446 matches found
iDEFENSE Security Advisory 10.31.02b: Prometheus Application Framework Code Injection
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDEFENSE Security Advisory 10.31.02b: http://www.idefense.com/advisory/10.31.02b.txt Prometheus Application Framework Code Injection October 31, 2002 I. BACKGROUND Jason Orcutt's Prometheus is a web application framework written in PHP. It is availabl...
VBZoom 1.0 - Arbitrary File Upload
VBZoom 1.0 - Arbitrary File Upload source: https://www.securityfocus.com/bid/5926/info It has been reported that VBZoom 1.01 may allow attackers to upload arbitrary files to a vulnerable system. The vulnerability is the result of VBZoom failing to properly validate the types of files that are...
WikkiTikkiTavi 0.x - Remote File Inclusion
source: https://www.securityfocus.com/bid/3946/info WikkiTikkiTavi is a freely available engine for running a Wiki site. Wiki sites are web communities which are based on the idea that every webpage is editable by users of the website. WikkiTikkiTavi is back-ended by a MySQL database and runs on...
phpBB does not adequately validate user input for language selection thereby allowing user to execute arbitrary php code
Overview phpBB is an open-source bulletin board program. A user input validation problem exists with regard to language settings. An intruder can excute arbitrary php code and gain a shell with the privileges of the web server on the system. Description Version 1.4.0 and earlier have a user input...
PHP Code Injection
phpWhois PHP Code Injection Vulnerability Overview phpWhois and some of its forks in versions before 5.1.0 are prone to a code injection vulnerability due to insufficient sanitization of returned WHOIS data. This allows attackers controlling the WHOIS information of a requested domain to execute...