PT-2011-4934

Name of the Vulnerable Software and Affected Versions Contao versions prior to 2.10.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to index.php in specific actions, such as teachers.html or teachers/. This can lead to cross-site scripting...

PT-2011-4989

Name of the Vulnerable Software and Affected Versions Phorum version 5.2.18 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved by manipulating the PATH INFO to admin/index.php. Recommendations For Phorum version...

PT-2011-4837

Name of the Vulnerable Software and Affected Versions Gnuboard versions 4.33.02 and earlier Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the PATH INFO. Recommendations For Gnuboard versions 4.33.02 and earlier, at the moment, there is no...

PT-2011-4737 · WordPress · Web Minimalist 200901 Theme

Name of the Vulnerable Software and Affected Versions: Web Minimalist 200901 theme for WordPress version 1.2 and earlier Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to "index.php". Recommendations: For Web Minimali...

PT-2011-4741 · Unknown · Black-Letterhead

Name of the Vulnerable Software and Affected Versions: Black-LetterHead theme version 1.5 and earlier Description: A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved by manipulating the PATH INFO to index.php. Recommendations: F...

PT-2011-4402

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.8 Description The issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO, affecting multiple pages, including "manage config email page.php", "manage config workflow page.php", and...

CVE-2009-5076

CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator privileges via a request with 1 login.php or 2 passwordforgotten.php appended as the PATHINFO, which bypasses a check that uses PHPSELF, which is not properl...

PT-2011-1330 · Cre Loaded · Cre Loaded

Name of the Vulnerable Software and Affected Versions: CRE Loaded versions prior to 6.3.x CRE Loaded version 6.2.14 and earlier Description: The issue allows remote attackers to bypass authentication and gain administrator privileges. This is achieved by sending a request with specific PHP files,...

VulnCheck KEV: CVE-2009-5076

CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator privileges via a request with 1 login.php or 2 passwordforgotten.php appended as the PATHINFO, which bypasses a check that uses PHPSELF, which is not properl...

CVE-2011-1723

Cross-site scripting XSS vulnerability in app/views/layouts/base.rhtml in Redmine 1.0.1 through 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to projects/hg-helloworld/news/. NOTE: some of these details are obtained from third party information...

PT-2011-3282

Name of the Vulnerable Software and Affected Versions Tracks versions 1.7.2, 2.0RC2, and 2.0devel Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to "todos/tag/". Recommendations For versions 1.7.2, 2.0RC2, and 2.0devel...

PT-2011-2828

Name of the Vulnerable Software and Affected Versions IBM Lotus Sametime version 8.0.1 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the stconf.nsf component of the server. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML...

PT-2010-4524 · Php · Nusoap

Name of the Vulnerable Software and Affected Versions: NuSOAP version 0.9.5 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to an arbitrary PHP script that uses NuSOAP classes. This could potentially lead to unauthoriz...

mod_perl PerlRun denial of service

PerlRun.pm in Apache modperl before 1.30, and RegistryCooker.pm in modperl 2.x, does not properly escape PATHINFO before use in a regular expression, which allows remote attackers to cause a denial of service resource consumption via a crafted URI...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with certain creation privileges, to inject arbitrary web script or HTML via the 1 content parameter in conjunction with a /admin/poll/add PATHINFO, the 2 meta parameter in...

CVE-2010-1994

SQL injection vulnerability in index.php in TomatoCMS before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the q parameter in conjunction with a /news/search PATHINFO...

PDFs on IE8 Can Disclose User Path Info

Using Internet Explorer and a virtual PDF generator to print a PDF file from a HTML page causes the document’s entire storage path, for example file://C:UsersdabDownloadsdocument.pdf, to be stored in the document itself. Read the full article. The H Security...

CVE-2008-6644

Cross-site scripting XSS vulnerability in Default.aspx in DotNetNuke 4.8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

mod_perl PerlRun denial of service

PerlRun.pm in Apache modperl before 1.30, and RegistryCooker.pm in modperl 2.x, does not properly escape PATHINFO before use in a regular expression, which allows remote attackers to cause a denial of service resource consumption via a crafted URI...

mod_perl PerlRun denial of service

PerlRun.pm in Apache modperl before 1.30, and RegistryCooker.pm in modperl 2.x, does not properly escape PATHINFO before use in a regular expression, which allows remote attackers to cause a denial of service resource consumption via a crafted URI...