CVE-2008-6960: Undefined Security Weakness

download.php in X10media x10 Automatic Mp3 Search Engine Script 1.5.5 through 1.6 allows remote attackers to read arbitrary files via an encoded url parameter, as demonstrated by obtaining database credentials from includes/constants.php...

CVE-2008-6911: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the authenticateUser function in includes/authentication.inc.php in BrewBlogger BB 2.1.0.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the loginUsername parameter to includes/logincheck.inc.php. NOTE: some of these...

Orbis CMS 1.0 (AFD/ADF/ASU/SQL) Multiple Remote Vulnerabilities

No description provided by source. + Orbis CMS 1.0 AFD/ADF/ASU/SQL Multiple Remote Vulnerabilities + Discovered By SirGod + http://insecurity-ro.org + http://h4cky0u.org + Dork : Powered by Orbis CMS + Download script : http://www.novo-ws.com/orbis-cms/download.shtml + Arbitrary File Download + -...

Directory traversal

Directory traversal vulnerability in admin/includes/initsystem.php in Zen Cart 1.3.8 and 1.3.8a, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the loaderfile parameter. NOTE: the vendor disputes this issue, stating "at...

CVE-2008-6877: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in admin/includes/initsystem.php in Zen Cart 1.3.8 and 1.3.8a, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the loaderfile parameter. NOTE: the vendor disputes this issue, stating "at...

CVE-2008-6878: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in admin/includes/languages/english.php in Zen Cart 1.3.8a, 1.3.8, and earlier, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the SESSIONlanguage parameter. NOTE: the vendor disputes this...

httpd: AllowOverride Options=IncludesNoExec allows Options Includes

The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring 1 Options Includes, 2 Options +Includes, or 3 Options +IncludesNOEXEC in a .htaccess file, and then...

httpd: AllowOverride Options=IncludesNoExec allows Options Includes

The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring 1 Options Includes, 2 Options +Includes, or 3 Options +IncludesNOEXEC in a .htaccess file, and then...

httpd: AllowOverride Options=IncludesNoExec allows Options Includes

The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring 1 Options Includes, 2 Options +Includes, or 3 Options +IncludesNOEXEC in a .htaccess file, and then...

CVE-2009-2380: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in includes/functions.php in 4images 1.7 through 1.7.7 allows remote attackers to inject arbitrary web script or HTML via vectors related to the url variable...

CVE-2009-2337: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in includes/module/book/index.inc.php in w3b|cms Gaestebuch Guestbook Module 3.0.0, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the spamid parameter...

CVE-2009-2338: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in includes/startmodules.inc.php in FreeWebshop.org 2.2.9 R2, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the langfile parameter...

CVE-2008-6840: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in V-webmail 1.6.4 allow remote attackers to execute arbitrary PHP code via a URL in the 1 CONFIGpeardir parameter to a Mail/RFC822.php, b Net/Socket.php, c XML/Parser.php, d XML/Tree.php, e Mail/mimeDecode.php, f Console/Getopt.php, g System.php...

Zen Cart 1.3.8 Remote Code Execution Exploit

No description provided by source. !/usr/bin/php ?php ------- Zen Cart 1.3.8 Remote Code Execution http://www.zen-cart.com/ Zen Cart Ecommerce - putting the dream of server rooting within reach of anyone! A new version 1.3.8a is avaible on http://www.zen-cart.com/ BlackH : errorreportingEALL ^...

CVE-2009-2015: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in includes/fileincluder.php in the Ideal MooFAQ commoofaq component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

Podcast Generator <= 1.2 GLOBALS[] Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ================================================================== Podcast Generator RFI | | | magicquotesgpc=off -- LFI | +-------------------------+-----------------------------------------------------------+ |...

DEBIAN-CVE-2009-1195

The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring 1 Options Includes, 2 Options +Includes, or 3 Options +IncludesNOEXEC in a .htaccess file, and then...

CVE-2009-1195

The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring 1 Options Includes, 2 Options +Includes, or 3 Options +IncludesNOEXEC in a .htaccess file, and then...

CVE-2009-1770: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in includes/database/examples/addressbook.php in Flyspeck CMS 6.8 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...

CVE-2008-6806: Improper Input Validation

Unrestricted file upload vulnerability in includes/imageupload.php in 7Shop 1.1 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/artikel/...