CVE-2004-1969: Undefined Security Weakness

The avatar upload capability in Open Bulletin Board OpenBB 1.0.6 and earlier allows remote attackers to execute arbitrary script by uploading files that include scripting code such as Javascript...

CVE-2005-0743

The custom avatar uploading feature uploader.php for XOOPS 2.0.9.2 and earlier allows remote attackers to upload arbitrary PHP scripts, whose file extensions are not filtered...

CVE-2005-0662

Cross-site scripting XSS vulnerability in index.php for MercuryBoard 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the Avatar field...

CVE-2005-1031

RUNCMS 1.1A, and possibly other products based on e-Xoops exoops, when "Allow custom avatar upload" is enabled, does not properly verify uploaded files, which allows remote attackers to upload arbitrary files...

CVE-2005-0650

Multiple cross-site scripting XSS vulnerabilities in ProjectBB 0.4.5.1 allow remote attackers to inject arbitrary web script or HTML via 1 the pages parameter to divers.php incorrectly referred to as "drivers.php" by some sources, 2 in the search feature text area, 3 forum name, 4 site name or 5...

CVE-2005-1031: Undefined Security Weakness

RUNCMS 1.1A, and possibly other products based on e-Xoops exoops, when "Allow custom avatar upload" is enabled, does not properly verify uploaded files, which allows remote attackers to upload arbitrary files...

runcms/e-xoops 1.1A and below file upload vulnerability

Products: runcms/e-xoops 1.1A http://www.runcms.org Summary: runcms/e-xoops 1.1A and below file upload vulnerability Description =========== runcms/e-xoops is an extensible, OO Object Oriented, easy to use dynamic web content management system written in PHP. runcms/e-xoops is the ideal tool for...

CVE-2005-0259

phpBB 2.0.11, and possibly other versions, with remote avatars and avatar uploading enabled, allows local users to read arbitrary files by providing both a local and remote location for an avatar, then modifying the "Upload Avatar from a URL:" field to reference the target file...

CVE-2005-0743

The CVE describes an arbitrary PHP file upload flaw in XOOPS 2.0.9.2 and earlier, exploitable via the uploader.php feature because file extensions are not filtered. This allows remote attackers to upload and potentially execute PHP scripts, with impact on confidentiality, integrity, and availabil...

CVE-2005-0743

The custom avatar uploading feature uploader.php for XOOPS 2.0.9.2 and earlier allows remote attackers to upload arbitrary PHP scripts, whose file extensions are not filtered...

[SCAN Associates Security Advisory] xoops 2.0.9.2 and below weak file extension validation

Summary: xoops 2.0.9.2 and below weak file extension validation Description =========== XOOPS is an extensible, OO Object Oriented, easy to use dynamic web content management system written in PHP. XOOPS is the ideal tool for developing small to large dynamic community websites, intra company...

XOOPS Arbitrary Avatar File Upload

Binary data 2683.prm...

CVE-2005-0662: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php for MercuryBoard 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the Avatar field...

CVE-2005-0629

Multiple cross-site scripting XSS vulnerabilities in profile.php in 427BB 2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 user or 2 Avatar parameters...

CVE-2005-0629: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in profile.php in 427BB 2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 user or 2 Avatar parameters...

CVE-2005-0629

Multiple cross-site scripting XSS vulnerabilities in profile.php in 427BB 2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 user or 2 Avatar parameters...

phpBB vulnerable to file disclosure

Overview The phpBB input validation methods may fail to sanitize user input resulting in a disclosure of arbitrary file data. Description phpBB is a customizable open source bulletin board package. It contains functionality that allows users to specify graphic files for use as "avatars." These...

phpBB <= 2.0.11 Multiple Vulnerabilities

The remote host is running phpBB version 2.0.11 or older. Such versions suffer from multiple vulnerabilities: - full path display on critical messages. - full path disclosure in username handling caused by a PHP 4.3.10 bug. - arbitrary file disclosure vulnerability in avatar handling functions. -...

CVE-2005-0259

CVE-2005-0259 affects phpBB 2.0.11 (and possibly other versions) where enabling remote avatars and avatar uploading allows local users to read arbitrary files by providing both a local and remote avatar location and setting the “Upload Avatar from a URL:” field to reference the target file. Root ...

CVE-2005-0259: Undefined Security Weakness

phpBB 2.0.11, and possibly other versions, with remote avatars and avatar uploading enabled, allows local users to read arbitrary files by providing both a local and remote location for an avatar, then modifying the "Upload Avatar from a URL:" field to reference the target file...