98 matches found
WordPress jRSS Widget Plugin <= 1.2 - SSRF
This vulnerability is in the proxy.php. It allows the attackers to trigger outbound requests and enumerate open ports via the "URL" parameter. Solution Update the plugin...
CVE-2014-5181: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in lastfm-proxy.php in the Last.fm Rotation lastfm-rotation plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the snode parameter...
CVE-2014-4941
Absolute path traversal vulnerability in Cross-RSS wp-cross-rss plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a full pathname in the rss parameter to proxy.php...
CVE-2014-4941: Improper Limitation of a Pathname to a Restricted Directory
Absolute path traversal vulnerability in Cross-RSS wp-cross-rss plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a full pathname in the rss parameter to proxy.php...
CVE-2014-1855
Multiple cross-site scripting XSS vulnerabilities in Seo Panel before 3.5.0 allow remote attackers to inject arbitrary web script or HTML via the 1 capcheck parameter to directories.php or 2 keyword parameter to proxy.php...
CVE-2014-1855
Seo Panel 3.x is affected by two XSS vulnerabilities (CVE-2014-1855) in 3.4.0 and earlier. The issues arise from insufficient sanitisation of user-supplied data in the capcheck parameter (directories.php) and the keyword parameter (proxy.php), enabling remote code execution in the victim’s browse...
CVE-2014-1855: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Seo Panel before 3.5.0 allow remote attackers to inject arbitrary web script or HTML via the 1 capcheck parameter to directories.php or 2 keyword parameter to proxy.php...
FlashCanvas 1.5 proxy.php XSS Vulnerability
Advisory Information Title: FlashCanvas proxy.php XSS Vulnerability Date published: 11 December 2013 Reference: CVE-2013-6880 Advisory Summary Script does not adequately verify the Referer header before requesting via curl the remote URL specified in the ‘url’ GET parameter and rendering it. Vend...
ClarkConnect proxy.php url Parameter XSS
The remote web server is used by ClarkConnect, an Internet server and gateway product, to process PHP scripts used for configuration. The installed version includes a script, '/public/proxy.php', that fails to sanitize user- supplied input to the 'url' parameter before using it to generate dynami...
CVE-2008-5949
Multiple PHP remote file inclusion vulnerabilities in ccTiddly 1.7.4 and 1.7.6 allow remote attackers to execute arbitrary PHP code via a URL in the cctbase parameter to 1 index.php; 2 handle/proxy.php; 3 header.php, 4 include.php, and 5 workspace.php in includes/; and 6 plugins/RSS/files/rss.php...
CVE-2008-5949: Improper Control of Generation of Code
Multiple PHP remote file inclusion vulnerabilities in ccTiddly 1.7.4 and 1.7.6 allow remote attackers to execute arbitrary PHP code via a URL in the cctbase parameter to 1 index.php; 2 handle/proxy.php; 3 header.php, 4 include.php, and 5 workspace.php in includes/; and 6 plugins/RSS/files/rss.php...
cctiddly-rfi.txt
/ $Id: cctiddly-1.7.4-rfi.txt,v 0.1 2008/12/04 04:12:20 cOndemned Exp $ ccTiddly 1.7.4 cctbase Multiple Remote File Inclusion Vulnerabilities found by cOndemned download from : http://tiddlywiki.org/ccTiddly/ccTiddlyv1.7.4.zip Probably prior versions are vulnerable too... Greetz: ZaBeaTy, str0ke,...
ext10-lfi.txt
ext 1.0 alpha1 feed-proxy.php Remote File Disclosure D.Script: http://yui-ext.com/deploy/ext-1.0-alpha1.zip Discovered by: Alkomandoz Hacker Homepage: http://www.asb-may.net - mohandko.com - sniper-sa.com - tryag.com V.Code In /examples/layout/feed-proxy.php...
ext 1.0 alpha1 (feed-proxy.php) Remote File Disclosure
ext 1.0 alpha1 feed-proxy.php Remote File Disclosure D.Script: http://yui-ext.com/deploy/ext-1.0-alpha1.zip Discovered by: Alkomandoz Hacker Homepage: http://www.asb-may.net - mohandko.com - sniper-sa.com - tryag.com V.Code In /examples/layout/feed-proxy.php...
Directory traversal
Directory traversal vulnerability in examples/layout/feed-proxy.php in Jack Slocum Ext 1.0 alpha1 Ext JS allows remote attackers to read arbitrary files via a .. dot dot in the feed parameter. NOTE: analysis by third party researchers indicates that this issue might be platform dependent...
CVE-2007-2285
CVE-2007-2285 affects the Ext JS example component: layout/feed-proxy.php in Jack Slocum Ext 1.0 alpha1. The vulnerability is a directory traversal that allows a remote attacker to read arbitrary files by manipulating the feed parameter via "..". Public sources confirm the same description across...
CVE-2007-2285: Undefined Security Weakness
Directory traversal vulnerability in examples/layout/feed-proxy.php in Jack Slocum Ext 1.0 alpha1 Ext JS allows remote attackers to read arbitrary files via a .. dot dot in the feed parameter. NOTE: analysis by third party researchers indicates that this issue might be platform dependent...
Ext 1.0 - 'feed-proxy.php?feed' Remote File Disclosure
ext 1.0 alpha1 feed-proxy.php Remote File Disclosure D.Script: http://yui-ext.com/deploy/ext-1.0-alpha1.zip Discovered by: Alkomandoz Hacker Homepage: http://www.asb-may.net - mohandko.com - sniper-sa.com - tryag.com V.Code In /examples/layout/feed-proxy.php...