MySpace Content Zone 'uploadgames.php'任意文件上传漏洞

MySpace Content Zone是一款基于PHP的WEB应用程序。 MySpace Content Zone不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞上传任意文件并执行。 问题是由于'uploadgames.php'脚本不安全限制用户上传文件，通过上传恶意PHP文件可导致以WEB权限执行。 peerGoal MySpace Content Zone 厂商解决方案 ------------ 目前没有解决方案提供： http://www.peergoal.com/index.php?script=myspacecontentzone...

CVE-2007-6581: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in Social Engine 2.0 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the globallang parameter to 1 headeralbum.php, 2 headerblog.php, or 3 headergroup.php; or 4 adminheaderalbum.php, 5 adminheaderblog.php, or 6...

CVE-2007-6453: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in raidenhttpd-admin/workspace.php in RaidenHTTPD 2.0.19, when the WebAdmin function is enabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the ulang parameter...

CVE-2007-6475: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in GF-3XPLORER 2.4 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the langsel parameter to 1 updater.php and 2 thumber.php...

CVE-2007-6344: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in modules/cms/index.php in Mcms Easy Web Make 1.3, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the template parameter...

Rejetto HTTP File Server (HFS) 2.22.3 - Arbitrary File Upload

Rejetto HTTP File Server HFS 2.22.3 - Arbitrary File Upload source: https://www.securityfocus.com/bid/26732/info HFS HTTP File Server is prone to a vulnerability that lets attackers upload files and place them in arbitrary locations on the server. The issue occurs because the software fails to...

CVE-2007-6233: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in FTP Admin 0.1.0 allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the page parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an...

CVE-2007-6184: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter...

CVE-2007-6129: Improper Input Validation

Directory traversal vulnerability in scripts/include/showcontent.php in Amber Script 1.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the id parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share...

CVE-2007-5684: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to include and execute arbitrary files via an absolute pathname in 1 errorhandlerfile and 2 localphp parameters to a tiki-index.php, or 3 encoded "..%2F" sequences in the implanguage parameter to...

CVE-2007-5489: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in Artmedic CMS 3.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the page parameter...

CVE-2007-5465: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in doop CMS 1.3.7 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the page parameter to an unspecified component...

Microsoft Word Workspace Memory Corruption Remote Code Execution Vulnerability

Description Microsoft Word is prone to a remote code-execution vulnerability. An attacker could exploit this issue by enticing a victim to open a malicious Word file. Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in...

CVE-2007-5311: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic Edition 1.07 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the ssuri parameter...

PT-2007-6341 · Phpfreelog · Phpfreelog

Name of the Vulnerable Software and Affected Versions: phpFreeLog version 0.2.0 Description: A remote file inclusion issue in log.php allows remote attackers to include and execute arbitrary files. Recommendations: For phpFreeLog version 0.2.0, at the moment, there is no information about a newer...

CVE-2007-4976

CVE-2007-4976 involves a directory traversal in Coppermine Photo Gallery (CPG) prior to or including 1.4.12. The flaw is in viewlog.php: an unsafely handled log parameter can be exploited to include and execute arbitrary local files by using ".." (dot dot). The vulnerability requires authenticati...

CVE-2007-4976: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in viewlog.php in Coppermine Photo Gallery CPG 1.4.12 and earlier allows remote authenticated administrators to include and execute arbitrary local files via a .. dot dot in the log parameter...

CVE-2007-4908: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in AuraCMS 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the pilih parameter...

CVE-2007-4718: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in inc/lib/language.lib.php in Claroline before 1.8.6 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter...

CVE-2007-4585: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in activateuser.php in 2532|Gigs 1.2.1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter...