4730 matches found
News Evolution 1.0/2.0 - Include Undefined Variable Command Execution
source: https://www.securityfocus.com/bid/6260/info News Evolution is a freely available, open source news software package. It is written in PHP, and designed for use on Unix and Linux operating systems. The problem occurs in the affnews.php file. By loading this file, and defining the chemin...
PHP.networking_utils
Title: The bug in networkingutils.php http://www.sourcecraft.org/downloads networkingutilsPHP Show Files Vulnerability Summary: networkingutils.php Includes a ping function, a traceroute function, and an nslookup function. Vulnerable systems: networkingutils networkingutils.php of the...
Benjamin Lefevre Dobermann Forum 0.x - entete.php?subpath Remote File Inclusion
Benjamin Lefevre Dobermann Forum 0.x - entete.php?subpath Remote File Inclusion source: https://www.securityfocus.com/bid/6057/info Dobermann Forum is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several PHP scri...
Benjamin Lefevre Dobermann Forum 0.x - 'enteteacceuil.php?subpath' Remote File Inclusion
source: https://www.securityfocus.com/bid/6057/info Dobermann Forum is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several PHP script files provided with Dobermann. An attacker may exploit this by supplying a pa...
Midicart PHP - Arbitrary File Upload
Midicart PHP - Arbitrary File Upload source: https://www.securityfocus.com/bid/5855/info A problem with the default installation of Midicart PHP may make it possible for remote users to gain access to sensitive information. The default installation of Midicart PHP does not place sufficient access...
[SECURITY] [DSA 168-1] New PHP packages fix several vulnerabilities
-------------------------------------------------------------------------- Debian Security Advisory DSA 168-1 [email protected] http://www.debian.org/security/ Martin Schulze September 18th, 2002 http://www.debian.org/security/faq -...
AWOL helperfunction.php includedir Parameter Remote File Inclusion
The remote host is running AWOL, an open source PHP application. It is possible to make the remote host include php files hosted on a third party server using the '$include' variable in AWOL. An attacker may use this flaw to inject arbitrary code in the remote host and gain a shell with the...
Achievo class.atkdateattribute.js.php config_atkroot Parameter Remote File Inclusion
The remote host is running Achievo, a web-based resource management tool written in PHP. The version of Achievo on the remote host includes a PHP script which is reported to be affected by a remote file include vulnerability. An attacker may use this flaw to inject arbitrary code in the remote ho...
CVE-2002-0484
moveuploadedfile in PHP does not does not check for the base directory openbasedir, which could allow remote attackers to upload files to unintended locations on the system...
CVE-2002-0717
PHP 4.2.0 and 4.2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP POST request with certain arguments in a multipart/form-data form, which generates an error condition that is not properly handled and causes improper memory to be freed...
CVE-2002-0717
PHP 4.2.0 and 4.2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP POST request with certain arguments in a multipart/form-data form, which generates an error condition that is not properly handled and causes improper memory to be freed...
Advisory CA-2002-21 Vulnerability in PHP
-----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-2002-21 Vulnerability in PHP Original release date: July 22, 2002 Last revised: -- Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affected Systems running PHP versions 4.2.0 or 4.2.1 Overview A...
ISS Brief: Remote Compromise and Denial of Service Vulnerability in PHP
TO UNSUBSCRIBE: email "unsubscribe alert" in the body of your message to [email protected] Contact [email protected] for help with any problems! --------------------------------------------------------------------------- -----BEGIN PGP SIGNED MESSAGE----- This document is an ISS X-Force Securit...
PHP Resource Exhaustion Denial of Service
The PHP interpreter is a heavy-duty CGI EXE or SAPI module, depending on configuration that implements an HTML-embedded script language. A vulnerability in PHP can be used to cause a denial of service in some cases. PHP's install process on Apache requires a "/php/" alias to be created, as it...
Security Advisory: Vulnerability in PHP versions 4.2.0 and 4.2.1
PHP Security Advisory: Vulnerability in PHP versions 4.2.0 and 4.2.1 Issued on: July 22, 2002 Software: PHP versions 4.2.0 and 4.2.1 Platforms: All The PHP Group has learned of a serious security vulnerability in PHP versions 4.2.0 and 4.2.1. An intruder may be able to execute arbitrary code with...
PHP < 4.2.x mail Function CRLF Injection
The remote host is running a version of PHP earlier than 4.2.2. The new POST handling system in PHP 4.2.0 and 4.2.1 has a bug which allows an attacker to disable the remote server or to compromise it. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Script audit and contributions from...
Advisory 02/2002: PHP remote vulnerability
e-matters GmbH www.e-matters.de -= Security Advisory =- Advisory: Remote Compromise/DOS Vulnerability in PHP Release Date: 2002/07/22 Last Modified: 2002/07/22 Author: Stefan Esser [email protected] Application: PHP 4.2.0, 4.2.1 Severity: A vulnerability within the multipart/form-data handler...
PHP fails to properly parse the headers of HTTP POST requests
Overview A vulnerability has been discovered in PHP. This vulnerability could be used by a remote attacker to execute arbitrary code or crash PHP and/or the web server. Description PHP is a popular scripting language in widespread use. For more information about PHP, see...
Several problems in CARE 2002
Several problems in CARE 2002 ------------------------------------- What is CARE 2002? CARE 2002 is a free software package for hospitals. It's based on php + mysql. For further information visit http://www.care2x.com/. include + NULL problem Problem description There are several include statemen...