I-Gallery Folder Argument Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14002/info i-Gallery is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'folder' parameter of 'folderview.asp'. An attacker...

Code injection

Mahara before 1.5.13, 1.6.x before 1.6.8, and 1.7.x before 1.7.4 does not properly restrict access to folders, which allows remote authenticated users to read arbitrary folders 1 by leveraging an active folder tab loaded before permissions were removed or 2 via the folder parameter to...

CVE-2013-4432

Mahara before 1.5.13, 1.6.x before 1.6.8, and 1.7.x before 1.7.4 does not properly restrict access to folders, which allows remote authenticated users to read arbitrary folders 1 by leveraging an active folder tab loaded before permissions were removed or 2 via the folder parameter to...

CVE-2013-4432: Undefined Security Weakness

Mahara before 1.5.13, 1.6.x before 1.6.8, and 1.7.x before 1.7.4 does not properly restrict access to folders, which allows remote authenticated users to read arbitrary folders 1 by leveraging an active folder tab loaded before permissions were removed or 2 via the folder parameter to...

Sql injection

SQL injection vulnerability in Collabtive 1.2 allows remote authenticated users to execute arbitrary SQL commands via the folder parameter in a fileviewlist action to manageajax.php...

CVE-2014-3246

SQL injection vulnerability in Collabtive 1.2 allows remote authenticated users to execute arbitrary SQL commands via the folder parameter in a fileviewlist action to manageajax.php...

CVE-2014-3246

SQL injection vulnerability in Collabtive 1.2 allows remote authenticated users to execute arbitrary SQL commands via the folder parameter in a fileviewlist action to manageajax.php...

PT-2014-5155

Name of the Vulnerable Software and Affected Versions Collabtive version 1.2 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by exploiting the folder parameter in a "fileview list" action to "manageajax.php" API endpoint. Recommendations...

CVE-2014-3246: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Collabtive 1.2 allows remote authenticated users to execute arbitrary SQL commands via the folder parameter in a fileviewlist action to manageajax.php...

PT-2012-3096

Name of the Vulnerable Software and Affected Versions Kish Guest Posting plugin version 1.2 and earlier Description The issue allows remote attackers to execute arbitrary code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the directory specified b...

CVE-2012-1125: Undefined Security Weakness

Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin before 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the directory...

Cross site scripting

Cross-site scripting XSS vulnerability in display.php in Obsession-Design Image-Gallery ODIG 1.1 allows remote attackers to inject arbitrary web script or HTML via the folder parameter...

CVE-2010-0979: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in display.php in Obsession-Design Image-Gallery ODIG 1.1 allows remote attackers to inject arbitrary web script or HTML via the folder parameter...

CVE-2008-5769: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Kerio MailServer before 6.6.2 allow remote attackers to inject arbitrary web script or HTML via the 1 folder parameter to mailCompose.php or the 2 daytime parameter to calendarEdit.php. NOTE: some of these details are obtained from third party...

CVE-2008-4668: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Image Browser comimagebrowser 0.1.5 component for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the folder parameter to index.php...

PT-2008-2240 · WordPress · Dmsguestbook

Name of the Vulnerable Software and Affected Versions: DMSGuestbook plugin for WordPress versions 1.7.0 through 1.8.0 Description: A directory traversal issue exists, allowing remote authenticated users to read arbitrary files. This is achieved by using a .. dot dot in the folder and file...

CVE-2007-3967: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in PHP Directory Lister dirLIST before 0.1.1 allows remote attackers to list the contents of a parent directory via a .. dot dot in the folder parameter...

CVE-2006-4311: Undefined Security Weakness

PHP remote file inclusion vulnerability in Sonium Enterprise Adressbook 0.2 allows remote attackers to execute arbitrary PHP code via the folder parameter in multiple files in the plugins directory, as demonstrated by plugins/1Adressbuch/delete.php...

DEBIAN-CVE-2005-3559

Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 through 1.2.0-beta1 allows remote attackers to access WAV files via a .. dot dot in the folder parameter...

CVE-2004-2334

Multiple cross-site scripting XSS vulnerabilities in EMU Webmail 5.2.7 allow remote attackers to inject arbitrary web script or HTML via 1 a hex-encoded value to the variable parameter in emumail.fcgi, 2 the folder parameter in emumail.fcgi, or Javascript in the 3 username or 4 password field in...