CVE-2012-0992

interface/fax/faxdispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter...

PT-2012-2997

Name of the Vulnerable Software and Affected Versions OpenEMR version 4.1.0 Description The issue allows remote authenticated users to execute arbitrary commands. This is achieved by injecting shell metacharacters in the file parameter of the interface/fax/fax dispatch.php script. Recommendations...

CVE-2012-0992: Improper Input Validation

interface/fax/faxdispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter...

CVE-2012-0980

SQL injection vulnerability in download.php in phux Download Manager allows remote attackers to execute arbitrary SQL commands via the file parameter...

CVE-2012-0980: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in download.php in phux Download Manager allows remote attackers to execute arbitrary SQL commands via the file parameter...

Enigma2 'file' Parameter Information Disclosure Vulnerability

Enigma2 is prone to an information-disclosure vulnerability because it fails to sufficiently validate user-supplied data. An attacker can exploit this issue to download local files in the context of the webserver process. This may allow the attacker to obtain sensitive information; other attacks...

PT-2011-5131

Name of the Vulnerable Software and Affected Versions Web File Browser version 0.4b14 Description The issue allows remote authenticated users to read arbitrary files. This is achieved by using a ..%2f encoded dot dot in the file parameter in a download action. The download action is part of the...

Directory traversal

Directory traversal vulnerability in file in DreamBox DM800 1.6rc3, 1.5rc1, and earlier allows remote attackers to read arbitrary files via the file parameter...

CVE-2011-4716

CVE-2011-4716 describes a directory traversal vulnerability in DreamBox DM800 (versions up to 1.6rc3, 1.5rc1 and earlier) that allows remote attackers to read arbitrary files via the file parameter. The affected component is the file handling logic within the DreamBox DM800 firmware. The underlyi...

CVE-2011-4716: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in file in DreamBox DM800 1.6rc3, 1.5rc1, and earlier allows remote attackers to read arbitrary files via the file parameter...

PT-2011-5051

Name of the Vulnerable Software and Affected Versions DreamBox DM800 versions 1.6rc3, 1.5rc1, and earlier Description A directory traversal issue exists in the file component, allowing remote attackers to read arbitrary files by manipulating the file parameter. Recommendations For DreamBox DM800...

DEBIAN-CVE-2010-4879

PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary PHP code via a URL in the inputfile parameter...

PT-2011-1814

Name of the Vulnerable Software and Affected Versions dompdf version 0.6.0 beta1 Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the input file parameter. This enables attackers to potentially gain control over the system by injecting malicious code...

PT-2011-4084

Name of the Vulnerable Software and Affected Versions Chyrp versions 2.0 and earlier Description A directory traversal issue exists, allowing remote attackers to read arbitrary files by utilizing a .. dot dot in the file parameter. Recommendations For Chyrp versions 2.0 and earlier, at the moment...

CVE-2011-1715

Directory traversal vulnerability in framework/source/resource/qx/test/part/delay.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to read arbitrary files via ..%2f encoded dot dot sequences in the file parameter...

CVE-2011-1715

Directory traversal vulnerability in framework/source/resource/qx/test/part/delay.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to read arbitrary files via ..%2f encoded dot dot sequences in the file parameter...

PT-2011-3315

Name of the Vulnerable Software and Affected Versions QooxDoo versions 1.3 and possibly other versions eyeOS versions 2.2 and 2.3 Description A directory traversal issue allows remote attackers to read arbitrary files via ..%2f encoded dot dot sequences in the file parameter. This issue is presen...

CVE-2011-1715: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in framework/source/resource/qx/test/part/delay.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to read arbitrary files via ..%2f encoded dot dot sequences in the file parameter...

SQL-Ledger 2.8.33 - (Authenticated) Local File Inclusion / Edit

Exploit Title: SQL-Ledger = 2.8.33 Post-authentication Local File Include/Edit Vulnerability Google Dork: inurl:/sql-ledger/login.pl Date: April 15, 2011 Author: bitform Software Link: http://www.sql-ledger.com/source/sql-ledger-2.8.33.tar.gz Version: 2.8.33 Tested on: Ubuntu Server 10.04 CVE :...

CVE-2010-3447

Cross-site scripting XSS vulnerability in view.php in the file viewer in Horde Gollem before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the file parameter in a viewfile action...