CVE-2008-1325

Multiple directory traversal vulnerabilities in index.php in Uberghey CMS 0.3.1 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 pageid and 2 language parameters. NOTE: this might be the same issue as CVE-2008-1324...

CVE-2008-1231

JSPWiki Edit.jsp editor parameter traversal (CVE-2008-1231) is documented in a Nessus plugin entry (JSPWiki Editor LFI). The issue affects JSPWiki versions 2.4.104 and 2.5.139, where input to the editor parameter is not sanitized, allowing a remote attacker to perform a local file inclusion by us...

GLSA-200803-04 : Mantis: XSS

The remote host is affected by the vulnerability described in GLSA-200803-04 Mantis: XSS seiji reported that the filename for the uploaded file in bugreport.php is not properly sanitised before being stored. Impact : A remote attacker could upload a file with a specially crafted to a bug report,...

CVE-2008-0818

Multiple directory traversal vulnerabilities in freePHPgallery 0.6 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the lang cookie to 1 comment.php, 2 index.php, and 3 show.php...

CVE-2008-0745

CVE-2008-0745 concerns a directory traversal vulnerability in aides/index.php of DomPHP 0.82, where an attacker can influence the page parameter with a ../ sequence to include and execute local files. Public records in NVD/NVD-derived entries describe a remote exploit path via this parameter, yie...

CVE-2008-0458

CVE-2008-0458 describes a directory traversal vulnerability in SLAED CMS 2.5 Lite. The flaw exists in index.php’s newlang parameter, where a .. path component in the parameter can cause local file inclusion and arbitrary code execution. Affected component: function/sources.php (LITE version). Thi...

CVE-2007-6686

The URL rewrite module in Menalto Gallery before 2.2.4 allows attackers to include and execute arbitrary local files via unknown vectors related to the admin controller...

Sql injection

SQL injection vulnerability in loginform.asp in Instant Softwares Dating Site allows remote attackers to execute arbitrary SQL commands via the Password parameter, a different product than CVE-2006-6021. NOTE: some of these details are obtained from third party information...

CVE-2007-6344

Directory traversal vulnerability in modules/cms/index.php in Mcms Easy Web Make 1.3, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the template parameter...

CVE-2007-6184

Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter...

CVE-2007-5821

Multiple directory traversal vulnerabilities in DM Guestbook 0.4.1 and earlier allow remote attackers to include and execute arbitrary local files via a .. dot dot in 1 the lng parameter to a guestbook.php, b admin/admin.guestbook.php, or c auto/globnew.php; or 2 the lngdefault parameter to...

RealNetworks RealPlayer文件解析函数多个漏洞

RealPlayer是一款流行的媒体播放程序。 RealPlayer解析特殊构建的文件存在多个内存破坏问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 -当解析特殊构建的.mov文件，存在如下有问题代码： --//- snip ----//----------------------------------------------------- 62448F24 8B4D E2 MOV ECX,DWORD PTR SS:EBP-1E ; 1 62448F27 8B45 DE MOV EAX,DWORD PTR SS:EBP-22 62448F2A 2BC1 SUB EAX,E...

CVE-2002-2334

Joe text editor 2.8 through 2.9.7 does not remove the group and user setuid bits for backup files, which could allow local users to execute arbitrary setuid and setgid root programs when root edits scripts owned by other users...

Sql injection

Multiple SQL injection vulnerabilities in a LedgerSMB 1.0.0 through 1.2.7 and b DWS Systems SQL-Ledger 2.x allow remote attackers to execute arbitrary SQL commands via 1 the invoice quantity field or 2 the sort field...

Directory traversal

Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic Edition 1.07 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the ssuri parameter...

CVE-2007-5050

Directory traversal vulnerability in index.php in Neuron News 1.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the q parameter...

Unrestricted file upload

Unrestricted file upload vulnerability in admin/pages/blog-add.php in Neuron Blog 1.1 allows remote attackers to upload and execute arbitrary PHP files in uploads/...

CVE-2007-3082

Directory traversal vulnerability in sendcard.php in Sendcard 3.4.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the sclanguage parameter...

CVE-2007-2960

CVE-2007-2960 : Concrete details show multiple PHP remote file inclusion vulnerabilities in Scallywag (2005-04-25) where an attacker can include and execute arbitrary local PHP code via a URL in the path parameter to template.php for skin/dark/, skin/gold/, or skin/original/. The underlying cause...

CVE-2007-2613

WikkaWiki Wikka Wiki before 1.1.6.3 allows attackers in a shared virtual host server environment to upload and execute an arbitrary configuration file by modifying the WAKKACONFIG environment variable...