CVE-2007-6347

PHP remote file inclusion vulnerability in blocks/blocksitemap.php in ViArt 1 CMS 3.3.2, 2 HelpDesk 3.3.2, 3 Shop Evaluation 3.3.2, and 4 Shop Free 3.3.2 allows remote attackers to execute arbitrary PHP code via a URL in the rootfolderpath parameter. NOTE: some of these details are obtained from...

CVE-2007-6347

CVE-2007-6347 describes a PHP remote file inclusion in blocks/block_site_map.php affecting ViArt CMS/HelpDesk/Shop Evaluation/Shop Free 3.3.2. The flaw allows an attacker to execute arbitrary PHP code by supplying a URL in the root_folder_path parameter. Documented impact is remote code execution...

CVE-2007-6347: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in blocks/blocksitemap.php in ViArt 1 CMS 3.3.2, 2 HelpDesk 3.3.2, 3 Shop Evaluation 3.3.2, and 4 Shop Free 3.3.2 allows remote attackers to execute arbitrary PHP code via a URL in the rootfolderpath parameter. NOTE: some of these details are obtained from...

CheckPoint Secure Platform Multiple Buffer Overflows

Hi all, we have published a paper about CheckPoint Firewall-1 vulnerabilities. The platform tested is the Secure Platform R60. We have found many buffer overflows. Most of them are located in command line utilities that can be exploited locally. A very few of them maybe can be exploited remotely,...

Cocoon Counter statistics program background written mA-vulnerability warning-the black bar safety net

Reference the latest Ocean to the top of the eval version in a few words, here to use is % eval reques tchr 3 5 % , "evalExecutePP. htm in the text box write your own code is added with 2006X2. exe conversion to generate the html text box in code. What is the text box you know? Don't just check t...

SOL2591 - Linux kernel vulnerabilities - CAN-2003-0244, CAN-2003-0246

Note: Versions that are not listed in this Solution have not been evaluated for vulnerability to this security advisory. For information about F5 Networks' security policy regarding evaluating older and unsupported versions of F5 Networks products, refer to SOL4602: Overview of F5 Networks securi...

CVE-2007-2624

The CVE-2007-2624 entry concerns All In One Control Panel (AIOCP) before 1.3.016, where a dynamic variable evaluation vulnerability in shared/config/cp_config.php enables remote XSS via the SERVER superglobal array. The issue stems from processing user-supplied data in SERVER-related variables, a...

Cross site scripting

Dynamic variable evaluation vulnerability in shared/config/tceconfig.php in TCExam 4.0.011 and earlier allows remote attackers to conduct cross-site scripting XSS and possibly other attacks by modifying critical variables such as $SERVER, as demonstrated by injecting web script via the...

CVE-2007-2431: Undefined Security Weakness

Dynamic variable evaluation vulnerability in shared/config/tceconfig.php in TCExam 4.0.011 and earlier allows remote attackers to conduct cross-site scripting XSS and possibly other attacks by modifying critical variables such as $SERVER, as demonstrated by injecting web script via the...

CVE-2007-1634

Variable extraction vulnerability in grabglobals.php in Net Portal Dynamic System NPDS 5.10 and earlier allows remote attackers to conduct SQL injection attacks via the FILESDBtmpname parameter to print.php, which overwrites the $DB variable with dynamic variable evaluation...

Remote file inclusion

PHP remote file inclusion vulnerability in template.class.php in Carbonize Lazarus Guestbook before 1.7.3 allows remote attackers to execute arbitrary PHP code via a URL in the includepath parameter to admin.php, probably due to a dynamic variable evaluation vulnerability...

A new generation of webshell<Dynamic Function Evaluation>-vulnerability warning-the black bar safety net

A new generation of webshellDynamic Function Evaluation In the times read large cattle of the documentDynamic Evaluation Vulnerabilities in PHP applicationsfindDynamic Function Evaluation. You can do the webshell that was too perfect: it. Code: ? $func; ?& gt;...

CVE-2007-0968: Undefined Security Weakness

Unspecified vulnerability in Cisco Firewall Services Module FWSM before 2.34.7 and 3.x before 3.13.1 causes the access control entries ACE in an ACL to be improperly evaluated, which allows remote authenticated users to bypass intended certain ACL protections...

CVE-2006-6931

Removed by vendor...

iG Shop 1.0 (eval/sql injection) Multiple Remote Vulnerabilities

No description provided by source. "If eval is the answer, then you are asking the wrong question." --Unknowen ig-shop suffers from two eval's that can be controlled by an attacker: http://127.0.0.1/igshop/cart.php?action=;phpinfo;// ./cart.php line 692: eval "cart$action;";...

Debian DSA-1030-1 : moodle - several vulnerabilities

Several vulnerabilities have been discovered in libphp-adodb, the 'adodb' database abstraction layer for PHP, which is embedded in moodle, a course management system for online learning. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2006-0146 Andreas...

SOL2593 - Buffer overflow in zlib - CAN-2003-0107

Note: Versions that are not listed in this Solution have not been evaluated for vulnerability to this security advisory. For information about F5 Networks' security policy regarding evaluating older and unsupported versions of F5 Networks products, refer to SOL4602: Overview of F5 Networks securi...

CVE-2006-5116

Multiple cross-site request forgery CSRF vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by 1 directly setting a token in the URL though dynamic variable evaluation and 2 unsetting arbitrary variables via the REQUEST array,...

CVE-2006-5116

Multiple cross-site request forgery CSRF vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by 1 directly setting a token in the URL though dynamic variable evaluation and 2 unsetting arbitrary variables via the REQUEST array,...

CVE-2006-5116

Multiple cross-site request forgery CSRF vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by 1 directly setting a token in the URL though dynamic variable evaluation and 2 unsetting arbitrary variables via the REQUEST array,...