589 matches found
Directory traversal
Directory traversal vulnerability in index.php in the Pagesetter 6.2.0 through 6.3.0 beta 5 module for PostNuke allows remote attackers to read arbitrary files via a .. dot dot in the id parameter...
CVE-2007-1158
Directory traversal vulnerability in index.php in the Pagesetter 6.2.0 through 6.3.0 beta 5 module for PostNuke allows remote attackers to read arbitrary files via a .. dot dot in the id parameter...
CVE-2007-1158
The CVE-2007-1158 entry refers to a directory traversal in the Pagesetter 6.2.0 through 6.3.0 beta 5 module for PostNuke, via the id parameter in index.php, allowing remote attackers to read arbitrary files using .. traversal. The provided documents give the affected software and the vulnerabilit...
CVE-2007-1158: Undefined Security Weakness
Directory traversal vulnerability in index.php in the Pagesetter 6.2.0 through 6.3.0 beta 5 module for PostNuke allows remote attackers to read arbitrary files via a .. dot dot in the id parameter...
CVE-2007-1158
Directory traversal vulnerability in index.php in the Pagesetter 6.2.0 through 6.3.0 beta 5 module for PostNuke allows remote attackers to read arbitrary files via a .. dot dot in the id parameter...
Pagesetter for PostNuke index.php id Parameter Traversal Arbitrary File Access
The third-party Pagesetter module for PostNuke installed on the remote host fails to sanitize input to the 'id' parameter before using it to display a file in the function 'pagesetterfilepreview' of the script 'pnfile.php'. An unauthenticated attacker can exploit this issue to view arbitrary file...
[Full-disclosure] SEC Consult SA-20070226-0 :: File Disclosure in Pagesetter for PostNuke
SEC Consult Security Advisory 20070226-0 ======================================================================= title: File Disclosure in Pagesetter for PostNuke program: Pagesetter page creation module vulnerable version: 6.2.0 6.3.0 beta 5 impact: high homepage: http://www.elfisk.dk found:...
PostNuke Reviews Index.PHP跨站脚本漏洞
PHP-Nuke是一款基于PHP的WEB应用程序。 PHP-Nuke不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。 问题是reviews模块对用户提交的WEB参数缺少过滤，提交恶意脚本代码作为参数数据，并诱使用户访问恶意链接，可导致获得目标用户敏感信息。 PostNuke 0.764 目前没有解决方案提供： http://noc.postnuke.com/...
CVE-2007-0385
The faq section in PostNuke 0.764 allows remote attackers to obtain sensitive information the full path via "unvalidated output" in FAQ/index.php, possibly involving an undefined idcat variable...
Cross site scripting
Cross-site scripting XSS vulnerability in preview in the reviews section in PostNuke 0.764 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2007-0384
Cross-site scripting XSS vulnerability in preview in the reviews section in PostNuke 0.764 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2007-0386
Unspecified vulnerability in the rating section in PostNuke 0.764 has unknown impact and attack vectors, related to "an interesting bug."...
Design/Logic Flaw
The faq section in PostNuke 0.764 allows remote attackers to obtain sensitive information the full path via "unvalidated output" in FAQ/index.php, possibly involving an undefined idcat variable...
Design/Logic Flaw
Unspecified vulnerability in the rating section in PostNuke 0.764 has unknown impact and attack vectors, related to "an interesting bug."...
CVE-2007-0385
The faq section in PostNuke 0.764 allows remote attackers to obtain sensitive information the full path via "unvalidated output" in FAQ/index.php, possibly involving an undefined idcat variable...
CVE-2007-0386
Unspecified vulnerability in the rating section in PostNuke 0.764 has unknown impact and attack vectors, related to "an interesting bug."...
CVE-2007-0386
Technical details for CVE-2007-0386 are not provided in the supplied documents; the records only state an unspecified vulnerability in PostNuke 0.764 with unknown impact. Monitor for updates.
CVE-2007-0384
Cross-site scripting XSS vulnerability in preview in the reviews section in PostNuke 0.764 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2007-0385
The CVE-2007-0385 entry affects PostNuke 0.764. Affected component: FAQ/index.php where unvalidated output may disclose the server’s full path, potentially involving an undefined id_cat variable. This is a remote information-disclosure issue in the FAQ section. The connected sources confirm the v...
CVE-2007-0386: Undefined Security Weakness
Unspecified vulnerability in the rating section in PostNuke 0.764 has unknown impact and attack vectors, related to "an interesting bug."...