EUVD-2012-2899

Malware in sbrugna...

CVE-2012-2918

Chevereto 1.91 is affected by CVE-2012-2918 due to a cross-site scripting (XSS) flaw in Upload/engine.php that allows injecting arbitrary web script or HTML via the v parameter. The vulnerability is tied to the engine.php handler in Chevereto 1.91; exploitation details are not provided in the ava...

PT-2012-4364

Name of the Vulnerable Software and Affected Versions Chevereto version 1.91 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the v parameter in the Upload/engine.php file. Recommendations For Chevereto...

CVE-2012-2918: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Upload/engine.php in Chevereto 1.91 allows remote attackers to inject arbitrary web script or HTML via the v parameter...

CVE-2012-2919: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Upload/engine.php in Chevereto 1.9.1 allows remote attackers to determine the existence of arbitrary files via a .. dot dot in the v parameter...

PT-2012-4365

Name of the Vulnerable Software and Affected Versions Chevereto version 1.9.1 Description A directory traversal issue exists, allowing remote attackers to determine the existence of arbitrary files by using a .. dot dot in the v parameter of the Upload/engine.php file. Recommendations For Chevere...