PT-2011-4625

Name of the Vulnerable Software and Affected Versions Escort Agency CMS affected versions not specified Description The issue allows remote attackers to obtain sensitive information via crafted array parameters in a request to a .php file. This is demonstrated by files such as makethumb.php, whic...

CVE-2011-3735: Exposure of Sensitive Information to an Unauthorized Actor

Escort Agency CMS aka escort-agency-cms allows remote attackers to obtain sensitive information via crafted array parameters in a request to a .php file, which reveals the installation path in an error message, as demonstrated by makethumb.php and certain other files...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in PHP Multi User Randomizer phpMUR 2006.09.13 allow remote attackers to inject arbitrary web script or HTML via 1 the editplugin parameter to configureplugin.tpl.php, or 2 certain array parameters to web/phpinfo.php, as demonstrated by 1 or a...

CVE-2007-0418

BEA WebLogic Server 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1 does not enforce a security policy that declares permissions for EJB methods that have array parameters, which allows remote attackers to obtain unauthorized access to these methods...

Design/Logic Flaw

BEA WebLogic Server 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1 does not enforce a security policy that declares permissions for EJB methods that have array parameters, which allows remote attackers to obtain unauthorized access to these methods...

CVE-2007-0418: Undefined Security Weakness

BEA WebLogic Server 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1 does not enforce a security policy that declares permissions for EJB methods that have array parameters, which allows remote attackers to obtain unauthorized access to these methods...

CVE-2007-0418

BEA WebLogic Server 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1 does not enforce a security policy that declares permissions for EJB methods that have array parameters, which allows remote attackers to obtain unauthorized access to these methods...

CVE-2006-6403

mystats.php in MyStats 1.0.8 and earlier allows remote attackers to obtain the installation path via 1 details and 2 by array parameters, probably resulting in a path disclosure in an error message...

CVE-2006-4297: Undefined Security Weakness

SQL injection vulnerability in shoppingcart.php in osCommerce before 2.2 Milestone 2 060817 allows remote attackers to execute arbitrary SQL commands via id array parameters...

CVE-2006-3757

index.php in Zen Cart 1.3.0.2 allows remote attackers to obtain sensitive information via empty 1 GET, 2 SESSION, 3 POST, 4 COOKIE, or 5 SESSION array parameters, which reveals the installation path in an error message. NOTE: this issue might be resultant from a global overwrite vulnerability...