CVE-2007-0138

formbankcgi.exe in Fersch Formbankserver 1.9, when the PATHINFO begins with 1 AbfrageForm or 2 EingabeForm, allows remote attackers to cause a denial of service daemon crash via multiple requests containing many /../ sequences in the Name parameter. NOTE: The provenance of this information is...

CVE-2006-6848

SQL injection vulnerability in admin.asp in ASPTicker 1.0 allows remote attackers to execute arbitrary SQL commands via the PATHINFO, possibly related to the Password parameter...

CVE-2006-6848

The CVE-2006-6848 entry describes an SQL injection in ASPTicker 1.0, exploiting admin.asp via PATH_INFO (possibly related to the Password parameter) to allow remote execution of arbitrary SQL. This conveys a remote, unauthenticated risk with potential data exposure or modification. No remediation...

CVE-2006-6910

formbankcgi.exe in Fersch Formbankserver 1.9, when the PATHINFO begins with Abfrage, allows remote attackers to cause a denial of service daemon crash via multiple requests containing many /../ sequences in the Name parameter...

CVE-2006-6848

SQL injection vulnerability in admin.asp in ASPTicker 1.0 allows remote attackers to execute arbitrary SQL commands via the PATHINFO, possibly related to the Password parameter...

GLSA-200611-15 : qmailAdmin: Buffer overflow

The remote host is affected by the vulnerability described in GLSA-200611-15 qmailAdmin: Buffer overflow qmailAdmin fails to properly handle the 'PATHINFO' variable in qmailadmin.c. The PATHINFO is a standard CGI environment variable filled with user-supplied data. Impact : A remote attacker coul...

CVE-2006-5560

CVE-2006-5560 is a cross-site scripting vulnerability in Boesch ProgSys 0.151 and earlier. The flaw allows remote attackers to inject arbitrary web script or HTML via PATH_INFO to admin/index.php and related files. CVSS v2.0 base score 4.3 (Medium): Network access, no authentication, partial inte...

CVE-2006-2506

Multiple cross-site scripting XSS vulnerabilities in search.php in Sphider allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO and 2 the category parameter...

CVE-2006-2506

CVE-2006-2506 affects Sphider’s search.php, enabling multiple XSS via PATH_INFO and the category parameter. The available connected documents confirm the vulnerable component and vectors but do not provide specific version numbers, exploit details, or remediation within the supplied material. The...

Buffer overflow

Buffer overflow in qmailadmin.c in QmailAdmin before 1.2.10 allows remote attackers to execute arbitrary code via a long PATHINFO environment variable...

CVE-2006-1141

Buffer overflow in qmailadmin.c in QmailAdmin before 1.2.10 allows remote attackers to execute arbitrary code via a long PATHINFO environment variable...

CVE-2006-1141

CVE-2006-1141 affects QmailAdmin prior to 1.2.10. The vulnerability is a buffer overflow in qmailadmin.c where an overlong PATH_INFO CGI environment variable can be exploited by a remote attacker to potentially execute arbitrary code with the privileges of the running qmailAdmin process. Affected...

CVE-2006-0707

PyBlosxom before 1.3.2, when running on certain webservers, allows remote attackers to read arbitrary files via an HTTP request with multiple leading / slash characters, which is accessed using the PATHINFO variable...

CVE-2006-0707

PyBlosxom before 1.3.2, when running on certain webservers, allows remote attackers to read arbitrary files via an HTTP request with multiple leading / slash characters, which is accessed using the PATHINFO variable...

CVE-2006-0707

PyBlosxom before 1.3.2, when running on certain webservers, allows remote attackers to read arbitrary files via an HTTP request with multiple leading / slash characters, which is accessed using the PATHINFO variable...

CVE-2006-0707

PyBlosxom before 1.3.2, when running on certain webservers, allows remote attackers to read arbitrary files via an HTTP request with multiple leading / slash characters, which is accessed using the PATHINFO variable...

CVE-2006-0707

Removed by vendor...

Code injection

myquiz.pl in Dale Ray MyQuiz 1.01 allows remote attackers to execute arbitrary commands via shell metacharacters in the URL, which are not properly handled as part of the PATHINFO environment variable...

CVE-2006-0628

myquiz.pl in Dale Ray MyQuiz 1.01 allows remote attackers to execute arbitrary commands via shell metacharacters in the URL, which are not properly handled as part of the PATHINFO environment variable...

CVE-2006-0628

myquiz.pl in Dale Ray MyQuiz 1.01 allows remote attackers to execute arbitrary commands via shell metacharacters in the URL, which are not properly handled as part of the PATHINFO environment variable...