Directory traversal

Directory traversal vulnerability in index.php in Simple Machines Forum SMF 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated administrators to install packages from arbitrary directories via a .. dot dot in the package parameter during an install2 action, as demonstrated by a...

CVE-2008-6658

Directory traversal vulnerability in index.php in Simple Machines Forum SMF 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated administrators to install packages from arbitrary directories via a .. dot dot in the package parameter during an install2 action, as demonstrated by a...

Unrestricted file upload

Unrestricted file upload vulnerability in the file manager module in DotNetNuke before 4.8.2 allows remote administrators to upload arbitrary files and gain privileges to the server via unspecified vectors...

CVE-2008-6541

Unrestricted file upload vulnerability in the file manager module in DotNetNuke before 4.8.2 allows remote administrators to upload arbitrary files and gain privileges to the server via unspecified vectors...

CVE-2008-6541

Unrestricted file upload vulnerability in the file manager module in DotNetNuke before 4.8.2 allows remote administrators to upload arbitrary files and gain privileges to the server via unspecified vectors...

CVE-2008-6541

The CVE-2008-6541 entry describes an unrestricted file upload vulnerability in the DotNetNuke file manager module prior to version 4.8.2. Remote administrators could upload arbitrary files and gain server privileges via unspecified vectors. Affected product: DotNetNuke, component: file manager mo...

CVE-2008-6273

Directory traversal vulnerability in configurationscript.php in MyKtools 3.0 allows remote authenticated administrators to include and execute arbitrary local files via a .. dot dot in the langage parameter, a different vulnerability than CVE-2008-4781. NOTE: the provenance of this information is...

CVE-2008-4305

Static code injection vulnerability in installation/setup.php in phpCollab 2.5 rc3 and earlier allows remote authenticated administrators to inject arbitrary PHP code into include/settings.php via the URI...

CVE-2008-4542

Cross-site scripting XSS vulnerability in Cisco Unity 4.x before 4.21ES162, 5.x before 5.01ES56, and 7.x before 7.02ES8 allows remote authenticated administrators to inject arbitrary web script or HTML by entering it in the database aka data store...

Cross site scripting

Cross-site scripting XSS vulnerability in Cisco Unity 4.x before 4.21ES162, 5.x before 5.01ES56, and 7.x before 7.02ES8 allows remote authenticated administrators to inject arbitrary web script or HTML by entering it in the database aka data store...

CVE-2008-2943

Double free vulnerability in IBM Tivoli Directory Server TDS 6.1.0.0 through 6.1.0.15 allows remote authenticated administrators to cause a denial of service ABEND and possibly execute arbitrary code by using ldapadd to attempt to create a duplicate ibm-globalAdminGroup LDAP database entry. NOTE:...

CVE-2008-2195

Static code injection vulnerability in admincp.php in DeluxeBB 1.2 and earlier allows remote authenticated administrators to inject arbitrary PHP code into logs/cp.php via the URI...

CVE-2008-1495

Unrestricted file upload vulnerability in administrer/produits.php in PEEL, possibly 3.x and earlier, allows remote authenticated administrators to upload and execute arbitrary PHP files via a modified content type in an ajout action, as demonstrated by 1 image/gif and 2 application/pdf...

CVE-2008-0383

Multiple SQL injection vulnerabilities in MyBB 1.2.10 and earlier allow remote moderators and administrators to execute arbitrary SQL commands via 1 the mergepost parameter in a domergeposts action, 2 rid parameter in an allreports action, or 3 threads parameter in a domultimovethreads action to ...

Authentication flaw

Joomla! before 1.5 RC4 allows remote authenticated administrators to promote arbitrary users to the administrator group, in violation of the intended security model...

CVE-2007-4717

Multiple cross-site scripting XSS vulnerabilities in Claroline before 1.8.6 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 dir parameter in admin/adminusers.php, the 2 action parameter in admin/advancedUserSearch.php, and the 3 view parameter in...

CVE-2007-4153

Multiple cross-site scripting XSS vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via 1 the Options Database Table in the Admin Panel, accessed through options.php; or 2 the opmlurl parameter to link-import.php. NOTE: this might...

CVE-2007-1150

Unrestricted file upload vulnerability in LoveCMS 1.4 allows remote authenticated administrators to upload arbitrary files to /modules/content/pictures/tmp/...

Unrestricted file upload

Unrestricted file upload vulnerability in index.php in phpBP RC3 2.204 and earlier allows remote administrators to inject arbitrary PHP code into an upload/banners/ file via a banners add operation that uploads the PHP code through an imageform parameter specifying a multiple-extension filename...

CVE-2007-0370

Unrestricted file upload vulnerability in index.php in phpBP RC3 2.204 and earlier allows remote administrators to inject arbitrary PHP code into an upload/banners/ file via a banners add operation that uploads the PHP code through an imageform parameter specifying a multiple-extension filename...