CVE-2012-1614: Exposure of Sensitive Information to an Unauthorized Actor

Coppermine Photo Gallery before 1.5.20 allows remote attackers to obtain sensitive information via 1 a direct request to plugins/visiblehookpoints/index.php, an invalid 2 page or 3 cat parameter to thumbnails.php, an invalid 4 page parameter to usermgr.php, or an invalid 5 newerthan or 6 oldertha...

CVE-2011-5143

Multiple cross-site scripting XSS vulnerabilities in Open Business Management OBM 2.3.20 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the 1 tfname, 2 tfdelegation, and 3 tfip parameters to index.php. NOTE: the provenance of this information is unknown; th...

CVE-2011-5143

Multiple cross-site scripting XSS vulnerabilities in Open Business Management OBM 2.3.20 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the 1 tfname, 2 tfdelegation, and 3 tfip parameters to index.php. NOTE: the provenance of this information is unknown; th...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Open Business Management OBM 2.3.20 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the 1 tfname, 2 tfdelegation, and 3 tfip parameters to index.php. NOTE: the provenance of this information is unknown; th...

CVE-2011-5143

Multiple cross-site scripting XSS vulnerabilities in Open Business Management OBM 2.3.20 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the 1 tfname, 2 tfdelegation, and 3 tfip parameters to index.php. NOTE: the provenance of this information is unknown; th...

PT-2012-2118

Name of the Vulnerable Software and Affected Versions DiY-CMS blog module version 1.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the start parameter to various API endpoints, including "tags.php", "list.php", "index.php", "main index.php"...

PT-2012-2119

Name of the Vulnerable Software and Affected Versions Open Business Management OBM versions 2.4.0-rc13 and earlier Description The issue allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the module parameter in an "export page" action. This is a...

CVE-2011-5143: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open Business Management OBM 2.3.20 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the 1 tfname, 2 tfdelegation, and 3 tfip parameters to index.php. NOTE: the provenance of this information is unknown; th...

CVE-2011-4951: Undefined Security Weakness

Open redirect vulnerability in phpgwapi/ntlm/index.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter...

PT-2012-2123

Name of the Vulnerable Software and Affected Versions Open Business Management versions 2.4.0-rc13 and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via various parameters in different PHP files, including sel domain id or...

PT-2012-2120

Name of the Vulnerable Software and Affected Versions Open Business Management OBM versions 2.4.0-rc13 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters in various PHP files. The vulnerable parameters include tf delegation, tf...

PT-2012-2121

Name of the Vulnerable Software and Affected Versions Open Business Management OBM versions 2.3.20 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via vulnerable parameters. Specifically, the tf name, tf delegation, and tf ip parameters to the...

PT-2012-2113

Name of the Vulnerable Software and Affected Versions DoceboLMS versions 4.0.4 and earlier Description The issue concerns SQL injection vulnerabilities in the save connection function within the iotask module of DoceboLMS. These vulnerabilities allow remote authenticated users with admin or teach...

Directory traversal

Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F encoded dot dot slash in the defaultlang parameter...

CVE-2010-5094

The deleteinstallfiles function in control/ContentController.php in SilverStripe 2.3.x before 2.3.7 does not require ADMIN permissions, which allows remote attackers to delete index.php and "disrupt modrewrite-less URL routing."...

CVE-2012-2227

Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F encoded dot dot slash in the defaultlang parameter...

CVE-2012-2227

PluXml is affected by a Local File Inclusion in update/index.php before version 5.1.6. The issue arises from using the default_lang parameter in include_once(), enabling an attacker to traverse directories and include arbitrary local files. Public disclosures and exploits reference PluXml 5.1.5 (...

PT-2012-3893

Name of the Vulnerable Software and Affected Versions PluXml versions prior to 5.1.6 Description The issue allows remote attackers to include and execute arbitrary local files. This is achieved by exploiting a directory traversal vulnerability in the update/index.php file. The vulnerability can b...

PT-2012-1337

Name of the Vulnerable Software and Affected Versions SilverStripe versions 2.3.x through 2.3.6 Description The issue concerns the deleteinstallfiles function in control/ContentController.php, which does not require ADMIN permissions. This allows remote attackers to delete index.php, disrupting m...

CVE-2012-2227: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F encoded dot dot slash in the defaultlang parameter...