CVE-2005-1884

Directory traversal vulnerability in the 1 rmdir or 2 mkdir commands in upload.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to create or delete arbitrary directories via a .. dot dot in the dir parameter...

CVE-2005-1885

YaPiG is a PHP-based image gallery. CVE-2005-1885 affects YaPiG 0.92b/0.93u/0.94u, where view.php accepts a phid parameter that is not required to be an integer, causing an error message that reveals the filesystem path. OpenVAS notes this within YaPiG’s broader set of flaws (including remote/loc...

CVE-2005-1881

upload.php in YaPiG 0.92b, 0.93u and 0.94u does not properly restrict the file extension for uploaded image files, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code...

CVE-2005-1882

PHP remote file inclusion vulnerability in lastgallery.php in YaPiG 0.93u and 0.94u allows remote attackers to execute arbitrary PHP code via the YAPIGPATH parameter...

CVE-2005-1882

CVE-2005-1882 (YaPiG) — YaPiG is a PHP-based image gallery. The vulnerability is a PHP Remote File Inclusion in last_gallery.php that allows an attacker to execute arbitrary PHP code by supplying a crafted YAPIG_PATH parameter in YaPiG versions 0.93u and 0.94u. The linked OpenVAS/NVD entries corr...

CVE-2005-1884

CVE-2005-1884 affects YaPiG (web-based PHP image gallery) versions 0.92b, 0.93u, and 0.94u. A directory traversal vulnerability exists in upload.php, where the dir parameter can be exploited with .. to create or delete arbitrary directories via rmdir or mkdir commands. Multiple sources (NVD entry...

CVE-2005-1881

YaPiG (PHP image gallery) is affected by CVE-2005-1881 due to upload.php not properly restricting image file extensions in YaPiG versions 0.92b, 0.93u, and 0.94u. This allows remote attackers to upload arbitrary files and execute arbitrary PHP code on the server. The issue is part of a set of YaP...

CVE-2005-1885

view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to obtain sensitive information via a phid parameter that is not an integer, which reveals the path in an error message...

CVE-2005-1886

Cross-site scripting XSS vulnerability in view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to inject arbitrary web script or HTML via 1 the phid parameter or 2 unknown parameters when posting a new comment...

CVE-2005-1882: Undefined Security Weakness

PHP remote file inclusion vulnerability in lastgallery.php in YaPiG 0.93u and 0.94u allows remote attackers to execute arbitrary PHP code via the YAPIGPATH parameter...

CVE-2005-1886: Undefined Security Weakness

Cross-site scripting XSS vulnerability in view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to inject arbitrary web script or HTML via 1 the phid parameter or 2 unknown parameters when posting a new comment...

CVE-2005-1884: Undefined Security Weakness

Directory traversal vulnerability in the 1 rmdir or 2 mkdir commands in upload.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to create or delete arbitrary directories via a .. dot dot in the dir parameter...

CVE-2005-1885: Undefined Security Weakness

view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to obtain sensitive information via a phid parameter that is not an integer, which reveals the path in an error message...

[SA15600] YaPiG Multiple Vulnerabilities

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

CVE-2005-1881: Unrestricted Upload of File with Dangerous Type

upload.php in YaPiG 0.92b, 0.93u and 0.94u does not properly restrict the file extension for uploaded image files, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code...

CVE-2005-1883: Undefined Security Weakness

global.php in YaPiG 0.92b allows remote attackers to include arbitrary local files via the BASEDIR parameter...

CVE-2005-1881

upload.php in YaPiG 0.92b, 0.93u and 0.94u does not properly restrict the file extension for uploaded image files, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code...

CVE-2005-1885

view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to obtain sensitive information via a phid parameter that is not an integer, which reveals the path in an error message...

YaPiG 0.9x - view.php Cross-Site Scripting

YaPiG 0.9x - view.php Cross-Site Scripting source: https://www.securityfocus.com/bid/13875/info YaPiG is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary...

PT-2005-2838 · Yapig · Yapig

Name of the Vulnerable Software and Affected Versions: YaPiG versions 0.92b through 0.94u Description: The issue concerns the upload.php file in YaPiG, which does not properly restrict the file extension for uploaded image files. This allows remote attackers to upload arbitrary files and execute...