PT-2007-6341 · Phpfreelog · Phpfreelog

Name of the Vulnerable Software and Affected Versions: phpFreeLog version 0.2.0 Description: A remote file inclusion issue in log.php allows remote attackers to include and execute arbitrary files. Recommendations: For phpFreeLog version 0.2.0, at the moment, there is no information about a newer...

CVE-2007-2106

The CVE-2007-2106 entry concerns Kai Content Management System (K-CMS) 1.0, where index.php is vulnerable to directory traversal via .. in the current_theme parameter, allowing local file inclusion/execution. The underlying issue is a local file inclusion via unvalidated user input in current_the...

CVE-2007-1933

CVE-2007-1933 describes multiple directory traversal vulnerabilities in PcP-Guestbook (PcP-Book) 3.0 that allow remote attackers to include and execute arbitrary local files through a ".." in the lang parameter to (1) index.php, (2) gb.php, or (3) faq.php. The root cause is directory traversal le...

CVE-2006-7134

Unrestricted file upload vulnerability in mainuser.php in Upload Tool for PHP 1.0 allows remote attackers to upload and execute arbitrary files with executable extensions such as .php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party informatio...

CVE-2007-0337

CVE-2007-0337 describes a directory traversal in KGB 1.9 and earlier where sesskglogadmin.php can include and execute arbitrary local files via a .. in the skinnn parameter. The attack path involves invoking kg.php with a postek parameter containing PHP code, which is injected into a file in the ...

rediffbol.txt

Rediff Bol Downloader Allows Downloading and Spawning Arbitary Files Affected Program : Rediff Bol Download ActiveX ActiveX OCX Control that downloads the Rediff Bol Messenger setup and spawns it. Related URL : http://messenger.rediff.com/newbol/ Discovered by : Gregory R. Panakkal Vulnerability...

PT-2006-7435 · Rediff · Rediff Bol Downloader Activex

Name of the Vulnerable Software and Affected Versions: Rediff Bol Downloader ActiveX OCX control affected versions not specified Description: The issue allows remote attackers to execute arbitrary files and obtain sensitive information, such as usernames and pathnames, by providing a URL in the u...

GLSA-200612-15 : McAfee VirusScan: Insecure DT_RPATH

The remote host is affected by the vulnerability described in GLSA-200612-15 McAfee VirusScan: Insecure DTRPATH Jakub Moc of Gentoo Linux discovered that McAfee VirusScan was distributed with an insecure DTRPATH which included the current working directory, rather than $ORIGIN which was probably...

Jupiter CMS 1.1.41.1.5 - modulessearch.php Multiple Cross-Site Scripting Vulnerabilities

Jupiter CMS 1.1.41.1.5 - modulessearch.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/20048/info Jupiter CMSA is prone to multiple input-validation vulnerabilities, including cross-site scripting, SQL-injection, and arbitrary file-upload issues, becaus...

EZContents 2.0.3 - review_summary.php?GLOBALS[admin_home] Remote File Inclusion

EZContents 2.0.3 - reviewsummary.php?GLOBALSadminhome Remote File Inclusion source: https://www.securityfocus.com/bid/19776/info ezContents is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker can exploit thes...

EZContents 2.0.3 - 'toprated.php?GLOBALS[language_home]' Remote File Inclusion

source: https://www.securityfocus.com/bid/19776/info ezContents is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code a...

PHP Blue Dragon CMS 2.9.1 - Multiple Remote File Inclusions

source: https://www.securityfocus.com/bid/18609/info PHP Blue Dragon CMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input to the application. An attacker may leverage these issues to have an arbitrary remote file containing malicio...

[DRUPAL-SA-2006-007] Drupal 4.6.8 / 4.7.2 fixes arbitrary file execution issue

---------------------------------------------------------------------------- Drupal security advisory DRUPAL-SA-2006-007 ---------------------------------------------------------------------------- Advisory ID: DRUPAL-SA-2006-007 Project: Drupal core and any web app that allows user uploads Date:...

CVE-2006-2511

The ActiveX version of FrontRange iHEAT allows remote authenticated users to run arbitrary programs or access arbitrary files on the host machine by uploading a file with an extension that is not associated with an application, and selecting a file from the "Open With..." dialog...

Advanced Guestbook 2.x - 'Addentry.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/17745/info Advanced GuestBook for phpBB is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file...

CVE-2006-1243

CVE-2006-1243 affects Simple PHP Blog (SPB) up to version 0.4.7.1, via install05.php. The vulnerability is a local file inclusion triggered by improper handling of the blog_language parameter, allowing directory traversal and a NUL character to force inclusion of arbitrary local files (demonstrat...

CVE-2006-0785

Absolute path traversal vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier allows remote attackers to include and execute arbitrary local files via a direct request with a path parameter with a null character and beginning with 1 '/' slash for an absolute pathname or 2 a drive...

ImageVue 0.16.1 - 'upload.php' Unrestricted Arbitrary File Upload

source: https://www.securityfocus.com/bid/16594/info ImageVue is prone to multiple vulnerabilities, including unauthorized uploading of files with arbitrary extensions, authentication bypass, information disclosure, and content injection. Successful exploitation could allow attackers to upload an...

EUVD-2003-1282

PHP remote file include vulnerability in Derek Ashauer ashNews 0.83 allows remote attackers to include and execute arbitrary remote files via a URL in the pathtoashnews parameter to 1 ashnews.php and 2 ashheadlines.php...

Tolva 0.1 - Usermods.php Remote File Inclusion

Tolva 0.1 - Usermods.php Remote File Inclusion source: https://www.securityfocus.com/bid/16000/info Tolva is prone to a remote file-include vulnerability. An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the...