CVE-2013-1348: Improper Control of Generation of Code

The Yaml::parse function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397...

CVE-2013-4321

The File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250...

CVE-2013-4250: Improper Input Validation

The 1 file upload component and 2 File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file...

PT-2014-2767

Name of the Vulnerable Software and Affected Versions TYPO3 versions 6.0.0 through 6.0.7 TYPO3 versions 6.1.0 through 6.1.2 Description The issue concerns the file upload component and the File Abstraction Layer FAL in TYPO3, which do not properly check file extensions. This allows remote...

PT-2014-4258

Name of the Vulnerable Software and Affected Versions Dotclear versions prior to 2.6.2 Description The issue allows remote attackers to execute arbitrary PHP code via a serialized object in the dc passwd cookie to a password-protected page. This is due to improper handling by certain PHP files,...

CVE-2014-2558

The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a ' backslash quote in the setting fields to /wp-admin/options-media.php, related to the createfunction function...

PT-2014-4914

Name of the Vulnerable Software and Affected Versions WD Arkeia virtual appliance AVA versions prior to 10.2.9 Description A directory traversal issue exists, allowing remote attackers to read arbitrary files and execute arbitrary PHP code. This is achieved by manipulating the lang Cookie paramet...

PT-2014-3573

Name of the Vulnerable Software and Affected Versions PivotX versions prior to 2.3.9 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .php or .php extension. This can be achieved by accessing the uploaded file via unspecified vectors...

CVE-2014-0342: Undefined Security Weakness

Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a 1 .php or 2 .php extension, and then accessing it via unspecified vectors...

CVE-2013-0303: Undefined Security Weakness

Unspecified vulnerability in core/ajax/translations.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors. NOTE: this entry has been SPLIT due to different affected versions. The core/settings.php issue is covered ...

PT-2014-3380

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.12 ownCloud versions 4.5.x prior to 4.5.6 Description The issue allows remote authenticated users to execute arbitrary PHP code. Recommendations For ownCloud versions prior to 4.0.12, update to version 4.0.12 or...

PT-2014-2189

Name of the Vulnerable Software and Affected Versions Domain Technologie Control DTC versions prior to 0.34.1 Description A directory traversal issue exists, allowing remote authenticated users to execute arbitrary PHP code. This is achieved by including a .. dot dot in the pkg parameter within a...

CVE-2013-1850

Multiple incomplete blacklist vulnerabilities in 1 import.php and 2 ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file...

CVE-2013-1850: Improper Control of Generation of Code

Multiple incomplete blacklist vulnerabilities in 1 import.php and 2 ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file...

CVE-2014-2088

Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrary PHP code by using a .php filename in an uploadfiles action to the uploadFiles command, and then accessing the .php file via a direct request to a certain clientid pathname...

PT-2014-4476

Name of the Vulnerable Software and Affected Versions ILIAS version 4.4.1 Description The issue allows remote authenticated users to execute arbitrary PHP code. This is achieved by using a .php filename in an upload files action to the uploadFiles command and then accessing the .php file via a...

PT-2014-4477

Name of the Vulnerable Software and Affected Versions ILIAS version 4.4.1 Description The issue allows remote attackers to execute arbitrary PHP code via an e-mail attachment. This attachment leads to the creation of a .php file with a certain client id pathname. Recommendations For ILIAS version...

CVE-2014-1903

admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args...

PT-2014-4353

Name of the Vulnerable Software and Affected Versions FreePBX versions 2.9 through 2.9.0.13 FreePBX versions 2.10 through 2.10.1.14 FreePBX versions 2.11 through 2.11.0.22 FreePBX versions 12 through 12.0.1alpha21 Description The issue allows remote attackers to execute arbitrary PHP code via the...

PT-2013-5020

Name of the Vulnerable Software and Affected Versions Context module versions 6.x-2.x through 6.x-3.1 Context module versions 7.x-3.x through 7.x-2.x Description The issue allows remote attackers to execute arbitrary PHP code via unspecified vectors related to Ajax operations, possibly involving...