CVE-2015-2970

The vulnerability CVE-2015-2970 affects the LEMON-S PHP Simple Oekaki BBS, specifically versions prior to 1.21. A flaw in index.php allows remote attackers to delete arbitrary files by manipulating the oekakis parameter, due to improper parsing. This is a server-side file deletion issue that coul...

CVE-2015-2969

Cross-site scripting XSS vulnerability in index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allows remote attackers to inject arbitrary web script or HTML via the oekakis parameter...

JVN#61935381: Simple Oekaki BBS vulnerability where arbitary files may be deleted

Simple Oekaki BBS provided by LEMON-S PHP contains a flaw in parsing the oekakis parameter in index.php, which may allow a remote attacker to delete arbitrary files. Impact A remote attacker may delete arbitrary files on the server. Solution Update the Software Update to the latest version...

Lemon CMS 1.10 'browser.php' Local File Include Vulnerability

source: http://www.securityfocus.com/bid/30285/info Lemon CMS is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability using directory-traversal strings to view local files within the context of the...

Directory traversal

Directory traversal vulnerability in lemonincludes/FCKeditor/editor/filemanager/browser/browser.php in Lemon CMS 1.10 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the dir parameter. NOTE: the provenance of this information is unknown; the details are...

CVE-2008-3312

Directory traversal vulnerability in lemonincludes/FCKeditor/editor/filemanager/browser/browser.php in Lemon CMS 1.10 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the dir parameter. NOTE: the provenance of this information is unknown; the details are...

CVE-2008-3312

The CVE-2008-3312 entry describes a directory traversal vulnerability in Lemon CMS 1.10, specifically in lemon_includes/FCKeditor/editor/filemanager/browser/browser.php. An attacker can abuse the .. (dot dot) traversal in the dir parameter to include and execute arbitrary local files. This inform...

CVE-2008-3312

Directory traversal vulnerability in lemonincludes/FCKeditor/editor/filemanager/browser/browser.php in Lemon CMS 1.10 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the dir parameter. NOTE: the provenance of this information is unknown; the details are...

Lemon CMS 1.10 - 'browser.php' Local File Inclusion

source: https://www.securityfocus.com/bid/30285/info Lemon CMS is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability using directory-traversal strings to view local files within the context of the...

Lemon CMS 1.10 - browser.php Local File Inclusion

Lemon CMS 1.10 - browser.php Local File Inclusion source: https://www.securityfocus.com/bid/30285/info Lemon CMS is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability using directory-traversal strings t...

[eVuln] VSNS Lemon Multiple Vulnerabilities

New eVuln Advisory: VSNS Lemon Multiple Vulnerabilities http://evuln.com/vulns/106/summary.html --------------------Summary---------------- eVuln ID: EV0106 CVE: CVE-2006-1553 CVE-2006-1554 CVE-2006-1555 Vendor: Tachyon Vendor's Web Site: http://tachyondecay.net/ Software: VSNS Lemon Versions:...

CVE-2006-1555

VSNS Lemon 3.2.0 allows remote attackers to bypass authentication and access password-protected articles by setting the vsnstopicid cookie to the targeted topic...

CVE-2006-1553

SQL injection vulnerability in functions/finalfunctions.php in VSNS Lemon 3.2.0, with magicquotesgpc disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter...

Sql injection

SQL injection vulnerability in functions/finalfunctions.php in VSNS Lemon 3.2.0, with magicquotesgpc disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter...

Authentication flaw

VSNS Lemon 3.2.0 allows remote attackers to bypass authentication and access password-protected articles by setting the vsnstopicid cookie to the targeted topic...

CVE-2006-1554

Cross-site scripting XSS vulnerability in VSNS Lemon 3.2.0 allows remote attackers to inject arbitrary web script or HTML via the name parameter while adding a comment...

Cross site scripting

Cross-site scripting XSS vulnerability in VSNS Lemon 3.2.0 allows remote attackers to inject arbitrary web script or HTML via the name parameter while adding a comment...

CVE-2006-1554

CVE-2006-1554 concerns a cross-site scripting (XSS) vulnerability in VSNS Lemon 3.2.0. The issue arises from insufficient sanitization of the name parameter in the comment-adding workflow, allowing remote attackers to inject arbitrary web scripts or HTML. The vulnerability is tied to the comment ...

CVE-2006-1555

VSNS Lemon 3.2.0 allows remote attackers to bypass authentication and access password-protected articles by setting the vsnstopicid cookie to the targeted topic...

CVE-2006-1553

VSNS Lemon 3.2.0 is affected by CVE-2006-1553 due to an SQL injection in functions/final_functions.php when magic_quotes_gpc is disabled. The vulnerable parameter is id, enabling remote attackers to inject arbitrary SQL commands. This is a server-side input validation flaw in the PHP code path ha...