CVE-2006-1704

Sire 2.0 nws allows remote attackers to upload arbitrary image files without authentication via a direct request to upload.php...

SLQ Injection vulnerability in WPCeasy

My first vulnerability report : Description: "WPC.easy" is a database generated website with a dynamic on-line administration suite which allows for product updates, editing, deleting, image upload and price changes. "WPC.easy" is powered by a Secure Database. vendor:...

CVE-2005-4171

The "Upload new image" command in the "Manage Images" eFiction 1.1, when members are allowed to upload images, allows remote attackers to execute arbitrary PHP code by uploading a filename with a .php extension that contains a GIF header, which passes the image validity check but executes any PHP...

CVE-2005-4094

connector.php in the fckeditor2rc2 addon in DoceboLMS 2.0.4 allows remote attackers to execute arbitrary PHP by using the FileUpload command to upload a file that appears to be an image but contains PHP script...

CVE-2005-3477

Multiple interpretation error in the image upload handling code in Invision Gallery 2.0.3 allows remote attackers to conduct cross-site scripting XSS attacks via HTML or script in an image whose type does not match its extension, which is rendered by Internet Explorer due to CVE-2005-3312. NOTE: ...

CVE-2005-3477

Multiple interpretation error in the image upload handling code in Invision Gallery 2.0.3 allows remote attackers to conduct cross-site scripting XSS attacks via HTML or script in an image whose type does not match its extension, which is rendered by Internet Explorer due to CVE-2005-3312. NOTE: ...

phpBB-IE-gif.txt

phpBB 2.0.17 and other BB systems as well Cookie disclosure exploit. I sent the report to phpBB and they said that a patch will be available withing a few days and It will be integrated into 2.0.18 . Note: This works like XSS, and requires the victim to use IE Affects all versions of IE. Special...

[SA17295] phpBB Avatar Script Insertion Vulnerability

TITLE: phpBB Avatar Script Insertion Vulnerability SECUNIA ADVISORY ID: SA17295 VERIFY ADVISORY: http://secunia.com/advisories/17295/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: phpBB 2.x http://secunia.com/product/463/ DESCRIPTION: K-Gen has discovered a...

Множественные уязвимости в SimpleViewerAdmin

+++++++++++++++++++++++++++++++++++++++++++++++ Множественные уязвимости в SimpleViewerAdmin +++++++++++++++++++++++++++++++++++++++++++++++ Затронутые продукты: SimpleViewerAdmin v1.7, возможно и более ранние версии. +++++++++++++++++++++++++++++++++++++++++++++++ Описание: SimpleViewerAdmin - э...

Rookie fun picture Trojan horse-vulnerability warning-the black bar safety net

Since my ftp space due to uploading too many Trojans, estimation is terminated. BLOG., The estimated rank of the Empress, it was deleted, I used the BLOG is to upload images. No nonsense. We start: First generate a web page Trojans, this I will not nonsense. http://mfk8827.go3.icpcn.com/jiaozhu.h...

CVE-2005-3021

image.php in vBulletin 3.0.9 and earlier allows remote attackers with access to the administrator panel to upload arbitrary files via the upload action...

Advanced Guestbook 2.3.3 upload image bug

TITLE: Advanced Guestbook 2.3.3 upload image error and maybe possible file inclusion! Severity: Well for now I haven't tested it completely but if not patched it may cause a remote command execution and file inclusion. SOFTWARE: Advanced Guestbook 2.3.3 http://www.proxy2.de/ DESCRIPTION: At the...

CVE-2005-1583

1Two News 1.0 allows remote attackers to 1 delete images for new stories via a direct request to admin/delete.php or 2 upload arbitrary images via a direct request to admin/upload.php...

CVE-2005-1583

The vulnerability CVE-2005-1583 affects 1Two News 1.0. It allows remote attackers to perform two actions via direct requests to admin endpoints: (1) delete images for new stories through admin/delete.php and (2) upload arbitrary images through admin/upload.php. The description does not state the ...

CVE-2004-1928

The image upload feature in Tiki CMS/Groupware TikiWiki 1.8.1 and earlier allows remote attackers to upload and possibly execute arbitrary files via the img/wikiup URL...

CVE-2004-1928

CVE-2004-1928 affects Tiki Wiki CMS Groupware (TikiWiki) up to version 1.8.1. The issue is in the image upload feature, where remote attackers can upload and potentially execute arbitrary files via the img/wiki_up URL. The vulnerability is remote, over the network, and contributes to partial conf...

phpWebSite Image Announcement Upload Arbitrary Command Execution

The remote host is running a version of phpWebSite in which the Announcements module allows a remote attacker to both upload PHP scripts disguised as image files and later run them using the permissions of the web server user. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

CVE-2004-1386

TikiWiki before 1.8.4.1 does not properly verify uploaded images, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2005-0200...

CVE-2004-1928

The image upload feature in Tiki CMS/Groupware TikiWiki 1.8.1 and earlier allows remote attackers to upload and possibly execute arbitrary files via the img/wikiup URL...

Coppermine Photo Gallery 1.0 - PHP Code Injection

Coppermine Photo Gallery 1.0 - PHP Code Injection source: https://www.securityfocus.com/bid/7300/info Coppermine Photo Gallery has been reported prone to PHP code injection attacks. Due to a lack of sufficient sanitization performed on user-supplied filenames that are uploaded into the Photo...