Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in artpublic/recommandation/index.php in Artiphp CMS 5.5.0 Neo r422 allow remote attackers to inject arbitrary web script or HTML via the 1 addimgnamepost, 2 asciiartpost, 3 expediteur, 4 titresav, or 5 z39d27af885b32758ac0e7d4014a61561 parameter...

Centreon "command_name"参数远程命令执行漏洞

BUGTRAQ ID: 50568 CVE ID: CVE-2011-4431 Centreon是一款开源的软件，主要用于与nagios搭配，通过页面管理nagios，通过第三方组件实现对网络，操作系统，应用程序的监控。 Centreon的"commandname"参数在实现上存在输入验证漏洞，攻击者可利用此漏洞在命令执行任意命令。所有可以访问"Configuration Nagios Checks"的帐户都可以执行命令。 Centreon 2.3.1 厂商补丁： Centreon -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Firefox Hit by Drive-by Download Flaws

Mozilla has shipped a mega patch for Firefox to fix a total of 16 security flaws that expose Web surfers to drive-by download, data theft and local bar spoofing attacks. The latest Firefox 3.6.7 update includes fixes for nine “critical” issues that could be exploited to launch remote code executi...

Remote file inclusion

PHP remote file inclusion vulnerability in include/template.php in Uiga Proxy, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the content parameter...

CVE-2010-1466

Directory traversal vulnerability in scr/soustab.php in openUrgence Vaccin 1.03 allows remote attackers to read arbitrary files via the dsnphptype parameter...

Directory traversal

Directory traversal vulnerability in the SSL Service in EMC HomeBase Server 6.2.x before 6.2.3 and 6.3.x before 6.3.2 allows remote attackers to overwrite arbitrary files with any content, and consequently execute arbitrary code, via a .. dot dot in an unspecified parameter...

CVE-2009-4464

Cross-site scripting XSS vulnerability in searchadvance.asp in Active Business Directory 2 allows remote attackers to inject arbitrary web script or HTML via the search parameter...

CVE-2009-1380

Cross-site scripting XSS vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter, related to the key...

Directory traversal

Directory traversal vulnerability in debugger/debugphp.php in Ve-EDIT 0.1.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the GETfilename parameter...

CVE-2009-2587

Multiple cross-site scripting XSS vulnerabilities in DragDropCart allow remote attackers to inject arbitrary web script or HTML via the 1 sid parameter to assets/js/ddcart.php, the 2 prefix parameter to includes/ajax/getstate.php, the search parameter to 3 index.php and 4 search.php, the 5 redire...

Directory traversal

Directory traversal vulnerability in archive.php in TorrentVolve 1.4, when registerglobals is enabled, allows remote attackers to delete arbitrary files via a .. dot dot in the deleteTorrent parameter...

CVE-2008-6584

html/index.php in TorrentFlux 2.3 allows remote authenticated users to execute arbitrary code via a URL with a file containing an executable extension in the urlupload parameter, which is downloaded by TorrentFlux and can be accessed via a direct request in a html/downloads/ user directory...

XOOPS mydirname参数多个PHP代码注入漏洞

BUGTRAQ ID: 33176 Xoops是非常流行的动态web内容管理系统，用面向对象的PHP编写。...

Unfixed Frame Redirect vulnerability at www.merkleinc.com

Security researcher skathgh420, has submitted on 01/05/2009 a Frame Redirect vulnerability affecting www.merkleinc.com, which at the time of submission ranked 421128 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 09/07/2010. It is currently...

Hidden type parameters of the variables are not filtered resulting in the upload exploit a-vulnerability warning-the black bar safety net

Inadvertently saw a graphic design website, website full by the static asp configuration, done very beautiful. Sigh it's beautifully designed at the same time, could not help heart muttered, full of static asp pages can indeed prevent injection vulnerabilities, but WEB vulnerabilities is more tha...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in CreaCMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the 1 cfgdocumenturi parameter to administration/editionarticle/editionarticle.php and the 2 cfgbaseuriadmin parameter to administration/fonctions/getlistelangue.php...

Directory traversal

Multiple directory traversal vulnerabilities in data/inc/themes/predefinedvariables.php in pluck 4.5.1 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 langpref, 2 file, 3 blogpost, or 4 cat parameter...

CVE-2008-2767

SQL injection vulnerability in search.asp in Xigla Poll Manager XE allows remote authenticated users with administrator role privileges to execute arbitrary SQL commands via the orderby parameter...

CVE-2008-2534

Directory traversal vulnerability in admin/adminframe.php in Phoenix View CMS Pre Alpha2 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the ltarget parameter...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in W-Agora 4.0 allow remote attackers to execute arbitrary PHP code via a URL in the bndirdefault parameter to 1 adduser.php, 2 createforum.php, 3 createuser.php, 4 deletenotes.php, 5 deleteuser.php, 6 editforum.php, 7 mailusers.php, 8...