PT-2012-3090

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.9 Description The issue concerns the access has bug level function in core/access api.php, which fails to properly restrict access when the private bug view threshold is set to an array. This allows remote...

CVE-2010-2787: Exposure of Sensitive Information to an Unauthorized Actor

api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data, which allows remote attackers to bypass intended access restrictions and obtain sensitive information by retrieving documents from an HTTP proxy cache that has been used by a victim...

PT-2011-1381

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.15.5 Description The issue allows remote attackers to bypass intended access restrictions and obtain sensitive information by retrieving documents from an HTTP proxy cache that has been used by a victim. This is d...

CVE-2008-7269: Improper Input Validation

Open redirect vulnerability in api.php in SiteEngine 5.x allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter in a logout action...

PT-2010-1258

Name of the Vulnerable Software and Affected Versions SiteEngine versions 5.x Description The issue allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a URL in the forward parameter in a logout action in the api.php...

MediaWiki api.php脚本信息泄露漏洞

BUGTRAQ ID: 42019 MediaWiki是著名的wiki程序，运行于PHP+MySQL环境。 MediaWiki的api.php脚本没有正确地对缓存数据强制Cache-Control头，远程攻击者可以通过公开缓存头请求保密数据，包括文章标题和内容、已删除文章的内容、用户邮件地址或watchlist等。成功攻击要求攻击者能够使用与受害用户相同的HTTP代理服务器。 MediaWiki 1.8 - 1.15.4 厂商补丁： MediaWiki --------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

UC Gateway Investment SiteEngine 5.0 - api.php Open Redirection

UC Gateway Investment SiteEngine 5.0 - api.php Open Redirection source: https://www.securityfocus.com/bid/31888/info SiteEngine is prone to a remote URI-redirection vulnerability because the application fails to properly sanitize user-supplied input. A successful exploit may aid in phishing-style...

DEBIAN-CVE-2008-0460

Cross-site scripting XSS vulnerability in api.php in 1 MediaWiki 1.11 through 1.11.0rc1, 1.10 through 1.10.2, 1.9 through 1.9.4, and 1.8; and 2 the BotQuery extension for MediaWiki 1.7 and earlier; when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via...

CVE-2008-0460

Cross-site scripting XSS vulnerability in api.php in 1 MediaWiki 1.11 through 1.11.0rc1, 1.10 through 1.10.2, 1.9 through 1.9.4, and 1.8; and 2 the BotQuery extension for MediaWiki 1.7 and earlier; when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via...

CVE-2008-0460: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in api.php in 1 MediaWiki 1.11 through 1.11.0rc1, 1.10 through 1.10.2, 1.9 through 1.9.4, and 1.8; and 2 the BotQuery extension for MediaWiki 1.7 and earlier; when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via...

CVE-2006-4425: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in phpCOIN 1.2.3 allow remote attackers to execute arbitrary PHP code via the CCFGPKGPATHINCL parameter in coinincludes scripts including 1 api.php, 2 common.php, 3 core.php, 4 custom.php, 5 db.php, 6 redirect.php or 7 sessionset.php. NOTE: the...