[SA17359] vBulletin Image Script Insertion Vulnerability

TITLE: vBulletin Image Script Insertion Vulnerability SECUNIA ADVISORY ID: SA17359 VERIFY ADVISORY: http://secunia.com/advisories/17359/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: vBulletin 3.x http://secunia.com/product/3212/ vBulletin 2.x...

CVE-2005-3392

Unspecified vulnerability in PHP before 4.4.1, when using the virtual function on Apache 2, allows remote attackers to bypass safemode and openbasedir directives...

PHP 4.x5.0.x - Arbitrary File Upload GLOBAL Variable Overwrite

PHP 4.x5.0.x - Arbitrary File Upload GLOBAL Variable Overwrite source: https://www.securityfocus.com/bid/15250/info PHP is prone to a vulnerability that allows attackers to overwrite the GLOBAL variable via HTTP POST requests. By exploiting this issue, remote attackers may be able to overwrite th...

CVE-2005-3328

PHP remote file inclusion vulnerability in common.php in PunBB 1.1.2 through 1.1.5 allows remote attackers to execute arbitrary code via the punroot parameter...

USN-207-1: PHP vulnerability

A bug has been found in the handling of the openbasedir directive handling. Contrary to the specification, the value of openbasedir was handled as a prefix instead of a proper directory name even if it was terminated by a slash '/'. For example, this allowed PHP scripts to access the directory...

PHP 5.0.5 - Safedir Restriction Bypass

PHP 5.0.5 - Safedir Restriction Bypass source: https://www.securityfocus.com/bid/15119/info PHP is prone to multiple vulnerabilities that permit an attacker to bypass the 'safedir' directory restriction. An attacker can exploit these vulnerabilities to possible execute arbitrary code currently...

vlbook10.txt

------------------------------------------------------ Nightmare TeAmZ Advisory 005 ------------------------------------------------------ Date - 10/2005 vlbook Remote File Inclusion AFFECTED PRODUCTS ================= vlbook 1.0 Guestbook http://vlbook.com/ OVERVIEW ======== he vlbook is a free,...

My Little Forum 1.5 / 1.6beta SQL Injection

My Little Forum 1.5 / 1.6beta SQL Injection software: site: http://www.mylittlehomepage.net/mylittleforum software: "A simple web-forum that supports classical thread view message tree as well as messagebord view to display the messages. Requires PHP 4.1 and a MySQL database." 1 look at the...

CVE-2005-3038

Unspecified vulnerability in Hosting Controller 6.1 before Hotfix 2.4 allows remote attackers to list and read contents of arbitrary drives, related to "the PHP vulnerability."...

CVE-2005-3038: Undefined Security Weakness

Unspecified vulnerability in Hosting Controller 6.1 before Hotfix 2.4 allows remote attackers to list and read contents of arbitrary drives, related to "the PHP vulnerability."...

CVE-2005-2793

PHP remote file inclusion vulnerability in welcome.php in phpLDAPadmin 0.9.6 and 0.9.7 allows remote attackers to execute arbitrary PHP code via the customwelcomepage parameter...

Flatnuke <= 2.5.5 Remote Code Execution

Exploit for unknown platform in category web applications ======================================= Flatnuke FlatNuke 2.5.5 remote commands execution FlatNuke 2.5.5 possibly prior versions remote commands execution a script by rgod at http://rgod.altervista.org form name="form1" method="post"...

Atomic Photo Album apa_phpinclude.inc.php apa_module_basedir Parameter Remote File Inclusion

The remote host is running Atomic Photo Album, a free, PHP-based photo gallery. The installed version of Atomic Photo Album allows remote attackers to control the 'apamodulebasedir' variable used when including PHP code in the 'apaphpinclude.inc.php' script. By leveraging this flaw, an attacker m...

CVE-2005-2199

PHP remote file inclusion vulnerability in inc/functions.inc.php in PPA web photo gallery 0.5.6 allows remote attackers to execute arbitrary code via the configpparootpath variable...

CVE-2004-2195

PHP remote file inclusion vulnerability in index.php in Zanfi CMS lite 1.1 allows remote attackers to execute arbitrary PHP code via the inc parameter...

CVE-2005-2155

PHP remote file inclusion vulnerability in EasyPHPCalendar 6.1.5 and earlier allows remote attackers to execute arbitrary code via the serverPath parameter...

CVE-2005-2157

PHP remote file inclusion vulnerability in survey.inc.php for nabopoll 1.2 allows remote attackers to execute arbitrary PHP code via the path parameter...

CVE-2005-2157

PHP remote file inclusion vulnerability in survey.inc.php for nabopoll 1.2 allows remote attackers to execute arbitrary PHP code via the path parameter...

CVE-2005-2154

PHP local file inclusion vulnerability in 1 view.php and 2 open.php in osTicket 1.3.1 beta and earlier allows remote attackers to include and possibly execute arbitrary local files via the inc parameter...

Mambo 4.5.2.1 Fetch Password Hash Remote Exploit

Exploit for unknown platform in category web applications ================================================ Mambo 4.5.2.1 Fetch Password Hash Remote Exploit ================================================ !/usr/bin/php -q Mambo 4.5.2.1 + mysql 4.1 fetch password hash by pokleyzz fetch password ha...