PhpWiki fails to properly restrict uploaded files

Overview PhpWiki fails to properly restrict uploaded files, which can allow a remote attacker to execute arbitrary commands on a vulnerable system. Description PhpWiki is Wiki software that is implemented in PHP. PhpWiki includes an "UpLoad" feature that allows users to upload files. Files with a...

CVE-2007-0147

Cuyahoga before 1.0.1 installs the FCKEditor component with an incorrect deny statement in a Web.config file, which allows remote attackers to upload files when these privileges were intended only for the Administrator and Editor roles...

Design/Logic Flaw

Cuyahoga before 1.0.1 installs the FCKEditor component with an incorrect deny statement in a Web.config file, which allows remote attackers to upload files when these privileges were intended only for the Administrator and Editor roles...

CVE-2007-0147

Cuyahoga before 1.0.1 installs the FCKEditor component with an incorrect deny statement in a Web.config file, which allows remote attackers to upload files when these privileges were intended only for the Administrator and Editor roles...

ContentNow 1.30 (upload/xss) Multiple Remote Vulnerabilities

No description provided by source. ContentNow Directory Traversalupload.php ------------------------------------------ -vulnerability By: Timq -http://securitydb.org -Team Root-Shell -Email:timqathushmail.com ------------------------------------------ It appears that it is possible to view any...

CVE-2006-5833

gbcmsphpfiles/uploader.php GreenBeast CMS 1.3 does not require authentication to upload files, which allows remote attackers to cause a denial of service disk consumption and execute arbitrary code by uploading arbitrary files, such as executing PHP code via an uploaded PHP file...

PmWiki < 2.1.21 Global Variables Overwriting

The version of PmWiki installed on the remote host contains a programming flaw in 'pmwiki.php' that may allow an unauthenticated remote attacker to overwrite global variables used by the application, which could in turn be exploited to execute arbitrary PHP code on the affected host, subject to t...

Awareness of vulnerabilities haha-vulnerability warning-the black bar safety net

Text/SuperHeiAtph4nt0m.org 2006-2-12 2006-02-0 9, milw0rm released the FCKEditor one upload vulnerability1. Fig. FCKEditor is one of a plurality of language Language version of theasp,cgi,aspx,php,cfm,...of the online editing class2, many web systems use this A class. In fact, this is something o...

CVE-2006-3935

system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allows remote authenticated users to 1 send broadcast messages to all users /workplace/broadcast, 2 list all users /accounts/users, 3 add webusers...

Microsoft Internet Explorer 5.56.07.0 - JavaScript Key Filtering

Microsoft Internet Explorer 5.56.07.0 - JavaScript Key Filtering source: https://www.securityfocus.com/bid/18308/info Multiple web browsers are prone to a JavaScript key-filtering vulnerability because the browsers fail to securely handle keystroke input from users. This issue is demonstrated to...

FreeBSD : coppermine -- Multiple File Extensions Vulnerability (0b628470-e9a6-11da-b9f4-00123ffe8333)

Secunia reports : Coppermine Photo Gallery have a vulnerability, which can be exploited by malicious users to compromise a vulnerable system. The vulnerability is caused due to an error in the handling of file uploads where a filename has multiple file extensions. This can be exploited to upload...

coppermine -- Multiple File Extensions Vulnerability

Secunia reports: Coppermine Photo Gallery have a vulnerability, which can be exploited by malicious users to compromise a vulnerable system. The vulnerability is caused due to an error in the handling of file uploads where a filename has multiple file extensions. This can be exploited to upload...

PT-2006-3389 · Dubanner · Dubanner

Name of the Vulnerable Software and Affected Versions: DUbanner version 3.1 Description: The issue allows remote attackers to execute arbitrary code by uploading files with arbitrary extensions, such as ASP files, to the add.asp endpoint, probably due to client-side enforcement that can be...

Cross site scripting

E-Business Designer eBD 3.1.4 and earlier allows remote attackers to upload or modify arbitrary files, and execute arbitrary code, via a direct request to 1 common/htmleditor/imagebrowser.upload.html, 2 common/htmleditor/imagebrowser.html, or 3 common/htmleditor/htmleditor.html. NOTE: this can al...

ImageVue 0.16.1 - dir.php Folder Permission Disclosure

ImageVue 0.16.1 - dir.php Folder Permission Disclosure source: https://www.securityfocus.com/bid/16594/info ImageVue is prone to multiple vulnerabilities, including unauthorized uploading of files with arbitrary extensions, authentication bypass, information disclosure, and content injection...

Hardcoded credentials

CRE Loaded 6.15 allows remote attackers to perform privileged actions, including uploading and creating arbitrary files, via a direct request to files.php. NOTE: the vendor states "The initial announcement of this risk was made on our website... and it included a patch which will close the...

pixelpostXSS.txt

New eVuln Advisory: Pixelpost Photoblog XSS Vulnerability http://evuln.com/vulns/45/summary.html --------------------Summary---------------- Software: Pixelpost Photoblog Sowtware's Web Site: http://www.pixelpost.org/ Versions: 1.4.3 Critical Level: Moderate Type: Cross-Site Scripting Class: Remo...

Toshiba Bluetooth stack directory traversal

Directory traversal with filename allows to upload file to any location...

CVE-2006-0169

addresses.php3 in MyPhPim 01.05 does not restrict uploaded files, which allows remote attackers to execute arbitrary PHP code via the pdbfile variable, then directly accessing those files from the uploads directory...

SEC-20051107-0.txt

SEC-CONSULT Security Advisory 20051107-0 ============================================================================= title: toendaCMS multiple vulnerabilites program: toendaCMS vulnerable version: .xml, where is string composed of 5 bytes e.g. 2ac336ff0d.xml. Each XML file contains username...