, which causes the $dontvalidate variable to be set to true. NOTE: a separate traversal...

CVE-2007-3986: Undefined Security Weakness

file.cgi in Secure Computing SecurityReporter aka Network Security Analyzer 4.6.3 allows remote attackers to bypass authentication via a name parameter that specifies the eventcache directory and a non-GIF file, which causes the $dontvalidate variable to be set to true. NOTE: a separate traversal...

CVE-2007-3985: Undefined Security Weakness

Directory traversal vulnerability in file.cgi in Secure Computing SecurityReporter aka Network Security Analyzer 4.6.3 allows remote attackers to download arbitrary files via a .. dot dot in the name parameter...

Directory traversal

Directory traversal vulnerability in ShowImage.php in SiteDepth CMS 3.44 allows remote attackers to read arbitrary files via a .. dot dot in the name parameter...

CVE-2007-3404: Undefined Security Weakness

Directory traversal vulnerability in ShowImage.php in SiteDepth CMS 3.44 allows remote attackers to read arbitrary files via a .. dot dot in the name parameter...

CVE-2007-3332: Undefined Security Weakness

Directory traversal vulnerability in Satellite.php in Satel Lite for PhpNuke allows remote attackers to read arbitrary files via a .. dot dot sequence in the name parameter in a modload action...

Cross site scripting

Cross-site scripting XSS vulnerability in register.php in cpCommerce 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter Full Name field...

CVE-2007-2968: Undefined Security Weakness

Cross-site scripting XSS vulnerability in register.php in cpCommerce 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter Full Name field...

Directory traversal

Multiple directory traversal vulnerabilities in Scallywag 2005-04-25 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the skinname parameter to template.php in 1 skin/dark/, 2 skin/gold/, or 3 skin/original/, a different vector than CVE-2007-2900. NOTE: the...

CVE-2007-2551: Undefined Security Weakness

Cross-site scripting XSS vulnerability in usersettings.php in WikkaWiki Wikka Wiki before 1.1.6.3 allows remote attackers to inject arbitrary web script or HTML via the name parameter...