Monsta Box WebFTP Arbitrary File Read

Application ----------- "MONSTA Box is a lightweight open-source file manager you can install on your website or server to easily manage your files through any browser." Description from the official website http://www.monstahq.com/ Vulnerability ------------- The Monsta Box WebFTP application...

FarsiNews 2.1/2.5 show_archives.php template Parameter Traversal Arbitrary File Access

No description provided by source. source: http://www.securityfocus.com/bid/16580/info FarsiNews is prone to directory-traversal and local file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit the...

CVE-2012-5224

PHP remote file inclusion vulnerability in vb/includes/vbacmpsincludebottom.php in vBadvanced CMPS 3.2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pagestemplate parameter...

CVE-2012-2202

CVE-2012-2202 is a directory-traversal vulnerability affecting IBM Lotus Protector for Mail Security (versions 2.1, 2.5, 2.5.1, 2.8) and IBM Proventia Network Mail Security System. The issue is in javatester_init.php where an unvalidated parameter (after authentication) enables an arbitrary file ...

CVE-2012-2202: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in javatesterinit.php in IBM Lotus Protector for Mail Security 2.1, 2.5, 2.5.1, and 2.8 and IBM ISS Proventia Network Mail Security System allows remote authenticated administrators to read arbitrary files via a .. dot dot in the template parameter...

CVE-2011-4832: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in CaupoShop Pro 2.x, CaupoShop Classic 3.01, and CaupoShop Pro 3.70 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the template parameter in a template action...

phpcms 2008 product.php pagesize参数代码注射漏洞

PHPCMS是国内领先的网站管理系统，同时也是一个开源的PHP开发框架。 PHPCMS 2008在处理某些模板参数时存在安全漏洞，其yp/product.php页面的pagesize参数没有正确进行检查过滤，导致可以提交任意字符，远程攻击者可利用此漏洞执行任意命令 具体的代码触发路径是这样的： phpcms/yp/product.php中获取pagesize参数，拼接为$urlrule变量。随后将之带入yp目录下的product.html模板之中。在模板执行后，进入到get函数处理中，最后经过get-pages-pageurl函数，最终触发pageurl的如下代码： eval"$url ...

Pecio CMS 'template' Multiple Remote File Include Vulnerabilities

This host is running Pecio CMS and is prone to multiple remote file inclusion vulnerabilities. OpenVAS Vulnerability Test $Id: gbpeciocmsmultrfivuln.nasl 5323 2017-02-17 08:49:23Z teissa $ Pecio CMS 'template' Multiple Remote File Include Vulnerabilities Authors: Madhuri D Copyright: Copyright c...

CVE-2010-3204: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Pecio CMS 2.0.5 allow remote attackers to execute arbitrary PHP code via a URL in the template parameter to 1 post.php, 2 article.php, 3 blog.php, or 4 home.php in pectemplates/nova-blue/...

CVE-2009-3849

Multiple stack-based buffer overflows in HP OpenView Network Node Manager OV NNM 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via 1 a long Template parameter to nnmRptConfig.exe, related to the strcat function; or 2 a long Oid parameter to snmp.exe...

CVE-2009-3848

Stack-based buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager OV NNM 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long Template parameter, related to the vsprintf function...

CVE-2009-3849: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple stack-based buffer overflows in HP OpenView Network Node Manager OV NNM 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via 1 a long Template parameter to nnmRptConfig.exe, related to the strcat function; or 2 a long Oid parameter to snmp.exe...

CVE-2009-3848: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager OV NNM 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long Template parameter, related to the vsprintf function...

CVE-2008-7240

Directory traversal vulnerability in include/unverified.inc.php in Linux Web Shop LWS php User Base 1.3beta allows remote attackers to include and execute arbitrary local files via the template parameter...

Directory traversal

Directory traversal vulnerability in include/unverified.inc.php in Linux Web Shop LWS php User Base 1.3beta allows remote attackers to include and execute arbitrary local files via the template parameter...

CVE-2008-7240: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in include/unverified.inc.php in Linux Web Shop LWS php User Base 1.3beta allows remote attackers to include and execute arbitrary local files via the template parameter...

CVE-2009-3167: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Anantasoft Gazelle CMS 1.0, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the template parameter...

Directory traversal

Directory traversal vulnerability in DJcalendar.cgi in DJCalendar allows remote attackers to read arbitrary files via a .. dot dot in the TEMPLATE parameter...

CVE-2009-2925: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in DJcalendar.cgi in DJCalendar allows remote attackers to read arbitrary files via a .. dot dot in the TEMPLATE parameter...

CVE-2009-2176

Multiple directory traversal vulnerabilities in fuzzylime cms 3.03a and earlier, when magicquotesgpc is disabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the 1 list parameter to code/confirm.php and the 2 template parameter to...