CVE-2006-0702

The provided connected Nessus entry confirms a concrete vulnerability in imageVue: versions prior to 16.2 allow unauthenticated remote upload of arbitrary files via admin/upload.php, effectively enabling code execution under the web server’s user context. The issue is described as an unrestricted...

CVE-2006-0702: Undefined Security Weakness

admin/upload.php in imageVue 16.1 allows remote attackers to upload arbitrary files to certain allowed folders via .. dot dot sequences in the path parameter. NOTE: due to the lack of details, the specific vulnerability type cannot be determined, although it might be due to directory traversal...

CVE-2005-4224: Undefined Security Weakness

Multiple "potential" SQL injection vulnerabilities in e107 0.7 might allow remote attackers to execute arbitrary SQL commands via 1 the email, hideemail, image, realname, signature, timezone, and xupexist parameters in signup.php, 2 the contentcomment, contentrating, and contentsummary parameters...

CVE-2005-1884

Directory traversal vulnerability in the 1 rmdir or 2 mkdir commands in upload.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to create or delete arbitrary directories via a .. dot dot in the dir parameter...

CVE-2005-1884: Undefined Security Weakness

Directory traversal vulnerability in the 1 rmdir or 2 mkdir commands in upload.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to create or delete arbitrary directories via a .. dot dot in the dir parameter...

CVE-2005-1881: Unrestricted Upload of File with Dangerous Type

upload.php in YaPiG 0.92b, 0.93u and 0.94u does not properly restrict the file extension for uploaded image files, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code...

CVE-2003-1204: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Mambo Site Server 4.0.12 BETA and earlier allow remote attackers to execute script on other clients via 1 the link parameter in sectionswindow.php, the directory parameter in 2 gallery.php, 3 navigation.php, or 4 uploadimage.php, the path...

CVE-2005-1583: Undefined Security Weakness

1Two News 1.0 allows remote attackers to 1 delete images for new stories via a direct request to admin/delete.php or 2 upload arbitrary images via a direct request to admin/upload.php...

CVE-2004-1953: Undefined Security Weakness

phProfession 2.5 allows remote attackers to gain sensitive information via a direct HTTP request to upload.php, which reveals the path in a PHP error message...

CVE-2005-0313: Undefined Security Weakness

Multiple directory traversal vulnerabilities in Magic Winmail Server 4.0 Build 1112 allow remote attackers to 1 upload arbitrary files via certain parameters to upload.php or 2 read arbitrary files via certain parameters to download.php, and remote authenticated users to read, create, or delete...