ECOA Building Automation System - Directory Traversal Content Disclosure Detection

The ECOA BAS controller suffers from a directory traversal content disclosure vulnerability. Using the GET parameter cpath in File Manager fmangersub, attackers can disclose directory content on the affected device !/usr/bin/env python3 -- coding: utf-8 -- """The ECOA BAS controller suffers from ...

CVE-2018-18572

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related extensions such as .phtml and .php5 didn't execute in the application. But this filter didn't prevent the '.pht' extension. Thus, remote...

PT-2019-9607

Name of the Vulnerable Software and Affected Versions osCommerce version 2.3.4.1 Description The issue arises from an incomplete '.htaccess' file for blacklist filtering on the product page, which fails to prevent the execution of files with the '.pht' extension. This allows remote authenticated...

PT-2019-9608

Name of the Vulnerable Software and Affected Versions osCommerce version 2.3.4.1 Description The issue is related to an incomplete '.htaccess' file for blacklist filtering in the product page, allowing remote authenticated administrators to upload new '.htaccess' files. This can lead to arbitrary...

interact 2.4.1 Multiple Remote File Inclusion Vulnerabilities

Exploit for unknown platform in category web applications ============================================================= interact 2.4.1 Multiple Remote File Inclusion Vulnerabilities ============================================================= -========================================== ViVa Isla...

CVE-2006-6824: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Jim Hu and Chad Little PHP iCalendar 2.23 rc1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 getdate parameter in a day.php, b month.php, c year.php, d week.php, e search.php, f rss/index.php, g print.php, a...