Unfixed XSS vulnerability at catfish.dnsvelocity.com

Security researcher zuppergazi, has submitted on 08/03/2007 a cross-site-scripting XSS vulnerability affecting catfish.dnsvelocity.com, which at the time of submission ranked 1059728 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/03/2007. I...

Information Disclosure from phpmyadmin

An information disclosure issue has been found in the phpmyadmin extension of TYPO3 that may give access to phpinfo information in special cases. The standalone version of phpmyadmin is not affected. Component Type: Third party extension. This extension is not part of the TYPO3 default...

CVE-2007-3525

Ripe Website Manager 0.8.9 and earlier allows remote attackers to obtain configuration information via a direct request to includes/phpinfo.php, which calls the phpinfo function. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-3525

Ripe Website Manager 0.8.9 and earlier suffers an information disclosure vulnerability where an unauthenticated remote attacker can access includes/phpinfo.php, which calls phpinfo and reveals configuration information. Root cause: direct request to a file that executes phpinfo. Impact: disclosur...

CVE-2007-3191

Just For Fun Network Management System JFFNMS 0.8.3 allows remote attackers to obtain configuration information via a direct request to admin/adm/test.php, which calls the phpinfo function...

CVE-2007-3191

Just For Fun Network Management System JFFNMS 0.8.3 allows remote attackers to obtain configuration information via a direct request to admin/adm/test.php, which calls the phpinfo function...

Information disclosure

Just For Fun Network Management System JFFNMS 0.8.3 allows remote attackers to obtain configuration information via a direct request to admin/adm/test.php, which calls the phpinfo function...

CVE-2007-3191

Just For Fun Network Management System JFFNMS 0.8.3 allows remote attackers to obtain configuration information via a direct request to admin/adm/test.php, which calls the phpinfo function...

CVE-2007-3191

The vulnerability CVE-2007-3191 affects Just For Fun Network Management System (JFFNMS) version 0.8.3, where a direct request to admin/adm/test.php triggers phpinfo and exposes configuration information. Public sources among connected documents cite Debian’s DSA-1374-1 and the related Nessus/Open...

CVE-2007-3191: Undefined Security Weakness

Just For Fun Network Management System JFFNMS 0.8.3 allows remote attackers to obtain configuration information via a direct request to admin/adm/test.php, which calls the phpinfo function...

FreeBSD : php -- multiple vulnerabilities (f5e52bf5-fc77-11db-8163-000e0c2e438a)

The PHP development team reports : Security Enhancements and Fixes in PHP 5.2.2 and PHP 4.4.7 : - Fixed CVE-2007-1001, GD wbmp used with invalid image size - Fixed asciiz byte truncation inside mail - Fixed a bug in mbparsestr that can be used to activate registerglobals - Fixed unallocated memor...

CVE-2007-2016

Cross-site scripting XSS vulnerability in mysql/phpinfo.php in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

Woven dream content management system（DEDECMS 3.the X+4. X upload vulnerability-vulnerability warning-the black bar safety net

Ghost boy note:accurate to say should be DEDECMS used in the php version of FCKeditor there upload vulnerability, the gif89a file header to cheat, did not expect the php version of FCKeditor, even the existence of such a vulnerability, the gif89a file header spoofing is not fresh things. Sources ...

CVE-2007-1574

CARE2X 2.2, and possibly earlier, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-1574

CARE2X 2.2, and possibly earlier, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-1574

CARE2X 2.2 (and possibly earlier) is affected by an information-disclosure vulnerability where remote attackers can obtain configuration details via a direct request to phpinfo.php (which calls phpinfo). The provenance of this information is unknown and comes from third party sources. The vulnera...

PHP PHPInfo函数跨站脚本漏洞

PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 phpinfo函数可以显示有关PHP当前环境的详细信息，包括所发送请求变量的dump。该函数在显示GET、POST或COOKIE变量中所提供的数组内容时没有进行转义，允许攻击者通过特制请求执行跨站脚本攻击。 PHP 4.4.3 - 4.4.6 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.php.net --TEST-- SECURITY phpinfo simple XSS test --SKIPIF-- ?php...

CVE-2007-1287

A regression error in the phpinfo function in PHP 4.4.3 to 4.4.6, and PHP 6.0 in CVS, allows remote attackers to conduct cross-site scripting XSS attacks via GET, POST, or COOKIE array values, which are not escaped in the phpinfo output, as originally fixed for CVE-2005-3388...

CVE-2007-1287

CVE-2007-1287 describes a regression in PHP’s phpinfo output allowing cross-site scripting via unescaped GET/POST/COOKIE array values. Affects PHP 4.4.3–4.4.6 and PHP 6.0 in CVS; vulnerability stems from not escaping values in the phpinfo output, reusing the XSS issue originally addressed by CVE-...

CVE-2007-1287: Undefined Security Weakness

A regression error in the phpinfo function in PHP 4.4.3 to 4.4.6, and PHP 6.0 in CVS, allows remote attackers to conduct cross-site scripting XSS attacks via GET, POST, or COOKIE array values, which are not escaped in the phpinfo output, as originally fixed for CVE-2005-3388...