Unrestricted file upload

Unrestricted file upload vulnerability in the ajoutcat mode in admin/main.php in Tr Script News 2.1 allows remote authenticated users to execute arbitrary code by uploading a file with a .php extension...

CVE-2007-4586

Multiple buffer overflows in phpiisfunc.dll in the iisfunc extension for PHP 5.2.0 and earlier allow context-dependent attackers to execute arbitrary code, probably during Unicode conversion, as demonstrated by a long string in the first argument to the iisgetservicestate function, related to the...

CVE-2007-4586

Multiple buffer overflows in phpiisfunc.dll in the iisfunc extension for PHP 5.2.0 and earlier allow context-dependent attackers to execute arbitrary code, probably during Unicode conversion, as demonstrated by a long string in the first argument to the iisgetservicestate function, related to the...

CVE-2007-3199

Unrestricted file upload vulnerability in Link Request Contact Form 3.4 allows remote attackers to execute arbitrary PHP code by uploading a file with a .php extension and an image content type, as demonstrated by image/jpeg...

CVE-2007-1709

Buffer overflow in the confirmphpdoccompiled function in the phpDOC extension PECL phpDOC in PHP 5.2.1 allows context-dependent attackers to execute arbitrary code via a long argument string...

esser-php.txt

?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...

BONUS-07-2007:Zend Platform ini_modifier Local Root Vulnerability

Summary Zend Platform comes with an inimodifier that is used by the GUI to alter the php.ini file. By abusing a vulnerability within the inimodifier it is possible for a local attacker to edit the php.ini file without knowing the necessary GUI password. This can be used to obtain root privileges ...

CS-Gallery 2.0 - index.php?album Remote File Inclusion

CS-Gallery 2.0 - index.php?album Remote File Inclusion ?php //File Inclusion Exploit for CSGallery = 2.0 //Found and Exploit Coded by burncycle - burncycleatrobert-berandotde //| //Vendor: http://www.cschneider.de/ //Dork: www.cschneider.info //| //Bug in "index.php": //...

security flaw

The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the keylength variable for a numerical key, which allows context-dependent attackers to read stack memory via a wddxPacket element that contains a variable with a string name befo...

[DRUPAL-SA-2006-024] Drupal 4.6.10 / 4.7.4 fixes multiple XSS issues

------------------------------------------------------------------------ ---- Drupal security advisory DRUPAL-SA-2006-024 ------------------------------------------------------------------------ ---- Project: Drupal core Date: 2006-Oct-18 Security risk: Moderately critical Exploitable from: Remot...

gd: GIF handling buffer overflow

Buffer overflow in the LWZReadByte function in ext/gd/libgd/gdgifin.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with inputcodesize greater than MAXLWZBITS, which triggers an overflow when initializing the table array...

CVE-2006-0869

Directory traversal vulnerability in the "remember me" feature in liveuser.php in PHP Extension and Application Repository PEAR LiveUser 0.16.8 and earlier allows remote attackers to determine file existence, and possibly delete arbitrary files with short pathnames or possibly read arbitrary file...

CVE-2006-0869

The CVE-2006-0869 entry concerns PEAR LiveUser before 0.16.9. A directory traversal flaw in the remember-me cookie handling (store_id) allows remote attackers to probe file existence and potentially read or delete arbitrary files on the server. Exploit details exist for PEAR LiveUser

CVE-2005-1868

I-Man 0.9, and possibly earlier versions, allows remote attackers to execute arbitrary PHP code by uploading a file attachment with a .php extension...

php security update

CentOS Errata and Security Advisory CESA-2005:406 Updated PHP packages that fix various security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache...