178 matches found
CVE-2016-4056
TYPO3 Backend component (TYPO3 6.2.x before 6.2.19) is affected by a Cross-site scripting (XSS) vulnerability. An attacker can inject arbitrary script/HTML via the module parameter when creating a bookmark, enabling script execution in an authenticated user’s browser. The issue stems from insuffi...
CVE-2016-4056: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the module parameter when creating a bookmark...
CVE-2012-1669: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in index.php in phpMoneyBooks before 1.0.3 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the module parameter...
kernel: block: passing disk names as format strings
Format string vulnerability in the registerdisk function in block/genhd.c in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and writing format string specifiers to /sys/module/mdmod/parameters/newarray in order to create a crafted /dev/md device nam...
CVE-2013-4880: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter...
Directory traversal
Directory traversal vulnerability in modules/comvtigerworkflow/sortfieldsjson.php in vtiger CRM 5.1.0 allows remote attackers to read arbitrary files via a .. dot dot in the modulename parameter...
CVE-2012-3805
Multiple cross-site scripting XSS vulnerabilities in the getAllPassedParams function in system/functions.php in Kajona before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 absendername, 2 absenderemail, or 3 absendernachricht parameter to the content page; 4...
CVE-2012-1207: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in frontend/core/engine/javascript.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to read arbitrary files via a .. dot dot in the module parameter to frontend/js.php...
Sql injection
SQL injection vulnerability in comments.php in SiteEngine 7.1 allows remote attackers to execute arbitrary SQL commands via the module parameter...
CVE-2010-4357
SQL injection vulnerability in comments.php in SiteEngine 7.1 allows remote attackers to execute arbitrary SQL commands via the module parameter...
CVE-2010-4357: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in comments.php in SiteEngine 7.1 allows remote attackers to execute arbitrary SQL commands via the module parameter...
Miniweb 2.0 - Full Path Disclosure
Miniweb 2.0 Full Path Disclosure Name Miniweb 2.0 Vendor http://www.miniweb2.com Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2009-12-12 X. INDEX I. ABOUT THE APPLICATION II. DESCRIPTION III. ANALYSIS IV. SAMPLE CODE V...
CVE-2009-3216: Improper Limitation of a Pathname to a Restricted Directory
Multiple directory traversal vulnerabilities in iWiccle 1.01, when magicquotesgpc is disabled, allow remote attackers to read arbitrary files via a .. dot dot in 1 the show parameter to the admin module, reachable through index.php; or 2 the module parameter to index.php...
CVE-2009-2081: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in help.php in phpWebThings 1.5.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the module parameter...
CVE-2009-1488: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in admin/load.php in FunGamez RC1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the module parameter to index.php...
Directory traversal
Directory traversal vulnerability in admin.php in Malleo 1.2.3 allows remote authenticated administrators to include and execute arbitrary local files via a .. dot dot in the module parameter...
CVE-2008-6551
Multiple directory traversal vulnerabilities in e-Vision CMS 2.0.2 and earlier, when magicquotesgpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in 1 an adminlang cookie to admin/index.php; or the module parameter to 2...
CVE-2008-6551
Multiple directory traversal vulnerabilities in e-Vision CMS 2.0.2 and earlier, when magicquotesgpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in 1 an adminlang cookie to admin/index.php; or the module parameter to 2...
CVE-2008-5943
Multiple directory traversal vulnerabilities in NavBoard 16 2.6.0 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the module parameter to 1 adminmodules.php and 2 modules.php...