846 matches found
PT-2007-1290 · Develooping · Develooping Flash Chat
Name of the Vulnerable Software and Affected Versions: Develooping Flash Chat affected versions not specified Description: A remote file inclusion issue in the adminips.php file of Develooping Flash Chat allows remote attackers to execute arbitrary PHP code via a URL in the banned file parameter...
Remote file inclusion
PHP remote file inclusion vulnerability in lang/index.php in Oreon 1.2.3 RC4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the file parameter...
Oreon lang/index.php file Parameter Remote File Inclusion
The remote host is running Oreon, a web-based network supervision program based on Nagios. The installation of Oreon on the remote host fails to sanitize input to the 'file' parameter of the 'lang/index.php' script before using it to include PHP code. Regardless of PHP's 'registerglobals' setting...
Directory traversal
download.php in Joonas Viljanen JV2 Folder Gallery allows remote attackers to read sensitive files via a relative pathname in the file parameter, as demonstrated by config/gallerysetup.php. NOTE: this issue might be resultant from a directory traversal vulnerability...
CVE-2006-6808
Cross-site scripting XSS vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. NOTE: some sources have reported this as a vulnerability in the getfiledescription function in wp-admin/admin-functions.php...
DEBIAN-CVE-2006-6808
Cross-site scripting XSS vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. NOTE: some sources have reported this as a vulnerability in the getfiledescription function in wp-admin/admin-functions.php...
CVE-2006-6808
Cross-site scripting XSS vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. NOTE: some sources have reported this as a vulnerability in the getfiledescription function in wp-admin/admin-functions.php...
CVE-2006-6808
Cross-site scripting XSS vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. NOTE: some sources have reported this as a vulnerability in the getfiledescription function in wp-admin/admin-functions.php...
cwmExplorer 1.0 (show_file) Source Code Disclosure Vulnerability
Exploit for unknown platform in category web applications ================================================================ cwmExplorer 1.0 showfile Source Code Disclosure Vulnerability ================================================================ Title : cwmExplorer 1.0 showfile Source Code...
CVE-2006-6419
jce.php in the JCE Admin Component in Ryan Demmer Joomla Content Editor JCE 1.1.0 beta 2 and earlier for Joomla! comjce allows remote attackers to include and possibly execute arbitrary local files via the 1 plugin or 2 file parameter. NOTE: The provenance of this information is unknown; the...
CVE-2006-6268
SQL injection vulnerability in system/core/profile/profile.inc.php in Neocrome Land Down Under LDU 8.x and earlier allows remote authenticated users to execute arbitrary SQL commands via a url-encoded id parameter to users.php that begins with a valid filename, as demonstrated by "default.gif"...
CVE-2006-6028
Directory traversal vulnerability in textview.php in Anton Vlasov DoSePa 1.0.4 allows remote attackers to read arbitrary files via a .. dot dot sequence or absolute file path in the file parameter...
PT-2006-6675 · Dosepa · Dosepa
Name of the Vulnerable Software and Affected Versions: DoSePa version 1.0.4 Description: A directory traversal issue exists, allowing remote attackers to read arbitrary files. This is achieved by using a .. dot dot sequence or absolute file path in the file parameter. Recommendations: For version...
CVE-2006-4081
previewemail.cgi in Barracuda Spam Firewall BSF 3.3.01.001 through 3.3.03.053 allows remote attackers to execute commands via shell metacharacters "|" pipe symbol in the file parameter. NOTE: the attack can be extended to arbitrary commands by the presence of CVE-2006-4000...
CVE-2006-3737
Cross-site scripting XSS vulnerability in filemanager/filemanager.php in the control panel in SWsoft Plesk 8.0 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the file parameter...
CVE-2006-2437
The CVE-2006-2437 entry concerns Caucho Resin’s viewfile servlet in the Resin documentation package (resin-doc) for versions 3.0.17 and 3.0.18. The available sources in the connected documents describe an arbitrary file disclosure: an unauthenticated remote attacker can obtain the contents of fil...
Directory traversal
Directory traversal vulnerability in help/index.php in X7 Chat 2.0 and earlier allows remote attackers to include arbitrary files via .. dot dot sequences in the helpfile parameter...
Coppermine Photo Gallery index.php file Parameter Local File Inclusion
The version of Coppermine Gallery installed on the remote host fails to properly sanitize input to the 'file' parameter of the 'index.php' script before using it in a PHP 'includeonce' function. Regardless of PHP's 'registerglobals' setting, an unauthenticated attacker may be able to exploit this...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in bol.cgi in BlankOL 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 file or 2 function parameter...