Design/Logic Flaw

libraries/databaseinterface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to serverdatabases.php with a sortby parameter containing PHP sequences, which are processed by createfunction...

Code injection

awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function...

CVE-2008-3922

awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function...

CVE-2008-3922

awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function...

CVE-2008-2938

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than...

Directory traversal

Directory traversal vulnerability in index.php in 1 WSN Forum 4.1.43 and earlier, 2 Gallery 4.1.30 and earlier, 3 Knowledge Base WSNKB 4.1.36 and earlier, 4 Links 4.1.44 and earlier, and possibly 5 Classifieds before 4.1.30 allows remote attackers to include and execute arbitrary local files via ...

CVE-2008-3555

Directory traversal vulnerability in index.php in 1 WSN Forum 4.1.43 and earlier, 2 Gallery 4.1.30 and earlier, 3 Knowledge Base WSNKB 4.1.36 and earlier, 4 Links 4.1.44 and earlier, and possibly 5 Classifieds before 4.1.30 allows remote attackers to include and execute arbitrary local files via ...

CVE-2008-3555

Directory traversal vulnerability in index.php in 1 WSN Forum 4.1.43 and earlier, 2 Gallery 4.1.30 and earlier, 3 Knowledge Base WSNKB 4.1.36 and earlier, 4 Links 4.1.44 and earlier, and possibly 5 Classifieds before 4.1.30 allows remote attackers to include and execute arbitrary local files via ...

Directory traversal

Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bit parameter, as demonstrated by an upload to avatar/ of a .jpg file containing PHP...

CVE-2008-3415

Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bit parameter, as demonstrated by an upload to avatar/ of a .jpg file containing PHP...

CVE-2008-3415

CVE-2008-3415 affects CMScout 2.05 (and related listings reference CMScout 2.06). The vulnerability is a directory traversal in common.php when .htaccess is not supported, allowing remote attackers to include and execute arbitrary local files through crafted directory traversal sequences in the b...

Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : php5 vulnerabilities (USN-628-1)

It was discovered that PHP did not properly check the length of the string parameter to the fnmatch function. An attacker could cause a denial of service in the PHP interpreter if a script passed untrusted input to the fnmatch function. CVE-2007-4782 Maksymilian Arciemowicz discovered a flaw in t...

php htmlentities/htmlspecialchars multibyte sequences

The 1 htmlentities and 2 htmlspecialchars functions in PHP before 5.2.5 accept partial multibyte sequences, which has unknown impact and attack vectors, a different issue than CVE-2006-5465...

php htmlentities/htmlspecialchars multibyte sequences

The 1 htmlentities and 2 htmlspecialchars functions in PHP before 5.2.5 accept partial multibyte sequences, which has unknown impact and attack vectors, a different issue than CVE-2006-5465...

php htmlentities/htmlspecialchars multibyte sequences

The 1 htmlentities and 2 htmlspecialchars functions in PHP before 5.2.5 accept partial multibyte sequences, which has unknown impact and attack vectors, a different issue than CVE-2006-5465...

php htmlentities/htmlspecialchars multibyte sequences

The 1 htmlentities and 2 htmlspecialchars functions in PHP before 5.2.5 accept partial multibyte sequences, which has unknown impact and attack vectors, a different issue than CVE-2006-5465...

Directory traversal

Directory traversal vulnerability in phpi/rss.php in Ourvideo CMS 9.5, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the prefix parameter...

php htmlentities/htmlspecialchars multibyte sequences

The 1 htmlentities and 2 htmlspecialchars functions in PHP before 5.2.5 accept partial multibyte sequences, which has unknown impact and attack vectors, a different issue than CVE-2006-5465...

DEBIAN-CVE-2008-2942

Directory traversal vulnerability in patch.py in Mercurial 1.0.1 allows user-assisted attackers to modify arbitrary files via ".." dot dot sequences in a patch file...

mod_jk sends decoded URL to tomcat

modjk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. dot dot sequences and...