Directory traversal

Directory traversal vulnerability in includes/feedcreator.class.php in Elxis CMS allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter...

CVE-2009-4154: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in includes/feedcreator.class.php in Elxis CMS allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter...

Elxis CMS File Disclosure

Discovered by cr4wl3r \ cr4wl3r4tlinuxmaildotorg Elxis CMS Local File Disclosure Vulnerability Script Site : http://www.elxis.org Code : contentType."; charset=".$this-encoding; line 640 Header"Content-Disposition: inline; filename=".basename$filename; line 641 readfile$filename, "r"; line 642 di...

CVE-2009-1677: Improper Control of Generation of Code

Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allow 1 remote authenticated users to inject arbitrary PHP code into files by placing PHP sequences into the account's "display name" setting and then invoking...

CVE-2009-1678: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allows remote attackers to create or overwrite arbitrary files via a .. dot dot in the version parameter to boards/boardsrss.php...

CVE-2006-1028

feedcreator.class.php aka the syndication component in Joomla! 1.0.7 allows remote attackers to cause a denial of service stressed file cache by creating many files via filenames in the feed parameter to index.php...

CVE-2006-1027

The CVE-2006-1027 issue affects Joomla! 1.0.7, specifically feedcreator.class.php (the syndication component). A remote attacker can cause an information disclosure by passing a "/" in the feed parameter to index.php, which leaks the installation path in an error message. The available sources de...

CVE-2006-1028: Undefined Security Weakness

feedcreator.class.php aka the syndication component in Joomla! 1.0.7 allows remote attackers to cause a denial of service stressed file cache by creating many files via filenames in the feed parameter to index.php...

CVE-2006-1027: Undefined Security Weakness

feedcreator.class.php aka the syndication component in Joomla! 1.0.7 allows remote attackers to obtain sensitive information via a "/" slash in the feed parameter to index.php, which reveals the path in an error message...

CVE-2006-1028

feedcreator.class.php aka the syndication component in Joomla! 1.0.7 allows remote attackers to cause a denial of service stressed file cache by creating many files via filenames in the feed parameter to index.php...