CVE-2008-0458

CVE-2008-0458 describes a directory traversal vulnerability in SLAED CMS 2.5 Lite. The flaw exists in index.php’s newlang parameter, where a .. path component in the parameter can cause local file inclusion and arbitrary code execution. Affected component: function/sources.php (LITE version). Thi...

CVE-2007-6686

The URL rewrite module in Menalto Gallery before 2.2.4 allows attackers to include and execute arbitrary local files via unknown vectors related to the admin controller...

Sql injection

SQL injection vulnerability in loginform.asp in Instant Softwares Dating Site allows remote attackers to execute arbitrary SQL commands via the Password parameter, a different product than CVE-2006-6021. NOTE: some of these details are obtained from third party information...

CVE-2007-6344

Directory traversal vulnerability in modules/cms/index.php in Mcms Easy Web Make 1.3, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the template parameter...

CVE-2007-6184

Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter...

CVE-2007-5821

Multiple directory traversal vulnerabilities in DM Guestbook 0.4.1 and earlier allow remote attackers to include and execute arbitrary local files via a .. dot dot in 1 the lng parameter to a guestbook.php, b admin/admin.guestbook.php, or c auto/globnew.php; or 2 the lngdefault parameter to...

RealNetworks RealPlayer文件解析函数多个漏洞

RealPlayer是一款流行的媒体播放程序。 RealPlayer解析特殊构建的文件存在多个内存破坏问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 -当解析特殊构建的.mov文件，存在如下有问题代码： --//- snip ----//----------------------------------------------------- 62448F24 8B4D E2 MOV ECX,DWORD PTR SS:EBP-1E ; 1 62448F27 8B45 DE MOV EAX,DWORD PTR SS:EBP-22 62448F2A 2BC1 SUB EAX,E...

CVE-2002-2334

Joe text editor 2.8 through 2.9.7 does not remove the group and user setuid bits for backup files, which could allow local users to execute arbitrary setuid and setgid root programs when root edits scripts owned by other users...

Sql injection

Multiple SQL injection vulnerabilities in a LedgerSMB 1.0.0 through 1.2.7 and b DWS Systems SQL-Ledger 2.x allow remote attackers to execute arbitrary SQL commands via 1 the invoice quantity field or 2 the sort field...

Directory traversal

Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic Edition 1.07 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the ssuri parameter...

CVE-2007-5050

Directory traversal vulnerability in index.php in Neuron News 1.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the q parameter...

Unrestricted file upload

Unrestricted file upload vulnerability in admin/pages/blog-add.php in Neuron Blog 1.1 allows remote attackers to upload and execute arbitrary PHP files in uploads/...

CVE-2007-3082

Directory traversal vulnerability in sendcard.php in Sendcard 3.4.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the sclanguage parameter...

CVE-2007-2960

CVE-2007-2960 : Concrete details show multiple PHP remote file inclusion vulnerabilities in Scallywag (2005-04-25) where an attacker can include and execute arbitrary local PHP code via a URL in the path parameter to template.php for skin/dark/, skin/gold/, or skin/original/. The underlying cause...

CVE-2007-2613

WikkaWiki Wikka Wiki before 1.1.6.3 allows attackers in a shared virtual host server environment to upload and execute an arbitrary configuration file by modifying the WAKKACONFIG environment variable...

CVE-2007-2008

CVE-2007-2008 is a directory traversal vulnerability in pL-PHP beta 0.9 (admin.php) allowing remote attackers to include and execute arbitrary local files via a .. in the lang parameter. The NVD entry confirms the vulnerability and impact (partial confidentiality, integrity, and availability affe...

CVE-2007-1541

Directory traversal vulnerability in am.pl in SQL-Ledger 2.6.27 only checks for the presence of a NULL %00 character to protect against directory traversal attacks, which allows remote attackers to run arbitrary executables and bypass authentication via a .. dot dot sequence in the login paramete...

PortailPHP 2 - '/mod_news/index.php?chemin' Remote File Inclusion

source: https://www.securityfocus.com/bid/22381/info PortailPHP is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. A successful exploit of these issues allows an attacker to execute arbitrary server-side script code on an affected...

GNU BinUtils GAS缓冲区溢出漏洞

GNU BinUtils GAS是GNU的汇编器。 GNU BinUtils GAS存在缓冲区溢出，本地攻击者可以利用漏洞以用户进程权限执行任意指令。 通过诱使用户或自动系统使用gcc或gas构建恶意源文件，可导致触发漏洞，可能以用户进程权限执行任意指令。 Ubuntu Ubuntu Linux 5.10 sparc Ubuntu Ubuntu Linux 5.10 powerpc Ubuntu Ubuntu Linux 5.10 i386 Ubuntu Ubuntu Linux 5.10 amd64 Ubuntu Ubuntu Linux 5.0 4 powerpc Ubuntu...

SeaMonkey: Multiple vulnerabilities

Background The SeaMonkey project is a community effort to deliver production-quality releases of code derived from the application formerly known as 'Mozilla Application Suite'. Description The SeaMonkey project is vulnerable to arbitrary JavaScript bytecode execution and arbitrary code execution...