Unfixed XSS vulnerability at www.optimus.kiev.ua

Security researcher zuppergazi, has submitted on 08/03/2007 a cross-site-scripting XSS vulnerability affecting www.optimus.kiev.ua, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/03/2007. It is...

Information disclosure

Ripe Website Manager 0.8.9 and earlier allows remote attackers to obtain configuration information via a direct request to includes/phpinfo.php, which calls the phpinfo function. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Unfixed XSS vulnerability at www.tr-clan.ca

Security researcher KaBuS, has submitted on 07/03/2007 a cross-site-scripting XSS vulnerability affecting www.tr-clan.ca, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/03/2007. It is currently...

CVE-2007-3525: Undefined Security Weakness

Ripe Website Manager 0.8.9 and earlier allows remote attackers to obtain configuration information via a direct request to includes/phpinfo.php, which calls the phpinfo function. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-2632: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in PHP Multi User Randomizer phpMUR 2006.09.13 allow remote attackers to inject arbitrary web script or HTML via 1 the editplugin parameter to configureplugin.tpl.php, or 2 certain array parameters to web/phpinfo.php, as demonstrated by 1 or a...

phpmur-xss.txt

""""""""""""""""""""""""""""""""""""""""""""""" """ :: :: ::::: :::: """ """ :: :: :: : :: """ """ :::: :: :: ::::: ::::: :::: """ """ :: :: ::: ::: :: :: :: :: :: """ """ :: :: :: : : ::::: :: :: :::: """ """ """ """"""""""""""""""""""""""""""""""""""""""""""" Xmor$ Security Vulnerability Resear...

DEBIAN-CVE-2007-2016

Cross-site scripting XSS vulnerability in mysql/phpinfo.php in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2007-2016

Cross-site scripting XSS vulnerability in mysql/phpinfo.php in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2007-2016: Undefined Security Weakness

Cross-site scripting XSS vulnerability in mysql/phpinfo.php in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

Information disclosure

CARE2X 2.2, and possibly earlier, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-1574: Undefined Security Weakness

CARE2X 2.2, and possibly earlier, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-3882: Undefined Security Weakness

Shalwan MusicBox 2.3.4 and earlier allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function...

Code injection

Direct static code injection vulnerability in sysinfo.cgi in sysinfo 1.21 and possibly other versions before 2.25 allows remote attackers to execute arbitrary commands via a leading ; semicolon in the name parameter in a systemdoc action, which is injected into phpinfo.php...

CVE-2006-1831

Direct static code injection vulnerability in sysinfo.cgi in sysinfo 1.21 and possibly other versions before 2.25 allows remote attackers to execute arbitrary commands via a leading ; semicolon in the name parameter in a systemdoc action, which is injected into phpinfo.php...

CVE-2006-1831: Undefined Security Weakness

Direct static code injection vulnerability in sysinfo.cgi in sysinfo 1.21 and possibly other versions before 2.25 allows remote attackers to execute arbitrary commands via a leading ; semicolon in the name parameter in a systemdoc action, which is injected into phpinfo.php...

CVE-2006-1105: Undefined Security Weakness

Pixelpost 1.5 beta 1 and earlier allows remote attackers to obtain configuration information via a direct request to includes/phpinfo.php, which calls the phpinfo function. NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not...

CVE-2006-0756

dotProject 2.0.1 and earlier leaves 1 phpinfo.php and 2 check.php accessible under the /docs/ directory after installation, which allows remote attackers to obtain sensitive configuration information. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignor...

CVE-2006-0756

CVE-2006-0756 affects dotProject versions 2.0.1 and earlier. The issue: phpinfo.php and check.php remain accessible under the /docs/ directory after installation, allowing remote attackers to obtain sensitive configuration information. The vendor disputes the flaw, noting it occurs only if instal...

CVE-2006-0756

dotProject 2.0.1 and earlier leaves 1 phpinfo.php and 2 check.php accessible under the /docs/ directory after installation, which allows remote attackers to obtain sensitive configuration information. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignor...

CVE-2006-0756: Undefined Security Weakness

dotProject 2.0.1 and earlier leaves 1 phpinfo.php and 2 check.php accessible under the /docs/ directory after installation, which allows remote attackers to obtain sensitive configuration information. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignor...