CVE-2012-0834

Cross-site scripting XSS vulnerability in lib/QueryRender.php in phpLDAPadmin 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the base parameter in a queryengine action to cmd.php...

CVE-2011-5042: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in inc/lib/lib.base.php in SASHA 0.2.0 allows remote attackers to inject arbitrary web script or HTML via the instructors parameter. NOTE: the original disclosure also mentions the sectiontitle parameter, but this was disputed by the vendor and retracted by...

PT-2011-4079

Name of the Vulnerable Software and Affected Versions Mahara versions prior to 1.4.1 Description The issue concerns the get dataroot image path function in lib/file.php, which does not properly validate uploaded image files. This allows remote attackers to cause a denial of service, specifically...

CVE-2011-2772: Improper Input Validation

The getdatarootimagepath function in lib/file.php in Mahara before 1.4.1 does not properly validate uploaded image files, which allows remote attackers to cause a denial of service memory consumption via a 1 large or 2 invalid image...

CVE-2011-4075: Improper Control of Generation of Code

The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter aka sortby variable in a queryengine action to cmd.php, as exploited in the wild in October 2011...

php forge local file inclusion vulnerability-vulnerability warning-the black bar safety net

Code: ? php $page=$GETpage; include$page.'php'; ?& gt; You can use http://www.xxx.com/index.php?page=../etc/passwd http://www.xxx.com/index.php?page=../../../etc/passwd http://www.xxx.com/index.php?page=..../../etc/passwd Get more data: etc/profile etc/services the /etc/passwd /etc/shadow the...

PT-2011-4888

Name of the Vulnerable Software and Affected Versions OneOrZero Action & Information Management System AIMS version 2.7.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the cookieName variable in the lib/ooz access.php file. Recommendations F...

CVE-2011-4215: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in lib/oozaccess.php in OneOrZero Action & Information Management System AIMS 2.7.0 allows remote attackers to execute arbitrary SQL commands via the cookieName variable...

CVE-2011-3807

Textpattern 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/txplibdb.php and certain other files...

PT-2011-4697

Name of the Vulnerable Software and Affected Versions Textpattern version 4.2.0 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by revealing the installation path in an error message, as demonstrated by files such...

CVE-2011-3807: Exposure of Sensitive Information to an Unauthorized Actor

Textpattern 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/txplibdb.php and certain other files...

Information disclosure

eyeOS 2.2.0.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by apps/rmail/webmail/program/lib/Net/SMTP.php and certain other files...

CVE-2011-3758

::mound:: 2.1.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/smarty/libs/sysplugins/smartyinternaltemplate.php and certain other files...

CVE-2011-3727: Exposure of Sensitive Information to an Unauthorized Actor

DokuWiki 2009-12-25c allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/tpl/index.php and certain other files...

PT-2011-4627

Name of the Vulnerable Software and Affected Versions eyeOS version 2.2.0.0 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is demonstrated by accessing certain files, such as apps/rmail/webmail/program/lib/Net/SMTP.php, whic...

PT-2011-4617

Name of the Vulnerable Software and Affected Versions DokuWiki version 2009-12-25c Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is demonstrated by requesting files such as lib/tpl/index.php, which reveals the installation...

CVE-2011-3758: Exposure of Sensitive Information to an Unauthorized Actor

::mound:: 2.1.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/smarty/libs/sysplugins/smartyinternaltemplate.php and certain other files...

openads-2.0.11 - Remote File Inclusion

openads-2.0.11 - Remote File Inclusion Exploit Title: Openads-2.0.11 Remote File inclusion Vulnerability Google Dork: Just open you eyes ; Date: 02/09/2011 Author: HaCkErS eV!L E-mail:[email protected] Software Link:...

openads-2.0.11 - Remote File Inclusion

Exploit Title: Openads-2.0.11 Remote File inclusion Vulnerability Google Dork: Just open you eyes ; Date: 02/09/2011 Author: HaCkErS eV!L E-mail:[email protected] Software Link: http://sourceforge.net/projects/phpadsnew/files/Current%20Release/Openads%202.0.11-pr1/Openads-2.0.11-pr1.zip/download...

CVE-2011-3186

CRLF injection vulnerability in actionpack/lib/actioncontroller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header...