1173 matches found
CVE-2007-1478: Improper Input Validation
download.php in McGallery 0.5b allows remote attackers to read arbitrary files and obtain script source code via the filename parameter...
CVE-2006-7133: Undefined Security Weakness
Directory traversal vulnerability in upload/bin/download.php in Upload Tool for PHP 1.0 allows remote attackers to read arbitrary files via 1 ".." sequences or 2 absolute pathnames in the filename parameter...
PT-2007-1411 · Php · Upload Tool For Php
Name of the Vulnerable Software and Affected Versions: Upload Tool for PHP version 1.0 Description: The issue allows remote attackers to read arbitrary files via directory traversal attacks using ".." sequences or absolute pathnames in the filename parameter of the /upload/bin/download.php API...
CVE-2006-7105: Improper Control of Generation of Code
PHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows remote attackers to execute arbitrary PHP code via a URL in the filename parameter. NOTE: in the original disclosure, filename is used in a function definition, so this report is probably incorrect...
PT-2007-1383 · Smarty · Smarty
Name of the Vulnerable Software and Affected Versions: Smarty version 2.6.9 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the filename parameter in the libs/Smarty.class.php file. This is a PHP remote file inclusion issue. Note that the original...
CVE-2007-1140
Directory traversal vulnerability in edit.php in pheap allows remote attackers to read and modify arbitrary files via a .. dot dot in the filename parameter...
Directory traversal
Directory traversal vulnerability in edit.php in pheap allows remote attackers to read and modify arbitrary files via a .. dot dot in the filename parameter...
CVE-2007-1140
The CVE-2007-1140 entry describes a directory traversal vulnerability in edit.php of the pheap application, where an attacker can supply a filename containing .. to read and modify arbitrary files. Affected component: pheap (edit.php). Root cause: improper validation of the filename parameter all...
CVE-2006-6912
SQL injection vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly the userfile or filename parameter...
CVE-2006-6725
Multiple directory traversal vulnerabilities in PHPBuilder 0.0.2 and earlier allow remote attackers to read arbitrary files via a .. dot dot in the filename parameter to 1 lib/htm2php.php and 2 sitetools/htm2php.php. NOTE: The provenance of this information is unknown; the details are obtained...
CVE-2006-6381: Undefined Security Weakness
Directory traversal vulnerability in getfile.asp in Ultimate HelpDesk allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter...
CVE-2006-6255
Direct static code injection vulnerability in util.php in the NukeAI 0.0.3 Beta module for PHP-Nuke, aka Program E is an AIML chatterbot, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension in the filename parameter and code in the moreinfo...
CVE-2006-6255: Undefined Security Weakness
Direct static code injection vulnerability in util.php in the NukeAI 0.0.3 Beta module for PHP-Nuke, aka Program E is an AIML chatterbot, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension in the filename parameter and code in the moreinfo...
CVE-2006-4221: Undefined Security Weakness
Stack-based buffer overflow in the IBM Access Support eGatherer ActiveX control before 3.20.0284.0 allows remote attackers to execute arbitrary code via a long filename parameter to the RunEgatherer method...
CVE-2006-3547
EMC VMware Player allows user-assisted attackers to cause a denial of service unrecoverable application failure via a long value of the ide1:0.fileName parameter in the .vmx file of a virtual machine. NOTE: third parties have disputed this issue, saying that write access to the .vmx file enables...
CVE-2005-3947: Undefined Security Weakness
Directory traversal vulnerability in index.php in PHP Upload Center allows remote attackers to read arbitrary files via "../" sequences in the filename parameter...
PT-2005-4687 · Php · Php Upload Center
Name of the Vulnerable Software and Affected Versions: PHP Upload Center affected versions not specified Description: A directory traversal issue exists in index.php, allowing remote attackers to read arbitrary files by including "../" sequences in the filename parameter of the vulnerable API...
CVE-2004-2586
CVE-2004-2586 applies to SmarterTools SmarterMail 1.6.1511 and 1.6.1529, where a directory traversal flaw in frmGetAttachment.aspx allows remote attackers to read arbitrary files via the filename parameter. Root cause: insufficient input validation leading to path traversal. The available sources...
CVE-2005-2140: Undefined Security Weakness
Directory traversal vulnerability in default.asp for FSboard 2.0 allows remote attackers to read arbitrary files via ".." sequences in the filename parameter...
